11 ms·
Windows drive letters are not limited to A-Z
- rado 11mo agoWindows drive letters are ridiculous. Use an external drive for e.g. video editing, its letter can be stolen by another drive, you can’t work anymore.
- TazeTSchnitzel 11mo agoYou can fix the drive letter assignments at any time if they become a problem, or use a directory as a mount point if that's less troublesome. (Win-R, diskmgmt.msc)
- Arainach 11mo agoNot while it's mounted. This is akin to complaining that on Linux if you unplug a flash drive and plug in a different one that second drive could "steal" /mnt/sdb1 or whatever.
- Filligree 11mo agoPeople did complain about that, which is why on Linux today that mount would use the disk UUID or label instead. So it’s fixed. What’s windows’ excuse? :-)
- ChrisSD 11mo agoWindows also has uuids. E.g.: \\.\Volume{3558506b-6ae4-11eb-8698-806e6f6e6963}\
- Someone1234 11mo agoWhich can be trivially mapped to directories for aliasing. Just like Linux. Windows NT and UNIX are much more similar than many people realize; Windows NT just has a giant pile of Dos/Win9x compatibility baked on top hiding how great the core kernel design actually is. I think this article demonstrates that very well.
- jug 11mo agoYeah, NTFS is quite capable. I mostly blame the Windows UI for being a bit too dumbed down and not advertising the capabilities well.
- anthk 11mo agoIn the end, if you think about it, the Win32 subsystem running on top of NT OSes it's pretty much the same concept as Wine running on Unix. That's why Wine is not an emulator. And neither is XP emulating old Win32 stuff to run Win9x binaries.
- hulitu 11mo agoLinux is broken from this point of view. Inserting an USB drive before boot breaks booting .
- Xiol 11mo agoCertainly doesn't for me. Skill issue.
- dpark 11mo ago“Works on my machine” is rarely a helpful response. Doubling down with the “skill issue” insult makes it rude in addition to being unhelpful. Two other people were able to concisely explain the problem instead of being rude and condescending.
- oasisaimlessly 11mo agoOnly if you have a broken kernel cmdline or fstab that references /dev/sd* instead of using the UUID=xyz or /dev/disk/by-id/xyz syntax.
- cesarb 11mo ago> Only if you have an old-style kernel cmdline or fstab that references /dev/sd* instead of using the UUID=xyz or /dev/disk/by-id/xyz syntax. Fixed that for you. It used to be normal to use the device path (/dev/hd* or /dev/sd*) to reference the filesystem partitions. Using the UUID or the by-id symlink instead is a novelty, introduced precisely to fix these device enumeration order issues.
- creatonez 11mo agoYes... things were certainly broken in the distant past
- lutusp 11mo ago> [ .. ] Inserting an USB drive before boot breaks booting. Only if the machine's BIOS is configured to give bootable USB devices boot-order priority. So it's not about Linux -- in fact, the same thing would happen on a Windows machine. Remember that in a properly configured Linux install, the boot partition is identified by UUID, not hardware identifier (in /etc/fstab). Consequently if you change a drive's hardware connection point, the system still boots.
- avhception 11mo agoI remember vividly when a user couldn't access his smb drive from Windows because both his printer and also the computer's case came with one of these multi-cardreaders with n slots and the drive letters collided. That's when I learned that smb drive letters don't even come from the "global" pool of drive letters, because, and this is obvious in hindsight, they are a per-user affair (credentials and all that). I think the concept of drive letters is flawed.
- mrweasel 11mo agoEven Microsoft appears to agree with you, given that drive letters are symlinks. It's basically legacy, there's just no plan or reasonable path forward that will remove them.
- p_ing 11mo agoI always tried to point people to DFS w/ the FQDN path. We added a shortcut to the user's desktop that pointed to their home folder on the DFS namespace.
- bluGill 11mo agoDrive letters made sense in 1981 for personal computers. Of course a network run by IT isn't personal anymore - by definition.
