After digging into this with a coworker, we found an unexpected style of IRP. When performing the directory query over the network the SRV kernel component issues a IRP_MN_QUERY_DIRECTORY with a IrpSp->Parameters.QueryDirectory.FileName and IrpSp->Parameters.QueryDirectory.FileIndex combination that seems to essentially reset the point at which the enumeration continues. The sequence we were seeing goes something like this:

1. Normal IRP_MN_QUERY_DIRECTORY with FileName of “*” and SL_RESTART_SCAN. This is successful and returns the first buffer of information.
2. Normal IRP_MN_QUERY_DIRECTORY with no FileName (and no FileIndex). This is successful and continues where the previous scan left off.
3. Repeat #2 approximately 3 times.
4. Unexpected IRP_MN_QUERY_DIRECTORY with FileName = “AppPatch” (one of the entries that was previously returned in #2, FileIndex = 0, and Flags = SL_INDEX_SPECIFIED. This appears to enumerate beginning with the entry just after “AppPatch”.
5. Repeat #2 through #4 until there are no more entries.

The behavior doesn’t appear to be documented anywhere, but I was able to reproduce it by rolling my own IRPs that match the above. (Zw APIs don’t accept the FileIndex parameter, so I couldn’t see any way to reproduce it outside of IRP rolling.)

It seems likely that the SRV component is sending QUERY_DIRECTORY IRPs until it has enough data to fill a network buffer, and then uses the restart at named index capability to get the data to start filling the next network buffer. Of course, that is just speculation, but it seems to make a kind of sense.

What I have derived from this is that there are two ways to use the SL_INDEX_SPECIFIED flag. If there is a FileName provided along with the flag, then the FileIndex value seems to be ignored, and the provided filename is used to find the index at which enumeration should begin. If the FileName is NULL, then the FileIndex would be used instead. Again, this is speculation but seems to be borne out by my testing.

The first passage that strongly resonated with me was a description of a time when Thoreau was put in jail for non-payment of taxes: “I could not but smile to see how industriously they locked the door on my meditations, which followed them out again without let or hindrance, and THEY were really all that was dangerous. As they could not reach me, they had resolved to punish my body; just as boys, if they cannot come at some person against whom they have a spite, will abuse his dog. I saw that the State was half-witted, that it was timid as a lone woman with her silver spoons, and that it did not know its friends from its foes, and I lost all my remaining respect for it, and pitied it.” I love this! It is so true that the State can force a body to do what they desire it to, but they cannot force a man’s mind to do anything. This is an idea that is also eloquently expressed in Ayn Rand’s Atlas Shrugged.

The second passage that I want to share today is in a similar context. Thoreau has been ordered by the law to pay a tax/tool to a church which he never attended. He writes a letter to the town clerk saying “I, Henry Thoreau, do not wish to be regarded as a member of any incorporated society which I have not joined.” He then goes on to write “If I had known how to name them, I should then have signed off in detail from all the societies which I never signed on to; but I did not know where to find a complete list.” We are said to be members of various societies every day that we did not consciously agree to, not the least of which is the State. I was never asked to participate in the social contract that makes our society; rather, it is presumed and forced upon each of us without our explicit consent.

Thoreau is one of the fathers of non-violent resistance to government. His example inspired men like Martin Luther King, Jr. to rise up in their own non-violent ways to defy the State’s power to control their lives. The more I read of Thoreau’s writings, the more inspirational he becomes to me.

The documentation can be a lot to wade through as there are a number of different ways that such notification can be accomplished. I won’t go into the reasons for using each (check MSDN documentation for some information on that), but I wanted to post some simple samples of using each for anyone who might be interested.

There are five different methods, using Win32 APIs, that are used in this sample. They don’t do anything special except print out basic information about the changes that are detected.

VOID
_processBuffer(
    __in PFILE_NOTIFY_INFORMATION pNotifyInformation
    )
{
    wchar_t filename[ MAX_PATH + 1 ];

    while ( pNotifyInformation->NextEntryOffset != 0 )
    {
        StringCbCopyNW( filename, sizeof( filename ), pNotifyInformation->FileName, pNotifyInformation->FileNameLength );
        wprintf( L"   Action %d [%s]\n", pNotifyInformation->Action, filename );
        pNotifyInformation = (PFILE_NOTIFY_INFORMATION) Add2Ptr( pNotifyInformation, pNotifyInformation->NextEntryOffset );
    }
}

DWORD
_changeDir1(
    __in LPCWSTR path
    )
{
    DWORD  status = ERROR_SUCCESS;

