FRESH

Hacker News

Home

Windows drive letters are not limited to A-Z

498 points by LorenDB

by notepad0x90

6 subcomments

The NT paths are how the object manager refers to things. For example the registry hive HKEY_LOCAL_MACHINE is an alias for \Registry\Machine
https://learn.microsoft.com/en-us/windows-hardware/drivers/k...
In this way, NT is similar to Unix in that many things are just files part of one global VFS layout (the object manager name space).
Paths that start with drive letters are called a "DOSPath" because they only exist for DOS compatibility. But unfortunately, even in kernel mode, different sub systems might still refer to a DOSPath.
Powershell also exposes various things as "drives", pretty sure you could create your own custom drive as well for your custom app. For example, by default there is the 'hklm:\' drive path:
https://learn.microsoft.com/en-us/powershell/scripting/sampl...
Get-PSDrive/New-PSDrive
You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows.
I highly recommend getting the NtObjectManager powershell module and exploring about:
https://github.com/googleprojectzero/sandbox-attacksurface-a...
ls NtObject:\

by noinsight

7 subcomments

Windows is not limited to accessing partitions through drive letters either, it's just the existing convention.
You can mount partitions under directories just like you can in Linux/Unix.
PowerShell has Add-PartitionAccessPath for this:
> mkdir C:\Disk
> Add-PartitionAccessPath -DiskNumber 1 -PartitionNumber 2 -AccessPath "C:\Disk"
> ls C:\Disk
It will persist through reboots too.

by thrtythreeforty

3 subcomments

The cursedness of "€:\" is awesome. It's amazing how much more flexible the NT kernel is vs what's exposed to the user.

by RobotToaster

4 subcomments

> Drives with a drive-letter other than A-Z do not appear in File Explorer, and cannot be navigated to in File Explorer.
Well there goes my plan to replace all my drive letters with emojis :(

by the_mitsuhiko

1 subcomments

> In other words, since RtlDosPathNameToNtPathName_U converts C:\foo to \??\C:\foo, then an object named C: will behave like a drive letter. To give an example of what I mean by that: in an alternate universe, RtlDosPathNameToNtPathName_U could convert the path FOO:\bar to \??\FOO:\bar and then FOO: could behave like a drive letter.
For some reason I remember that the original xbox 360 had "drive letters" which were entire strings. Unfortunately I no longer have access to the developer docs and now I wonder if my mind completely made this up. I think it was something like "Game:\foo" and "Hdd0:\foo".

by vunderba

3 subcomments

From the article:
> Drives with a drive-letter other than A-Z do not appear in File Explorer, and cannot be navigated to in File Explorer.
Reminds me of the old-school ALT + 255 trick on Win9x machines where adding this "illegal trailing character" made the directory inaccessible from the regular file explorer.

by ddtaylor

1 subcomments

For anyone curious there is a somewhat similar thing in Linux called Abstract Domain Sockets. These are Unix domain sockets where the first character is NUL ('\0')
I am working on a game where every player has system resources on a Linux computer. The basic idea is that some resources need to be shared or protected in some ways, such as files, but the core communication of the game client itself needs to be preserved without getting in the way of the real system environment.
I am using these abstract data sockets because they sidestep most other permissions in Linux. If you have the magic numbers to find the socket, you get access.

by azalemeth

3 subcomments

This all sounds like a wonderful way to write some truly annoying malware. I expect to see hidden mounts on SQL-escape-type-maliciously-named drives soon...

by layer8

1 subcomments

> drive letters are essentially just a convention borne out of the conversion of a Win32 path into a NT path
CMD also has the concept of a current drive, and of a per-drive current directory. (While “X:\” references the root directory of drive X, “X:” references whatever the current directory of drive X is. And the current directory, i.e. “.”, is the current directory of the current drive.) I wonder how those mesh with non-standard drive letters.

by Tanoc

0 subcomment

Anybody who's had to look through files on multi-disc arrays knows exactly how weird the drive letters can get. Mount the ISOs of thirty six 8.5GB DVDs because someone thought it was a good idea to split zip a single archive into 7.99GB segments and things get very tricky in cmd. If you weren't in the habit of using several layers of quotation marks to separate everything you'll form it very quickly because the operators can be the same symbols as the drive letters, as shown in the article with the "+" example.

