FLT_PREOP_CALLBACK_STATUS PfltPreOperationCallbackCreate(PFLT_CALLBACK_DATA Data, PCFLT_RELATED_OBJECTS FltObjects, PVOID *CompletionContext)
{
	PFLT_FILE_NAME_INFORMATION stNameInfo;
	NTSTATUS lStatus = FltGetFileNameInformation(Data, FLT_FILE_NAME_OPENED | FLT_FILE_NAME_QUERY_ALWAYS_ALLOW_CACHE_LOOKUP, &stNameInfo);
	if (!NT_SUCCESS(lStatus))
	{
	return FLT_PREOP_SUCCESS_NO_CALLBACK;
	}
	lStatus = FltParseFileNameInformation(stNameInfo);

	if (!NT_SUCCESS(lStatus))
	{
	return FLT_PREOP_SUCCESS_NO_CALLBACK;
	}

	PWCHAR szFileName = (PWCHAR)ExAllocatePool(NonPagedPool, stNameInfo->Name.MaximumLength);

	RtlCopyMemory(szFileName, stNameInfo->Name.Buffer, stNameInfo->Name.MaximumLength);

	if (wcsstr(szFileName, L"AAAA.pak"))
	{
		DbgPrint("禁止文件操作");
		FltReleaseFileNameInformation(stNameInfo);
		return FLT_PREOP_COMPLETE;
	}
	FltReleaseFileNameInformation(stNameInfo);

	return FLT_PREOP_SUCCESS_NO_CALLBACK;
}