Registry Entry - path preceded by /??/

  • Thread starter Thread starter DirtRoadie
  • Start date Start date
D

DirtRoadie

Can anyone tell me the significance of double question marks between
backslashes preceding a pathname or ID in a registry entry?
It typically appears like this:

\??\C:\WINDOWS\SYSTEM32\DRIVERS\.....

or

\??\PCI#VEN_10DE&DEV ....
 
It's a namespace subdirectory created by the NT Object Manager during
the boot process. The named objects in this subdirectory are symbolic
links to Object Manager resources accessible by the Win32 API. For
example, C: might be a symbolic link to \Device\HardiskVolume1, when a
Win32 call is made for a file on C: the Win32 subsystem converts it to
\??\C: and the the Object Manager locates the symbolic link in the \??
subdirectory and finds the device object where the file is located.

You can get a better idea of how the Object namespaces are organized
with SysInternals' WinObj utility:
http://technet.microsoft.com/en-us/sysinternals/bb896657.aspx

My guess is that the full path to the Object Manager's \?? subdirectory
is used in the registry values because when those registry entries are
processed during the boot process the Win32 subsystem may not yet be
fully initialized and as such without the \?? portion of the path the
boot process would not be able to resolve the paths referenced in those
registry values. Most of these \?? paths are in the
HKEY_LOCAL_MACHINE\SYSTEM key and without the full path the machine
would probably not boot, or if it did it would boot in a severely
crippled state.

John
 
Back
Top