- p_l 11mo agoOnly if the actual "drive letter" assigned to the drive is the special value for "auto". Otherwise, the drive letter is allocated statically and won't be used by another volume.
- leptons 11mo agoYou can't work anymore only if you are incurious and unable to google a simple solution - assign a different drive letter with the disk management program.
- Kwpolska 11mo agoIf you go with the defaults, they might be. But if you manually define the letter for your external drive, it will keep it forever. (I have my external drive set to X. I’m not sure if Windows would respect that assignment if I had plugged in 19 other drives, but that is never going to happen.)
- thrtythreeforty 11mo agoThe cursedness of "€:\" is awesome. It's amazing how much more flexible the NT kernel is vs what's exposed to the user.
- jeffbee 11mo agoYeah only the DOS façade of Windows NT is well known. Under that skin lurks some pretty wild late-1980s concepts. One of the core things to understand is that a lot of the features are based on a reverse map of GUIDs to various actions, and resolution of these map entries pervades the UI. That's why you can put {hexspew} as the name of a shortcut on the Windows desktop and have it magically become a deep link to some feature that Windows doesn't otherwise let you create a shortcut to, and also why you can just add things to the control panel which doesn't seem like it would be an intentional feature. And these actions can be named symbols inside DLLs, so they can do literally anything the OS is capable of doing. This is also why Windows has always been ground zero for malware.
- pixl97 11mo ago>so they can do literally anything the OS is capable of doing Yea, over the years someone thought of something they wanted to do and then did it without a systematic consideration of what that level of power meant, especially as multi-user network connectivity and untrusted data became the norm.
- p_ing 11mo agoThose weren't a consideration when the NT OS/2 Design Workbook was being written.
- sedatk 11mo agoThose GUIDs aren't related to NT kernel but Windows Explorer and its COM-based component system. They were introduced with Windows 95, IIRC.
- Wonkey 11mo agoThat sounds fun. Do you have a link or and example “hexspew”
- the_mitsuhiko 11mo ago> In other words, since RtlDosPathNameToNtPathName_U converts C:\foo to \??\C:\foo, then an object named C: will behave like a drive letter. To give an example of what I mean by that: in an alternate universe, RtlDosPathNameToNtPathName_U could convert the path FOO:\bar to \??\FOO:\bar and then FOO: could behave like a drive letter. For some reason I remember that the original xbox 360 had "drive letters" which were entire strings. Unfortunately I no longer have access to the developer docs and now I wonder if my mind completely made this up. I think it was something like "Game:\foo" and "Hdd0:\foo".
- Just_Harry 11mo agoYour memory is intact :) Those were/are a thing. The Xenia emulator handles them with symbolic links in its virtual-file-system: https://github.com/xenia-canary/xenia-canary/blob/70e44ab6ecc27eac3953fb7939225e3d5447bf86/src/xenia/emulator.cc#L561-L572 https://github.com/xenia-canary/xenia-canary/blob/70e44ab6ec...
- azalemeth 11mo agoThis all sounds like a wonderful way to write some truly annoying malware. I expect to see hidden mounts on SQL-escape-type-maliciously-named drives soon...
- hulitu 11mo ago> This all sounds like a wonderful way to write some truly annoying malware. AFAIK you need admin priviledges to play with drives in Windows.
- Someone1234 11mo agoI understand your point; but I'm struggling to see how this could be weaponized. Keep in mind, that these Dos compatible drive letters need to map to a real NT path endpoint (e.g. a drive/volume); so it isn't clear how the malware could both have a difficult to scan Dos tree while also not exposing that same area elsewhere for trivial scanning.
- rwmj 11mo agoI'm betting there's some badly written AV software out there which will crash on non-standard drive letters, allowing at least a bit of mayhem.
- buzer 11mo agoThe recovery partition might work if it exists.
