Question about files that start with \??\
in [Win32 API]
|
Prev: update CDialog region in a user defined message handler
Next: Determine if "this" process is running with administrative privileges
From: Jackie on 14 Jun 2010 10:03 nki00 wrote: > How to convert a file name with \??\ at the beginning into format that file > APIs can understand? > I can't seem to remember or find the API I talked about earlier. But is it something like this you're looking for? http://msdn.microsoft.com/en-us/library/aa366789%28VS.85%29.aspx -- Regards, Jackie
From: Alf P. Steinbach on 14 Jun 2010 17:18 * Jackie, on 14.06.2010 15:41: > Jackie wrote: >> Might be called "device path"... I am looking for it at least. >> > > Not device path.. I think.. I kind of recall something with "DOS".. I > might be lying here but I'm letting you anyways just in case it gives > some hints on what to look for at least. The general notation stems from UNC paths. Define UNICODE before including <windows.h>, fix your string literals, and at least CreateFile, but I suspect most API functions, should then accept them. Cheers & hth., - Alf -- blog at <url: http://alfps.wordpress.com>
From: nki00 on 15 Jun 2010 04:55 > I can't seem to remember or find the API I talked about earlier. > But is it something like this you're looking for? > http://msdn.microsoft.com/en-us/library/aa366789%28VS.85%29.aspx I seem to be finding this tough-to-figure-out stuff, don't I, Jackie :) Nice link though. Thanks! (Again I found something I wasn't looking for -- it's pretty cool how they were able to get a file name from a handle). Still, unfortunately QueryDosDevice() returns a more digestible results, something like \Device\HarddiskVolume1 and nothing near to what I'm looking for. Here's how to replicate what I got: 1. Somehow get a process ID of the "csrss.exe". Either get if off the task manager, or enumerate all running processes (you may need to request elevation for your process for that) 2. Open that process 3. Call GetModuleFileNameEx(hProcHandle, NULL, buff, MAX_PATH) 4. buff will contain something like this: \??\C:\WINDOWS\system32\csrss.exe Another way to encounter such path is this. My Windows XP SP3 for instance, adds file paths in this format into the following registry key (when they are marked for delayed deletion at reboot): HKLM\System\CurrentControlSet\Control\Session Manager -> PendingFileRenameOperations So far my only solution to resolve these paths is to check if \??\ is at the front and remove it :) PS. Just stumbled upon a user commend on GetModuleFileNameEx page: Supposedly this naming convention is called, "kernel object syntax". That narrows down the search.
From: Jackie on 15 Jun 2010 08:27 nki00 wrote: > I seem to be finding this tough-to-figure-out stuff, don't I, Jackie :) Nice > link though. Thanks! (Again I found something I wasn't looking for -- it's > pretty cool how they were able to get a file name from a handle). Still, > unfortunately QueryDosDevice() returns a more digestible results, something > like \Device\HarddiskVolume1 and nothing near to what I'm looking for. The article topic wasn't what you asked for but I thought maybe you could still find some interesting things there. :D > Another way to encounter such path is this. My Windows XP SP3 for instance, > adds file paths in this format into the following registry key (when they > are marked for delayed deletion at reboot): .... > So far my only solution to resolve these paths is to check if \??\ is at the > front and remove it :) > > > PS. Just stumbled upon a user commend on GetModuleFileNameEx page: > Supposedly this naming convention is called, "kernel object syntax". That > narrows down the search. > I saw a user comment here: http://msdn.microsoft.com/en-us/library/ms684919(v=VS.85).aspx It says: "For the best results use the following table to convert paths. Windows 2000 = GetModuleFileName() Windows XP x32 = GetProcessImageFileName() Windows XP x64 = GetProcessImageFileName() Windows Vista = QueryFullProcessImageName() Windows 7 = QueryFullProcessImageName() Note: If you are not aware the API GetProcessImageFileName() returns a kernel DOS device path. You can use the following API to map the device paths to a Win32 format. GetLogicalDriveStrings QueryDosDevice" This looks pretty useful to me! -- Regards, Jackie
From: Jackie on 16 Jun 2010 07:01
Jackie wrote: > This looks pretty useful to me! It hit me just now... I guess that wasn't what you originally were looking for, and I've been trying to help regarding that.. But I was looking in the wrong direction. Silly me. -- Regards, Jackie |