C / C++ / MFC

DDDElements::DDDDocument* pDocument = new DDDElements::DDDDocument();

DDDDocument::DDDDocument(void) : CLRObject(NULL, NULL, NULL)
{
	clr = new CLR();
	clra = new CLRAssembly(clr, L"DDD");
 	vtCLRObject = clra->CreateInstance(THISDOTNETTYPE());
}

CLR::CLR(void)
{
	this->pszVersion = L"v4.0.30319";
	this->init();
}

void CLR::init() {
	HRESULT hr;

	BOOL bLoadable = false;
	IUnknownPtr spAppDomainThunk = NULL;
	
    hr = CLRCreateInstance(CLSID_CLRMetaHost, IID_ICLRMetaHost, (LPVOID *)&lpMetaHost);
	if(FAILED(hr)) throw "CLR instance could not be created!";

    hr = lpMetaHost->GetRuntime(pszVersion, IID_ICLRRuntimeInfo, (LPVOID *)&lpRuntimeInfo);    
	if(FAILED(hr)) throw "Failed getting the reference to CLR interface!";

	hr = lpRuntimeInfo->IsLoadable(&bLoadable);
	if(FAILED(hr)) throw "Failed loading the CLR!";
	if(!bLoadable) throw "CLR is not loadable!";

	hr = lpRuntimeInfo->GetInterface(CLSID_CorRuntimeHost, IID_PPV_ARGS(&lpRuntimeHost));
	if(FAILED(hr)) throw "Failed loading the CLR!";

    hr = lpRuntimeHost->Start();
	if(FAILED(hr)) throw "Failed starting the CLR!";	

	hr = lpRuntimeHost->GetDefaultDomain(&spAppDomainThunk);
	if (FAILED(hr)) throw "Failed to get CLR default appdomain!";

	hr = spAppDomainThunk->QueryInterface(IID_PPV_ARGS(&spAppDomain));
	if (FAILED(hr)) throw "Failed to get CLR default appdomain!";
}

CLRAssembly::CLRAssembly(CLR* clr, PCWSTR pszAssemblyName)
{
	HRESULT hr;
	bstr_t bstrAssemblyName(pszAssemblyName);	

	this->clr = clr;
	hr = clr->GetAppDomain()->Load_2(bstrAssemblyName, &spAssembly);
	if(FAILED(hr)) throw "Loading of assembly failed.";
}

_TypePtr DDDDocument::THISDOTNETTYPE() 
{
	return clra->BuildType(L"DDD.DDDDocument");
}

_TypePtr CLRAssembly::BuildType(PCWSTR pszClassName) 
{
	HRESULT hr = NULL;
	bstr_t bstrClassName(pszClassName);	
	_TypePtr spType = NULL;

	hr = spAssembly->GetType_2(bstrClassName, &spType);
	if(FAILED(hr)) throw "Failed to get typereferece.";

	return spType;
}

_variant_t CLRAssembly::CreateInstance(_TypePtr spType) 
{
	SAFEARRAY* psaMethodArgs = NULL;
	psaMethodArgs = SafeArrayCreateVector(VT_VARIANT, 0, 0);
	return this->CreateInstance(spType, psaMethodArgs);
}

_variant_t CLRAssembly::CreateInstance(_TypePtr spType, SAFEARRAY* psaMethodArgs) 
{
	HRESULT hr;
	_variant_t vtResult= NULL;
	_variant_t vtEmpty;

	if(psaMethodArgs == NULL) psaMethodArgs = SafeArrayCreateVector(VT_VARIANT, 0, 0);

    hr = spType->InvokeMember_3(NULL, static_cast<BindingFlags>(
        BindingFlags_CreateInstance | BindingFlags_Instance | BindingFlags_Public),
        NULL, vtEmpty, psaMethodArgs, &vtResult);
	if(FAILED(hr)) throw "Failed to create Instance.";

	return vtResult;
}

#pragma comment (lib,"WtsApi32.lib")
#pragma comment (lib,"UserEnv.lib")

#include <iostream>
#include <Windows.h>
#include <WinSvc.h>
#include <WtsApi32.h>
#include <UserEnv.h>
#include <TlHelp32.h>

