[BlackWhite]

Hi, bilbo. Thank you for your experiments.
But I found that SetFocus() did not work in my case,
GetMessagePos() still returned the wrong value.

   SetFocus((HWND)hTreeView);
   SetCursorPos(0x0027, 0x0289);
   POINT ap={0x0027, 0x0289}, cp={0x0025, 0x00AE};
   ScreenToClient((HWND)hTreeView, &ap);
   cp = ap;
   SendMessage((HWND)hTreeView, WM_LBUTTONDOWN, MK_LBUTTON, cp.y<<16|cp.x); // It does not work.
/* Whether or not the following WM_NOTIFY is sent, GetMessagePos() returns the wrong value.
   NMHDR notify;
   notify.hwndFrom = (HWND)hTreeView;
   notify.idFrom = 0x9E01; 
   notify.code = 0xFFFFFFFE; // NM_CLICK;  
   SendMessage(GetParent((HWND)hTreeView), 0x4E, 0x9E01, (long)&notify);
*/

In my case, the message processing function is bound to
hTreeView, and the message being processed is WM_NOTIFY,
here is the code for processing WM_NOTIFY:

0442D470    83EC 08         sub     esp, 8
0442D473    8B4424 10       mov     eax, [esp+10]
0442D477    53              push    ebx
0442D478    55              push    ebp
0442D479    56              push    esi
0442D47A    57              push    edi
0442D47B    8BF1            mov     esi, ecx; ESI=pTreeView
0442D47D    C700 00000000   mov     dword ptr [eax], 0
0442D483    C74424 20 00000>mov     dword ptr [esp+20], 0
0442D48B    E8 D8670200     call    <jmp.&MFC4.#CWnd::GetCurrentMessage_3021>; GetCurrentMessage() further calls GetMessagePos()
;[!] GetCurrentMessage() returns a MSG pointer in EAX
;EAX->hwnd=hTreeViewFather
;EAX->message=4Eh=WM_NOTIFY
;EAX->wParam=0xE901=hTreeView's ID
;EAX->lParam=pNMHDR
;       pNMHDR->hwndFrom=hTreeView, pNMHDR->idFrom=0xE901, pNMHDR->code=0xFFFFFFFE=NM_CLICK
;EAX->pt.x = screen coordinate x  \ They are not the same as those corresponding to my simulating 
;EAX->pt.y = screen coordinate y  / WM_LBUTTON message.

0442D490    8BC8            mov     ecx, eax
0442D492    8D5424 10       lea     edx, [esp+10]
0442D496    52              push    edx
0442D497    8B41 14         mov     eax, [ecx+14]; EAX=pt.x
0442D49A    8B49 18         mov     ecx, [ecx+18]; ECX=pt.y
0442D49D    894424 14       mov     [esp+14], eax
0442D4A1    8B46 20         mov     eax, [esi+20]; EAX=hTreeView
0442D4A4    894C24 18       mov     [esp+18], ecx
0442D4A8    50              push    eax
0442D4A9    FF15 F4E24604   call    [<&USER32.ScreenToClient>]                  ; user32.ScreenToClient
;[!]
;EDX->x=client coordinate x
;EDX->y=client coordinate y
0442D4AF    8B5424 14       mov     edx, [esp+14]
0442D4B3    8B4424 10       mov     eax, [esp+10]
0442D4B7    8D4C24 20       lea     ecx, [esp+20]
0442D4BB    51              push    ecx
0442D4BC    52              push    edx
0442D4BD    50              push    eax
0442D4BE    8BCE            mov     ecx, esi
0442D4C0    E8 9D670200     call    <jmp.&MFC42.#CTreeCtrl::HitTest_3914>
;[!] EAX=NULL, that's bad!
0442D4C5    8BF8            mov     edi, eax                                    ; EDI=hMenuItem
0442D4C7    85FF            test    edi, edi
0442D4C9    0F84 AE000000   je      0442D57D
......
0442D57D    5F              pop     edi                                         ; 05B0D428
0442D57E    5E              pop     esi
0442D57F    5D              pop     ebp
0442D580    5B              pop     ebx
0442D581    83C4 08         add     esp, 8
0442D584    C2 0800         retn    8

So, is there any difference between WM_LBUTTON and WM_NOTIFY?