Windows RPC object marshalling

I'm trying to use Windows RPC for communcation between two processes (C/C++, 32bit, Win7).

I've followed the example here Instruction to RPC and successfully got RPC to work. Now I have difficulties getting the proxy / stub thing to work too.

The IDL file looks like this:

[ uuid(3cb112c0-688a-4611-83b6-31d33d87ea28), object ]
interface IDemo : IUnknown
{
    HRESULT ThisIsAMethod([in, string] const char* test);
}

[ uuid(60ad6a21-ba49-483a-b0a2-faa5187b8299), version(1.0),
  implicit_handle(handle_t hDemoBinding)]
interface IDemoRPC
{
    void SimpleTest();
    void GetDemo([out] IDemo** service);
    void Shutdown();
}

I can invoke SimpleTest() remotely on the server from the client. Works just fine. But GetDemo() gives me an access violation when the server 'returns' something else than NULL.

Here's what I've done:

• Build a DLL based on the generated demo_i.c, demo_p.c, dlldata.c. With REGISTER_PROXY_DLL set and a def file containing the five private entries. I've registered it with regsvr32 (the one from WOW64).

• Created a DemoImpl class in the server process that extends IDemo and implements ThisIsAMethod as well as AddRef and friends.

• Implemented GetDemo(IDemo** service) with a one-liner *service = new DemoImpl();

When I invoke GetDemo from the client process, the server process terminates with an access violation (0x00000014). The stacktrace shows that it happens in a separate thread deep within rpcrt4.

I would have expected that the thing returns a proxy to the client.

I have the suspicion that I'm doing something fundamentally wrong here. For one thing, I can't find an example where instances of interface-objects are created with new. There always some some magic with CoGetClassObject or something. No clue how these functions should know where to find the implementation.