On my Windows machine, I had a folder with a name of four dots that acted like some kind of rabbit hole - how...











up vote
191
down vote

favorite
61












The folder name was listed in File Explorer with just plain four dots .....



When I tried opening it, I came into some kind of endless rabbit hole loop where I opened the exact same folder again and again - I could do this endlessly. Showing the path like C:ExamplePath...................., etc.



It was hanging my TypeScript compilation in one specific project. It took me more than a year before I found this folder and its related problems, because it was rooted deeply in nested folders. I never expected an issue like this, so I never looked for it.



I couldn't delete the folder the normal way because of the special name. In the end, I could remove it by using the command line and deleting the parent folder with rd /s /q path.



Afterward, I tried to create the folder again but was unable to do so with both File Explorer and the command line.



In my 20-plus years of using Windows I have never seen this bug before, so I can imagine that it would really be an annoying and confusing problem for amateur users.



Does anyone know how this could have happened and how to reproduce this issue?



Update



For people who are interested: this path was located deep within a TFS folder. So probably TFS uses the bypass method @grawity explained ("Various file managers, archivers, etc")



Did I stumble on a rare TFS bug?










share|improve this question















migrated from serverfault.com Oct 31 at 8:26


This question came from our site for system and network administrators.











  • 5




    The answers below detail what's happening, how to reproduce it intentionally, and how to fix it, but they don't mention why it happened. Since .. can be used in a path to indicate 'go up one folder', I would hazard a guess that somewhere along the line, some program or script concatenated two strings to create a path, one ended with .., and the next began with .., and since it used one of the techniques mentioned below, it succeeded in creating the path, even though it was missing the folder separator between them.
    – 3D1T0R
    Oct 31 at 20:58






  • 5




    strange things will also happen if you create a folder with only spaces in its name
    – phuclv
    Nov 1 at 4:32






  • 5




    Is this server on the internet? Just to warn you I regularly see hack attempts on internet facing web servers requesting: GET /....\....\....\....\....\....\....\....\....\winnt\win.ini. Clearly there is/was some vulnerability somewhere that this attempts to exploit.
    – Andy Brown
    Nov 2 at 16:11






  • 4




    @AndyBrown much more likely that's .., not ..... It's simply a way to traverse to winnt regardless of the depth of the starting point (the web root), so long as the starting point is less than 9 levels deep. It relies on the fact that going .. from the root directory leaves you at the root directory.
    – hobbs
    Nov 2 at 17:32






  • 5




    @hobbs That's a copy and paste from the Apache access log on linux. Definitely 4 dots in there. There are other hack attempts logged that do use .. which was why I found this one rather odd.
    – Andy Brown
    Nov 3 at 9:47

















up vote
191
down vote

favorite
61












The folder name was listed in File Explorer with just plain four dots .....



When I tried opening it, I came into some kind of endless rabbit hole loop where I opened the exact same folder again and again - I could do this endlessly. Showing the path like C:ExamplePath...................., etc.



It was hanging my TypeScript compilation in one specific project. It took me more than a year before I found this folder and its related problems, because it was rooted deeply in nested folders. I never expected an issue like this, so I never looked for it.



I couldn't delete the folder the normal way because of the special name. In the end, I could remove it by using the command line and deleting the parent folder with rd /s /q path.



Afterward, I tried to create the folder again but was unable to do so with both File Explorer and the command line.



In my 20-plus years of using Windows I have never seen this bug before, so I can imagine that it would really be an annoying and confusing problem for amateur users.



Does anyone know how this could have happened and how to reproduce this issue?



Update



For people who are interested: this path was located deep within a TFS folder. So probably TFS uses the bypass method @grawity explained ("Various file managers, archivers, etc")



Did I stumble on a rare TFS bug?










share|improve this question















migrated from serverfault.com Oct 31 at 8:26


This question came from our site for system and network administrators.











  • 5




    The answers below detail what's happening, how to reproduce it intentionally, and how to fix it, but they don't mention why it happened. Since .. can be used in a path to indicate 'go up one folder', I would hazard a guess that somewhere along the line, some program or script concatenated two strings to create a path, one ended with .., and the next began with .., and since it used one of the techniques mentioned below, it succeeded in creating the path, even though it was missing the folder separator between them.
    – 3D1T0R
    Oct 31 at 20:58






  • 5




    strange things will also happen if you create a folder with only spaces in its name
    – phuclv
    Nov 1 at 4:32






  • 5




    Is this server on the internet? Just to warn you I regularly see hack attempts on internet facing web servers requesting: GET /....\....\....\....\....\....\....\....\....\winnt\win.ini. Clearly there is/was some vulnerability somewhere that this attempts to exploit.
    – Andy Brown
    Nov 2 at 16:11






  • 4




    @AndyBrown much more likely that's .., not ..... It's simply a way to traverse to winnt regardless of the depth of the starting point (the web root), so long as the starting point is less than 9 levels deep. It relies on the fact that going .. from the root directory leaves you at the root directory.
    – hobbs
    Nov 2 at 17:32






  • 5




    @hobbs That's a copy and paste from the Apache access log on linux. Definitely 4 dots in there. There are other hack attempts logged that do use .. which was why I found this one rather odd.
    – Andy Brown
    Nov 3 at 9:47















up vote
191
down vote

favorite
61









up vote
191
down vote

favorite
61






61





The folder name was listed in File Explorer with just plain four dots .....



When I tried opening it, I came into some kind of endless rabbit hole loop where I opened the exact same folder again and again - I could do this endlessly. Showing the path like C:ExamplePath...................., etc.



It was hanging my TypeScript compilation in one specific project. It took me more than a year before I found this folder and its related problems, because it was rooted deeply in nested folders. I never expected an issue like this, so I never looked for it.



