CoCreateInstanceEx CLSCTX_REMOTE_SERVER远程创建对象

using System;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;

namespace TaskSchedulerApp
{
    [Flags]
    public enum CLSCTX : uint
    {
        CLSCTX_INPROC_SERVER = 0x1,
        CLSCTX_INPROC_HANDLER = 0x2,
        CLSCTX_LOCAL_SERVER = 0x4,
        CLSCTX_INPROC_SERVER16 = 0x8,
        CLSCTX_REMOTE_SERVER = 0x10,
        CLSCTX_INPROC_HANDLER16 = 0x20,
        CLSCTX_RESERVED1 = 0x40,
        CLSCTX_RESERVED2 = 0x80,
        CLSCTX_RESERVED3 = 0x100,
        CLSCTX_RESERVED4 = 0x200,
        CLSCTX_NO_CODE_DOWNLOAD = 0x400,
        CLSCTX_RESERVED5 = 0x800,
        CLSCTX_NO_CUSTOM_MARSHAL = 0x1000,
        CLSCTX_ENABLE_CODE_DOWNLOAD = 0x2000,
        CLSCTX_NO_FAILURE_LOG = 0x4000,
        CLSCTX_DISABLE_AAA = 0x8000,
        CLSCTX_ENABLE_AAA = 0x10000,
        CLSCTX_FROM_DEFAULT_CONTEXT = 0x20000,
        CLSCTX_ACTIVATE_X86_SERVER = 0x40000,
        CLSCTX_ACTIVATE_32_BIT_SERVER = CLSCTX_ACTIVATE_X86_SERVER,
        CLSCTX_ACTIVATE_64_BIT_SERVER = 0x80000,
        CLSCTX_ENABLE_CLOAKING = 0x100000,
        CLSCTX_APPCONTAINER = 0x400000,
        CLSCTX_ACTIVATE_AAA_AS_IU = 0x800000,
        CLSCTX_RESERVED6 = 0x1000000,
        CLSCTX_ACTIVATE_ARM32_SERVER = 0x2000000

    }

    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
    internal struct COAUTHINFO
    {
        public uint dwAuthnSvc;
        public uint dwAuthzSvc;
        public IntPtr pwszServerPrincName;
        public uint dwAuthnLevel;
        public uint dwImpersonationLevel;
        public IntPtr pAuthIdentityData;
        public uint dwCapabilities;
    }
    internal struct COAUTHIDENTITY
    {
        public IntPtr User;
        public uint UserLength;
        public IntPtr Domain;
        public uint DomainLength;
        public IntPtr Password;
        public uint PasswordLength;
        public uint Flags;
    }
    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
    internal struct COSERVERINFO
    {
        public uint dwReserved1;
        [MarshalAs(UnmanagedType.LPWStr)] public string pwszName;
        public IntPtr pAuthInfo;
        public uint dwReserved2;
    };

    [ComImport, Guid("9C86F320-DEE3-4DD1-B972-A303F26B061E"), InterfaceType(ComInterfaceType.InterfaceIsDual), System.Security.SuppressUnmanagedCodeSecurity, DefaultMember("Path")]
    internal interface IRegisteredTask
    {
        string Name { [return: MarshalAs(UnmanagedType.BStr)] get; }
        string Path { [return: MarshalAs(UnmanagedType.BStr)] get; }
        uint State { get; }
        bool Enabled { get; set; }
        [return: MarshalAs(UnmanagedType.Interface)]
        object Run([In, MarshalAs(UnmanagedType.Struct)] object parameters);
        [return: MarshalAs(UnmanagedType.Interface)]
        object RunEx([In, MarshalAs(UnmanagedType.Struct)] object parameters, [In] int flags, [In] int sessionID, [In, MarshalAs(UnmanagedType.BStr)] string user);
        [return: MarshalAs(UnmanagedType.Interface)]
        object GetInstances(int flags);
        DateTime LastRunTime { get; }
        int LastTaskResult { get; }
        int NumberOfMissedRuns { get; }
        DateTime NextRunTime { get; }
        object Definition { [return: MarshalAs(UnmanagedType.Interface)] get; }
        string Xml { [return: MarshalAs(UnmanagedType.BStr)] get; }
        [return: MarshalAs(UnmanagedType.BStr)]
        string GetSecurityDescriptor(int securityInformation);
        void SetSecurityDescriptor([In, MarshalAs(UnmanagedType.BStr)] string sddl, [In] int flags);
        void Stop(int flags);
    }

