11

What I know is

\\.\

It is used when we open a device's symbolic link in user mode 

\??\

It is used when we open a device in kernel mode 

\\?\

long file name 

\\

UNC path.

But I want to know more detail.
Could you explain more certainly about these prefixs.

Benjamin
  • 10,085
  • 19
  • 80
  • 130

1 Answers1

12

http://msdn.microsoft.com/en-us/library/aa365247%28VS.85%29.aspx#paths

Apparently, \?? is a short form for \Global?? according to this article:

In NT naming convention, \Global?? can also be called \?? to shorten the access.

William Niu
  • 15,798
  • 7
  • 53
  • 93
  • _That_ is only true for the latest incarnations of Windows (MSDN mostly references the latest versions anyway). `\??` has been a symlink to `\DosDevices` in the past and how it got treated depended in no small part on whether terminal services were available or not. With XP terminal services were always on board even on consumer Windows, so that's when it changed a bit. – 0xC0000022L Jun 15 '16 at 07:15
  • @0xC0000022L, actually it's not true that it's merely a short form of "\Global??", else local logon-session DOS devices wouldn't work. "\??" is the Object Manager's virtual "DosDevices" directory. First the Object Manager checks the local devices defined in "\Sessions\0\DosDevices\\[Logon_AuthenticationId]" before checking "\Global??". Also there's a "Global" symbolic link in the local directory to ensure creating or accessing a global device, e.g. "\\?\Global\Z:\Path". Nowadays the classic "\DosDevices" entry is a symbolic link to "\??". – Eryk Sun Sep 08 '17 at 01:35
  • @eryksun: For starters I was qualifying the statement in the answer (`\\GLOBAL??` didn't even exist in older Windows versions). The way the Object Manager checks stuff is transparent to the user, however. So while I didn't make the claim you're arguing I was wrong on, I hold that for all practical purposes to the user mode programmer the statement is sufficiently detailed and as true as it gets without opening a whole can of worms. – 0xC0000022L Sep 08 '17 at 12:16
  • @0xC0000022L, this is a dialog (stretched across time) -- not a trial, so please there's no reason to get so defensive in tone. William made a claim that you supported, so I replied to you as the last person who 'spoke'. The simple claim to make is that "\??" is where the Object Manager looks for DOS devices. Talking about "\Global??" without the logon-session directories is a misleadingly *specific* half picture. – Eryk Sun Sep 08 '17 at 15:16
  • @0xC0000022L, also the way DOS device lookup is implemented in XP and later isn't really dependent on Windows Sessions, but rather logon sessions. This *could* have been implemented in NT 3.1 by simply adding the "AuthenticationId" subdirectories to "\DosDevices". In contrast, NT 4 with Hydra and Windows 2000 use Windows terminal Sessions for DOS devices -- because they had yet to realize it's a bad idea for every process in a Session to share the same DOS devices, regardless of its logon session, access token, and cached credentials. – Eryk Sun Sep 08 '17 at 15:25