diff --git a/23_day/Makefile b/23_day/Makefile
index 0c48339..6314477 100644
--- a/23_day/Makefile
+++ b/23_day/Makefile
@@ -106,9 +106,16 @@ winhelo2.bim : winhelo2.obj a_nask.obj Makefile
 winhelo2.hrb : winhelo2.bim Makefile
 	$(BIM2HRB) winhelo2.bim winhelo2.hrb 0
 
+winhelo3.bim : winhelo3.obj a_nask.obj Makefile
+	$(OBJ2BIM) @$(RULEFILE) out:winhelo3.bim stack:1k map:winhelo3.map \
+		winhelo3.obj a_nask.obj
+
+winhelo3.hrb : winhelo3.bim Makefile
+	$(BIM2HRB) winhelo3.bim winhelo3.hrb 40k
+
 haribote.img : ipl10.bin haribote.sys Makefile \
 		hello.hrb hello2.hrb a.hrb hello3.hrb hello4.hrb hello5.hrb \
-		winhelo.hrb winhelo2.hrb
+		winhelo.hrb winhelo2.hrb winhelo3.hrb
 	$(EDIMG)   imgin:../z_tools/fdimg0at.tek \
 		wbinimg src:ipl10.bin len:512 from:0 to:0 \
 		copy from:haribote.sys to:@: \
@@ -122,8 +129,9 @@ haribote.img : ipl10.bin haribote.sys Makefile \
 		copy from:hello5.hrb to:@: \
 		copy from:winhelo.hrb to:@: \
 		copy from:winhelo2.hrb to:@: \
+		copy from:winhelo3.hrb to:@: \
 		imgout:haribote.img
-
+		
 # 其他指令
 
 %.gas : %.c bootpack.h Makefile
diff --git a/23_day/a_nask.nas b/23_day/a_nask.nas
index 66b7bd9..63ed27b 100644
--- a/23_day/a_nask.nas
+++ b/23_day/a_nask.nas
@@ -9,6 +9,9 @@
 		GLOBAL	_api_openwin
 		GLOBAL	_api_putstrwin
 		GLOBAL	_api_boxfilwin
+		GLOBAL	_api_initmalloc
+		GLOBAL	_api_malloc
+		GLOBAL	_api_free
 
 [SECTION .text]
 
@@ -83,3 +86,35 @@ _api_boxfilwin:	; void api_boxfilwin(int win, int x0, int y0, int x1, int y1, in
 		POP		ESI
 		POP		EDI
 		RET
+
+_api_initmalloc:	; void api_initmalloc(void);
+		PUSH	EBX
+		MOV		EDX,8
+		MOV		EBX,[CS:0x0020]		; malloc内存空间的地址
+		MOV		EAX,EBX
+		ADD		EAX,32*1024				; 加上32KB
+		MOV		ECX,[CS:0x0000]		; 数据段的大小
+		SUB		ECX,EAX
+		INT		0x40
+		POP		EBX
+		RET
+
+_api_malloc:		; char *api_malloc(int size);
+		PUSH	EBX
+		MOV		EDX,9
+		MOV		EBX,[CS:0x0020]
+		MOV		ECX,[ESP+8]			; size
+		INT		0x40
+		POP		EBX
+		RET
+
+_api_free:			; void api_free(char *addr, int size);
+		PUSH	EBX
+		MOV		EDX,10
+		MOV		EBX,[CS:0x0020]
+		MOV		EAX,[ESP+ 8]		; addr
+		MOV		ECX,[ESP+12]		; size
+		INT		0x40
+		POP		EBX
+		RET
+		
\ No newline at end of file
diff --git a/23_day/console.c b/23_day/console.c
index b2ff811..ff80a71 100644
--- a/23_day/console.c
+++ b/23_day/console.c
@@ -344,6 +344,16 @@ int *hrb_api(int edi, int esi, int ebp, int esp, int ebx, int edx, int ecx, int
 		sht = (struct SHEET *) ebx;
 		boxfill8(sht->buf, sht->bxsize, ebp, eax, ecx, esi, edi);
 		sheet_refresh(sht, eax, ecx, esi + 1, edi + 1);
+	} else if (edx == 8) {
+		memman_init((struct MEMMAN *) (ebx + ds_base));
+		ecx &= 0xfffffff0; /*以16字节为单位*/
+		memman_free((struct MEMMAN *) (ebx + ds_base), eax, ecx);
+	} else if (edx == 9) {
+		ecx = (ecx + 0x0f) & 0xfffffff0; /*以16字节为单位进位取整*/
+		reg[7] = memman_alloc((struct MEMMAN *) (ebx + ds_base), ecx);
+	} else if (edx == 10) {
+		ecx = (ecx + 0x0f) & 0xfffffff0; /*以16字节为单位进位取整*/
+		memman_free((struct MEMMAN *) (ebx + ds_base), eax, ecx);
 	}
 	return 0;
 }
diff --git a/23_day/winhelo3.c b/23_day/winhelo3.c
new file mode 100644
index 0000000..527ec01
--- /dev/null
+++ b/23_day/winhelo3.c
@@ -0,0 +1,19 @@
+int api_openwin(char *buf, int xsiz, int ysiz, int col_inv, char *title);
+void api_putstrwin(int win, int x, int y, int col, int len, char *str);
+void api_boxfilwin(int win, int x0, int y0, int x1, int y1, int col);
+void api_initmalloc(void);
+char *api_malloc(int size);
+void api_end(void);
+
+void HariMain(void)
+{
+	char *buf;
+	int win;
+
+	api_initmalloc();
+	buf = api_malloc(150 * 50);
+	win = api_openwin(buf, 150, 50, -1, "hello");
+	api_boxfilwin(win,  8, 36, 141, 43, 6); /*浅蓝色*/
+	api_putstrwin(win, 28, 28, 0 , 12, "hello, world");/*黑色*/
+	api_end();
+}
\ No newline at end of file