Category: Post by Eddie Jackson

I’m using this to do a simple setting replacement in a config file. It won’t matter which line it is on, and…it won’t matter if you only know part of the string.

'Option Explicit
On error resume next

dim objFSO, strFolder, strFilePath, tmpFile, strLineInput, Settings

Const ForReading = 1

Const ForWriting = 2

Set objFSO = CreateObject("Scripting.FileSystemObject")

strFolder = "C:\ProgramData\ABC_Program\"

strFilePath = strFolder & "TheFile.ini"

Set Settings = objFSO.OpenTextFile(strFilePath, ForReading, True)

Set tmpFile = objFSO.OpenTextFile(strFilePath & ".tmp", ForWriting, True)

Do While Not Settings.AtEndofStream

strLineInput = Settings.ReadLine

If InStr(strLineInput, "AutoUpdate=") Then

strLineInput = "AutoUpdate=0"

End If

tmpFile.WriteLine strLineInput

Loop

Settings.Close

tmpFile.Close

objFSO.DeleteFile(strFilePath)

objFSO.MoveFile strFilePath&".tmp", strFilePath

Notes

on error resume next 

Const ForReading = 1

Const ForWriting = 2

Set objFSO = CreateObject("Scripting.FileSystemObject")

Set objShell = WScript.CreateObject("WScript.Shell")

Set objFile = objFSO.OpenTextFile("C:\IEZoneSettings.reg", ForReading)


strUser = objShell.ExpandEnvironmentStrings("%USERNAME%")

strText = objFile.ReadAll

objFile.Close

strNewText = Replace(strText, "XXXXX", strUser)


Set objFile = objFSO.OpenTextFile("C:\IEZoneSettings.reg", ForWriting)

objFile.WriteLine strNewText

objFile.Close

Silent Installation

JavaDownload.exe INSTALL_SILENT=1 STATIC=0 AUTO_UPDATE=0 WEB_JAVA=1 WEB_JAVA_SECURITY_LEVEL=H WEB_ANALYTICS=0 EULA=0 REBOOT=0

64 Bit

Version
1.8.1810.13

Size
68.4 MB

Registry
REG.exe ADD “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F64180181F0}” /v “Publisher” /t REG_SZ /d “YourDesktopManagementSoftware—example: SCCM” /f

Uninstall
msiexec /x{26A24AE4-039D-4CA4-87B4-2F64180181F0}

32 Bit

Version
1.8.1810.13

Size
61.5 MB

Registry
REG.exe ADD “HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180181F0}” /v “Publisher” /t REG_SZ /d “YourDesktopManagementSoftware—example: SCCM” /f

Uninstall
msiexec /x{26A24AE4-039D-4CA4-87B4-2F32180181F0}

I mostly refrain from posting my legal hacking exploits, but…the vendor just hasn’t stepped up to add this feature, and I believe it could be useful to other people.

First, what is RemotePC? RemotePC is a remote access solution for consumers and businesses, and is a product of IDrive Inc. RemotePC allows users, businesses and IT professionals to access and control their PCs & Macs remotely from any device including iOS/Android devices.

In RemotePC, there is a support console (back end), and an agent service (front end). The issue I have with the agent service is it can be configured by the end-user. Why would you allow that??? What company on the planet wants their end-users disabling remote support? None.

So, after contacting the vendor, there is no way to remove the notify icon, which contains all the settings (and, apparently, the remote support functionality). Arrrrrg.

This is what end-users see:

What should be on the menu, and should have the ability to be configured remotely, is a hide icon, but it does not exist.

Okay, on to the hacking part. The first thing I normally do when I want to peer into an application, is to load it into IDA. Interactive Disassembler (or IDA) is a disassembler for computer software which generates assembly language source code from machine-executable code (yes, assembly is still around). It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. Reverse engineering requires practice; it is as much of an artform, as it is a science.

In the IDA Console

After opening IDA, I do an overview of all the code.

