6

This is about the registry on a 64-bit Windows 7 Home Premium (my friend's computer). I was going to set the system to clear the pagefile at shutdown by setting the REG_DWORD value ClearPageFileAtShutdown in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management to "1".

My question is however about the questions marks in the values ExistingPageFiles and PagingFiles in this registry location.

The question marks are shown in below image.

question marks used in registry values

The questions I wanted to ask are:

  1. Are the paths used in these values supposed to have questions marks in the beginning?
  2. What function do these question marks serve?
2

3 Answers 3

12

Double-question mark paths are NT Object Manager paths that can look up DOS-style devices like drive letters. The Object Manager is a system that organizes lots of different kinds of system resources (e.g. devices, memory sections, window stations, events) into one tree-like structure. You can explore that tree with the WinObj tool.

The \?? pseudo-directory first looks in the requesting process's DosDevices table, but if the process doesn't have a specific definition for the device (as the component responsible for the page file probably won't), lookup proceeds to the \GLOBAL?? Object Manager directory. Its contents can be seen in the GLOBAL?? section of WinObj. There are other subtrees, like Device. In fact, every single item in GLOBAL?? is a symbolic link - a shortcut or alias - to an object somewhere else. \GLOBAL??\C: is (on my system) a link to \Device\HarddiskVolume4, and the rest of the path shown in your screenshot is a path under the root of that volume. Each drive letter shows up there as a symbolic link to the volume it's on. You might find other kinds of devices that are familiar, like CON and NUL.

Note: You can't use this kind of path to access files or directories in most applications. Only certain low-level system components are designed to work with Object Manager paths.

That explains your screenshot's ExistingPageFiles, but not PagingFiles. PagingFiles contains your virtual memory settings with paths to paging files expressed as normal paths. If your system is set to manage all virtual memory settings by itself, that entry doesn't specify a drive letter (only a file name and path), so the ? is just a placeholder for whatever drive the page file does end up on.

In summary, yes, those question marks are supposed to be there.

Further reading: Inside NT's Object Manager, Object Manager (Windows), The Definitive Guide on Win32 to NT Path Conversion, Windows Internals Sixth Edition Part 1 page 174

Video: NT Object Manager at Microsoft's Channel 9

3
  • Confusing answer... the things under GLOBAL?? I cannot access via \??\ , but I can access anything in there via \\?\ and \\.\ , e.g. \\?\COM1 or \\.\HarddiskVolume1 . However, \??\COM1 will not work via CreateFileW .
    – hasufell
    Dec 4, 2021 at 15:27
  • @hasufell Object Manager paths are mostly meant to be used by internal APIs such as NtCreateFile, so I am not that they are supported by higher-level APIs on all Windows versions. Nevertheless, on 21H2 I can access things in GLOBAL?? with \??\ through CreateFileW. Note that COM1 doesn't seem to work through any mechanism if there's not actually an active COM port.
    – Ben N
    Dec 5, 2021 at 15:53
  • SprintDLL example that successfully creates a file at the path specified by the first parameter: call kernel32.dll!CreateFileW /return native (lpwstr "\\??\\C:\\Users\\Ben\\test\\x.txt", int 0, int 7, nullptr, int 1, int 0, nullptr). Replacing C: with the appropriate HarddiskVolume# also works.
    – Ben N
    Dec 5, 2021 at 15:54
0

I seem to remember when using DOS cmd file queries, a question mark means single character wildcard. The double question mark I'm clueless to, unless it simply means a part of a path with 2 sequential wildcard characters. Hope this helps.

i.e. ?: could be C: or D: unlike \d*\ which means d char with any number and type of letters or numbers following e.g. \dr\ or \d2165thingy\

Trying to be helpful, since the ?: notation would refer to any drive recognised at the time the command was run in DOS 3 onward, in my experience.

2
  • 3
    Sadly, I don't believe this information is the correct answer to the question. The interpretation of the ? will depend on which registry key is being used, and I don't think it is meant to refer to the common "command line" standard of a single character. e.g, DOS doesn't support "?:\" to mean "any drive".
    – TOOGAM
    Apr 24, 2016 at 4:33
  • 1
    In the PagingFiles entry, the ? does indicate that the paging file isn't bound to a specific drive (i.e. all virtual memory is automatically configured by the system). The \??\ path, however, is an NT Object Manager object name.
    – Ben N
    Jul 4, 2016 at 16:29
0

I have seen the \?\C:\... path used a lot to get access to files/paths longer than 260 characters. At least when dealing with Win32 API calls. Although the structure in your screenshot varies slightly, I would feel safe assuming it is similar in behavior. Or, it could also be that the Win32 API (when reading values from this Registry key) will automatically replace those 'variables' with the appropriate values.

Naming Files, Paths, and Namespaces (on MSDN)

The Windows API has many functions that also have Unicode versions to permit an extended-length path for a maximum total path length of 32,767 characters. This type of path is composed of components separated by backslashes, each up to the value returned in the lpMaximumComponentLength parameter of the GetVolumeInformation function (this value is commonly 255 characters). To specify an extended-length path, use the "\\?\" prefix. For example, "\\?\D:\very long path".

2
  • 3
    You're right in that \\?\ paths (with one question mark) are indeed extended-length literal paths. This \??\ path, however, has two question marks and is a different kind of path - an NT Object Manager object name, specifically.
    – Ben N
    Jul 4, 2016 at 16:27
  • @BenN from my tests, I can only use \\?\ to access NT Object Manager object names, e.g. \\?\COM1 works perfectly fine, \??\COM1 doesn't.
    – hasufell
    Dec 4, 2021 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.