0

I use Avast Web Shield, and it intercepts TLS traffic from the browser using the env variable:

SSLKEYLOGFILE \\.\aswMonFltProxy\FFFFDE812B3DD840

While I don't actually mind that it does this, and I understand why it does so, I got curious as to what this "path" actually points to. My first thought is this is either some kind of Netbios address or a socket connection, but I really have no idea.

Does anyone have any idea what this kind of "path" is and if it's actually mappable to a physical file on the disk or maybe in memory?

1
  • its a mountpoint, not sure to what though... You can use the following to get an example of another mountpoint: `dir \\.\c:` to get a listing of c:\. This allows you to create, access and delete filenames that normally are impossible, such as prn, con, lpt, etc. They are network mappings to a local point on the system.
    – LPChip
    Sep 5, 2020 at 11:54

1 Answer 1

3

The \\. prefix is used for accessing the "device namespace", which works somewhat like Linux /dev or even /sys. (It corresponds to the subfolder \GLOBAL?? in the NT object namespace, so you can browse its contents using WinObjEx.)

From what I know, Windows resolves object paths incrementally, providing an effect similar to mountpoints, so \\.\aswMonFltProxy will likely be a device object created by Avast's filtering driver, and the remainder is handled by that driver itself – most likely returning a "pipe" object or similar. Firefox can write data to one end of the pipe and the driver receives.

(Windows also has actual named pipes, which live under the \\.\Pipe prefix and work in a very similar way – when accessing e.g. \\.\Pipe\whatever, the first part gets resolved to the named-pipe device driver, the remainder to the actual namedpipefs object.)

Generally, none of those objects are physical – they only exist in the kernel's memory. Only some objects (e.g. \\.\C:) correspond to a physical disk and allow reaching back into the "real" filesystem.

1
  • Thank you for the detailed answer and the tip for the WinObjEx program.
    – Stian Lund
    Sep 6, 2020 at 20:26

Not the answer you're looking for? Browse other questions tagged .