We Keep Coding

Issues with injection code

So after looking around online, and debugging the code I found out that there are issues with using CreateRemoteThread and CreateRemoteThreadEx on windows 8, 8.1, and 10 (The dll does not inject at all). The code works fine for anyone who is not using windows 8+. I was wondering if anyone could help me debug the code in order for it to work on the newer operating system, and if possible to provide a explanation to why it is not working. This is the first time I looked into c#, I mainly program in Java.
While I was following the stack I know that it is coming from InjectLibrary in Injector.cs
// load dll via call to LoadLibrary using CreateRemoteThread
hThread = Imports.CreateRemoteThread(_handle, IntPtr.Zero, 0, hLoadLib, pLibRemote, 0, IntPtr.Zero);
Program.cs:
using System;
using System.IO;
using System.Diagnostics;
using System.Net;
using System.Threading;
using System.Runtime.InteropServices;
using System.Windows.Forms;
using Syringe;
namespace GameLauncherEx
{
class Program
{
// Injector code by adaephon on ownedcore
// www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-bots-programs/wow-memory-editing/265219-c-net-dll-injector.html
static void Main(string[] args)
{
string ip = "127.0.0.1";
int maxTryCount = 5;
int waitWindowSleep = 1;
int failInjectSleep = 500;
string dll = "IPRedirect.dll";
string client = string.Format("{0}\\MapleStory.exe", Environment.CurrentDirectory);
if (!File.Exists(client))
{
MessageBox.Show("Couldn't find MapleStory.exe", "GameLauncherEx");
return;
}
if (!File.Exists(string.Format("{0}\\{1}", Environment.CurrentDirectory, dll)))
{
MessageBox.Show("Couldn't find IPRedirect.dll", "GameLauncherEx");
return;
}
IPAddress ipAddress;
if (args.Length >= 1 && IPAddress.TryParse(args[0], out ipAddress)) {
ip = args[0];
MessageBox.Show(args[0]);
}
using(Process process = Process.Start(client, "GameLaunching"))
{
while (process.MainWindowHandle == IntPtr.Zero && !process.HasExited)
Thread.Sleep(waitWindowSleep);
if (process.HasExited)
return;
for (int i = 0; i < maxTryCount; i++)
{
try
{
using (Injector injector = new Injector(process))
{
injector.EjectOnDispose = false;
injector.InjectLibrary(dll);
if (ip != IPAddress.Loopback.ToString())
injector.CallExport<IPInfo>(dll, "SetIP", new IPInfo(ip));
// Add any additional IPs you want maped here, you can also unmap them with UnMapIP if needed
//injector.CallExport<MapedIPInfo>(dll, "MapIP", new MapedIPInfo("RealGameIP", "YourServerIP"));
//injector.CallExport<MapedIPInfo>(dll, "UnMapIP", new MapedIPInfo("RealGameIP", "YourServerIP"));
return;
}
}
catch (Exception e)
{
Thread.Sleep(failInjectSleep);
MessageBox.Show(e.ToString());
}
}
}
MessageBox.Show("Failed to initialize GameLauncherEx");
}
[StructLayout(LayoutKind.Sequential)]
struct IPInfo
{
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 15)]
public string IP;
public IPInfo(string ip)
{
IP = ip;
}
}
[StructLayout(LayoutKind.Sequential)]
struct MapedIPInfo
{
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 15)]
public string DestIP;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 15)]
public string IP;
public MapedIPInfo(string destIP, string ip)
{
DestIP = destIP;
IP = ip;
}
}
}
}
Injector.cs:
http://pastebin.com/QUVXSTHC
Imports.cs
http://pastebin.com/L1CtWYfN
I seemed to have surpassed the character limit, so I posted the code on pastebin.

