Difference between SystemRoot and C:\Windows

Question

In kernel mode, do \SytemRoot and \??\C:\Windows produce the same result?

For instance, if I want to access a file named test.txt in the Windows directory, what is right to use between the two options?

Answer 1

If you want to access a file test.txt in the directory C:\Windows explicitly, by name, you would use \??\C:\Windows\test.txt. However, this is most likely not what you want (unless you got the full path including C:\Windows from elsewhere and just prepend \??\), because it will fail if Windows is installed elsewhere, for example \??\D:\WINNT (or \??\X:\Windows in case of the recovery environment).

So, if you just want to access a file test.txt in the directory in which the current Windows installation is located, i.e. by the role of the directory as system root directory, regardless of its absolute path, you'd use \SystemRoot\test.txt. This is usually what you want, since \SystemRoot is a symlink that always points to the correct Windows installation directory. This even works if the drive letter of the partition (i.e. the symlink \??\C:) gets unexpectedly unassigned or changed at runtime (or wasn't assigned yet to begin with) because it doesn't go through symlinks in \?? like \??\C:\Windows but instead it directly points to a device path like \Device\Harddisk0\Partition1\Windows.