Calling advapi32.dll CreateProcessWithLogonW entry point

Hello *,

I'm struggling with setting up an entry point for the
CreateProcessWithLogonW function in advapi32.dll.

I'm using the new 2.0 alpha version of Jawin and tried to follow the
instructions "Calling a DLL Entry Point", but my app still crashes and burns.

Here's my minimal testdriver:
--------------------------------->8----------------------------------------

import java.io.IOException;

import org.jawin.COMException;
import org.jawin.FuncPtr;
import org.jawin.ReturnFlags;
import org.jawin.io.LittleEndianOutputStream;
import org.jawin.io.NakedByteStream;
import org.jawin.marshal.StructConverter;

public class TestDriver {

    public static void main(String[] args) {
        try {
            // Exchange the strings with valid auth.-info and the
            // Program with something that exists on your system
            createProcessWithLogonW("validuser",
                                    "validdomain",
                                    "validpassword",
                                    "C:/Programme/Internet
Explorer/iexplore.exe");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    private static boolean createProcessWithLogonW(String user, String
domain, String passwd, String appname) throws COMException, IOException {
        FuncPtr fp = new FuncPtr("advapi32.dll", "CreateProcessWithLogonW");

        NakedByteStream nbs = new NakedByteStream();
        LittleEndianOutputStream leos = new LittleEndianOutputStream(nbs);
        leos.writeStringUnicode(user);
        leos.writeStringUnicode(domain);
        leos.writeStringUnicode(passwd);
        leos.writeStringUnicode(appname);
        byte[]result = fp.invoke( "GGGK4GK4K4K4K4K4:B1:A", 44, nbs, null,
ReturnFlags.CHECK_FALSE );
        return StructConverter.bytesIntoBoolean(result, 0);
    }

}
---------------------------------8<----------------------------------------

I'm especially unsure about the instruction string and the stack size.
The definition of CreateProcessWithLogonW is (with my assumptions for the
instruction string and the stack size):

BOOL CreateProcessWithLogonW(
  LPCWSTR lpUsername,           in param -> G, 4 bytes
  LPCWSTR lpDomain,             in param -> G, 4 bytes
  LPCWSTR lpPassword,           in param -> G, 4 bytes
  DWORD dwLogonFlags,           in param, may be null -> K4, 4 bytes
  LPCWSTR lpApplicationName,    in param -> G, 4 bytes
  LPWSTR lpCommandLine,         in param, may be null -> K4, 4 bytes
  DWORD dwCreationFlags,        in param, may be null -> K4, 4 bytes
  LPVOID lpEnvironment,         in param, may be null -> K4, 4 bytes
  LPCWSTR lpCurrentDirectory,   in param, may be null -> K4, 4 bytes
  LPSTARTUPINFOW lpStartupInfo, in param, may be null -> K4, 4 bytes
  LPPROCESS_INFORMATION lpProcessInfo, out param -> A, 4 bytes
);

If you use the testdriver with invalid user information or an invalid
application name sensible exceptions are thrown.

If all parameters are setup correctly, the application starts up, but the
program crashes with an "Access Violation at 0x77DE692C, thread attempts to
write at 0x0 (description: The thread attempted to read from or write to a
virtual address for which it does not have the appropriate access)".

When I use the -Dorg.jawin.traceRefs=true -Dorg.jawin.traceWin32=true
-Dorg.jawin.traceCom=true -Dorg.jawin.traceDispatch=true args, I got some
more info:
at
ch.forumedia.futura.secondarylogin.TestDriver.createProcessWithLogonW(TestDriver.java:32)
GenericStub.win32Invoke
 instructions: GGGK4GK4K4K4K4K4:B1:A
 stackSize: 44
 flags: [CHECK_FALSE (1)]
 argStream: 256, argStreamSize: 140
[I'm deliberately leaving out the byte array as it contains my login info...]

As the program fires up o.k., I assume that the exception happens during
serializing the return value from the function or during serializing the out
value...

Any hints?

Thx in advance,
  Andreas