    //    For unwind
    HANDLE hFind = INVALID_HANDLE_VALUE;

    hFind =
        FindFirstChangeNotificationW(
            path,
            FALSE,
            FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME |
            FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE |
            FILE_NOTIFY_CHANGE_LAST_WRITE
            );
    if ( INVALID_HANDLE_VALUE == hFind )
    {
        fn_return( status = GetLastError() );
    }

    while ( WAIT_OBJECT_0 == WaitForSingleObject( hFind, INFINITE ) )
    {
        wprintf( L"Dir Notify: No information\n" );

        if ( !FindNextChangeNotification( hFind ) )
        {
            fn_return( status = GetLastError() );
        }
    }

    fn_return( NOTHING );

fn_exit:

    if ( hFind != INVALID_HANDLE_VALUE )
    {
        FindCloseChangeNotification( hFind );
    }

    return status;
}

DWORD
_changeDir2(
    __in LPCWSTR path
    )
{
    DWORD                    status = ERROR_SUCCESS;
    DWORD                    cbNotifyBuffer;
    DWORD                    cbReturned;

    //    For unwind
    HANDLE                   hFile = INVALID_HANDLE_VALUE;
    PFILE_NOTIFY_INFORMATION pNotifyBuffer = NULL;

    cbNotifyBuffer = 4096;
    pNotifyBuffer = (PFILE_NOTIFY_INFORMATION) new BYTE[ cbNotifyBuffer ];
    if ( !pNotifyBuffer )
    {
        fn_return( status = ERROR_NOT_ENOUGH_MEMORY );
    }

    hFile =
        CreateFileW(
            path,
            FILE_LIST_DIRECTORY,
            FILE_SHARE_READ | FILE_SHARE_WRITE,
            NULL,
            OPEN_EXISTING,
            FILE_ATTRIBUTE_DIRECTORY | FILE_FLAG_BACKUP_SEMANTICS,
            NULL
            );
    if ( INVALID_HANDLE_VALUE == hFile )
    {
        fn_return( status = GetLastError() );
    }

    while (
        ReadDirectoryChangesW(
            hFile,
            pNotifyBuffer,
            cbNotifyBuffer,
            FALSE,
            FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME |
                FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE |
                FILE_NOTIFY_CHANGE_LAST_WRITE,
            &cbReturned,
            NULL,
            NULL
            )
        )
    {
        if ( cbReturned > 0 )
        {
            wprintf( L"Dir Notify:\n" );
            _processBuffer( pNotifyBuffer );
        }
        else
        {
            wprintf( L"Dir Notify: No information\n" );
        }
    }

fn_exit:

    if ( INVALID_HANDLE_VALUE != hFile )
    {
        CloseHandle( hFile );
    }

    if ( pNotifyBuffer )
    {
        delete [] pNotifyBuffer;
    }

    return status;
}

DWORD
_changeDir3(
    __in LPCWSTR path
    )
{
    DWORD                    status = ERROR_SUCCESS;
    DWORD                    cbNotifyBuffer;
    DWORD                    cbReturned;
    PFILE_NOTIFY_INFORMATION pNotifyInformation;
    wchar_t                  filename[ MAX_PATH + 1 ];
    OVERLAPPED               overlapped;

    //    For unwind
    HANDLE                   hFile = INVALID_HANDLE_VALUE;
    PFILE_NOTIFY_INFORMATION pNotifyBuffer = NULL;

    ZeroMemory( &overlapped, sizeof( overlapped ) );

    cbNotifyBuffer = 4096;
    pNotifyBuffer = (PFILE_NOTIFY_INFORMATION) new BYTE[ cbNotifyBuffer ];
    if ( !pNotifyBuffer )
    {
        fn_return( status = ERROR_NOT_ENOUGH_MEMORY );
    }

    hFile =
        CreateFileW(
            path,
            FILE_LIST_DIRECTORY,
            FILE_SHARE_READ | FILE_SHARE_WRITE,
            NULL,
            OPEN_EXISTING,
            FILE_ATTRIBUTE_DIRECTORY | FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED,
            NULL
            );
    if ( INVALID_HANDLE_VALUE == hFile )
    {
        fn_return( status = GetLastError() );
    }

    overlapped.hEvent = CreateEventW( NULL, TRUE, FALSE, NULL );