Format Exception Unhandled while debugging

When debugging the code, Visual Studio gives me a "format exception was unhandled" while highlighting this line of code: 'CustObj.d_CustDiscount = Convert.ToDecimal(gs_InPutBuffer.Substring(000, 004));'
I have been googling correct formats and have not come up with any fixes. So my main question is, how do I rewrite this code in order for it to work?
Thanks for any help!
Below is the full program if you need to reference it:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.IO;
using CustFile_DLL;
namespace FileConvertorPA03
{
class Program
{
//add these to handle I/O
//instatiate streamreader
private static StreamReader TextfileIn = new StreamReader("customers.txt");
//instantiate the dll
private static CustFileClass CustObj = new CustFileClass();
//a few vars
private static string gs_InPutBuffer = "";
private static Int32 gi_TotalRec = 0, gi_FirstRecNo = 0;
private static bool gb_FirstRec = true;
static void Main(string[] args)
{
while ((gs_InPutBuffer = TextfileIn.ReadLine()) != null)
{
ParsetoAttributes();
CustObj.AddObject();
}//end while
PopMessageBox();
TextfileIn.Close();
}//end main
//method to parse input buffer to class attributes
private static void ParsetoAttributes()
{
CustObj.s_CustName = gs_InPutBuffer.Substring(000, 033).Trim();
CustObj.s_CustAddress = gs_InPutBuffer.Substring(033, 032).Trim();
CustObj.s_CustZip = gs_InPutBuffer.Substring(065, 005);
CustObj.s_CustPhone = gs_InPutBuffer.Substring(070, 010);
CustObj.d_CustDiscount = Convert.ToDecimal(gs_InPutBuffer.Substring(000, 004));
}//end parse attributes
//method to count records added
static void CountRecs()
{
if (gb_FirstRec == true)
{
gi_FirstRecNo = CustObj.i_CustNumber;
gb_FirstRec = false;
}//end if
gi_TotalRec++;
}//end count recs
public static void PopMessageBox()
{
MessageBox.Show(String.Format("Message: \n\tRecords Added \t{0,6}n\tFirst Rec Added\t {1,6}\n\tLast Rec Added\t{2,6}",
gi_TotalRec, gi_FirstRecNo, CustObj.i_CustNumber),"File Conversion Message:",
MessageBoxButtons.OK, MessageBoxIcon.Information);
}//end class
}
}//end namespace

Replace the ToDecimal call with the following to find out what the issue is:
try
{
CustObj.d_CustDiscount = Convert.ToDecimal(gs_InPutBuffer.Substring(0, 4));
}
catch (FormatException e)
{
Console.WriteLine(gs_InPutBuffer.Substring(0, 4));
Console.WriteLine(e.Message);
}
If this isn't a console application, you can change the code in the catch block to write out to a MessageBox. You can also leave out the leading zeros in the arguments to the calls to Substring.