I couldn't delete the folder the normal way because of the special name. In the end, I could remove it by using the command line and deleting the parent folder with rd /s /q path.



Afterward, I tried to create the folder again but was unable to do so with both File Explorer and the command line.



In my 20-plus years of using Windows I have never seen this bug before, so I can imagine that it would really be an annoying and confusing problem for amateur users.



Does anyone know how this could have happened and how to reproduce this issue?



Update



For people who are interested: this path was located deep within a TFS folder. So probably TFS uses the bypass method @grawity explained ("Various file managers, archivers, etc")



Did I stumble on a rare TFS bug?










share|improve this question















The folder name was listed in File Explorer with just plain four dots .....



When I tried opening it, I came into some kind of endless rabbit hole loop where I opened the exact same folder again and again - I could do this endlessly. Showing the path like C:ExamplePath...................., etc.



It was hanging my TypeScript compilation in one specific project. It took me more than a year before I found this folder and its related problems, because it was rooted deeply in nested folders. I never expected an issue like this, so I never looked for it.



I couldn't delete the folder the normal way because of the special name. In the end, I could remove it by using the command line and deleting the parent folder with rd /s /q path.



Afterward, I tried to create the folder again but was unable to do so with both File Explorer and the command line.



In my 20-plus years of using Windows I have never seen this bug before, so I can imagine that it would really be an annoying and confusing problem for amateur users.



Does anyone know how this could have happened and how to reproduce this issue?



Update



For people who are interested: this path was located deep within a TFS folder. So probably TFS uses the bypass method @grawity explained ("Various file managers, archivers, etc")



Did I stumble on a rare TFS bug?







windows filesystems






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Nov 5 at 19:27









Run5k

10.4k72749




10.4k72749










asked Oct 31 at 8:03









Dirk Boer

1,0312810




1,0312810




migrated from serverfault.com Oct 31 at 8:26


This question came from our site for system and network administrators.






migrated from serverfault.com Oct 31 at 8:26


This question came from our site for system and network administrators.










  • 5




    The answers below detail what's happening, how to reproduce it intentionally, and how to fix it, but they don't mention why it happened. Since .. can be used in a path to indicate 'go up one folder', I would hazard a guess that somewhere along the line, some program or script concatenated two strings to create a path, one ended with .., and the next began with .., and since it used one of the techniques mentioned below, it succeeded in creating the path, even though it was missing the folder separator between them.
    – 3D1T0R
    Oct 31 at 20:58






  • 5




    strange things will also happen if you create a folder with only spaces in its name
    – phuclv
    Nov 1 at 4:32






  • 5




    Is this server on the internet? Just to warn you I regularly see hack attempts on internet facing web servers requesting: GET /....\....\....\....\....\....\....\....\....\winnt\win.ini. Clearly there is/was some vulnerability somewhere that this attempts to exploit.
    – Andy Brown
    Nov 2 at 16:11






  • 4




    @AndyBrown much more likely that's .., not ..... It's simply a way to traverse to winnt regardless of the depth of the starting point (the web root), so long as the starting point is less than 9 levels deep. It relies on the fact that going .. from the root directory leaves you at the root directory.
    – hobbs
    Nov 2 at 17:32






  • 5




    @hobbs That's a copy and paste from the Apache access log on linux. Definitely 4 dots in there. There are other hack attempts logged that do use .. which was why I found this one rather odd.
    – Andy Brown
    Nov 3 at 9:47
















  • 5




    The answers below detail what's happening, how to reproduce it intentionally, and how to fix it, but they don't mention why it happened. Since .. can be used in a path to indicate 'go up one folder', I would hazard a guess that somewhere along the line, some program or script concatenated two strings to create a path, one ended with .., and the next began with .., and since it used one of the techniques mentioned below, it succeeded in creating the path, even though it was missing the folder separator between them.
    – 3D1T0R
    Oct 31 at 20:58






  • 5




    strange things will also happen if you create a folder with only spaces in its name
    – phuclv
    Nov 1 at 4:32






  • 5




    Is this server on the internet? Just to warn you I regularly see hack attempts on internet facing web servers requesting: GET /....\....\....\....\....\....\....\....\....\winnt\win.ini. Clearly there is/was some vulnerability somewhere that this attempts to exploit.
    – Andy Brown
    Nov 2 at 16:11






  • 4




    @AndyBrown much more likely that's .., not ..... It's simply a way to traverse to winnt regardless of the depth of the starting point (the web root), so long as the starting point is less than 9 levels deep. It relies on the fact that going .. from the root directory leaves you at the root directory.
    – hobbs
    Nov 2 at 17:32






  • 5




    @hobbs That's a copy and paste from the Apache access log on linux. Definitely 4 dots in there. There are other hack attempts logged that do use .. which was why I found this one rather odd.
    – Andy Brown
    Nov 3 at 9:47










5




5




The answers below detail what's happening, how to reproduce it intentionally, and how to fix it, but they don't mention why it happened. Since .. can be used in a path to indicate 'go up one folder', I would hazard a guess that somewhere along the line, some program or script concatenated two strings to create a path, one ended with .., and the next began with .., and since it used one of the techniques mentioned below, it succeeded in creating the path, even though it was missing the folder separator between them.
– 3D1T0R
Oct 31 at 20:58




The answers below detail what's happening, how to reproduce it intentionally, and how to fix it, but they don't mention why it happened. Since .. can be used in a path to indicate 'go up one folder', I would hazard a guess that somewhere along the line, some program or script concatenated two strings to create a path, one ended with .., and the next began with .., and since it used one of the techniques mentioned below, it succeeded in creating the path, even though it was missing the folder separator between them.
– 3D1T0R
Oct 31 at 20:58




