Geek Answers Handbook

What does the lead "\ ?? \" mean on the way to the window?

When using GetModuleFileNameEx to request a path to a sample of a running process, some processes have an image path starting with "\ ?? \". For example, while most processes start "C: \ WINDOWS", some processes start "\ ?? \ C: \ WINDOWS".

What does the leading \ ?? \ mean on the way to the window?

+6
windows winapi path
source share
2 answers

This is a long Unicode length path - see Naming Files, Paths , and Namespaces on MSDN (section "Limiting Maximum Path Length").

(By the way, do you mean \\?\ , Not \??\ ?)

+7
source share

2 question marks in front of the drive letter, i.e. \ ?? \ c: means it works in Kernal mode. (In PICK or a multi-valued OS, we will call this level "monitor mode", where the instruction can directly address the memory or execute the IO disk.) The kernel mode is better explained in this message: What to do "\\. \", "\ ?? \ ", \\? \", "\\" means? what was indicated by dot com

Another way to put it; user mode leaves the workspace for the user / window, while kernel mode uses a memory space common to all, which means that you can stop the machine and not interrupt only one window / tab in Windows.

I leave it to search in kernel mode (engine)

-one
source share

More articles:


All Articles