    [ComImport, Guid("8CFAC062-A080-4C15-9A88-AA7C2AF80DFC"), InterfaceType(ComInterfaceType.InterfaceIsDual), System.Security.SuppressUnmanagedCodeSecurity, DefaultMember("Path")]
    internal interface ITaskFolder
    {
        string Name { [return: MarshalAs(UnmanagedType.BStr)] get; }
        string Path { [return: MarshalAs(UnmanagedType.BStr)] get; }
        [return: MarshalAs(UnmanagedType.Interface)]
        ITaskFolder GetFolder([MarshalAs(UnmanagedType.BStr)] string Path);
        [return: MarshalAs(UnmanagedType.Interface)]
        object GetFolders(int flags);
        [return: MarshalAs(UnmanagedType.Interface)]
        ITaskFolder CreateFolder();
        void DeleteFolder();
        [return: MarshalAs(UnmanagedType.Interface)]
        IRegisteredTask GetTask();
        [return: MarshalAs(UnmanagedType.Interface)]
        object GetTasks(int flags);
        void DeleteTask();
        [return: MarshalAs(UnmanagedType.Interface)]
        IRegisteredTask RegisterTask([In, MarshalAs(UnmanagedType.BStr)] string Path, [In, MarshalAs(UnmanagedType.BStr)] string XmlText, [In] int flags, [In, MarshalAs(UnmanagedType.Struct)] object UserId, [In, MarshalAs(UnmanagedType.Struct)] object password, [In] int LogonType, [In, Optional, MarshalAs(UnmanagedType.Struct)] object sddl);
        [return: MarshalAs(UnmanagedType.Interface)]
        IRegisteredTask RegisterTaskDefinition();
        [return: MarshalAs(UnmanagedType.BStr)]
        string GetSecurityDescriptor(int securityInformation);
        void SetSecurityDescriptor([In, MarshalAs(UnmanagedType.BStr)] string sddl, [In] int flags);
    }
    [ComImport, DefaultMember("TargetServer"), Guid("2FABA4C7-4DA9-4013-9697-20CC3FD40F85"), System.Security.SuppressUnmanagedCodeSecurity]
    internal interface ITaskService
    {
        [return: MarshalAs(UnmanagedType.Interface)]
        [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(1)]
        ITaskFolder GetFolder([In, MarshalAs(UnmanagedType.BStr)] string Path);
        [return: MarshalAs(UnmanagedType.Interface)]
        [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(2)]
        object GetRunningTasks(int flags);
        [return: MarshalAs(UnmanagedType.Interface)]
        [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(3)]
        object NewTask([In] uint flags);
        [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(4)]
        void Connect([In, Optional, MarshalAs(UnmanagedType.Struct)] object serverName, [In, Optional, MarshalAs(UnmanagedType.Struct)] object user, [In, Optional, MarshalAs(UnmanagedType.Struct)] object domain, [In, Optional, MarshalAs(UnmanagedType.Struct)] object password);
        [DispId(5)]
        bool Connected { [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(5)] get; }
        [DispId(0)]
        string TargetServer { [return: MarshalAs(UnmanagedType.BStr)] [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(0)] get; }
        [DispId(6)]
        string ConnectedUser { [return: MarshalAs(UnmanagedType.BStr)] [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(6)] get; }
        [DispId(7)]
        string ConnectedDomain { [return: MarshalAs(UnmanagedType.BStr)] [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(7)] get; }
        [DispId(8)]
        uint HighestVersion { [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime), DispId(8)] get; }
    }
    [System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Sequential)]
    public struct MULTI_QI
    {
        public IntPtr pIID;
        [System.Runtime.InteropServices.MarshalAs(System.Runtime.InteropServices.UnmanagedType.Interface)]
        public object pItf;
        public int hr;
    }



    class Program
    {
        public static IntPtr IID_IUnknownPtr = GuidToPointer("00000000-0000-0000-C000-000000000046");

        public static IntPtr GuidToPointer(string guid)
        {
            Guid g = new Guid(guid);