5




5




strange things will also happen if you create a folder with only spaces in its name
– phuclv
Nov 1 at 4:32




strange things will also happen if you create a folder with only spaces in its name
– phuclv
Nov 1 at 4:32




5




5




Is this server on the internet? Just to warn you I regularly see hack attempts on internet facing web servers requesting: GET /....\....\....\....\....\....\....\....\....\winnt\win.ini. Clearly there is/was some vulnerability somewhere that this attempts to exploit.
– Andy Brown
Nov 2 at 16:11




Is this server on the internet? Just to warn you I regularly see hack attempts on internet facing web servers requesting: GET /....\....\....\....\....\....\....\....\....\winnt\win.ini. Clearly there is/was some vulnerability somewhere that this attempts to exploit.
– Andy Brown
Nov 2 at 16:11




4




4




@AndyBrown much more likely that's .., not ..... It's simply a way to traverse to winnt regardless of the depth of the starting point (the web root), so long as the starting point is less than 9 levels deep. It relies on the fact that going .. from the root directory leaves you at the root directory.
– hobbs
Nov 2 at 17:32




@AndyBrown much more likely that's .., not ..... It's simply a way to traverse to winnt regardless of the depth of the starting point (the web root), so long as the starting point is less than 9 levels deep. It relies on the fact that going .. from the root directory leaves you at the root directory.
– hobbs
Nov 2 at 17:32




5




5




@hobbs That's a copy and paste from the Apache access log on linux. Definitely 4 dots in there. There are other hack attempts logged that do use .. which was why I found this one rather odd.
– Andy Brown
Nov 3 at 9:47






@hobbs That's a copy and paste from the Apache access log on linux. Definitely 4 dots in there. There are other hack attempts logged that do use .. which was why I found this one rather odd.
– Andy Brown
Nov 3 at 9:47












3 Answers
3






active

oldest

votes

















up vote
295
down vote



accepted










Win32 doesn't let you create files or folders with names ending in . – all dots are stripped from the end. Trying to create test. makes test appear instead. (This is for compatibility with 8.3 names in old DOS/Win9x era software.)



As a result, whenever you try to access a folder named ...., its name gets reduced to the empty string, and you're back to the folder you were in before.



The NT kernel, however, does allow such names. There are various mechanisms which bypass filename limitations imposed by Win32 APIs – for example, WSL (Windows Subsystem for Linux) doesn't run on top of Win32 and is unaffected by it. There is also the \? bypass method, a deliberate "backdoor" left in for programs which know what they're doing. Even though you cannot create C:Example...., you can create \?C:Example.... just fine.



Likewise you can delete such directories with rmdir \?C:path... from Cmd (I haven't tested with PowerShell yet).



Various file managers, archivers, etc. might use the \? method in order to be able to use longer path names than usual – and by doing so, they're also unaffected by the compatibility code within Win32; they bypass dot stripping, as well as translation of magic filenames like CON or NUL.



So it could be that one of your programs:




  1. always uses \? to access files,

  2. accidentally tried to create a folder named .... – but it's not really possible to know for sure after the fact.






share|improve this answer



















  • 13




    another way to create such a folder is by using alternate data streams. On the cmd: echo "" > ....::$INDEX_ALLOCATION. This will create a folder named .... (still pointing to the current folder).
    – WorldSEnder
    Oct 31 at 12:53






  • 2




    @DirkBoer I found this: docs.microsoft.com/en-us/dotnet/standard/io/…
    – user31389
    Oct 31 at 13:17






  • 123




    Microsoft calls this the "Extended Path Prefix", and paths with that prefix are called "extended-length paths". (funny: when you search for \?" in the .NET reference source, it causes a runtime error on their server).
    – dlatikay
    Oct 31 at 13:29








  • 2




    @grawity So . . . how should I go about deleting this folder now?
    – Shadow503
    Oct 31 at 13:56






  • 20




    I had a curious 'computer repair' client case where anytime the client made an account on any windows machine, it would work just fine but once he logged/rebooted it wouldn't let him into his account, instead making a temp account for the session. The local pc-repair shop was stumped (charged him still). Turns out his actual name is Con & he always used his name for his windows account.....on that day I learned there was more than just com1 as a magic filename
    – RozzA
    Nov 2 at 5:26


















up vote
22
down vote













In addition to @grawity's answer, a Win32 program can also do this by calling "native" API directly. If I'm not mistaken, in the present case, that would be NtCreateDirectoryObject. Those calls are fairly well documented nowadays, especially their kernel counterpart (which you cannot call from a Win32 program), in this case, ZwCreateDirectoryObject .



Regarding the "endless depth", an easy way to achieve this is to use links.
Create a directory, then inside it, create a junction to it (you can use mklink /j for instance), and you will end up with a very deep structure. Last time I did this was on Windows 2000, there was an end to the recursion though (you couldn't "dig infinitely"). Possibly on newer OS the limit is bigger or removed, also you could create let's say 10 directories each being a child of the previous one, and in the 10th one, create a link back to the first one.






share|improve this answer



















  • 3




    That's very possibly evil genius material right there ...
    – Agi Hammerthief
    Nov 1 at 14:35






  • 1




    I have copied full directories similarly to this to artificially fill up the disc for testing being able to determine when it was close to a set limit.
    – mickeyf
    Nov 1 at 16:08










  • It's also possible to reproduce using cygwin's mkdir ....
    – lucidbrot
    Nov 2 at 11:20


















up vote
16
down vote













There is an easier way to create the directory.
From the command prompt type:



MD ....



and hit enter, it will create a directory with four dots.
This directory is also viewable with explorer.



