背景

最近写了一份遍历clsid所有接口的代码（链接点这里），在查找有意思的包含exe方法的时候发现了mmc20，且接口是6efc2da2-b38c-457e-9abb-ed2d189b8c38。

但常见的使用mmc20都是用的vbs和powershell来创建的进程，这里提供c/c++的实现。

#include<iostream>
#include<Windows.h>
#include<comdef.h>
#include<rpcdce.h>

#pragma comment(lib, "Rpcrt4.lib")
using namespace std;

void MMC20ExeDemo2()
{
	CLSID clsidshell;
	LPDISPATCH lpDisp;
	HRESULT hres = E_FAIL;
	hres = CoInitializeEx(0, COINIT_MULTITHREADED);
	hres = CLSIDFromString(L"{49b2791a-b1ae-4c90-9b8e-e860ba07f889}", &clsidshell);
	if (FAILED(hres))
	{
		printf("CLSIDFromProgID or CLSIDFromString failed %x \n", hres);
		CoUninitialize();
		return ;
	}

	hres = CoCreateInstance(clsidshell, NULL, CLSCTX_LOCAL_SERVER, IID_IDispatch, (LPVOID*)& lpDisp);
	if (FAILED(hres))
	{
		printf("CoCreateInstance failed %x \n", hres);
		CoUninitialize();
		return ;
	}

	LPOLESTR pFuncName = (LPOLESTR)L"Document";
	DISPID Run;
	hres = lpDisp->GetIDsOfNames(IID_NULL, &pFuncName, 1, LOCALE_SYSTEM_DEFAULT, &Run);
	if (FAILED(hres))
	{
		printf("GetIDsOfNames failed %x \n", hres);
		lpDisp->Release();
		CoUninitialize();
		return;
	}

	DISPPARAMS disParams = { NULL, NULL, 0, 0 };
	VARIANT pVarResult;
	hres = lpDisp->Invoke(Run, IID_NULL, LOCALE_SYSTEM_DEFAULT, DISPATCH_PROPERTYGET, &disParams, &pVarResult, NULL, NULL);
	if (FAILED(hres))
		printf("Invoke failed %x \n", hres);

	if (pVarResult.vt == VT_DISPATCH)
	{
		LPDISPATCH lpDisp2 = pVarResult.pdispVal;

		LPOLESTR pFuncName = (LPOLESTR)L"ActiveView";
		DISPID Run;
		hres = lpDisp2->GetIDsOfNames(IID_NULL, &pFuncName, 1, LOCALE_SYSTEM_DEFAULT, &Run);
		if (FAILED(hres))
		{
			printf("lpDisp2->GetIDsOfNames failed %x \n", hres);
		}

		DISPPARAMS disParams2 = { NULL, NULL, 0, 0 };
		VARIANT pVarResult2;
		hres = lpDisp2->Invoke(Run, IID_NULL, LOCALE_SYSTEM_DEFAULT, DISPATCH_PROPERTYGET, &disParams2, &pVarResult2, NULL, NULL);
		if (FAILED(hres))
			printf("lpDisp2->Invoke failed %x \n", hres);
		if (pVarResult2.vt == VT_DISPATCH)
		{
			LPDISPATCH lpDisp3 = pVarResult2.pdispVal;

			LPOLESTR pFuncName = (LPOLESTR)L"Executeshellcommand";
			DISPID Run;
			hres = lpDisp3->GetIDsOfNames(IID_NULL, &pFuncName, 1, LOCALE_SYSTEM_DEFAULT, &Run);
			if (FAILED(hres))
			{
				printf("lpDisp3->GetIDsOfNames failed %x \n", hres);
			}

			VARIANTARG V[4];
			V[0].vt = VT_BSTR;
			V[0].bstrVal = _bstr_t(L"");
			V[1].vt = VT_BSTR;
			V[1].bstrVal = _bstr_t(L"");
			V[2].vt = VT_BSTR;
			V[2].bstrVal = _bstr_t(L"");
			V[3].vt = VT_BSTR;
			V[3].bstrVal = _bstr_t(L"calc.exe");  
			DISPPARAMS disParams3 = { V, NULL, 4, 0 };
			VARIANT pVarResult3;
			hres = lpDisp3->Invoke(Run, IID_NULL, LOCALE_SYSTEM_DEFAULT, DISPATCH_METHOD, &disParams3, &pVarResult3, NULL, NULL);
			if (FAILED(hres))
				printf("lpDisp3->Invoke failed %x \n", hres);
		}
	}
	
	lpDisp->Release();
	CoUninitialize();
	return ;
}

int main()
{
	MMC20ExeDemo2();
	system("pause");
	return TRUE;
}