            IntPtr ret = System.Runtime.InteropServices.Marshal.AllocCoTaskMem(16);
            System.Runtime.InteropServices.Marshal.Copy(g.ToByteArray(), 0, ret, 16);

            return ret;
        }
        [DllImport("ole32.dll")]
        private static extern int CoCreateInstance(
            [In] ref Guid rclsid,
            [In, MarshalAs(UnmanagedType.IUnknown)] object pUnkOuter,
            [In] uint dwClsContext,
            [In] ref Guid riid,
            [Out, MarshalAs(UnmanagedType.Interface)] out object ppv);
        [DllImport("ole32.dll")]
        private static extern void CoCreateInstanceEx(
            ref Guid clsid,
            [MarshalAs(UnmanagedType.IUnknown)] object punkOuter,
            uint dwClsCtx,
            [In] ref COSERVERINFO pServerInfo,
            uint dwCount,
            [In, Out] MULTI_QI[] pResults);


        static void Main(string[] args)
        {
            string str2 = "yourname";
            string str3 = "pwd";
            string str4 = ".";


            GCHandle handle = GCHandle.Alloc(str2, GCHandleType.Pinned);
            GCHandle handle2 = GCHandle.Alloc(str3, GCHandleType.Pinned);
            GCHandle handle3 = GCHandle.Alloc(str4, GCHandleType.Pinned);
            COAUTHIDENTITY coauthidentity = new COAUTHIDENTITY
            {
                User = handle.AddrOfPinnedObject(),
                UserLength = (str2 != null) ? ((uint)str2.Length) : 0,
                Password = handle2.AddrOfPinnedObject(),
                PasswordLength = (str3 != null) ? ((uint)str3.Length) : 0,
                Domain = handle3.AddrOfPinnedObject(),
                DomainLength = (str4 != null) ? ((uint)str4.Length) : 0,
                Flags = 2
            };
            GCHandle handle4 = GCHandle.Alloc(coauthidentity, GCHandleType.Pinned);
            COAUTHINFO coauthinfo = new COAUTHINFO
            {
                dwAuthnSvc = 10,
                dwAuthzSvc = 0,
                pwszServerPrincName = IntPtr.Zero,
                dwAuthnLevel = 2,
                dwImpersonationLevel = 3,
                pAuthIdentityData = handle4.IsAllocated ? handle4.AddrOfPinnedObject() : IntPtr.Zero,
                dwCapabilities = 0
            };
            GCHandle handle5 = GCHandle.Alloc(coauthinfo, GCHandleType.Pinned);


            MULTI_QI[] mqi = new MULTI_QI[1];
            mqi[0].pIID = IID_IUnknownPtr;

            COSERVERINFO info = new COSERVERINFO();
            info.pwszName = "172.22.159.64";
            info.dwReserved1 = 0;
            info.dwReserved2 = 0;
            info.pAuthInfo =  handle5.AddrOfPinnedObject();
           // Guid rclsid = new Guid("{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}");
            Guid rclsid = new Guid("{72566E27-1ABB-4EB3-B4F0-EB431CB1CB32}");
            CoCreateInstanceEx(ref rclsid, null, (uint)CLSCTX.CLSCTX_REMOTE_SERVER, ref info, 1, mqi);
            var svc = mqi[0].pItf ;

            Console.WriteLine(mqi[0].hr.ToString("x"));

            if (mqi[0].hr != 0)
            {
                throw Marshal.GetExceptionForHR(mqi[0].hr);
            }
            Console.WriteLine(svc);
        }
    }
}