There is a flaw in MS-DOS that goes way back to version 1.0.
MS has known about it for some time but could not or would not fix it.
They have corrected the problem with PowerShell.



BTW, if you try:



RD ....



It will fail to delete. You need to use this specific syntax to remove it.



RD ....



I use this on certain servers that I admin. I often create a user folder on the root of the disk and I don't want another administrator to come along and remove it.



So I will go inside my folder and create a subfolder named CON, AUX, or LPT, etc...



If another Admin wants to remove my folder they need to know how to remove this subfolder first.






share|improve this answer



















  • 6




    That rather sounds like a Win32 API flaw, given that the command prompt hasn't been "MS-DOS" anymore for about twenty years now.
    – grawity
    Nov 2 at 5:39






  • 2




    Interestingly, If I try to delete the directory in windows explorer, it crashes when I created it with your version. When I created it with cygwin, it simply fails and says so.
    – lucidbrot
    Nov 2 at 11:26










  • I have a DOS 3.3 and a DOS 6.0 machines and the commands work on them. When they switched to 32 bit the issue was still there. it works in the CMD window from win95 all the way up to today, including all server versions. Now that we're switching to Powershell It no longer works. I realized after I wrote that that it does create the directory but it doesn't provide the effect that the OP was seeing. If I try to CD into the directory with four dots it just kicks me back out.
    – Larryc
    Nov 2 at 21:33












  • On my Windows 7 machine MD ....` only creates ........` tree - there is only one step of recursion.
    – Tomáš Zato
    2 days ago











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














 

draft saved


draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1371527%2fon-my-windows-machine-i-had-a-folder-with-a-name-of-four-dots-that-acted-like-s%23new-answer', 'question_page');
}
);

Post as a guest
































3 Answers
3






active

oldest

votes








3 Answers
3






active

oldest

votes









active

oldest

votes






active

oldest

votes








up vote
295
down vote



accepted










Win32 doesn't let you create files or folders with names ending in . – all dots are stripped from the end. Trying to create test. makes test appear instead. (This is for compatibility with 8.3 names in old DOS/Win9x era software.)



As a result, whenever you try to access a folder named ...., its name gets reduced to the empty string, and you're back to the folder you were in before.



The NT kernel, however, does allow such names. There are various mechanisms which bypass filename limitations imposed by Win32 APIs – for example, WSL (Windows Subsystem for Linux) doesn't run on top of Win32 and is unaffected by it. There is also the \? bypass method, a deliberate "backdoor" left in for programs which know what they're doing. Even though you cannot create C:Example...., you can create \?C:Example.... just fine.



Likewise you can delete such directories with rmdir \?C:path... from Cmd (I haven't tested with PowerShell yet).



Various file managers, archivers, etc. might use the \? method in order to be able to use longer path names than usual – and by doing so, they're also unaffected by the compatibility code within Win32; they bypass dot stripping, as well as translation of magic filenames like CON or NUL.



So it could be that one of your programs:




  1. always uses \? to access files,

  2. accidentally tried to create a folder named .... – but it's not really possible to know for sure after the fact.






share|improve this answer



















  • 13




    another way to create such a folder is by using alternate data streams. On the cmd: echo "" > ....::$INDEX_ALLOCATION. This will create a folder named .... (still pointing to the current folder).
    – WorldSEnder
    Oct 31 at 12:53






  • 2




    @DirkBoer I found this: docs.microsoft.com/en-us/dotnet/standard/io/…
    – user31389
    Oct 31 at 13:17






  • 123




    Microsoft calls this the "Extended Path Prefix", and paths with that prefix are called "extended-length paths". (funny: when you search for \?" in the .NET reference source, it causes a runtime error on their server).
    – dlatikay
    Oct 31 at 13:29








  • 2




    @grawity So . . . how should I go about deleting this folder now?
    – Shadow503
    Oct 31 at 13:56






  • 20




    I had a curious 'computer repair' client case where anytime the client made an account on any windows machine, it would work just fine but once he logged/rebooted it wouldn't let him into his account, instead making a temp account for the session. The local pc-repair shop was stumped (charged him still). Turns out his actual name is Con & he always used his name for his windows account.....on that day I learned there was more than just com1 as a magic filename
    – RozzA
    Nov 2 at 5:26















up vote
295
down vote



accepted










Win32 doesn't let you create files or folders with names ending in . – all dots are stripped from the end. Trying to create test. makes test appear instead. (This is for compatibility with 8.3 names in old DOS/Win9x era software.)



As a result, whenever you try to access a folder named ...., its name gets reduced to the empty string, and you're back to the folder you were in before.



The NT kernel, however, does allow such names. There are various mechanisms which bypass filename limitations imposed by Win32 APIs – for example, WSL (Windows Subsystem for Linux) doesn't run on top of Win32 and is unaffected by it. There is also the \? bypass method, a deliberate "backdoor" left in for programs which know what they're doing. Even though you cannot create C:Example...., you can create \?C:Example.... just fine.



Likewise you can delete such directories with rmdir \?C:path... from Cmd (I haven't tested with PowerShell yet).



Various file managers, archivers, etc. might use the \? method in order to be able to use longer path names than usual – and by doing so, they're also unaffected by the compatibility code within Win32; they bypass dot stripping, as well as translation of magic filenames like CON or NUL.