C# windows service issues

I wrote a C# app which takes screenshot every 5 mins a saves it to server. It is timer, 2 threads, few methods(ping srv, check folder, take screenshot etc.).
As process (exe) it runs great, but I need to install it as service. I am installing it trough installutil (Framework service installer).
My problem is, that when it is installed as service, it doesn't take screenshots. Pull out some, when stopping the service. Not the right resolution and black.
I assume, that the executive code is misplaced (see main). I don't know where to put it, since I cannot have more than one main method. Please help.
Code of main application:
I've deleted some not important code.
using System;
using System.Threading;
using System.Collections.Generic;
using System.Linq;
using System.ServiceProcess;
using System.Text;
using System.Drawing;
using System.Drawing.Imaging;
using System.Windows.Forms;
//using System.Timers;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Net.NetworkInformation;
using System.ComponentModel;
using System.Configuration.Install;
namespace LogWriterService
{
static class Program
{
public static int TimeO = 5; // zpoždění časovače v minutách
private static bool Online;
private static bool active = false;
public static String GetIP()
{
// ...
// returns IP like xxx.xxx.xxx.xxx
// ...
}
// Test dostupnosti serveru
public static bool PingTest()
{
// ...
// return true if server is reachable
// ...
}
/*
* Z Windows.Forms _ screenů získá obrazová data, která uloží na
* server jako ../[IP]/[současný_systémový_čas].jpg
*/
public static void ScreenShot() //Bitmap
{
Int64 CurrTime = Int64.Parse(DateTime.Now.ToString("yyyyMMddhhmmss")); //yyyyMMddhhmmss
Rectangle bounds = Rectangle.Empty;
foreach (Screen s in Screen.AllScreens)
bounds = Rectangle.Union(bounds, s.Bounds);
Bitmap screenShotBMP = new Bitmap(bounds.Width, bounds.Height, PixelFormat.Format32bppArgb); // PixelFormat.Format32bppArgb
Graphics screenShotGraphics = Graphics.FromImage(screenShotBMP);
screenShotGraphics.CopyFromScreen(bounds.X, bounds.Y,
0, 0, bounds.Size, CopyPixelOperation.SourceCopy);
string path = null; //"D:/TEMP/" + CurrTime + ".jpg"; // GetIP()
// Ukládání obrázků do dočasné složky a přesun, pokud se připojí
if (PingTest() == true)
{
path = "//10.0.0.10/Upload/screen/test/" + GetIP() + "/" + CurrTime + ".jpg";
string path2 = "//10.0.0.10/Upload/screen/test/" + GetIP() + "/";
Online = true;
if (Directory.Exists(path2))
{
MoveCached();
}
else
{
Console.WriteLine("Online slozka neni dostupna.");
}
} else {
Console.WriteLine("Caching .. ");
path = "C:/TEMP/" + CurrTime + ".jpg"; // "C:/TEMP/" + GetIP() + "/" + CurrTime + ".jpg"
string LPath = #"c:\TEMP";
if (!Directory.Exists(LPath))
{
DirectoryInfo di = Directory.CreateDirectory(LPath);
di.Attributes = FileAttributes.Directory | FileAttributes.Hidden;
Console.WriteLine("Lokalni slozka neexistuje. Vytvarim ..");
}
Online = false;
}
screenShotBMP.Save(path, ImageFormat.Jpeg); // C:\\test\\test.jpg
screenShotGraphics.Dispose();
screenShotBMP.Dispose();
return; //screenShotBMP;
}
/*
* Přesune cache soubory (za dobu offline) na server
*/
public static void MoveCached()
{
// ...
// after conect, move localy saved screenshots to server
// ...
}
/// <summary>
/// The main entry point for the application.
/// </summary>
static void Main()
{
ServiceBase[] ServicesToRun;
ServicesToRun = new ServiceBase[]
{
new Service1()
};
ServiceBase.Run(ServicesToRun);
// Vytvoří událost signalizující hranici odpočtu ve
// zpětném volání časovače
AutoResetEvent autoEvent = new AutoResetEvent(false);
// Počet průchodů timeru
StatusChecker statusChecker = new StatusChecker(Timeout.Infinite); // 1440
