11

I noticed this when trying to find an answer to this question.

It seems to be exclusively associated with conhost.exe only appearing in the command-line parameters for conhost.exe

Also the parameter seems to be the same (on my computer) for all conhost.exe processes:

\??\C:\WINDOWS\system32\conhost.exe 0x4

My question is what does the \??\ signify? Is that some sort of physical device address? The only place I've seen this before is in this image, which came from this article.

1

1 Answer 1

10

Since I was curious as well, I collected some information; it is the original name of "\DosDevices" and usually used by modules which need to access kernel mode object names. e.g. device drivers, subsystem modules, .. Please note that, "\DosDevices" seems to be a symbolic link to "\??", so "\??" is the real name. It was believed that they tried to minimise the search time with this cryptic name.

This is why you saw that on the driver property. And, conhost.exe is usually invoked by csrss.exe which is also one of those modules which need to use kernel mode names. Please read the references below for further understanding.

References:

2
  • Just out of curiosity, could we use this in an actual command? I tried dir "\??\C:\" which worked, but gave me an unexpected Directory of C:\??\C: File Not Found
    – Vinayak
    Sep 12, 2014 at 2:08
  • 2
    Vinayak// I don't think it's supported in command prompt. dir "\??C:\" tries to find a folder named "??\C:" on the root of the current drive so the error makes sense for me. Actually some user mode applications (usually related to system devices) are able to show that format but the symbolic link "DosDevices" is used instead of "??".
    – Scott Rhee
    Sep 12, 2014 at 3:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .