A forum for reverse engineering, OS internals and malware analysis 

Ask your beginner questions here.
 #1879  by hack004
 Mon Aug 09, 2010 10:18 pm
I run a "sys"file,and then found in serveral process name in front suddenly increase in serveral "??"characters.~
for example:?? C:\WINDOWS\system32\smss.exe ---in this case~
//-------------------------------------------------------------------------
Does someone know why? - -~
 #1881  by EP_X0FF
 Tue Aug 10, 2010 2:52 am
Take a look at NT Namespaces section of the given article.

http://msdn.microsoft.com/en-us/library ... 85%29.aspx

Windows NT subsystem does not use Win32 style filenames e.g. C:\my.exe. Instead all paths specified in terms of object manager namespace.
smss.exe launch first in system and uses native subsystem, that's why it have such strange path.