Originally Posted by
Alec The reason for the two '??' is sort of a longer story. Basically, there is a whole set of specialized code that runs in ring 0, or "kernel mode" that is collectively referred to as "Executive Services". These executive services range from things like memory management to I/O management to something called the "Object Manager". The object manager is the kernel's method of unifying and organizing the various low-level resources and objects that the kernel needs in order to do its job (ie, things like processes, threads, files, devices, mutexes aka mutants, etc.) Anyway, the object manager can be sort of thought of as imposing some structure on these objects kind of like the filesystem on a drive. There is a "directory" in the object manager called "DosDevices" that ennumerates devices as they were known in DOS (eg, LPT:, COM1:, C:, D: ). That is, the "C:" referrence to the first harddrive that we are all familiar with comes from DOS convention, but isn't necessarily how NT/2000/XP has to refer to the first harddrive. Anyway, the "C:" reference is defined in the object manager under the DosDevices "directory". It turns out that the DosDevices directory is used so much internally, that Microsoft eventually just cryptically renamed it "??" so that it would be first in the search path apparently. It saved a few microseconds per access, I guess.
The reason those two executables in particular show up with the "??" reference in front of them is likely because they are both what's called "Native" API applications. CSRSS and Winlogon aren't written based upon the Win32 API, since they are in fact each partly responsible for, and run prior to, that API. Rather they are written to a lower-level core Windows NT API. Because of this, they probably somehow make reference to the actual "??" DosDevices object manager entity that causes them to show up in process listings with that on there. You can learn much more on all of this by reading Mark Russinovich (of Sysinternals' fame) & David Solomon's "Windows Internals" book. I'm just sort of reciting what I recall.