- avidiax 11mo agoNot sure if it is natively supported, but the malware can just decrypt a disk image to RAM and create a RAM disk mounted to +. Or it can maybe have a user space driver for a loop device, so the sectors of the drive are only decrypted on the fly. It would likely break a lot of analysis tools and just generally make things very difficult.
- ahoka 11mo agoWait until your learn about Alternate Data Streams…
- nunobrito 11mo agoThis was a cool article. Learned something new today.
- RobotToaster 11mo ago> Drives with a drive-letter other than A-Z do not appear in File Explorer, and cannot be navigated to in File Explorer. Well there goes my plan to replace all my drive letters with emojis :(
- mananaysiempre 11mo agoYou would be limited to a fairly small subset of emojis, anyway: many (most?) of them are outside of the BMP so don’t fit into a single UTF-16 code unit, and some of the remaining ones are ordinary characters followed by an emoji style selector (U+FE0F), which doesn’t fit either.
- bikson 11mo agoBut your computer name can be emoji.
- jeroenhd 11mo agoWith the right code pages, you should be able to find a few smiley faces. For everything else, the best advice I can offer is that you can put your own autorun config file on the root of a drive to point the drive icon to a different resource. Though the path will stay boring, the GUI will show emoji everywhere, especially if you also enter emoji in the drive label.
- BLKNSLVR 11mo agoWhenever I get onto a computer that someone left unlocked, the first thing I check is their eggplant- and peach-labelled drives.
- Tanoc 11mo agoAnybody who's had to look through files on multi-disc arrays knows exactly how weird the drive letters can get. Mount the ISOs of thirty six 8.5GB DVDs because someone thought it was a good idea to split zip a single archive into 7.99GB segments and things get very tricky in cmd. If you weren't in the habit of using several layers of quotation marks to separate everything you'll form it very quickly because the operators can be the same symbols as the drive letters, as shown in the article with the "+" example.
- kijin 11mo agoI remember when A and B were commonly used drive letters. C was a luxury. D was outright bourgeois. But for some reason, drive letters starting with C feel completely natural, too. Maybe it's because C is also the first note in the most widely known musical scale. We can totally afford to waste two drive letters at the start, right?
- urbandw311er 11mo agoOh bless you and your youngsterness. A and B, by convention, were reserved for floppy drives and C was typically the first hard drive.
- HPsquared 11mo agoHard drives were a luxury.
- prerok 11mo agoWhile original IBM PCs indeed may not have had HDDs, it did become a standard for PC XT, as early as 1983. Only the cheapest version were without a HDD by the end of the 1980s.
- actionfromafar 11mo agoMany clones came without a HDD.
- prerok 11mo agoSure, I can imagine that. My first contact with PCs was in 1988 and they all had HDDs and were definitely not "IBM PC" but clones. That said, that's just my experience so YMMV.
- pdonis 11mo agoMy first PC, bought in late 1986, was a Leading Edge Model D, with two 360K floppy drives and no hard drive. I wrote a script to put COMMAND.COM and some other key files on a RAM disk on boot so I didn't have to keep the DOS floppy in the A: drive all the time. IIRC they had come out with a model that had a 20 MB hard drive but it was more than I could afford. MIT, where I was at school then, had some IBM PC XTs with 10 MB hard drives, but most of their computer resources were time-sharing DEC VAX machines. You could go to one of several computer labs to get on a terminal, or even dial into them--I did the latter from my PC (the one above) using a 2400 baud modem, which was fast for the time.
- arcfour 11mo agoHmm. This seems like it could be abused rather hilariously (or not, depending on your perspective) by malware...
- Loughla 11mo agoIf the malware that exploits my machine also runs off the eggplant emoji drive, I'm becoming Amish.
- PunchyHamster 11mo agoWhen you mount a partition on eggplant in Linux, nobody bats an eye When you do that on windows, everybody loses their mind.