Then, I search for keywords related to my interest. In this case, it is Tray, Icon, Notify. Look what I’m rewarded with just after a couple of searches…

So, armed with this knowledge, I now want to prevent that particular function from being called, or loaded. How do I do that? By simply changing the name of said function, call handler, or program routine. Note, this doesn’t always work the first time (or the second…or the third); it may take numerous searches and attempts, trying different things, to actually modify the code in a manner that doesn’t crash the application. Reverse engineering may also require other tools to assist you in this process, but that’s another story. Never add or remove bits; just replace, as in overwrite, them (if you change the offset, expect the program to crash).

The minor change made:

UPDATE 12/19/2018

The company has updated the RPCSuite.exe, thus changing the function in the EXE. Search for INotify now (I changed the ‘I’ to an ‘a’):

I did the actual mod in another program called Hex Editor Neo. I just like it better for making changes to files.

And, something to think about, you could have added an assembly JMP instruction, effectively hopping over the LaunchNotifyIconForTray, but that requires knowing how to read assembly and doing a live trace (that is a topic for another time). I learned assembly back in the 90’s, and do still use it from time to time. I chose this simpler method, because almost anyone can do it.

Okay, once that is complete and saved. I run the EXE. The EXE loads just fine, RemotePC works great, and take a look at the icon notification area…no RemotePC notify icon. We did it! We have successfully removed the icon, while maintaining remote support functionality.

Other things I have figured out through reverse engineering

• Removed the toast notification; added one of my own (Vendor, please add this option).
• Added an end-user Allow remote support to connect prompt (Vendor…add this feature).
• Added scan and replace logic to disable AutoUpdates (Would be nice if this was an option).
• For the RemotePC Viewer, I have added 16 new functions.

* sorry, I will not be posting how did these

Notes

Reverse Engineering, or…Reversing

The process of reverse engineering is accomplished by making use of some tools that are categorized into debuggers or disassemblers, hex editors, monitoring and decompile tools:

1. Disassemblers – A disassembler is used to convert binary code into assembly code and also used to extract strings, imported and exported functions, libraries etc. The disassemblers convert the machine language into a user-friendly format. There are different dissemblers that specialize in certain things.
2. Debuggers – This tool expands the functionality of a disassembler by supporting the CPU registers, the hex duping of the program, view of stack etc. Using debuggers, the programmers can set breakpoints and edit the assembly code at run time. Debuggers analyse the binary in a similar way as the disassemblers and allow the reverser to step through the code by running one line at a time to investigate the results.
3. Hex Editors – These editors allow the binary to be viewed in the editor and change it as per the requirements of the software. There are different types of hex editors available that are used for different functions.
4. PE and Resource Viewer – The binary code is designed to run on a windows based machine and has a very specific data which tells how to set up and initialize a program. All the programs that run on windows should have a portable executable that supports the DLLs the program needs to borrow from.

Common Tools I use

• Ida Pro
• Windows Tools
• Ollydbg
• gdb
• SimpleProgramDebugger
• Immunity Debugger
• Windbg
• Resource Hacker
• 7-Zip
• HxD Hexeditor
• Hex Editor Neo
• WinInstall by Scalable
• Prism pictaker (takes before & after snapshots)
• x64dbg
• Reko Decompiler
• nasm
• sasm
• PEiD tools
• PE Tools
• Fiddler
• Wireshark
• Procmon
• TCPView
• ProcExp
• file
• nm
• ldd
• otool
• dumpbin
• strings  strings
• strip

reg add “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{81EFECC6-6D32-4730-AE00-DA3AB4DBA09A}Machine\Software\Policies\Microsoft\Windows Defender\Exclusions\Processes” /v “C:\Users\%username%\AppData\Roaming\Adobe\Connect\connect.exe” /t REG_SZ /d 0 /f /reg:64

gpupdate

Notes

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus

There is a bug in the set-up.exe that requires logging into the cloud to install Creative Cloud. Why, Adobe….just why?

Solution

Taking a different “setup.exe” from an older installer works.

Update 10/10/2018

4_7_0_400, 4.7.0.400 still requires an older set-up.exe to get around the ‘cloud’ requirement during installation.

