// test03.cpp : 定义控制台应用程序的入口点。
//

#include "stdafx.h"
#include <windows.h>
#include <Sddl.h>
#include <AclAPI.h>
const TCHAR newDesk[MAX_PATH]=TEXT("FuckApp");
BOOL IsHighOS()
{
	if (GetVersion()>=6)
	{
		return TRUE;
	}
	return FALSE;
}
HDESK CreateNewDesktop(LPCTSTR lpszDeskName)
{
	HDESK hdesk = CreateDesktop(lpszDeskName,NULL,NULL,0,GENERIC_ALL,NULL);
	if (hdesk)
	{
		BOOL bRet=FALSE;
		PSECURITY_DESCRIPTOR SecDes=NULL;
		bRet = ConvertStringSecurityDescriptorToSecurityDescriptor(TEXT("S:(ML;;NW;;;LW)"),SDDL_REVISION_1,&SecDes,NULL);
		if (bRet)
		{
			BOOL bSaclDefaulted=FALSE; 
			BOOL bSaclPresent=FALSE;
			PACL SecACL=NULL;
			bRet = GetSecurityDescriptorSacl(SecDes,&bSaclPresent,&SecACL,&bSaclDefaulted);
			if (bRet)
			{
				if(ERROR_SUCCESS==SetSecurityInfo(hdesk,SE_WINDOW_OBJECT,0x10,NULL,NULL,NULL,SecACL))
					return hdesk;
			}
		}
		CloseDesktop(hdesk);
	}
	return 0;
}
DWORD WINAPI NewExplorerThread(LPVOID lparam)
{
	HDESK hHandle = (HDESK)lparam;
	SetThreadDesktop(hHandle);
	if (!FindWindow(TEXT("Shell_TrayWnd"),NULL))
	{
		//创建一个Explorer起来
		TCHAR szExplorerFullPath[MAX_PATH];
		STARTUPINFO si;
		PROCESS_INFORMATION pi;
		GetSystemDirectory(szExplorerFullPath,MAX_PATH);
		_tcsncat(szExplorerFullPath,TEXT("\\Explorer.exe"),MAX_PATH);
		si.cb = sizeof(STARTUPINFO);
		GetStartupInfo(&si);
		si.lpDesktop = (LPTSTR)newDesk;
		si.dwFlags = 1;
		si.wShowWindow = SW_SHOW;
		RtlZeroMemory(&pi,sizeof(PROCESS_INFORMATION));
		if (CreateProcess(NULL,szExplorerFullPath,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi))
		{
			CloseHandle(pi.hProcess);
			CloseHandle(pi.hThread);
		}
		while (!FindWindow(TEXT("Shell_TrayWnd"),NULL))
		{
			Sleep(2000);
		}
		if (IsHighOS())
		{
			//高版本系统处理explorer的问题
			HWND hWnd = FindWindow(TEXT("Shell_TrayWnd"),NULL);
			PostMessage(hWnd,0x574,2,0);
                        PostMessage(hWnd, 0x112u, 0xF130u, 0);
		}
	}
	return 0;
}
BOOL MakeDesktop(HDESK hDesk,DWORD dwSetting)
{
	SwitchDesktop(hDesk);
	SetThreadDesktop(hDesk);
	if (IsHighOS())
	{
		//写入Setting就行吧？
		//具体记不起来！
		HKEY hKey;
		DWORD dwData =0;
		if (!RegOpenKeyEx(
			HKEY_CURRENT_USER,
			TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer"),
			0,
			KEY_ALL_ACCESS,
			&hKey) )
		{
			dwData = dwSetting;
			RegSetValueExW(hKey, L"AltTabSettings",0,REG_DWORD,(const BYTE *)&dwData,sizeof(DWORD));
			RegCloseKey(hKey);
		}
	}
	HANDLE hThread = CreateThread(NULL,0,NewExplorerThread,(LPVOID)hDesk,0,NULL);
	WaitForSingleObject(hThread,INFINITE);
	return TRUE;
}
DWORD GetExplorerSetting()
{
	DWORD cbData=0;
	DWORD Data=0;
	HKEY hKey;
	if (!RegOpenKeyEx(
		HKEY_CURRENT_USER,
		TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer"),
		0,
		KEY_ALL_ACCESS,
		&hKey) )
	{
		cbData = sizeof(DWORD);
		RegQueryValueEx(hKey, TEXT("AltTabSettings"), 0,NULL,(LPBYTE)&Data,&cbData);
		RegCloseKey(hKey);
	}
	return Data;
}
int _tmain(int argc, _TCHAR* argv[])
{
	DWORD DeskSwitch = GetExplorerSetting();
	HDESK hDesk = CreateNewDesktop(newDesk);
	if (hDesk)
	{
		MakeDesktop(hDesk,DeskSwitch);
	}
	return 0;
}

[课程]Linux pwn 探索篇！