- noinsight 11mo agoWindows is not limited to accessing partitions through drive letters either, it's just the existing convention. You can mount partitions under directories just like you can in Linux/Unix. PowerShell has Add-PartitionAccessPath for this: > mkdir C:\Disk > Add-PartitionAccessPath -DiskNumber 1 -PartitionNumber 2 -AccessPath "C:\Disk" > ls C:\Disk It will persist through reboots too.
- zamadatix 11mo agoOnly for NTFS (both source and dest) though, no exFAT shared drives under a folder mount or what have you. I think the same is actually true of ReFS for some reason. When you create/format the partition in the GUI tools it'll actually ask if you want to assign a drive letter or mount as a path as well.
- mschuster91 11mo agoWhat, excuse me, the fuck? I never knew one could do this. Thanks!
- vunderba 11mo agoFrom the article: > Drives with a drive-letter other than A-Z do not appear in File Explorer, and cannot be navigated to in File Explorer. Reminds me of the old-school ALT + 255 trick on Win9x machines where adding this "illegal trailing character" made the directory inaccessible from the regular file explorer.
- Telemakhos 11mo agoShhh… that’s how we hid the Duke Nukem installs on the boxen in the dorm computer lab.
- Someone1234 11mo agoUp until recently, you could do the same thing in the Windows Registry to make it so normal Windows tools (e.g. Regedit) couldn't view/modify certain entries. I believe it was still an issue in the last five~ years.
- mavhc 11mo agoIt's even worse now https://borncity.com/win/2023/03/11/windows-10-11-mock-folders-as-uac-bypass-security-disaster-leverage-applocker-and-srp/ https://borncity.com/win/2023/03/11/windows-10-11-mock-folde...
- perlgeek 11mo agoNow somebody will uses this to hide their malware, somehow...
- notepad0x90 11mo agoThe NT paths are how the object manager refers to things. For example the registry hive HKEY_LOCAL_MACHINE is an alias for \Registry\Machine https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/registry-key-object-routines https://learn.microsoft.com/en-us/windows-hardware/drivers/k... In this way, NT is similar to Unix in that many things are just files part of one global VFS layout (the object manager name space). Paths that start with drive letters are called a "DOSPath" because they only exist for DOS compatibility. But unfortunately, even in kernel mode, different sub systems might still refer to a DOSPath. Powershell also exposes various things as "drives", pretty sure you could create your own custom drive as well for your custom app. For example, by default there is the 'hklm:\' drive path: https://learn.microsoft.com/en-us/powershell/scripting/samples/managing-windows-powershell-drives?view=powershell-7.5 https://learn.microsoft.com/en-us/powershell/scripting/sampl... Get-PSDrive/New-PSDrive You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows. I highly recommend getting the NtObjectManager powershell module and exploring about: https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools https://github.com/googleprojectzero/sandbox-attacksurface-a... ls NtObject:\
- delusional 11mo ago> You can't access certificates in linux/bash as a file path for example, but you can in powershell/windows. I don't understand what you mean by this. I can access them "as a file" because they are in fact just files $ ls /etc/ca-certificates/extracted/cadir | tail -n 5 UCA_Global_G2_Root.pem USERTrust_ECC_Certification_Authority.pem USERTrust_RSA_Certification_Authority.pem vTrus_ECC_Root_CA.pem vTrus_Root_CA.pem
- kadoban 11mo agoI _suspect_ they mean that certs imported into MMC in Windows can be accessed at magic paths, but...yeah linux can do that because it skips the step of making a magical holding area for certs.
- notepad0x90 11mo ago
- theandrewbailey 11mo agoThis topic would make a good post on The Old New Thing.
- deleted 11mo ago[deleted]
- rwmj 11mo agoThis is an interesting reference about how drive letters are stored in the Windows Registry: http://www.goodells.net/multiboot/partsigs.shtml http://www.goodells.net/multiboot/partsigs.shtml I never tried, but I wonder if you could use direct registry editing to create some really strange drive letters.
