How to get the PIDL of the Open/Save Dialog

I have worked on this question for a long time. Now I can get the PIDL of the explorer dialog from the code below.

::CoCreateInstance(CLSID_ShellWindows, NULL, CLSCTX_ALL, IID_IShellWindows, (void**)&psw)

This code can only get the explorer dialog, I found nothing in Microsoft's docs about how to get the Open/Save Dialog.

HRESULT hr = S_OK;

CoInitialize(NULL);


IShellWindows *psw = NULL;
if (!SUCCEEDED(::CoCreateInstance(CLSID_ShellWindows, NULL, CLSCTX_ALL, IID_IShellWindows, (void**)&psw)) || !psw)
{
    CoUninitialize();
    return;
}

long lCount = 0;
if (!SUCCEEDED(psw->get_Count(&lCount)))
{
    psw->Release();
    CoUninitialize();
    return;
}

IDispatch *pdisp = NULL;
VARIANT v;
V_VT(&v) = VT_I4;
for (V_I4(&v) = 0; V_I4(&v) < lCount; V_I4(&v)++)
{
    if (!SUCCEEDED(psw->Item(v, &pdisp)) || !pdisp)
    {
        continue;
    }
 
    IWebBrowserApp *pwba = NULL;
    if (!SUCCEEDED(pdisp->QueryInterface(IID_IWebBrowserApp, (void**)&pwba)) || !pwba)
    {
        pdisp->Release();
        continue;
    }

    IServiceProvider *psp = NULL;
    if (!SUCCEEDED(pwba->QueryInterface(IID_IServiceProvider, (void**)&psp)) || !psp)
    {
        pdisp->Release();
        pwba->Release();
        continue;
    }

    IShellBrowser *psb = NULL;
    if (!SUCCEEDED(psp->QueryService(SID_STopLevelBrowser, IID_IShellBrowser, (void**)&psb)) || !psb)
    {
        pdisp->Release();
        pwba->Release();
        psp->Release();
        continue;
    }

    IShellView* psv = NULL;;
    if (!SUCCEEDED(psb->QueryActiveShellView(&psv)) || !psv)
    {
        pdisp->Release();
        pwba->Release();
        psp->Release();
        psb->Release();
        continue;
    }

    IFolderView2 *pfv = NULL;
    if (!SUCCEEDED(psv->QueryInterface(IID_IFolderView2, (void**)&pfv)) || !pfv)
    {
        pdisp->Release();
        pwba->Release();
        psp->Release();
        psb->Release();
        psv->Release();
        continue;
    }
    ...
}