On Mon Mar 4 02:45:29 2024 +0000, Zhiyi Zhang wrote:
It's better to do it in the same way. I don't know how it's implemented. You'll need to dig deeper if possible. There are some possibilities you can try, for example, PsSetCreateProcessNotifyRoutine() as shown at [Detecting Windows NT/2K process execution](https://www.codeproject.com/Articles/2018/Detecting-Windows-NT-2K-process-ex...), or a thread in win32u? maybe window hooks? You can also try calling ChangeDisplaySettingsEx(CDS_FULLSCREEN) in a console application and see how it reacts.
I don't think that trying to handle process exit from within the process itself is a good idea. The process state might be inconsistent due to a crash, or the process might be terminated by a SIGKILL, which can't be intercepted.
I tried wiping a process address space by calling `VirtualFreeEx`/`UnmapViewOfFile2` on all of the regions (a few them failed to free, though), and it did not break the mode restoration, so it looks like it is handled externally. I guess it is in csrss.exe, but I don't know how to verify it (without breaking the clean-room guidelines, that is).
Note also that Wine's explorer.exe does other things that are done by csrss.exe on Windows, e.g. creating the desktop window.