Notes

“set-up.exe”  –silent –ADOBEINSTALLDIR=”C:\Program Files (x86)\Adobe\CreativeCloud” –INSTALLLANGUAGE=en_GB

http://ccmdl.adobe.com/AdobeProducts/KCCC/1/win32/ACCCx4_6_0_391.zip

https://forums.adobe.com/thread/2519005

In a local admin profile—while the user is logged in as the local admin—I’m using this to pass a password into runas.exe, to automate a specific process. Make sure you compile this bit of code before using it in production.

Encoding currently leverages PowerShell’s char statement to cast a value to char-array.

Example:

$p1 = [char[]](65)
$p2 = [char[]](71)
$p3 = [char[]](68)

* I will be researching a more secure method of using runas.exe.

$wshell = New-Object -ComObject wscript.shell
$EncodedPW = "$p1$p7$p3$p2$p6$p4$p2$p1$p6$p7"

cmd /c ("start """" runas /u:administrator /netonly ""foo.exe"" ")

$wshell.AppActivate('MyAppWindow Title')
Sleep 1
$wshell.SendKeys('$EncodedPW')
$wshell.SendKeys('{ENTER}')

Notes

PowerShell Data Types

Windows 10

Group Policy Method

• Open GPedit.msc
• Navigate to Local Computer Policy -> Computer Configuration -> Administrative Templates -> Windows Components -> OneDrive.
• In the right pane, double click on policy named Prevent the usage of OneDrive for file storage.
• Select the Enabled radio button.
• Click OK when done.
• Run gpupdate /force.

Manual Method

• Terminate any process of OneDrive by running the following command

  taskkill /f /im OneDrive.exe

• Uninstall OneDrive app by running one of the following command
  32-bit

  %SystemRoot%\System32\OneDriveSetup.exe /uninstall

  64-bit

  %SystemRoot%\SysWOW64\OneDriveSetup.exe /uninstall

Cleaning and Removing OneDrive Remnants

rd "%UserProfile%\OneDrive" /Q /S
rd "%LocalAppData%\Microsoft\OneDrive" /Q /S
rd "%ProgramData%\Microsoft OneDrive" /Q /S
rd "C:\OneDriveTemp" /Q /S

• 32-bit
  • Browse to key: HKEY_CLASSES_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • Double-click value: System.IsPinnedToNameSpaceTree
  • Change to 0 and click OK
• 64-bit
  • Browse to key: HKEY_CLASSES_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • Double-click value: System.IsPinnedToNameSpaceTree
  • Change to 0 and click  OK
  • Browse to key: HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • Double-click value: System.IsPinnedToNameSpaceTree
  • Change to 0 and click OK

 Windows 7, Windows 8 and Windows 8.1

• Navigate to the following registry key: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows
• Right click on Windows and select New -> Key. Name the new key as OneDrive.
• WORD (32-bit) Value. Name the new value name as DisableFileSyncNGSC
• Set the data for DisableFileSyncNGSC registry value as 1.

This is how you would search a SQL DB looking for a specific element. Just change @SearchStrColumnValue = “%DoWhatYouWantToSearchFor%”.

DECLARE    @SearchStrTableName nvarchar(255), @SearchStrColumnName nvarchar(255), @SearchStrColumnValue nvarchar(255), @SearchStrInXML bit, @FullRowResult bit, @FullRowResultRows int
SET @SearchStrColumnValue = '%mail%' /* use LIKE syntax */
SET @FullRowResult = 1
SET @FullRowResultRows = 3
SET @SearchStrTableName = NULL /* NULL for all tables, uses LIKE syntax */
SET @SearchStrColumnName = NULL /* NULL for all columns, uses LIKE syntax */
SET @SearchStrInXML = 0 /* Searching XML data may be slow */

IF OBJECT_ID('tempdb..#Results') IS NOT NULL DROP TABLE #Results
CREATE TABLE #Results (TableName nvarchar(128), ColumnName nvarchar(128), ColumnValue nvarchar(max),ColumnType nvarchar(20))