    while (
        ReadDirectoryChangesW(
            hFile,
            pNotifyBuffer,
            cbNotifyBuffer,
            FALSE,
            FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME |
                FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE |
                FILE_NOTIFY_CHANGE_LAST_WRITE,
            NULL,
            &overlapped,
            NULL
            )
        &&
        GetOverlappedResult( hFile, &overlapped, &cbReturned, TRUE )
        )
    {
        if ( cbReturned > 0 )
        {
            wprintf( L"Dir Notify:\n" );
            _processBuffer( pNotifyBuffer );
        }
        else
        {
            wprintf( L"Dir Notify: No information\n" );
        }
    }

fn_exit:

    if ( overlapped.hEvent )
    {
        CloseHandle( overlapped.hEvent );
    }

    if ( INVALID_HANDLE_VALUE != hFile )
    {
        CloseHandle( hFile );
    }

    if ( pNotifyBuffer )
    {
        delete [] pNotifyBuffer;
    }

    return status;
}

DWORD
_changeDir4(
    __in LPCWSTR path
    )
{
    DWORD                    status = ERROR_SUCCESS;
    DWORD                    cbNotifyBuffer;
    DWORD                    cbReturned;
    PFILE_NOTIFY_INFORMATION pNotifyInformation;
    wchar_t                  filename[ MAX_PATH + 1 ];
    OVERLAPPED               overlapped;
    ULONG_PTR                completionKey;
    LPOVERLAPPED             pOverlapped;

    //    For unwind
    HANDLE                   hFile = INVALID_HANDLE_VALUE;
    PFILE_NOTIFY_INFORMATION pNotifyBuffer = NULL;
    HANDLE                   hCompletionPort = NULL;

    ZeroMemory( &overlapped, sizeof( overlapped ) );

    cbNotifyBuffer = 4096;
    pNotifyBuffer = (PFILE_NOTIFY_INFORMATION) new BYTE[ cbNotifyBuffer ];
    if ( !pNotifyBuffer )
    {
        fn_return( status = ERROR_NOT_ENOUGH_MEMORY );
    }

    hFile =
        CreateFileW(
            path,
            FILE_LIST_DIRECTORY,
            FILE_SHARE_READ | FILE_SHARE_WRITE,
            NULL,
            OPEN_EXISTING,
            FILE_ATTRIBUTE_DIRECTORY | FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED,
            NULL
            );
    if ( INVALID_HANDLE_VALUE == hFile )
    {
        fn_return( status = GetLastError() );
    }

    hCompletionPort = CreateIoCompletionPort( hFile, NULL, 0xF00DF00D, 0 );

    while (
        ReadDirectoryChangesW(
            hFile,
            pNotifyBuffer,
            cbNotifyBuffer,
            FALSE,
            FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME |
                FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE |
                FILE_NOTIFY_CHANGE_LAST_WRITE,
            NULL,
            &overlapped,
            NULL
            )
        &&
        GetQueuedCompletionStatus( hCompletionPort, &cbReturned, &completionKey, &pOverlapped, INFINITE )
        )
    {
        if ( cbReturned > 0 )
        {
            wprintf( L"Dir Notify:\n" );
            _processBuffer( pNotifyBuffer );
        }
        else
        {
            wprintf( L"Dir Notify: No information\n" );
        }
    }

fn_exit:

    if ( hCompletionPort )
    {
        CloseHandle( hCompletionPort );
    }

    if ( INVALID_HANDLE_VALUE != hFile )
    {
        CloseHandle( hFile );
    }

    if ( pNotifyBuffer )
    {
        delete [] pNotifyBuffer;
    }

    return status;
}

DWORD _cbReturned;

VOID CALLBACK
_changeDir5CompletionRoutine(
    __in DWORD        errorCode,
    __in DWORD        cbReturned,
    __in LPOVERLAPPED pOverlapped
    )
{
    _cbReturned = cbReturned;
    SetEvent( pOverlapped->hEvent );
}

DWORD
_changeDir5(
    __in LPCWSTR path
    )
{
    DWORD                    status = ERROR_SUCCESS;
    DWORD                    cbNotifyBuffer;
    PFILE_NOTIFY_INFORMATION pNotifyInformation;
    wchar_t                  filename[ MAX_PATH + 1 ];
    OVERLAPPED               overlapped;

    //    For unwind
    HANDLE                   hFile = INVALID_HANDLE_VALUE;
    PFILE_NOTIFY_INFORMATION pNotifyBuffer = NULL;

