4

I'm studying Windows NT architecture. I would like to know what is the relation between the "Win32" namespace and the "\Global??" namespace in the nt namespace? As far as i understand the win32 namespace maps to the "\Global??" namespace.

1 Answer 1

4

I'm not sure that I'd say that Win32 namespace "maps to the \Global??" namespace. Rather, the symbolic links in the \Global?? directory are used to interpret device names passed to CreateFile.

When you attempt to open a file object to a device, the symbolic links in \Global?? define the equivalent internal device names. There is an odd translation that happens: Let's say you want to open a handle to what you we ordinarily call COM1:. The name you have to pass to CreateFile would be \\.\COM1 . The \\. is changed to \Global?? and then a search is done for a symbolic link named \Global??\COM1 The symbolic link says that the name of the corresponding device object is \Device\Serial0 (or whatever it is).

Note that the \\ is actually syntax that introduces a UNC (Universal Name Convention) name. The period after the \\ means "on this machine". You probably know that for files, a remote server name can appear after the \\ instead.

Anyway, the value of the symbolic link object is the name of a device object, created by the serial port driver, that represents the specific serial port. You can find those names in the \Device directory of the object namespace. When it creates the device object and that object's name, the serial port driver also creates the corresponding symbolic link object.

This mechanism is not used for other Win32-visible objects. For example, if you create a named event object with CreateEvent, its name will show up in \Sessions\<your session number>\BaseNamedObjects by default. There are no symbolic links involved there.

2
  • 1
    Thank you for your answer. I spent sometime trying to figure out how it works. Actually when you open a file or a device from the user space, for instance C:, the path gets translated into \??\C: in the kernel space. The kernel starts looking the device in the local dos devices namespace and in the global dos devices namespace. In this case the global dos devices namespace is the \Global?? namespace.
    – Othman
    Mar 2, 2015 at 18:54
  • Yes, it's quite tangled. The "local DOS devices namespace" is \Sessions\<your session number>\DosDevices, but for user sessions is not used much. Note that you can still use \DosDevices as a prefix instead of \\. - DosDevices used to be the name of a directory, but for back-compatibility there is now a symbolic link in the object root directory, linking that name to \??. Just FYI, these functions are not done in the kernel, but rather in the object manager, which is part of the executive. (The executive does run in kernel mode, but is not considered part of the kernel.) Mar 2, 2015 at 22:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .