E

EBP register, and /GS flag, 64

echo servers, 91–92

ecount, 5

eEye, 55

elevated code, starting, 27

elevated tokens, 20

elevation

to administrator, 18–20

COM client/server configuration, 26

monikers, 25–26

of processes, determining, 20–22

prompts, disappearing, 23–24

of rouge software, 26

shield icon, 27

encoded pointers, 55

encoding, pointer, 172–175

encrypting credentials, 169–171

encrypting data, 141

ERROR_ELEVATION_REQUIRED (740) error, 44

errors.

See also warnings

450 error, 166

“Blocked by Parental Controls,” 166

CreateFileMapping (“Global\\objectname”), 43

ERROR_ELEVATION_REQUIRED (740), 44

OpenSCManager (…,SC_MANAGER_ALL_ ACCESS), 43

Event Viewer

certification events, 147

virtualization events, 30

event log, security, 163, 171–172

events, logging, 167

_except keyword, 67

exception handlers, 67–72

exception handling pointers, 71

Execution Disable (XD), 11

ExitProcess, 61

Explorer, and virtualized processes, finding, 29