//CUSTOM MESSAGE FOR SERVICE TO LAUNCH AN APP INTO SESSION 1
#define SERVICE_CONTROL_CUSTOM_MESSAGE 0x095

//ADD CUSTOM METHOD TO LAUNCH
BOOL LaunchAppIntoDifferentSession(LPWSTR appName, LPPROCESS_INFORMATION pi);

SERVICE_STATUS				m_ServiceStatus;
SERVICE_STATUS_HANDLE		m_ServiceStatusHandle;

BOOL bRunning				=TRUE;

VOID WINAPI ServiceControlHandler(DWORD Opcode);


using namespace std;


VOID WINAPI ServiceControlHandler(DWORD Opcode)
{
	PROCESS_INFORMATION pi;
	LPWSTR appName = L"cmd.exe";
	switch(Opcode)
	{
	case SERVICE_CONTROL_CUSTOM_MESSAGE:
		LaunchAppIntoDifferentSession(appName, &pi);
		break;
	case SERVICE_CONTROL_PAUSE:
		m_ServiceStatus.dwCurrentState	= SERVICE_PAUSED;
		break;
	case SERVICE_CONTROL_CONTINUE:
		m_ServiceStatus.dwCurrentState	= SERVICE_RUNNING;
		break;
	case SERVICE_CONTROL_STOP:
		m_ServiceStatus.dwWin32ExitCode	= 0;
		m_ServiceStatus.dwCurrentState	= SERVICE_STOPPED;
		m_ServiceStatus.dwCheckPoint	= 0;
		m_ServiceStatus.dwWaitHint		= 0;

		SetServiceStatus(m_ServiceStatusHandle, &m_ServiceStatus);
		bRunning = FALSE;
		break;
	case SERVICE_CONTROL_INTERROGATE:
		break;
	return;
}

BOOL LaunchAppIntoDifferentSession(LPWSTR appName,LPPROCESS_INFORMATION pi)
{
	//PROCESS_INFORMATION pi;
	STARTUPINFO si;
	BOOL bResult = FALSE;
	DWORD dwSessionID = 0, winLogonPid = 0, winLogonSessionID = 0, dwCreationFlags;
	HANDLE hUserTokenDup, hPToken, hProcess;

	dwSessionID = WTSGetActiveConsoleSessionId();

	PROCESSENTRY32 procEntry;

	HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
	if (hSnap == INVALID_HANDLE_VALUE)return 1;

	procEntry.dwSize = sizeof(PROCESSENTRY32);

	if (!Process32First(hSnap, &procEntry)) return 1;

	do 
	{
		if (wcscmp(procEntry.szExeFile,L"winlogon.exe") == 0)
		{
			ProcessIdToSessionId(procEntry.th32ProcessID, &winLogonSessionID);
			if (winLogonSessionID == dwSessionID)
			{
				winLogonPid = procEntry.th32ProcessID;
			}
		}
	} while (Process32Next(hSnap, &procEntry));

	hProcess = OpenProcess(MAXIMUM_ALLOWED,false,winLogonPid);

	if (!OpenProcessToken(hProcess,TOKEN_DUPLICATE,&hPToken))
	{
		CloseHandle(hProcess);
		return false;
	}

	if (!DuplicateTokenEx(hPToken,MAXIMUM_ALLOWED,NULL,SecurityIdentification,TokenPrimary,&hUserTokenDup))
	{
		CloseHandle(hProcess);
		CloseHandle(hPToken);
	}

	ZeroMemory(&si,sizeof(STARTUPINFO));
	si.cb = sizeof(STARTUPINFO);
	si.lpDesktop = L"winsta0\\default";

	dwCreationFlags = NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE;

	//bResult = CreateProcessAsUser(hUserTokenDup,NULL,L"cmd.exe",NULL,NULL,FALSE,dwCreationFlags,NULL,NULL,&si,&pi);
	bResult = CreateProcessAsUser(hUserTokenDup,NULL,appName,NULL,NULL,FALSE,dwCreationFlags,NULL,NULL,&si,pi);

	CloseHandle(hProcess);
	CloseHandle(hPToken);
	CloseHandle(hUserTokenDup);

	return bResult;
}