- lutusp 11mo agoI hope this article gets archived in a computer history, so people in the future can read how today's default operating system persisted in requiring its vict..., umm, users, to honor an archaic practice long past any imaginable justification, while free alternative operating systems don't have this handicap. I regularly have this conversation with my end-user neighbor -- I explain that he has once again written his backup archive onto his original because he plugged in his Windows USB drives in the wrong sequence. His reply is, more or less, "Are computers still that backward?" "No," I reply, "Windows is still that backward." The good news is that Linux is more sophisticated. The bad news is that Linux users must be more sophisticated as well. But this won't always be true.
- rwmj 11mo agoAre Linux /dev device paths (originating from Unix) really much better? They're a pretty odd feature if you think about it. "Everything is a file", except only certain things can be files and at least by convention they only appear under /dev. Plan 9 takes the everything is a file concept to its logical conclusion and is much better designed. Edit: Also /dev/sdX paths in Linux are not stable. They can and do vary across boot, since Linux 5.6.
- lutusp 11mo ago> Are Linux /dev device paths (originating from Unix) really much better? Not better at all, which is why Linux uses partition UUIDs to identify specific storage partitions, regardless of hardware identifiers. This isn't automatic, the user must make it happen, which explains why Linux users need to know more than Windows users (and why Linux adoption is stalled). > Edit: Also /dev/sdX paths in Linux are not stable. They can and do vary across boot, since Linux 5.6. Yes, true, another reason to use partition UUIDs. > Plan 9 takes the everything is a file concept to its logical conclusion and is much better designed. It's a shame that Plan 9 didn't get traction -- too far ahead of its time I guess.
- dist-epoch 11mo agoWindows drive letters are also linked to some partition UUIDs, which is why you can move a partition to a different drive, or move drive to a different address (change SATA/m.2 port) You can use mountvol command to see the mount-letter/GUID mapping.
- robocat 11mo agoSimilar corner cases are the bedrock of security flaws. If anyone adds this behaviour as a bet on a market about a future CVE or severity, can they add a link to the bet here?
- pdntspa 11mo agoSeems like a great way to hide a bunch of files from users for a malware payload
- WarOnPrivacy 11mo agoIn my first DOS, the drive letter after Z was AA. I created a series of small RAM drives to find out. That may have been DOS 3.3, not later. IDK when it changed.
- pixl97 11mo agoI remember Netware had some kind of drive letter mapping that went way past z:
- ddtaylor 11mo agoI never knew Λ was the upper case version of λ.
- layer8 11mo ago> drive letters are essentially just a convention borne out of the conversion of a Win32 path into a NT path CMD also has the concept of a current drive, and of a per-drive current directory. (While “X:\” references the root directory of drive X, “X:” references whatever the current directory of drive X is. And the current directory, i.e. “.”, is the current directory of the current drive.) I wonder how those mesh with non-standard drive letters.
- squeek502 11mo agoThey work just fine, as the drive-specific CWD is stored in the environment as a normally-hidden =<drive-letter>: environment variable which has all the same WTF-16 and case-insensitive properties as drive letters: C:\> cd /D λ:\ λ:\> cd bar λ:\bar> cd /D C:\ C:\> echo %=Λ:% λ:\bar C:\> cd /D Λ: λ:\bar>
- o11c 11mo agoHm, what about using `%` itself?
