Metadatacopystruct _FS_FILTER_CALLBACK_DATA { unsigned long SizeOfFsFilterCallbackData;/* 0x0 4 */ unsigned char Operation;/* 0x4 1 */ unsigned char Reserved;/* 0x5 1 */ /* 2 bytes padding */ struct _DEVICE_OBJECT* DeviceObject;/* 0x8 4 */ struct _FILE_OBJECT* FileObject;/* 0xc 4 */ union _FS_FILTER_PARAMETERS Parameters;/* 0x10 20 */};