consent.exe is responsible for showning the UAC dialog. Looking at the command line parameters with Process Explorer, I see the following:
consent.exe 1316 748 000000004385BD60
- read How does the Windows “Secure Desktop” mode work? here on SE
- tried to convert the numbers to and from hex to see if it matches something
- read the Technet article "Inside Windows Vista User Account Control" by Mark Russinovich
consent.exe /?(just in case - I didn't expect anything)
- checked if one of the numbers occurs in the output of a
!process 0 0using LiveKD. If that command really lists all process objects, the process to be created (executable name displayed by the UAC dialog) does not exist yet.
- Looking at Process Explorer's "Handle" lower pane
- Finding the values in a session recorded by Process Monitor
- I was unable to capture consent.exe in Rohitab's API monitor
So far, I only figured out the first number: it is the process ID (PID) of the parent process, which happens to be
svchost.exe in my case.
consent.exe figure out from that command line information what the path of the executable to be started is?