{IRP_MJ_FILE_SYSTEM_CONTROL ,0,GsFilePreProtectCallback,NULL},FLT_PREOP_CALLBACK_STATUSFLTAPI GsFilePreProtectCallback(_Inout_ PFLT_CALLBACK_DATA Data,_In_ PCFLT_RELATED_OBJECTS FltObjects,_Outptr_result_maybenull_ PVOID* CompletionContext){FLT_PREOP_CALLBACK_STATUS ret = FLT_PREOP_SUCCESS_NO_CALLBACK;if (FlagOn(gflag_global, gs_file_instace_flags_format_access_denied)){//TraceEvents(TRACE_LEVEL_INFORMATION, DBG_DIAGNOSE, "%!FUNC! FSCtrl FsControlCode %x\n", Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode);if (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode == 0x90018 && ProtectFormatStage == 0){TraceEvents(TRACE_LEVEL_INFORMATION, DBG_DIAGNOSE, "%!FUNC! FSCtrl FsControlCode %x ProtectFormatStage First\n", Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode);ProtectFormatStage = 1;Data->IoStatus.Status = STATUS_ACCESS_DENIED;Data->IoStatus.Information = 0;return FLT_PREOP_COMPLETE;}else if (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode == 0x90018){TraceEvents(TRACE_LEVEL_INFORMATION, DBG_DIAGNOSE, "%!FUNC! FSCtrl FsControlCode %x ProtectFormatStage Revert\n", Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode);ProtectFormatStage = 0;Data->IoStatus.Status = STATUS_ACCESS_DENIED;Data->IoStatus.Information = 0;return FLT_PREOP_COMPLETE;}if (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode == 0x90020 && ProtectFormatStage == 1){ProtectFormatStage = 0;TraceEvents(TRACE_LEVEL_INFORMATION, DBG_DIAGNOSE, "%!FUNC! FSCtrl FsControlCode %x STATUS_ACCESS_DENIED\n", Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode);Data->IoStatus.Status = STATUS_ACCESS_DENIED;Data->IoStatus.Information = 0;return FLT_PREOP_COMPLETE;}else if (Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode == 0x90020){TraceEvents(TRACE_LEVEL_INFORMATION, DBG_DIAGNOSE, "%!FUNC! FSCtrl FsControlCode %x ProtectFormatStage Revert\n", Data->Iopb->Parameters.FileSystemControl.Common.FsControlCode);ProtectFormatStage = 0;}}return ret;}