    ZeroMemory( &overlapped, sizeof( overlapped ) );

    cbNotifyBuffer = 4096;
    pNotifyBuffer = (PFILE_NOTIFY_INFORMATION) new BYTE[ cbNotifyBuffer ];
    if ( !pNotifyBuffer )
    {
        fn_return( status = ERROR_NOT_ENOUGH_MEMORY );
    }

    hFile =
        CreateFileW(
            path,
            FILE_LIST_DIRECTORY,
            FILE_SHARE_READ | FILE_SHARE_WRITE,
            NULL,
            OPEN_EXISTING,
            FILE_ATTRIBUTE_DIRECTORY | FILE_FLAG_BACKUP_SEMANTICS | FILE_FLAG_OVERLAPPED,
            NULL
            );
    if ( INVALID_HANDLE_VALUE == hFile )
    {
        fn_return( status = GetLastError() );
    }

    overlapped.hEvent = CreateEventW( NULL, TRUE, FALSE, NULL );

    while (
        ReadDirectoryChangesW(
            hFile,
            pNotifyBuffer,
            cbNotifyBuffer,
            FALSE,
            FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_DIR_NAME |
                FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE |
                FILE_NOTIFY_CHANGE_LAST_WRITE,
            NULL,
            &overlapped,
            _changeDir5CompletionRoutine
            )
        &&
        WaitForSingleObject( overlapped.hEvent, INFINITE )
        )
    {
        if ( _cbReturned > 0 )
        {
            wprintf( L"Dir Notify:\n" );
            _processBuffer( pNotifyBuffer );
        }
        else
        {
            wprintf( L"Dir Notify: No information\n" );
        }

        ResetEvent( overlapped.hEvent );
    }

fn_exit:

    if ( overlapped.hEvent )
    {
        CloseHandle( overlapped.hEvent );
    }

    if ( INVALID_HANDLE_VALUE != hFile )
    {
        CloseHandle( hFile );
    }

    if ( pNotifyBuffer )
    {
        delete [] pNotifyBuffer;
    }

    return status;
}

int
__cdecl
wmain(
    __in int      argc,
    __in wchar_t* argv[]
    )
{
    DWORD               status = ERROR_SUCCESS;

    if ( argc < 3 )
    {
        fn_return( NOTHING );
    }

    if ( !wcscmp( argv[ 1 ], L"1" ) )
    {
        wprintf( L"Type 1: FindFirstChangeNotification\n" );
        status = _changeDir1( argv[ 2 ] );
    }
    else if ( !wcscmp( argv[ 1 ], L"2" ) )
    {
        wprintf( L"Type 2: ReadDirectoryChanges (Synch)\n" );
        status = _changeDir2( argv[ 2 ] );
    }
    else if ( !wcscmp( argv[ 1 ], L"3" ) )
    {
        wprintf( L"Type 3: ReadDirectoryChanges (Asynch w/OVERLAPPED)\n" );
        status = _changeDir3( argv[ 2 ] );
    }
    else if ( !wcscmp( argv[ 1 ], L"4" ) )
    {
        wprintf( L"Type 4: ReadDirectoryChanges (Asynch w/IoCompletionPort)\n" );
        status = _changeDir4( argv[ 2 ] );
    }
    else if ( !wcscmp( argv[ 1 ], L"5" ) )
    {
        wprintf( L"Type 5: ReadDirectoryChanges (Asynch w/completion routine)\n" );
        status = _changeDir4( argv[ 2 ] );
    }

    fn_return( NOTHING );

fn_exit:

    wprintf( L"Status = %d\n", status );

    return status;
}

Education is such an important thing for children to get, and especially in high poverty areas they just don’t have the same chance. I believe strongly that this is the kind of cause that individuals should be able to solve and the government should stay out of, and this is one of the areas where I “put my money where my mouth is.”

I hope you’ll take a look at the site and see if it’s the kind of thing you would be interested in supporting as well.

This year I think there are a few Senate candidates that I can support (Mike Lee and Tim Bridgewater both seem palatable, though I prefer Lee.) I think that situation will help people stay more interested in the RLC-Utah, and the organization will hopefully see some gains in support. Who knows… now that I’m done with school I may decide to be more involved myself, possibly even volunteer for an RLC position.

Principled. I believe that Mike Lee will make principled decisions as a Senator. I think that our nation has been led into a horrible situation, primarily by people doing what they thought was right, or by doing what they thought was necessary. I don’t believe that Mike will be guided by these unprincipled concepts, but will let his decisions be guided by what the Constitution says and means. I trust that a representative who follows the Constitution (as the Founders understood it, not as it is misinterpreted by the three branches of our government today) will make correct decisions for me and my life. For the most part, this will lead them to decisions where they stay out of my life, providing only those minimal functions that government can actually accomplish where (arguably) individuals may not be able to.

