RAiLaunchAdminProcess callback
In the previous section, we mentioned a very important point: when anyone tries to create a privilege elevation process from a low-privilege program, the UAC privilege service will be notified and will confirm whether to delegate privileges or not. If the elevation request is granted, the UAC privilege service will then proceed to hatch the low-privilege program with high privileges.
At this point, the UAC privilege service must have a callback function that is responsible for receiving requests, validating them, and delegating the privileges while generating the process. This callback function is the RAiLaunchAdminProcess function located in appinfo.dll.
Figure 10.5 shows a screenshot of the dynamic analysis of the UAC privilege service by the well-known binary decompiler IDA and the dynamic debugging of its RAiLaunchAdminProcess callback function breakpoints. We will now explain this entirely in terms of IDA-generated pseudocode and dynamic debugging...