- squeek502 11mo agoThat would only interact with the shell, as `%` is not actually part of the environment variable name, it's just a way to tell the shell you want it to get the value of an environment variable. The environment block itself is a NULL terminated list of NULL terminated WTF-16 strings of the format <key>=<value>, so `=` would be the more interesting thing to try. And indeed, it looks like using `=` as a drive letter breaks things in an interesting way: =:\> cd bar Not enough memory resources are available to process this command. =:\bar> `cd` exits with error code 1, but the directory change still goes through. With a program that dumps the NULL terminated <key>=<value> lines of the environment block, it looks like it does still modify the environment, but in an unexpected way: Before `cd /D =:\`, I had a line that looked like this (i.e. the per-drive CWD for C:\ was C:\foo): =C:=C:\foo After `cd /D =:\`, that was unexpectedly modified to: =C:==:\ Funnily enough, that line means that the "working directory" of the C drive is `=:\`, and that actually is acted upon: =:\foo> cd /D C: =:\> --- You might also be interested to know that '= in the name of an environment variable' is a more general edge case that is handled inconsistently on more than just Windows: https://github.com/ziglang/zig/issues/23331 https://github.com/ziglang/zig/issues/23331
- ddtaylor 11mo agoFor anyone curious there is a somewhat similar thing in Linux called Abstract Domain Sockets. These are Unix domain sockets where the first character is NUL ('\0') I am working on a game where every player has system resources on a Linux computer. The basic idea is that some resources need to be shared or protected in some ways, such as files, but the core communication of the game client itself needs to be preserved without getting in the way of the real system environment. I am using these abstract data sockets because they sidestep most other permissions in Linux. If you have the magic numbers to find the socket, you get access.
- layer8 11mo ago> Non-ASCII drive letters are even case-insensitive like A-Z are I wonder, does `subst I: .` create i: or ı: under the Turkish locale?
- WalterBright 11mo ago26 drives should be enough for anyone.
- xori 11mo agoThe real question is can Windows defender scan these drives?
- jasomill 11mo agoI don't know what it scans in the background by default, but it can custom scan mounted volumes with no visible mount points assigned at all, e.g., my EFI partition containing a copy of the EICAR test file[1]: PS C:\Users\jtm> & 'C:\Program Files\Windows Defender\MpCmdRun.exe' -Scan -ScanType 3 -File '\\?\Volume{91ada2dc-bb55-4d7d-aee5-df40f3cfa155}\' Scan starting... Scan finished. Scanning \\?\Volume{91ada2dc-bb55-4d7d-aee5-df40f3cfa155}\ found 1 threats. Cleaning started... Cleaning finished. [1] https://www.eicar.org/download-anti-malware-testfile/ https://www.eicar.org/download-anti-malware-testfile/
- joquarky 11mo agoI miss the 'assign' feature on the Amiga.
- deleted 11mo ago[deleted]
- northantara 11mo agoWhat happens if you mount 0x0000?
- thenickdude 11mo agoDeep in the abyss, the dark lord stirs
- Iwan-Zotow 11mo agoBill Gates will get a call
- wheelie_bob 11mo ago[dead]
- theturtle 11mo ago[dead]
- kazinator 11mo agoIn the Cygnal fork of the cygwin.dll, I hacked Cygwin's POSIX chdir() function, as well as the path resolution mechanism, to support the per-drive-letter name current directory concept. A path like "f:myfile.txt" actually means f:\path\to\whatever\myfile.txt" where \path\to\whatever is the current working directory of the f drive. This is one of the details which makes the replacement DLL more of a "native" run-time library, whose behavior is less surprising to Windows users of the applicaton based on it. https://www.kylheku.com/cygnal/ https://www.kylheku.com/cygnal/
- fexed 11mo agoThis is amazing and a security flaw waiting to be exploited
- mschuster91 11mo ago> The \?? part of the \??\C:\foo path is actually a special virtual folder within the Object Manager that combines the \GLOBAL?? folder and a per-user DosDevices folder together. Oh, so that is how terminal servers are able to mount different network shares (e.g. the user's home directory always being H:\) for each user's session on the same drive letter.
- account42 11mo agoI wonder what characters are not allowed in driver letters. Is it the same set that is not allowed in file/directory names?
- OCTAGRAM 11mo agoFor maximum fun run Win+R eudcedit and Draw your drive letter today!