ULONG_PTR NtUserGetThreadState(ULONG ThreadState)
	{
		PVOID ThreadStateProcAddr = NULL;

		ThreadStateProcAddr = GetShadowSSDTProcAddr(0x3);
		KdPrint(("NtUserGetThreadState的地址为%p\n", ThreadStateProcAddr));


		NTSTATUS status;
		
		PRKAPC_STATE apcState;
		
		PEPROCESS eprocess;
		
		status = PsLookupProcessByProcessId((HANDLE)GetPidByProcName((PWCHAR)L"csrss.exe"), &eprocess);
		
		if (!NT_SUCCESS(status))
		{
			return NULL;
		}
		
		apcState = (PRKAPC_STATE)ExAllocatePool(NonPagedPool, sizeof(KAPC_STATE));
		
		KeStackAttachProcess((PRKPROCESS)eprocess, apcState);


		// 这里蓝屏，在获取当前线程信息时，rax返回为0，所以在返回句柄时出现内存访问错误

		ULONG_PTR hActiveWindow = ((pfNtUserGetThreadState)ThreadStateProcAddr)(ThreadState);
	

		KeUnstackDetachProcess(apcState);
		ExFreePool(apcState);
		
		ObDereferenceObject(eprocess);

		return hActiveWindow;
	}


	NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
	{
		NTSTATUS status = STATUS_UNSUCCESSFUL;


		DriverObject->DriverUnload = DriverUnload;


		status = STATUS_SUCCESS;


		HANDLE hActiveWindow = (HANDLE)NtUserGetThreadState(1);

		KdPrint(("驱动加载\n"));

		return status;
	}