James Tabor wrote:
Hi,
SVB revision 15031. List dll dump.
I noticed many cmd in the process list so I could only use listdlls to
dump
the processes and command lines. I use a old cvs ros build for
testing, this
uses less drive space (2 + G), so here it is,
ListDLLs V2.23 - DLL lister for Win9x/NT
Copyright (C) 1997-2000 Mark Russinovich
http://www.sysinternals.com
That is a result of my changes in rev 14475 and 14480. Csrss holds an
opened handle for each process. This is necessary to identify a process
over its process id. The process id is only unique if the process does
live. The process itself has an opened port handle. If the process is
closed the port handle, csrss does also close the process handle. If a
process is terminate and does not inform csrss, csrss does not close
the process handle. Deleting of the process' handle table will close the
port handle, but the handle table is only deleted if no reference to the
process exist. It seems I have to revert my changes. The old
implementation needs a delay between removing a process id from one
process and reassign the same id to a new process.
- Hartmut