I often come across paths similar to
\??\C:\Windows when looking in memory. I have been unable to understand why the double '
?' is appended to some paths. My google-fu is failing me with the ability to find a reason for the double '
?'.Any assistance would be appreciated.
All object-manager functions related to namespace management are aware of the instanced directories and participate in providing the illusion that all sessions use the same namespace. Windows subsystem DLLs prefix names passed by Windows applications that reference objects in \DosDevices with \?? (for example, C:\Windows becomes \??\C:\Windows). When the object manager sees the special \?? prefix, the steps it takes depends on the version of Windows, but it always relies on a field named DeviceMap in the executive process object (EPROCESS, which is described further in Chapter 5) that points to a data structure shared by other processes in the same session.
The DosDevicesDirectory field of the DeviceMap structure points at the object manager directory that represents the process’ local \DosDevices. When the object manager sees a reference to \??, it locates the process’ local \DosDevices by using the DosDevicesDirectory field of the DeviceMap. If the object manager doesn’t find the object in that directory, it checks the DeviceMap field of the directory object. If it’s valid, it looks for the object in the directory pointed to by the GlobalDosDevicesDirectory field of the DeviceMap structure, which is always \Global??.
I have been searching for an answer to this question for a while and I know this question is years old but on the off chance someone else comes across this question I will leave my response here.
The above answer is referring to non-canonicalized device paths where as you are asking about
\\?\ there may only be a small difference in the question but the answer is completely different.
Some definitions that may help you understand:
- \Device - Default location for kernel driver Device Objects
- \GLOBAL?? - System location for symbolic links to devices including drive letters
- \BaseNamedObjects - System location for named resources
- \Sessions\X - Directory for the login session X
- \Session\0\DosDevices - Directory for the “Dos Devices” for each logged in user.