Just to add some information, CSRSS is quite more involved then Filip would make it seem :). Although NtVdmControl is used for hardware kernel calls, almost all the 1) Console and 2) VDM Emulation is passed back through CSRSS. CSRSS is the one who executes the loops to get the newest emulated commands to do, and who handles all the I/O.
Best regards, Alex Ionescu
I was confused about the implementation (NT 4/5). Thanks for the information.
Klemens Friedl <fik85>