SET NOCOUNT ON

DECLARE @TableName nvarchar(256) = '',@ColumnName nvarchar(128),@ColumnType nvarchar(20), @QuotedSearchStrColumnValue nvarchar(110), @QuotedSearchStrColumnName nvarchar(110)
SET @QuotedSearchStrColumnValue = QUOTENAME(@SearchStrColumnValue,'''')
DECLARE @ColumnNameTable TABLE (COLUMN_NAME nvarchar(128),DATA_TYPE nvarchar(20))

WHILE @TableName IS NOT NULL
BEGIN
SET @TableName =
(
SELECT MIN(QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME))
FROM     INFORMATION_SCHEMA.TABLES
WHERE         TABLE_TYPE = 'BASE TABLE'
AND TABLE_NAME LIKE COALESCE(@SearchStrTableName,TABLE_NAME)
AND    QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME) > @TableName
AND    OBJECTPROPERTY(OBJECT_ID(QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME)), 'IsMSShipped') = 0
)
IF @TableName IS NOT NULL
BEGIN
DECLARE @sql VARCHAR(MAX)
SET @sql = 'SELECT QUOTENAME(COLUMN_NAME),DATA_TYPE
FROM     INFORMATION_SCHEMA.COLUMNS
WHERE         TABLE_SCHEMA    = PARSENAME(''' + @TableName + ''', 2)
AND    TABLE_NAME    = PARSENAME(''' + @TableName + ''', 1)
AND    DATA_TYPE IN (' + CASE WHEN ISNUMERIC(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(@SearchStrColumnValue,'%',''),'_',''),'[',''),']',''),'-','')) = 1 THEN '''tinyint'',''int'',''smallint'',''bigint'',''numeric'',''decimal'',''smallmoney'',''money'',' ELSE '' END + '''char'',''varchar'',''nchar'',''nvarchar'',''timestamp'',''uniqueidentifier''' + CASE @SearchStrInXML WHEN 1 THEN ',''xml''' ELSE '' END + ')
AND COLUMN_NAME LIKE COALESCE(' + CASE WHEN @SearchStrColumnName IS NULL THEN 'NULL' ELSE '''' + @SearchStrColumnName + '''' END  + ',COLUMN_NAME)'
INSERT INTO @ColumnNameTable
EXEC (@sql)
WHILE EXISTS (SELECT TOP 1 COLUMN_NAME FROM @ColumnNameTable)
BEGIN
PRINT @ColumnName
SELECT TOP 1 @ColumnName = COLUMN_NAME,@ColumnType = DATA_TYPE FROM @ColumnNameTable
SET @sql = 'SELECT ''' + @TableName + ''',''' + @ColumnName + ''',' + CASE @ColumnType WHEN 'xml' THEN 'LEFT(CAST(' + @ColumnName + ' AS nvarchar(MAX)), 4096),'''
WHEN 'timestamp' THEN 'master.dbo.fn_varbintohexstr('+ @ColumnName + '),'''
ELSE 'LEFT(' + @ColumnName + ', 4096),''' END + @ColumnType + '''
FROM ' + @TableName + ' (NOLOCK) ' +
' WHERE ' + CASE @ColumnType WHEN 'xml' THEN 'CAST(' + @ColumnName + ' AS nvarchar(MAX))'
WHEN 'timestamp' THEN 'master.dbo.fn_varbintohexstr('+ @ColumnName + ')'
ELSE @ColumnName END + ' LIKE ' + @QuotedSearchStrColumnValue
INSERT INTO #Results
EXEC(@sql)
IF @@ROWCOUNT > 0 IF @FullRowResult = 1
BEGIN
SET @sql = 'SELECT TOP ' + CAST(@FullRowResultRows AS VARCHAR(3)) + ' ''' + @TableName + ''' AS [TableFound],''' + @ColumnName + ''' AS [ColumnFound],''FullRow>'' AS [FullRow>],*' +
' FROM ' + @TableName + ' (NOLOCK) ' +
' WHERE ' + CASE @ColumnType WHEN 'xml' THEN 'CAST(' + @ColumnName + ' AS nvarchar(MAX))'
WHEN 'timestamp' THEN 'master.dbo.fn_varbintohexstr('+ @ColumnName + ')'
ELSE @ColumnName END + ' LIKE ' + @QuotedSearchStrColumnValue
EXEC(@sql)
END
DELETE FROM @ColumnNameTable WHERE COLUMN_NAME = @ColumnName
END
END
END
SET NOCOUNT OFF

