On Mon Mar 11 03:56:44 2024 +0000, Anton Baskanov wrote:
I don't think that trying to handle process exit from within the process itself is a good idea. The process state might be inconsistent due to a crash, or the process might be terminated by a SIGKILL, which can't be intercepted. I tried wiping a process address space by calling `VirtualFreeEx`/`UnmapViewOfFile2` on all of the regions (a few them failed to free, though), and it did not break the mode restoration, so it looks like it is handled externally. I guess it is in csrss.exe, but I don't know how to verify it (without breaking the clean-room guidelines, that is). Note also that Wine's explorer.exe does other things that are done by csrss.exe on Windows, e.g. creating the desktop window.
I see. explorer.exe seems like a reasonable choice.