So it could be that one of your programs:




  1. always uses \? to access files,

  2. accidentally tried to create a folder named .... – but it's not really possible to know for sure after the fact.






share|improve this answer



















  • 13




    another way to create such a folder is by using alternate data streams. On the cmd: echo "" > ....::$INDEX_ALLOCATION. This will create a folder named .... (still pointing to the current folder).
    – WorldSEnder
    Oct 31 at 12:53






  • 2




    @DirkBoer I found this: docs.microsoft.com/en-us/dotnet/standard/io/…
    – user31389
    Oct 31 at 13:17






  • 123




    Microsoft calls this the "Extended Path Prefix", and paths with that prefix are called "extended-length paths". (funny: when you search for \?" in the .NET reference source, it causes a runtime error on their server).
    – dlatikay
    Oct 31 at 13:29








  • 2




    @grawity So . . . how should I go about deleting this folder now?
    – Shadow503
    Oct 31 at 13:56






  • 20




    I had a curious 'computer repair' client case where anytime the client made an account on any windows machine, it would work just fine but once he logged/rebooted it wouldn't let him into his account, instead making a temp account for the session. The local pc-repair shop was stumped (charged him still). Turns out his actual name is Con & he always used his name for his windows account.....on that day I learned there was more than just com1 as a magic filename
    – RozzA
    Nov 2 at 5:26













up vote
295
down vote



accepted







up vote
295
down vote



accepted






Win32 doesn't let you create files or folders with names ending in . – all dots are stripped from the end. Trying to create test. makes test appear instead. (This is for compatibility with 8.3 names in old DOS/Win9x era software.)



As a result, whenever you try to access a folder named ...., its name gets reduced to the empty string, and you're back to the folder you were in before.



The NT kernel, however, does allow such names. There are various mechanisms which bypass filename limitations imposed by Win32 APIs – for example, WSL (Windows Subsystem for Linux) doesn't run on top of Win32 and is unaffected by it. There is also the \? bypass method, a deliberate "backdoor" left in for programs which know what they're doing. Even though you cannot create C:Example...., you can create \?C:Example.... just fine.



Likewise you can delete such directories with rmdir \?C:path... from Cmd (I haven't tested with PowerShell yet).



Various file managers, archivers, etc. might use the \? method in order to be able to use longer path names than usual – and by doing so, they're also unaffected by the compatibility code within Win32; they bypass dot stripping, as well as translation of magic filenames like CON or NUL.



So it could be that one of your programs:




  1. always uses \? to access files,

  2. accidentally tried to create a folder named .... – but it's not really possible to know for sure after the fact.






share|improve this answer














Win32 doesn't let you create files or folders with names ending in . – all dots are stripped from the end. Trying to create test. makes test appear instead. (This is for compatibility with 8.3 names in old DOS/Win9x era software.)



As a result, whenever you try to access a folder named ...., its name gets reduced to the empty string, and you're back to the folder you were in before.



The NT kernel, however, does allow such names. There are various mechanisms which bypass filename limitations imposed by Win32 APIs – for example, WSL (Windows Subsystem for Linux) doesn't run on top of Win32 and is unaffected by it. There is also the \? bypass method, a deliberate "backdoor" left in for programs which know what they're doing. Even though you cannot create C:Example...., you can create \?C:Example.... just fine.



Likewise you can delete such directories with rmdir \?C:path... from Cmd (I haven't tested with PowerShell yet).



Various file managers, archivers, etc. might use the \? method in order to be able to use longer path names than usual – and by doing so, they're also unaffected by the compatibility code within Win32; they bypass dot stripping, as well as translation of magic filenames like CON or NUL.



So it could be that one of your programs:




  1. always uses \? to access files,

  2. accidentally tried to create a folder named .... – but it's not really possible to know for sure after the fact.







share|improve this answer














share|improve this answer



share|improve this answer








edited Nov 6 at 18:45









Fabby

441417




441417










answered Oct 31 at 9:19









grawity

226k35469530




226k35469530








  • 13




    another way to create such a folder is by using alternate data streams. On the cmd: echo "" > ....::$INDEX_ALLOCATION. This will create a folder named .... (still pointing to the current folder).
    – WorldSEnder
    Oct 31 at 12:53






  • 2




    @DirkBoer I found this: docs.microsoft.com/en-us/dotnet/standard/io/…
    – user31389
    Oct 31 at 13:17






  • 123




    Microsoft calls this the "Extended Path Prefix", and paths with that prefix are called "extended-length paths". (funny: when you search for \?" in the .NET reference source, it causes a runtime error on their server).
    – dlatikay
    Oct 31 at 13:29








  • 2




    @grawity So . . . how should I go about deleting this folder now?
    – Shadow503
    Oct 31 at 13:56






  • 20




    I had a curious 'computer repair' client case where anytime the client made an account on any windows machine, it would work just fine but once he logged/rebooted it wouldn't let him into his account, instead making a temp account for the session. The local pc-repair shop was stumped (charged him still). Turns out his actual name is Con & he always used his name for his windows account.....on that day I learned there was more than just com1 as a magic filename
    – RozzA
    Nov 2 at 5:26














  • 13




    another way to create such a folder is by using alternate data streams. On the cmd: echo "" > ....::$INDEX_ALLOCATION. This will create a folder named .... (still pointing to the current folder).
    – WorldSEnder
    Oct 31 at 12:53






  • 2




    @DirkBoer I found this: docs.microsoft.com/en-us/dotnet/standard/io/…
    – user31389
    Oct 31 at 13:17






  • 123




    Microsoft calls this the "Extended Path Prefix", and paths with that prefix are called "extended-length paths". (funny: when you search for \?" in the .NET reference source, it causes a runtime error on their server).
    – dlatikay
    Oct 31 at 13:29








  • 2




    @grawity So . . . how should I go about deleting this folder now?
    – Shadow503
    Oct 31 at 13:56






  • 20




    I had a curious 'computer repair' client case where anytime the client made an account on any windows machine, it would work just fine but once he logged/rebooted it wouldn't let him into his account, instead making a temp account for the session. The local pc-repair shop was stumped (charged him still). Turns out his actual name is Con & he always used his name for his windows account.....on that day I learned there was more than just com1 as a magic filename
    – RozzA
    Nov 2 at 5:26