New Blood. I believe that Washington has a profoundly corrupting influence on almost anyone who works there. Utah’s current Senators have been under this influence for many years, and have been changed by it. I’m sure they don’t think so, but I believe that if you examine their voting records, campaign contributions, and whom they spend their time with, it becomes apparent. Mike has enough experience with Washington (clerking for Judge Alito) to be somewhat prepared, but not so much experience that he has been corrupted. I think that having a representative who is recently from among the general Utah population is vital to them understanding and representing our needs and desires.

Hope. This is a buzzword from recent elections, but I don’t use it in quite the same sense. I think that Mike Lee believes that he can make changes in Washington. I don’t know for sure whether it is possible to change much, at least in the short term. But I need to have a representative who believes he can make a change so that he will try. Representatives who have been in the Washington scene for a long time have a tendency to have bought into the system. They talk about changing things tomorrow, but tomorrow never comes. I believe that Mike will try to change things now.

One of the most important developments in the history of political thought is the idea called the “rule of law.” Essentially what this means is that the law applies to everyone, and that the law rules in place of any individual whim. When applied to Constitutional systems, the rule of law also implies that the Constitutional law rules all. It is more important than individual wishes, majority wishes, or even other laws. I think that Mike Lee is the ONLY candidate running in the Utah Republican Senate race who understands this and believes it. In my mind that makes him the only candidate worth voting for.

I haven’t decided whether I will try to extend my schooling further yet, but it is an option. For now, I am going to finish up getting my real estate license and relax for a bit.

I’ve also decided that I’m going to build a personal library of top-quality books that have influenced the world, particularly those of a political or philosophical nature. I have read a great deal of portions from these books during my school work, but I can not say that I have read all of these books. It is my goal to now be able to say that.

Craig believes in small government. This is such a critical issue to me, and I know Craig really gets it. Craig doesn’t believe in government giving handouts or incentives to companies for good behavior. The free market does a great job of that already and it should be allowed to operate without the corrupting influence of government. I don’t want my government involved in my business. I especially don’t want my state government involved in my city business! Craig doesn’t think that the state government should get involved in the city or county government. If they ask for help, through lobbying or personal requests, I know Craig is happy to help, but he’s not the kind who wants to use his State Legislator influence to try to change things on the local level.

Craig is very available to constituents. I have seen some complaints in the aforementioned e-mails that Craig didn’t come and visit this or that city official. My experience has been exactly the opposite. Craig has gone out of his way to speak to me when I wanted it; he has answered every e-mail I have sent him quickly and helpfully; he has proactively communicated the things he is working on at the state level. I would guess that anyone who thinks Craig is less than accessible hasn’t really tried to contact him.

Craig has a proven record of making the right choices and the correct votes. I can’t say that I know and agree with every single vote choice that Craig has made, because I honestly don’t know every vote or every issue well enough to judge. I CAN say that on every major issue that I have been interested in, Craig votes the right way. He has demonstrated through actions his conservative values and beliefs, and I trust that he will continue to do so. I’m not willing to vote for someone who says he will vote the right way over someone who has proven that he will vote the right way.

Libertarians. These are the so-called small-”l” libertarians. They believe that there is a role in society for government, but that it should be limited to functions explicitly given to it by the Constitution or by some other concept of the social contract. They believe in small government that limits each individual’s rights only when they start to conflict with another’s rights. Think Ron Paul for a good example.

Neo-cons. Everybody has heard of these guys, they are the guys to claim to want smaller government while pushing to enlarge it at every turn. They want preemptive wars with other countries, military bases around the world, government surveillance powers such as those granted by the PATRIOT Act, etc. Think Dick Cheney on this one.

Theo-cons. This is the one that I found to be pretty entertaining because of the clever name. These are the conservatives who believe in a smaller government which is used to enforce their own religious beliefs on others. They believe in small government, but still want to outlaw any recreational drug use, pornography, gambling, equal homosexual rights, etc. I’m not entirely sure whom I should choose as a poster-boy for this one… maybe Mitt Romney or Mike Huckabee?

Now I feel that I should point out that these groups rarely self-identify what they actually believe. The neo-cons and theo-cons are far more likely to claim to be small-government people who believe in limited government power. But they seem to believe that it is “necessary” for the government to do more because of all the bad stuff out there (drugs, porn, Iraqis, terrorists, lazy people, etc.). The libertarians, on the other hand, don’t like to use that word because it’s the name of a political party that they don’t want to be associated with.

I would welcome your thoughts on other classifications here. Please try to make them at least as entertaining as “theo-cons”, just to help brighten my day.