Csrss.exe, keeps all the process information for the Win32 subsystem process, this information is saved as a list. Under normal circumstances, each of the newly created process notifies the Csrss.exe,Csrss.exe received this information, and then save, so traverse the linked list can be of all of Win32 subsystem processes the information. First of all is to look for link list head, link list head for CsrssRootProcess, CSRSRV.DLL actions on CsrssRootProcess in the export function, so you can




File list:
CsrssWalker
..........\Release
..........\.......\CsrssWalker.exe
..........\CsrssStruct.h
..........\CsrssWalker.cpp
..........\CsrssWalker.dsp
..........\CsrssWalker.dsw
..........\CsrssWalker.ncb
..........\CsrssWalker.opt
..........\CsrssWalker.plg
..........\PSAPI.H
..........\PSAPI.LIB
..........\ReadMe.txt
..........\StdAfx.cpp
..........\StdAfx.h