13




13




another way to create such a folder is by using alternate data streams. On the cmd: echo "" > ....::$INDEX_ALLOCATION. This will create a folder named .... (still pointing to the current folder).
– WorldSEnder
Oct 31 at 12:53




another way to create such a folder is by using alternate data streams. On the cmd: echo "" > ....::$INDEX_ALLOCATION. This will create a folder named .... (still pointing to the current folder).
– WorldSEnder
Oct 31 at 12:53




2




2




@DirkBoer I found this: docs.microsoft.com/en-us/dotnet/standard/io/…
– user31389
Oct 31 at 13:17




@DirkBoer I found this: docs.microsoft.com/en-us/dotnet/standard/io/…
– user31389
Oct 31 at 13:17




123




123




Microsoft calls this the "Extended Path Prefix", and paths with that prefix are called "extended-length paths". (funny: when you search for \?" in the .NET reference source, it causes a runtime error on their server).
– dlatikay
Oct 31 at 13:29






Microsoft calls this the "Extended Path Prefix", and paths with that prefix are called "extended-length paths". (funny: when you search for \?" in the .NET reference source, it causes a runtime error on their server).
– dlatikay
Oct 31 at 13:29






2




2




@grawity So . . . how should I go about deleting this folder now?
– Shadow503
Oct 31 at 13:56




@grawity So . . . how should I go about deleting this folder now?
– Shadow503
Oct 31 at 13:56




20




20




I had a curious 'computer repair' client case where anytime the client made an account on any windows machine, it would work just fine but once he logged/rebooted it wouldn't let him into his account, instead making a temp account for the session. The local pc-repair shop was stumped (charged him still). Turns out his actual name is Con & he always used his name for his windows account.....on that day I learned there was more than just com1 as a magic filename
– RozzA
Nov 2 at 5:26




I had a curious 'computer repair' client case where anytime the client made an account on any windows machine, it would work just fine but once he logged/rebooted it wouldn't let him into his account, instead making a temp account for the session. The local pc-repair shop was stumped (charged him still). Turns out his actual name is Con & he always used his name for his windows account.....on that day I learned there was more than just com1 as a magic filename
– RozzA
Nov 2 at 5:26












up vote
22
down vote













In addition to @grawity's answer, a Win32 program can also do this by calling "native" API directly. If I'm not mistaken, in the present case, that would be NtCreateDirectoryObject. Those calls are fairly well documented nowadays, especially their kernel counterpart (which you cannot call from a Win32 program), in this case, ZwCreateDirectoryObject .



Regarding the "endless depth", an easy way to achieve this is to use links.
Create a directory, then inside it, create a junction to it (you can use mklink /j for instance), and you will end up with a very deep structure. Last time I did this was on Windows 2000, there was an end to the recursion though (you couldn't "dig infinitely"). Possibly on newer OS the limit is bigger or removed, also you could create let's say 10 directories each being a child of the previous one, and in the 10th one, create a link back to the first one.






share|improve this answer



















  • 3




    That's very possibly evil genius material right there ...
    – Agi Hammerthief
    Nov 1 at 14:35






  • 1




    I have copied full directories similarly to this to artificially fill up the disc for testing being able to determine when it was close to a set limit.
    – mickeyf
    Nov 1 at 16:08










  • It's also possible to reproduce using cygwin's mkdir ....
    – lucidbrot
    Nov 2 at 11:20















up vote
22
down vote













In addition to @grawity's answer, a Win32 program can also do this by calling "native" API directly. If I'm not mistaken, in the present case, that would be NtCreateDirectoryObject. Those calls are fairly well documented nowadays, especially their kernel counterpart (which you cannot call from a Win32 program), in this case, ZwCreateDirectoryObject .



Regarding the "endless depth", an easy way to achieve this is to use links.
Create a directory, then inside it, create a junction to it (you can use mklink /j for instance), and you will end up with a very deep structure. Last time I did this was on Windows 2000, there was an end to the recursion though (you couldn't "dig infinitely"). Possibly on newer OS the limit is bigger or removed, also you could create let's say 10 directories each being a child of the previous one, and in the 10th one, create a link back to the first one.






share|improve this answer



















  • 3




    That's very possibly evil genius material right there ...
    – Agi Hammerthief
    Nov 1 at 14:35






  • 1




    I have copied full directories similarly to this to artificially fill up the disc for testing being able to determine when it was close to a set limit.
    – mickeyf
    Nov 1 at 16:08










  • It's also possible to reproduce using cygwin's mkdir ....
    – lucidbrot
    Nov 2 at 11:20













up vote
22
down vote










up vote
22
down vote









In addition to @grawity's answer, a Win32 program can also do this by calling "native" API directly. If I'm not mistaken, in the present case, that would be NtCreateDirectoryObject. Those calls are fairly well documented nowadays, especially their kernel counterpart (which you cannot call from a Win32 program), in this case, ZwCreateDirectoryObject .



Regarding the "endless depth", an easy way to achieve this is to use links.
Create a directory, then inside it, create a junction to it (you can use mklink /j for instance), and you will end up with a very deep structure. Last time I did this was on Windows 2000, there was an end to the recursion though (you couldn't "dig infinitely"). Possibly on newer OS the limit is bigger or removed, also you could create let's say 10 directories each being a child of the previous one, and in the 10th one, create a link back to the first one.






share|improve this answer














In addition to @grawity's answer, a Win32 program can also do this by calling "native" API directly. If I'm not mistaken, in the present case, that would be NtCreateDirectoryObject. Those calls are fairly well documented nowadays, especially their kernel counterpart (which you cannot call from a Win32 program), in this case, ZwCreateDirectoryObject .