// Vytvoří odvozeného delegáta, který vyvolá metody pro časovač
TimerCallback tcb = statusChecker.CheckStatus;
// Create a timer that signals the delegate to invoke
// CheckStatus after one second, and every 1/4 second
// thereafter.
System.Threading.Timer stateTimer = new System.Threading.Timer(tcb, autoEvent, 1000, TimeO * 1000); // TimeO * 1000 * 60 * 12 * 5, 250
// When autoEvent signals, change the period to every
// 1/2 second.
autoEvent.WaitOne(15000, false);
stateTimer.Change(0, TimeO * 1000 * 60); // TimeO * 1000 * 60
Console.WriteLine("menim poprve..");
// When autoEvent signals the second time, dispose of
// the timer.
autoEvent.WaitOne(Timeout.Infinite, false);
stateTimer.Change(0, TimeO * 1000 * 60); // TimeO * 1000 * 60
Console.WriteLine("menim podruhe..");
//stateTimer.Dispose();
// Garbage collector
GC.Collect();
GC.WaitForPendingFinalizers();
}
}
}
class StatusChecker
{
private int invokeCount;
private int maxCount;
Int64 CurrTime = Int64.Parse(DateTime.Now.ToString("hh")); // screeny od 6:00 do 16:00
public StatusChecker(int count)
{
invokeCount = 0;
maxCount = count;
}
// Tato metoda je volána delegátem časovače
public void CheckStatus(Object stateInfo)
{
AutoResetEvent autoEvent = (AutoResetEvent)stateInfo;
//if ((CurrTime > 6) & (CurrTime < 16)) // 16
//{
LogWriterService.Program.ScreenShot();
Console.WriteLine("ScreenShot ..");
//}
Console.WriteLine("{0} Kontroluji stav {1,2}.",
DateTime.Now.ToString("h:mm:ss.fff"),
(++invokeCount).ToString());
if (invokeCount == maxCount)
{
// Resetuje čítač a signál Main.
invokeCount = 0;
autoEvent.Set();
}
// Garbage collector
GC.Collect();
Console.WriteLine("Paměť uvolněna .. \n");
}
}
Code of service:
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Diagnostics;
using System.Linq;
using System.ServiceProcess;
using System.Text;
namespace LogWriterService
{
public partial class Service1 : ServiceBase
{
public Service1()
{
InitializeComponent();
}
protected override void OnStart(string[] args)
{
EventLog.WriteEntry("Sluzba screenshot se spustila.");
}
protected override void OnStop()
{
EventLog.WriteEntry("Sluzba screenshot se zastavila.");
}
}
}
I thing the problem may be here:
public static void CreateProcessAsUser()
{
IntPtr hToken = WindowsIdentity.GetCurrent().Token;
IntPtr hDupedToken = IntPtr.Zero;
ProcessUtility.PROCESS_INFORMATION pi = new ProcessUtility.PROCESS_INFORMATION();
try
{
ProcessUtility.SECURITY_ATTRIBUTES sa = new ProcessUtility.SECURITY_ATTRIBUTES();
sa.Length = Marshal.SizeOf(sa);
bool result = ProcessUtility.DuplicateTokenEx(
hToken,
ProcessUtility.GENERIC_ALL_ACCESS,
ref sa,
(int)ProcessUtility.SECURITY_IMPERSONATION_LEVEL.SecurityIdentification,
(int)ProcessUtility.TOKEN_TYPE.TokenPrimary,
ref hDupedToken
);
if (!result)
{
throw new ApplicationException("DuplicateTokenEx failed");
}
ProcessUtility.STARTUPINFO si = new ProcessUtility.STARTUPINFO();
si.cb = Marshal.SizeOf(si);
si.lpDesktop = String.Empty;
string folder = "D:\\test"; //Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
string path = folder + "\\LogWriter\\LogWriter.exe"; // "C:/TEMP/" + GetIP() + "/" + CurrTime + ".jpg"
result = ProcessUtility.CreateProcessAsUser(
hDupedToken,
#path, // C:\Users\ToXiC\AppData\Roaming\LogWriter\LogWriter.exe
String.Empty,
ref sa, ref sa,
false, 0, IntPtr.Zero,
#"D:\\test", ref si, ref pi
);
if (!result)
{
int error = Marshal.GetLastWin32Error();
string message = String.Format("CreateProcessAsUser Error: {0}", error);
throw new ApplicationException(message);
}
}
finally
{
if (pi.hProcess != IntPtr.Zero)
ProcessUtility.CloseHandle(pi.hProcess);
if (pi.hThread != IntPtr.Zero)
ProcessUtility.CloseHandle(pi.hThread);
if (hDupedToken != IntPtr.Zero)
ProcessUtility.CloseHandle(hDupedToken);
}
}
}

