Path prefixes \\??\\ and \\\\?\\

问题:

What is the difference between paths prefixed with \??\ and those prefixed with \\?\

At Windows 7 CMD-Line

• DIR gives: \??\Volume{00000000-0000-0000-0000-000000000000}\
• WMIC VOLUME LIST gives \\?\Volume{00000000-0000-0000-0000-000000000000}\

Thanks

Additional Information:
I created a directory on my system drive where i placed all my mount points into. So I did a MD C:\HDDs first, then a MD C:\HDD\Drive1, MD C:\HDD\Drive2 ...for all my drives. After mounting the drives on those empty directories, I can see the GUID by switching to that Directory with CD /D C:\HDDs and issueing a DIR command. Maybe I have to issue a DIR /ah to Show hidden stuff, just in case the mount points are hidden directories ...

回答1:

\?? is the kernel's virtual object directory, in which the object manager searches for local and global DOS device symbolic links. First it checks the local DOS device links for the user's logon session in \Sessions\0\DosDevices\[Logon_AuthenticationId]. Then it checks the global DOS device links in \Global??. Back in the old days, NT used a single \DosDevices directory. Nowadays \DosDevices is a link to \??. Also, each local DOS devices directory has a "Global" link to allow accessing global devices when a local device shadows the global one (e.g. \\?\Global\Z:), or to allow a device driver to create a global device when not executing in a system thread.

In user mode, the runtime library in ntdll.dll transforms a fully-qualified DOS/Windows path to an NT path by either prepending \??\ for a drive letter or replacing the leading \\ of a UNC path with \??\UNC\ -- except \\?\ and \\.\ local-device paths are simply replaced by \??\. But first a \\.\ device path undergoes some preprocessing, such as resolving "." and ".." components, whereas \\?\ bypasses all user-mode preprocessing.

For example, typically \\?\C:\Windows is transformed to \??\C:\Windows, which resolves to \Global??\C:\Windows. The "C:" drive-letter DOS device is a symbolic link to the NT volume device. The final target depends on the system. For example, the final NT path may resolve to \Device\HarddiskVolume2\Windows.

DOS device links such as Volume{00000000-0000-0000-0000-000000000000} are created by the mount-point manager. They're the glue between persistent drive letters, NTFS mount points, and the NT volume device currently in use, such as \Device\HarddiskVolume2.

回答2:

As near as I can figure, both \\?\ and \??\ refer to the local DOS devices namespace, but are valid in different contexts.

\\?\ is only meaningful to Win32, not to the kernel, except that in certain special cases (e.g., when processing junction points) the kernel will translate Win32 paths back into kernel paths as needed.

\??\ is meaningful to both the kernel and to Win32, however most Win32 applications (including cmd.exe) do not understand it.

In the OPs particular examples: junction points and mount points can contain either Win32 or kernel paths, but typically contain kernel paths, and dir simply presents the raw contents without modification. WMIC is presumably intentionally converting the kernel path into a Win32 path, or is getting the data from an API function that does so.