Regarding the "endless depth", an easy way to achieve this is to use links.
Create a directory, then inside it, create a junction to it (you can use mklink /j for instance), and you will end up with a very deep structure. Last time I did this was on Windows 2000, there was an end to the recursion though (you couldn't "dig infinitely"). Possibly on newer OS the limit is bigger or removed, also you could create let's say 10 directories each being a child of the previous one, and in the 10th one, create a link back to the first one.







share|improve this answer














share|improve this answer



share|improve this answer








edited Nov 2 at 10:40









legoscia

2,0421326




2,0421326










answered Oct 31 at 13:28









user1532080

48625




48625








  • 3




    That's very possibly evil genius material right there ...
    – Agi Hammerthief
    Nov 1 at 14:35






  • 1




    I have copied full directories similarly to this to artificially fill up the disc for testing being able to determine when it was close to a set limit.
    – mickeyf
    Nov 1 at 16:08










  • It's also possible to reproduce using cygwin's mkdir ....
    – lucidbrot
    Nov 2 at 11:20














  • 3




    That's very possibly evil genius material right there ...
    – Agi Hammerthief
    Nov 1 at 14:35






  • 1




    I have copied full directories similarly to this to artificially fill up the disc for testing being able to determine when it was close to a set limit.
    – mickeyf
    Nov 1 at 16:08










  • It's also possible to reproduce using cygwin's mkdir ....
    – lucidbrot
    Nov 2 at 11:20








3




3




That's very possibly evil genius material right there ...
– Agi Hammerthief
Nov 1 at 14:35




That's very possibly evil genius material right there ...
– Agi Hammerthief
Nov 1 at 14:35




1




1




I have copied full directories similarly to this to artificially fill up the disc for testing being able to determine when it was close to a set limit.
– mickeyf
Nov 1 at 16:08




I have copied full directories similarly to this to artificially fill up the disc for testing being able to determine when it was close to a set limit.
– mickeyf
Nov 1 at 16:08












It's also possible to reproduce using cygwin's mkdir ....
– lucidbrot
Nov 2 at 11:20




It's also possible to reproduce using cygwin's mkdir ....
– lucidbrot
Nov 2 at 11:20










up vote
16
down vote













There is an easier way to create the directory.
From the command prompt type:



MD ....



and hit enter, it will create a directory with four dots.
This directory is also viewable with explorer.



There is a flaw in MS-DOS that goes way back to version 1.0.
MS has known about it for some time but could not or would not fix it.
They have corrected the problem with PowerShell.



BTW, if you try:



RD ....



It will fail to delete. You need to use this specific syntax to remove it.



RD ....



I use this on certain servers that I admin. I often create a user folder on the root of the disk and I don't want another administrator to come along and remove it.



So I will go inside my folder and create a subfolder named CON, AUX, or LPT, etc...



If another Admin wants to remove my folder they need to know how to remove this subfolder first.






share|improve this answer



















  • 6




    That rather sounds like a Win32 API flaw, given that the command prompt hasn't been "MS-DOS" anymore for about twenty years now.
    – grawity
    Nov 2 at 5:39






  • 2




    Interestingly, If I try to delete the directory in windows explorer, it crashes when I created it with your version. When I created it with cygwin, it simply fails and says so.
    – lucidbrot
    Nov 2 at 11:26










  • I have a DOS 3.3 and a DOS 6.0 machines and the commands work on them. When they switched to 32 bit the issue was still there. it works in the CMD window from win95 all the way up to today, including all server versions. Now that we're switching to Powershell It no longer works. I realized after I wrote that that it does create the directory but it doesn't provide the effect that the OP was seeing. If I try to CD into the directory with four dots it just kicks me back out.
    – Larryc
    Nov 2 at 21:33












  • On my Windows 7 machine MD ....` only creates ........` tree - there is only one step of recursion.
    – Tomáš Zato
    2 days ago















up vote
16
down vote













There is an easier way to create the directory.
From the command prompt type:



MD ....



and hit enter, it will create a directory with four dots.
This directory is also viewable with explorer.



There is a flaw in MS-DOS that goes way back to version 1.0.
MS has known about it for some time but could not or would not fix it.
They have corrected the problem with PowerShell.



BTW, if you try:



RD ....



It will fail to delete. You need to use this specific syntax to remove it.



RD ....



I use this on certain servers that I admin. I often create a user folder on the root of the disk and I don't want another administrator to come along and remove it.



So I will go inside my folder and create a subfolder named CON, AUX, or LPT, etc...



If another Admin wants to remove my folder they need to know how to remove this subfolder first.






share|improve this answer



















  • 6




    That rather sounds like a Win32 API flaw, given that the command prompt hasn't been "MS-DOS" anymore for about twenty years now.
    – grawity
    Nov 2 at 5:39






  • 2




    Interestingly, If I try to delete the directory in windows explorer, it crashes when I created it with your version. When I created it with cygwin, it simply fails and says so.
    – lucidbrot
    Nov 2 at 11:26










  • I have a DOS 3.3 and a DOS 6.0 machines and the commands work on them. When they switched to 32 bit the issue was still there. it works in the CMD window from win95 all the way up to today, including all server versions. Now that we're switching to Powershell It no longer works. I realized after I wrote that that it does create the directory but it doesn't provide the effect that the OP was seeing. If I try to CD into the directory with four dots it just kicks me back out.
    – Larryc
    Nov 2 at 21:33












  • On my Windows 7 machine MD ....` only creates ........` tree - there is only one step of recursion.
    – Tomáš Zato
    2 days ago













up vote
16
down vote










up vote
16
down vote









There is an easier way to create the directory.
From the command prompt type:



MD ....



and hit enter, it will create a directory with four dots.
This directory is also viewable with explorer.