The screenshots are all black I think. This happens because a windows service runs in Session 0 Isolation
One solution is to start a console application (with UI hidden) from the service after every 5 mins. The console application can take the screenshot and exit.
Some code to start a console app from windows service:
string applicationPath = ...;
private ProcessStartInfo psi = new System.Diagnostics.ProcessStartInfo(applicationPath);
//set working directiory
Directory.SetCurrentDirectory(Path.GetDirectoryName(applicationPath));
psi.WorkingDirectory = Path.GetDirectoryName(applicationPath);
//psi.CreateNoWindow = false;
psi.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden;
//psi.UseShellExecute = false;
prcs = System.Diagnostics.Process.Start(psi);
Edit: The console application will be started in session 0. Workaround is to use the WIN API CreateProcessAsUser pinvoke call and start the console application in a user session.
Some links with code samples on how to achieve this:
http://odetocode.com/blogs/scott/archive/2004/10/28/createprocessasuser.aspx
http://blogs.msdn.com/b/alejacma/archive/2007/12/20/how-to-call-createprocesswithlogonw-createprocessasuser-in-net.aspx
http://social.msdn.microsoft.com/Forums/en-US/windowssecurity/thread/31bfa13d-982b-4b1a-bff3-2761ade5214f/

Problem was with token. I found working solution here
how-can-windows-service-execute-gui
Thank you all for helping me out of it. I understand now much more how windows service works.

System.Data.SqlClient.Sql Error in C# Winform Application

i got the following error when i try to run my C# Winform Application on Client Machine
Description:
Stopped working
Problem signature:
Problem Event Name: CLR20r3
Problem Signature 01: ics.exe
Problem Signature 02: 1.0.0.0
Problem Signature 03: 5134926a
Problem Signature 04: System.Data
Problem Signature 05: 2.0.0.0
Problem Signature 06: 4a275e65
Problem Signature 07: 2755
Problem Signature 08: 29
Problem Signature 09: System.Data.SqlClient.Sql
OS Version: 6.1.7600.2.0.0.768.2
Locale ID: 1033
Read our privacy statement online:
http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409
If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt
and here is the Application.Run code
[STAThread]
static void Main()
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new frmLogin2());
}
and here is the form Login Code
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using DevComponents.DotNetBar;
using ICS.Classes;
using System.Threading;
using Microsoft.Win32;
namespace ICS.Forms
{
public partial class frmLogin2 : Office2007Form
{
static DataAccess da = new DataAccess();
static DataTable dt = new DataTable();
int num = 0;
public frmLogin2()
{
Thread t = new Thread(new ThreadStart(SplashScreen));
t.Start();
Thread.Sleep(5000);
InitializeComponent();
t.Abort();
}
void Registries()
{
try
{
RegistryKey regKey;
regKey = Registry.LocalMachine.OpenSubKey(#"SOFTWARE\ICS\POS", true);
string activated = EncDec.Decrypt(regKey.GetValue("Activated").ToString(), "A!11").ToString();
if (activated != "TRUE")
{
string coder1;
coder1 = regKey.GetValue("ICSPOS").ToString().Trim();
num = int.Parse(EncDec.Decrypt(coder1, "A!11"));
if (num < 30)
{
num++;
regKey.SetValue("ICSPOS", EncDec.Encrypt(num.ToString(), "A!11"));
lblNum.Text += (30 - num).ToString();
}
}
}
catch (Exception ex)
{
string coder1 = "";
try
{
RegistryKey regKey;
regKey = Registry.LocalMachine.OpenSubKey(#"SOFTWARE\ICS\POS", true);
coder1 = regKey.GetValue("ICSPOS").ToString().Trim();
}
catch
{
}
RegistryKey creator;
creator = Registry.LocalMachine.OpenSubKey("SOFTWARE", true);
creator.CreateSubKey(#"ICS\POS");
creator.Close();
RegistryKey REG2;
REG2 = Registry.LocalMachine.OpenSubKey(#"SOFTWARE\ICS\POS", true);
REG2.SetValue("AppName", "POS");
REG2.SetValue("Version", 1.0);
REG2.SetValue("Activated", EncDec.Encrypt("No", "A!11"));
if (string.IsNullOrEmpty(coder1))
{
REG2.SetValue("ICSPOS", EncDec.Encrypt("1", "A!11"));
lblNum.Text += (30 - 1).ToString();
}
REG2.Close();
}
}
private void frmLogin2_Load(object sender, EventArgs e)
{
try
{
ICS_Auth aut = new ICS_Auth();
Registries();
//MessageBox.Show(aut.CreatSerial());
if (num == 1)
{
da.ExecuteNonQuery("sp_admin_user");
}
}
catch (Exception ex)
{
MessageBox.Show(ex.Message);
}
}
private void btnLogin_Click(object sender, EventArgs e)
{
dt = da.GetDataTable("User_Login", da.CreateSqlParamter("#User_Name", txtUsername.Text)
, da.CreateSqlParamter("#User_Pass", txtUserpass.Text));
if (dt.Rows.Count == 1)
{
//this.Close();
frmMain main = new frmMain(dt);
main.Show();
this.Hide();
}
else
{
MessageBox.Show("اسم المستخدم او كلمة المرور غير صحيحة");
}
}
private void btnClose_Click(object sender, EventArgs e)
{
this.Close();
}
public void SplashScreen()
{
Application.Run(new frmSplash());
}
public static DataTable LOGIN()
{
frmLogin2 log = new frmLogin2();
log.ShowDialog();
return dt;
}
private void frmLogin2_KeyPress(object sender, KeyPressEventArgs e)
{
if (e.KeyChar == (char)27)this.Close();
}
}
}
and here is connection string in app.config
<add key="ConnStr" value="Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\POS.mdf;Integrated Security=True;User Instance=True"/>
And I'm using Visual Studio 2008 and SQL Server 2005 Express

