Windows NT 3.5 ran the Win32 subsystem inside csrss.exe [1]. But csrss.exe was and continues to be a "God process" that is game-over if compromised. The differe

Windows NT 3.5 ran the Win32 subsystem inside csrss.exe [1]. But csrss.exe was and continues to be a "God process" that is game-over if compromised. The difference between NT AUTHORITY\SYSTEM (what CSRSS runs as) and the kernel isn't particularly meaningful to an attacker: both are essentially unrestricted access. [1]: http://j00ru.vexillium.org/?p=492 http://j00ru.vexillium.org/?p=492