SELECT TableName, ColumnName, ColumnValue, ColumnType, COUNT(*) AS Count FROM #Results
GROUP BY TableName, ColumnName, ColumnValue, ColumnType

Notes

SQL – Search for Table Name

This is how you would launch a Google app, or spreadsheet, or….even directly download an application. Make sure to replace the ID with the relative application, spreadsheet, download, etc.

Command

C:\Progra~2\Google\Chrome\Application\chrome.exe  https://docs.google.com/spreadsheets/d/1zxGXf1J0F2Z_Ek-U8zfXkZkaxwwT3lmrRSZhVjQnspI

Example

Launching Google Remote Control

C:\Progra~2\Google\Chrome\Application\chrome.exe  –profile-directory=Default –app-id=gbchcmhmhahfdphkhkmpfmihenigjmpp

Screenshot

This is useful for adjusting the location of message boxes, forms, or other GUI components on the screen. When the height is returned, you can move it along the Y-axis. To use this, add the variable in the Y-axis element of that GUI component.

Example

$sAnswer = InputBox(“Computer Name”, “Enter Computer name or IP address”,””, “”,-1,-1,Default,$screenHeight)

Code

$screenHeight = _Desktop_Height()
$screenHeight = $screenHeight/2-150; move it up and down here

Func _Desktop_Height()
    Switch $height = ""
        Case @DesktopWidth = 640 And @DesktopHeight = 480;     
            $height = "480"
        Case @DesktopWidth = 800 And @DesktopHeight = 480;     
            $height = "480"
        Case @DesktopWidth = 854 And @DesktopHeight = 480;  
            $height = "480"
        Case @DesktopWidth = 800 And @DesktopHeight = 600;  
            $height = "600"
        Case @DesktopWidth = 960 And @DesktopHeight = 540;  
            $height = "540"
        Case @DesktopWidth = 1024 And @DesktopHeight = 576; 
            $height = "576"
        Case @DesktopWidth = 1024 And @DesktopHeight = 600; 
            $height = "600"
        Case @DesktopWidth = 1024 And @DesktopHeight = 768; 
            $height = "768"
        Case @DesktopWidth = 1152 And @DesktopHeight = 864; 
            $height = "864"
        Case @DesktopWidth = 1280 And @DesktopHeight = 720; 
            $height = "720"
        Case @DesktopWidth = 1280 And @DesktopHeight = 768; 
            $height = "768"
        Case @DesktopWidth = 1280 And @DesktopHeight = 800; 
            $height = "800"
        Case @DesktopWidth = 1280 And @DesktopHeight = 960; 
            $height = "960"
        Case @DesktopWidth = 1280 And @DesktopHeight = 1024;
            $height = "1024"
        Case @DesktopWidth = 1360 And @DesktopHeight = 768; 
            $height = "768"
        Case @DesktopWidth = 1366 And @DesktopHeight = 768; 
            $height = "768"
        Case @DesktopWidth = 1440 And @DesktopHeight = 900; 
            $height = "900"
        Case @DesktopWidth = 1400 And @DesktopHeight = 1050;
            $height = "900"
        Case @DesktopWidth = 1600 And @DesktopHeight = 900; 
            $height = "900"
        Case @DesktopWidth = 1600 And @DesktopHeight = 1200;
            $height = "1200"
        Case @DesktopWidth = 1680 And @DesktopHeight = 1050;
            $height = "1050"
        Case @DesktopWidth = 1920 And @DesktopHeight = 1080;
            $height = "1080"
        Case @DesktopWidth = 1920 And @DesktopHeight = 1200;
            $height = "1200"
        Case @DesktopWidth = 1920 And @DesktopHeight = 1400;
            $height = "1400"
        Case @DesktopWidth = 2048 And @DesktopHeight = 1080;
            $height = "1080"
        Case @DesktopWidth = 2048 And @DesktopHeight = 1152;
            $height = "1152"
        Case @DesktopWidth = 2048 And @DesktopHeight = 1536;
            $height = "1536"
        Case @DesktopWidth = 2538 And @DesktopHeight = 1080;
            $height = "1080"
        Case @DesktopWidth = 2560 And @DesktopHeight = 1080;
            $height = "1080"
        Case @DesktopWidth = 2560 And @DesktopHeight = 1440;
            $height = "1440"
        Case @DesktopWidth = 2560 And @DesktopHeight = 1600;
            $height = "1600"
        Case @DesktopWidth = 2560 And @DesktopHeight = 2048;
            $height = "2048"
        Case @DesktopWidth = 2880 And @DesktopHeight = 900; 
            $height = "900"
        Case Else
            Return SetError(1, 0, $height)
    EndSwitch
    Return $height
EndFunc   ;==>_Desktop_Height