There is a flaw in MS-DOS that goes way back to version 1.0.
MS has known about it for some time but could not or would not fix it.
They have corrected the problem with PowerShell.



BTW, if you try:



RD ....



It will fail to delete. You need to use this specific syntax to remove it.



RD ....



I use this on certain servers that I admin. I often create a user folder on the root of the disk and I don't want another administrator to come along and remove it.



So I will go inside my folder and create a subfolder named CON, AUX, or LPT, etc...



If another Admin wants to remove my folder they need to know how to remove this subfolder first.






share|improve this answer














There is an easier way to create the directory.
From the command prompt type:



MD ....



and hit enter, it will create a directory with four dots.
This directory is also viewable with explorer.



There is a flaw in MS-DOS that goes way back to version 1.0.
MS has known about it for some time but could not or would not fix it.
They have corrected the problem with PowerShell.



BTW, if you try:



RD ....



It will fail to delete. You need to use this specific syntax to remove it.



RD ....



I use this on certain servers that I admin. I often create a user folder on the root of the disk and I don't want another administrator to come along and remove it.



So I will go inside my folder and create a subfolder named CON, AUX, or LPT, etc...



If another Admin wants to remove my folder they need to know how to remove this subfolder first.







share|improve this answer














share|improve this answer



share|improve this answer








edited Nov 2 at 3:38









Run5k

10.4k72749




10.4k72749










answered Nov 2 at 3:07









Larryc

55228




55228








  • 6




    That rather sounds like a Win32 API flaw, given that the command prompt hasn't been "MS-DOS" anymore for about twenty years now.
    – grawity
    Nov 2 at 5:39






  • 2




    Interestingly, If I try to delete the directory in windows explorer, it crashes when I created it with your version. When I created it with cygwin, it simply fails and says so.
    – lucidbrot
    Nov 2 at 11:26










  • I have a DOS 3.3 and a DOS 6.0 machines and the commands work on them. When they switched to 32 bit the issue was still there. it works in the CMD window from win95 all the way up to today, including all server versions. Now that we're switching to Powershell It no longer works. I realized after I wrote that that it does create the directory but it doesn't provide the effect that the OP was seeing. If I try to CD into the directory with four dots it just kicks me back out.
    – Larryc
    Nov 2 at 21:33












  • On my Windows 7 machine MD ....` only creates ........` tree - there is only one step of recursion.
    – Tomáš Zato
    2 days ago














  • 6




    That rather sounds like a Win32 API flaw, given that the command prompt hasn't been "MS-DOS" anymore for about twenty years now.
    – grawity
    Nov 2 at 5:39






  • 2




    Interestingly, If I try to delete the directory in windows explorer, it crashes when I created it with your version. When I created it with cygwin, it simply fails and says so.
    – lucidbrot
    Nov 2 at 11:26










  • I have a DOS 3.3 and a DOS 6.0 machines and the commands work on them. When they switched to 32 bit the issue was still there. it works in the CMD window from win95 all the way up to today, including all server versions. Now that we're switching to Powershell It no longer works. I realized after I wrote that that it does create the directory but it doesn't provide the effect that the OP was seeing. If I try to CD into the directory with four dots it just kicks me back out.
    – Larryc
    Nov 2 at 21:33












  • On my Windows 7 machine MD ....` only creates ........` tree - there is only one step of recursion.
    – Tomáš Zato
    2 days ago








6




6




That rather sounds like a Win32 API flaw, given that the command prompt hasn't been "MS-DOS" anymore for about twenty years now.
– grawity
Nov 2 at 5:39




That rather sounds like a Win32 API flaw, given that the command prompt hasn't been "MS-DOS" anymore for about twenty years now.
– grawity
Nov 2 at 5:39




2




2




Interestingly, If I try to delete the directory in windows explorer, it crashes when I created it with your version. When I created it with cygwin, it simply fails and says so.
– lucidbrot
Nov 2 at 11:26




Interestingly, If I try to delete the directory in windows explorer, it crashes when I created it with your version. When I created it with cygwin, it simply fails and says so.
– lucidbrot
Nov 2 at 11:26












I have a DOS 3.3 and a DOS 6.0 machines and the commands work on them. When they switched to 32 bit the issue was still there. it works in the CMD window from win95 all the way up to today, including all server versions. Now that we're switching to Powershell It no longer works. I realized after I wrote that that it does create the directory but it doesn't provide the effect that the OP was seeing. If I try to CD into the directory with four dots it just kicks me back out.
– Larryc
Nov 2 at 21:33






I have a DOS 3.3 and a DOS 6.0 machines and the commands work on them. When they switched to 32 bit the issue was still there. it works in the CMD window from win95 all the way up to today, including all server versions. Now that we're switching to Powershell It no longer works. I realized after I wrote that that it does create the directory but it doesn't provide the effect that the OP was seeing. If I try to CD into the directory with four dots it just kicks me back out.
– Larryc
Nov 2 at 21:33














On my Windows 7 machine MD ....` only creates ........` tree - there is only one step of recursion.
– Tomáš Zato
2 days ago




On my Windows 7 machine MD ....` only creates ........` tree - there is only one step of recursion.
– Tomáš Zato
2 days ago


















 

draft saved


draft discarded



















































 


draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1371527%2fon-my-windows-machine-i-had-a-folder-with-a-name-of-four-dots-that-acted-like-s%23new-answer', 'question_page');
}
);

Post as a guest




















































































Popular posts from this blog

横浜市

Rostock

Europa