5

I often come across paths similar to \??\C:\Windows when looking in memory. I have been unable to understand why the double '?' is appended to some paths. My google-fu is failing me with the ability to find a reason for the double '?'.Any assistance would be appreciated.

3

From Windows Internals, Part 1 (6th Edition) --

All object-manager functions related to namespace management are aware of the instanced directories and participate in providing the illusion that all sessions use the same namespace. Windows subsystem DLLs prefix names passed by Windows applications that reference objects in \DosDevices with \?? (for example, C:\Windows becomes \??\C:\Windows). When the object manager sees the special \?? prefix, the steps it takes depends on the version of Windows, but it always relies on a field named DeviceMap in the executive process object (EPROCESS, which is described further in Chapter 5) that points to a data structure shared by other processes in the same session.

The DosDevicesDirectory field of the DeviceMap structure points at the object manager directory that represents the process’ local \DosDevices. When the object manager sees a reference to \??, it locates the process’ local \DosDevices by using the DosDevicesDirectory field of the DeviceMap. If the object manager doesn’t find the object in that directory, it checks the DeviceMap field of the directory object. If it’s valid, it looks for the object in the directory pointed to by the GlobalDosDevicesDirectory field of the DeviceMap structure, which is always \Global??.

  • 1
    -1 this does not answer the question and should not be the accepted answer. OP asked about \??` and not \\?` – Alec Wenzowski Jan 13 '18 at 1:03
  • 1
    You're absolutely right. I wasn't able to delete my answer because it was already marked as accepted, but I edited it to reflect the correct answer. – Jason Geffner Jan 13 '18 at 19:02
10

I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here.

The above answer is referring to non-canonicalized device paths where as you are asking about \??\ not \\?\ there may only be a small difference in the question but the answer is completely different.

\?? is a "fake" prefix which refers to per-user Dos devices, so here is an image that will hopefully help you understand what the process is: enter image description here

Some definitions that may help you understand:

  • \Device - Default location for kernel driver Device Objects
  • \GLOBAL?? - System location for symbolic links to devices including drive letters
  • \BaseNamedObjects - System location for named resources
  • \Sessions\X - Directory for the login session X
  • \Session\0\DosDevices - Directory for the “Dos Devices” for each logged in user.
  • 2
    This should be accepted as the correct answer – Jem Tucker Sep 14 '17 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.