by kijin

4 subcomments

I remember when A and B were commonly used drive letters. C was a luxury. D was outright bourgeois.
But for some reason, drive letters starting with C feel completely natural, too. Maybe it's because C is also the first note in the most widely known musical scale. We can totally afford to waste two drive letters at the start, right?

by mschuster91

0 subcomment

> The \?? part of the \??\C:\foo path is actually a special virtual folder within the Object Manager that combines the \GLOBAL?? folder and a per-user DosDevices folder together.
Oh, so that is how terminal servers are able to mount different network shares (e.g. the user's home directory always being H:\) for each user's session on the same drive letter.

by WarOnPrivacy

1 subcomments

In my first DOS, the drive letter after Z was AA. I created a series of small RAM drives to find out.
That may have been DOS 3.3, not later. IDK when it changed.

by arcfour

1 subcomments

Hmm. This seems like it could be abused rather hilariously (or not, depending on your perspective) by malware...

by rwmj

0 subcomment

This is an interesting reference about how drive letters are stored in the Windows Registry: http://www.goodells.net/multiboot/partsigs.shtml
I never tried, but I wonder if you could use direct registry editing to create some really strange drive letters.

by layer8

0 subcomment

> Non-ASCII drive letters are even case-insensitive like A-Z are
I wonder, does `subst I: .` create i: or ı: under the Turkish locale?

by kazinator

0 subcomment

In the Cygnal fork of the cygwin.dll, I hacked Cygwin's POSIX chdir() function, as well as the path resolution mechanism, to support the per-drive-letter name current directory concept.
A path like "f:myfile.txt" actually means f:\path\to\whatever\myfile.txt" where \path\to\whatever is the current working directory of the f drive.
This is one of the details which makes the replacement DLL more of a "native" run-time library, whose behavior is less surprising to Windows users of the applicaton based on it.
https://www.kylheku.com/cygnal/

by joquarky

0 subcomment

I miss the 'assign' feature on the Amiga.

by WalterBright

0 subcomment

26 drives should be enough for anyone.

by account42

0 subcomment

I wonder what characters are not allowed in driver letters. Is it the same set that is not allowed in file/directory names?

by xori

1 subcomments

The real question is can Windows defender scan these drives?

by robocat

0 subcomment

Similar corner cases are the bedrock of security flaws.
If anyone adds this behaviour as a bet on a market about a future CVE or severity, can they add a link to the bet here?

by theandrewbailey

0 subcomment

This topic would make a good post on The Old New Thing.

by nunobrito

0 subcomment

This was a cool article. Learned something new today.

by northantara

2 subcomments

What happens if you mount 0x0000?

by fexed

0 subcomment

This is amazing and a security flaw waiting to be exploited

by pdntspa

0 subcomment

Seems like a great way to hide a bunch of files from users for a malware payload

by OCTAGRAM

0 subcomment

For maximum fun run Win+R eudcedit and
Draw your drive letter today!

by ddtaylor

0 subcomment

I never knew Λ was the upper case version of λ.

0 subcomment

by rado

6 subcomments

Windows drive letters are ridiculous. Use an external drive for e.g. video editing, its letter can be stolen by another drive, you can’t work anymore.

by perlgeek

0 subcomment

Now somebody will uses this to hide their malware, somehow...

by wheelie_bob

0 subcomment

[dead]

by theturtle

0 subcomment

[dead]

0 subcomment

by lutusp

3 subcomments

I hope this article gets archived in a computer history, so people in the future can read how today's default operating system persisted in requiring its vict..., umm, users, to honor an archaic practice long past any imaginable justification, while free alternative operating systems don't have this handicap.
I regularly have this conversation with my end-user neighbor -- I explain that he has once again written his backup archive onto his original because he plugged in his Windows USB drives in the wrong sequence. His reply is, more or less, "Are computers still that backward?" "No," I reply, "Windows is still that backward."
The good news is that Linux is more sophisticated. The bad news is that Linux users must be more sophisticated as well. But this won't always be true.