Windows Defender Antivirus从C#扫描[AccessViolation exception

[DllImport(@"C:Program FilesWindows DefenderMpClient.dll")]
        public static extern int WDStatus(out bool pfEnabled);

        [DllImport(@"C:Program FilesWindows DefenderMpClient.dll")]
        public static extern int MpManagerOpen(uint dwReserved,out IntPtr phMpHandle);

        [DllImport(@"C:Program FilesWindows DefenderMpClient.dll")]
        public static extern int MpScanStart(IntPtr hMpHandle,uint ScanType,uint dwScanOptions,IntPtr pScanResources,IntPtr pCallbackInfo,out IntPtr phScanHandle);

        [DllImport(@"C:Program FilesWindows DefenderMpClient.dll")]
        public static extern int MpHandleClose(IntPtr hMpHandle);

        private void DoDefenderScan_Click(object sender,EventArgs e)
        {
            try
            {
                bool pfEnabled;
                int result = WDStatus(out pfEnabled); //Returns the defender status - It's working properly.
                ErrorHandler.ThrowOnFailure(result,VSConstants.S_OK);

                IntPtr phMpHandle;
                uint dwReserved = 0;

                IntPtr phScanHandle;

                MpManagerOpen(dwReserved,out phMpHandle); //Opens Defender and returns the handle in phMpHandle. 

                tagMPRESOURCE_INFO mpResourceInfo = new tagMPRESOURCE_INFO();
                mpResourceInfo.Path = "eicar.com";
                mpResourceInfo.Scheme = "file";
                mpResourceInfo.Class = IntPtr.Zero;

                tagMPRESOURCE_INFO[] pResourceList = new tagMPRESOURCE_INFO[1];
                pResourceList.SetValue(mpResourceInfo,0);

                tagMPSCAN_RESOURCES scanResource = new tagMPSCAN_RESOURCES();
                scanResource.dwResourceCount = 1;
                scanResource.pResourceList = pResourceList;
                IntPtr resourcePointer = StructToPtr(scanResource);

                result = MpScanStart(phMpHandle,3,resourcePointer,IntPtr.Zero,out phScanHandle); **//Getting Access violation exception here**.

                MpHandleClose(phMpHandle);
                MpHandleClose(phScanHandle);
                Marshal.FreeHGlobal(resourcePointer);
            }
            catch (Exception)
            { }
        }

这里定义了结构.

[StructLayout(LayoutKind.Sequential,Pack = 1)]
    public struct tagMPSCAN_RESOURCES
    {
        public uint dwResourceCount;

        [MarshalAs(UnmanagedType.ByValArray,ArraySubType = UnmanagedType.Struct,SizeConst = 1)]
        public tagMPRESOURCE_INFO[] pResourceList;
    }

    [StructLayout(LayoutKind.Sequential,Pack = 1)]
    public struct tagMPRESOURCE_INFO
    {
        [MarshalAs(UnmanagedType.LPWStr)]
        public String Scheme;

        [MarshalAs(UnmanagedType.LPWStr)]
        public String Path;

         public IntPtr Class;
    }

    public class MPRESOURCE_CLASS
    {
        public uint Value;
    }

    private static IntPtr StructToPtr(object obj)
    {
        var ptr = Marshal.AllocHGlobal(Marshal.SizeOf(obj));
        Marshal.StructureToPtr(obj,ptr,false);
        return ptr;
    }

代码是根据可用的文档编写的

https://msdn.microsoft.com/en-us/library/vs/alm/dn920144(v=vs.85).aspx

我们得到这个例外

尝试读取或写入受保护的内存.这通常表明其他内存已损坏.

在

result = MpScanStart(phMpHandle,out phScanHandle); **//Getting Access violation exception here**.

可能是什么问题呢？ struct的格式是否正确？

P.S – No information about MPRESOURCE_CLASS is available in msdn.

我不知道这行代码是否正确.

mpResourceInfo.Class = IntPtr.Zero;

更新：

快速扫描可以正常使用此代码：

result = MpScanStart(phMpHandle,1,out phScanHandle);

Defender在事件查看器[应用程序和服务日志 – Microsoft-Windows-Windows Defender / Operational]中记录为

Windows Defender scan has started.
Scan ID:{CDC2AC0D-7648-4313-851C-4D8B7B5EB5CD}
Scan Type:AntiSpyware
Scan Parameters:Quick Scan