These functions are useful if you’re trying to attach a child window to a parent application you created. I used it to control an app…inside a GUI form. I like to think of it as taking any app…and forcing that app into a frame. I then added layered functions to the frame, thus extending the original application’s features.

Func _WinGetByPID($iPID, $iArray = 1) ; 0 Will Return 1 Base Array & 1 Will Return The First Window.
Local $aError[1] = [0], $aWinList, $sReturn
If IsString($iPID) Then
$iPID = ProcessExists($iPID)
EndIf
$aWinList = WinList()
For $A = 1 To $aWinList[0][0]
If WinGetProcess($aWinList[$A][1]) = $iPID And BitAND(WinGetState($aWinList[$A][1]), 2) Then
If $iArray Then
Return $aWinList[$A][1]
EndIf
$sReturn &= $aWinList[$A][1] & Chr(1)
EndIf
Next
If $sReturn Then
Return StringSplit(StringTrimRight($sReturn, 1), Chr(1))
EndIf
Return SetError(1, 0, $aError)
EndFunc ;==>_WinGetByPID

Func _SetParent($id_child, $h_parent)
If Not IsHWnd($h_parent) Then $h_parent = HWnd($h_parent)
If Not IsHWnd($id_child) Then $id_child = GUICtrlGetHandle($id_child)
If DllCall("user32.dll", "hwnd", "SetParent", "hwnd", $id_child, "hwnd", $h_parent) <> 0 Then
Return 1
Else
seterror(1)
Return 0
EndIf
EndFunc

This is a snippet from a larger program I created.

Screenshot

Code

#include <GUIConstantsEx.au3>
#include <WindowsConstants.au3>

; create gui
$hGUI = GUICreate("The Main Form", 388, 610, 5, 5 ,BitOR($WS_MINIMIZEBOX,$WS_CLIPCHILDREN))
$hButton1 = GUICtrlCreateButton("CLOSE", 260, 510, 100, 40)

; create menu
Local $idFilemenu1 = GUICtrlCreateMenu("&MyMenu")
Local $idFileitem1 = GUICtrlCreateMenuItem("DoThis1", $idFilemenu1)
Local $idFileitem2 = GUICtrlCreateMenuItem("DoThis2", $idFilemenu1)
Local $idFileitem3 = GUICtrlCreateMenuItem("DoThis3", $idFilemenu1)
GUICtrlCreateMenuItem("", $idFilemenu1, 4) ; Create a separator line

GUISetState(@SW_SHOW)
; scan for menu action
While 1
Switch GUIGetMsg()
Case $idFileitem1
Run("cmd /c DoThis1.exe", "", @SW_HIDE)
Case $idFileitem2
Run("cmd /c DoThis2.exe", "", @SW_HIDE)
Case $idFileitem3
Run("cmd /c DoThis3.exe", "", @SW_HIDE)
Case $hButton1
Run("cmd /c DoThisButton.exe", "", @SW_HIDE)
EndSwitch
WEnd

Do
Sleep(10)
Until GuiGetMsg() =-3

GUIDelete()
;.....