Indeed, the problem is within the connection string, but not the Data Source= section. It is the User Instance=True
Unless you're absolutely positive about its need I suggest to remove it - the default value for User Instance is False.
I'm assuming the issue boils down to permissions/disk quotas and other sys admin related issues. Here you can find more on what the User Instance is and how to use it.

Your data source is the problem. You currently have:
Data Source=.\SQLEXPRESS
But what you need is (local) like this:
Data Source=(local)

how can i creating window station and windows desktop using c#

i would like create new window station & windows desktop and attach my process to it. how can i do that
i need to know
Creating Window station and attach my desktop
Creating & switching between Desktop effectively
how do i attaching process to winlogon desktop(if it is possible )
Destroy created desktop and return back to windows desktop

There is only one interactive window station per 'session' but you can have multiple sessions.
http://blogs.technet.com/markrussinovich/archive/2010/02/24/3315174.aspx
I'm not aware of an API to directly create a login session but if you are using a Windows Server version you could use Remote Desktop to create a local session, autorun your program there, then logout again once the program has ended (the program you are running in the Remote Desktop Session could logout when finished).
The code below will use the MSTSC ActiveX control to programmatically create an RDP session. You will need to manually generate the ActiveX stubs and add them to your project.
From the Visual Studio Command Prompt type the following: aximp.exe %windir%\system32\mstscax.dll
Copy the generated files (MSTSCLib.dll and AxMSTSCLib.dll) to the project directory.
Add both files to the project references.
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using AxMSTSCLib;
using MSTSCLib;
using System.Runtime.InteropServices;
namespace AutoLogin
{
public partial class Form1 : Form
{
private AxMSTSCLib.AxMsRdpClient5 rdpClient;
public Form1()
{
InitializeComponent();
rdpClient = new AxMSTSCLib.AxMsRdpClient5();
((ISupportInitialize)rdpClient).BeginInit();
rdpClient.Enabled = true;
rdpClient.Location = new System.Drawing.Point(0, 0);
rdpClient.Name = "MsRdpClient";
rdpClient.Size = ClientSize;
rdpClient.TabIndex = 1;
rdpClient.Anchor = (AnchorStyles)
(AnchorStyles.Top | AnchorStyles.Bottom |
AnchorStyles.Left | AnchorStyles.Right);
Controls.Add(rdpClient);
((ISupportInitialize)rdpClient).EndInit();
}
void axRemoteDesktop_OnDisconnected
(object sender, IMsTscAxEvents_OnDisconnectedEvent e)
{
Application.Idle += ExitTimerEvent;
}
public void ExitTimerEvent(object source, EventArgs e)
{
Application.Idle -= ExitTimerEvent;
// Attempt to close down the session we just connected to (there
// appears to be no way to get the session id, so we just close all
// disconnected sessions.
if (rdpClient.Connected == 1) {
rdpClient.Disconnect();
}
LogoffDisconnectedSessions();
Close();
}
private Timer logoffTimer;
private void Form1_Load(object sender, EventArgs e)
{
// Close down any existing disconnected sessions, the number of
// available sessions is limited.
LogoffDisconnectedSessions();
String username = "username";
String password = "password";
rdpClient.Server = "localhost";
rdpClient.UserName = username;
rdpClient.AdvancedSettings2.ClearTextPassword = password;
rdpClient.Domain = "";
rdpClient.FullScreen = false;
rdpClient.AdvancedSettings2.RedirectDrives = false;
rdpClient.AdvancedSettings2.RedirectPrinters = false;
rdpClient.AdvancedSettings2.RedirectPorts = false;
rdpClient.AdvancedSettings2.RedirectSmartCards = false;
rdpClient.AdvancedSettings6.RedirectClipboard = false;
rdpClient.AdvancedSettings6.MinutesToIdleTimeout = 1;
rdpClient.OnDisconnected += new
AxMSTSCLib.IMsTscAxEvents_OnDisconnectedEventHandler
(axRemoteDesktop_OnDisconnected);
rdpClient.Connect();
logoffTimer = new Timer();
logoffTimer.Tick += new EventHandler(LogoutTimerEvent);
logoffTimer.Interval = 150000;
logoffTimer.Start();
}
private void Form1_Close(object sender, FormClosedEventArgs e)
{
Application.Idle -= ExitTimerEvent;
if (rdpClient.Connected == 1) {
rdpClient.Disconnect();
}
}
public void LogoutTimerEvent(object source, EventArgs e)
{
logoffTimer.Stop();
rdpClient.Disconnect();
}
enum WTS_CONNECTSTATE_CLASS
{
WTSActive,
WTSConnected,
WTSConnectQuery,
WTSShadow,
WTSDisconnected,
WTSIdle,
WTSListen,
WTSReset,
WTSDown,
WTSInit
};
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Auto)]
struct WTS_SESSION_INFO
{
public int SessionId;
public string pWinStationName;
public WTS_CONNECTSTATE_CLASS State;
}
[DllImport("wtsapi32.dll")]
private static extern bool WTSLogoffSession(IntPtr hServer, int SessionId, bool bWait);
private static IntPtr WTS_CURRENT_SERVER_HANDLE = IntPtr.Zero;
[DllImport("wtsapi32.dll", CharSet = CharSet.Auto)]
private static extern bool WTSEnumerateSessions(
IntPtr hServer,
[MarshalAs(UnmanagedType.U4)]
int Reserved,
[MarshalAs(UnmanagedType.U4)]
int Version,
ref IntPtr ppSessionInfo,
[MarshalAs(UnmanagedType.U4)]
ref int pCount);
[DllImport("wtsapi32.dll")]
private static extern void WTSFreeMemory(IntPtr pMemory);
private void LogoffDisconnectedSessions()
{
IntPtr buffer = IntPtr.Zero;
int count = 0;
if (WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, 0, 1,
ref buffer, ref count)) {
WTS_SESSION_INFO sessionInfo = new WTS_SESSION_INFO();
for (int index = 0; index < count; index++) {
sessionInfo = (WTS_SESSION_INFO)Marshal.PtrToStructure(
new IntPtr(buffer.ToInt32() +
(Marshal.SizeOf(sessionInfo) * index)),
typeof(WTS_SESSION_INFO));
WTS_CONNECTSTATE_CLASS state = sessionInfo.State;
if (state == WTS_CONNECTSTATE_CLASS.WTSDisconnected)
{
WTSLogoffSession(WTS_CURRENT_SERVER_HANDLE,
sessionInfo.SessionId, true);
}
}
}
WTSFreeMemory(buffer);
}
}
}

Although Windows supports multiple "window stations", the documentation states that:
The interactive window station, Winsta0, is the only window station that can display a user interface or receive user input. It is assigned to the logon session of the interactive user, and contains the keyboard, mouse, and display device. All other window stations are noninteractive, which means they cannot display a user interface or receive user input.
This indicates that the ability to switch between window stations in the way you are proposing is not possible.