Abstract: Disclosed herein is a system for providing a test environment, composed of one or more virtual machines, to a developer instantly in response to a checkout request from the developer. To do this, a sandbox service implements a smart, tiered approach to creating and provisioning virtual machines that compose the test environments. The approach is flexible and elastic in nature, so that the developers do not have to wait an extended period of time for a test environment, yet the costs associated with configuring the virtual machines (e.g., storage and compute costs) are minimized. For example, the sandbox service can use historical data to predict a number of checkout requests expected for a first time interval (e.g., one day), a second time interval (e.g., thirty minutes), and a third time interval (e.g., five minutes). The sandbox service can then configure virtual machines into different states based on the predicted numbers.

Abstract: A security flag stored in a trusted store is utilized to determine if the trusted store has been subjected to tampering. The security flag is indicative of a globally unique identifier (GUID), the version of the trusted store, and a counter. The security flag is created when the trusted store is created. Each time a critical event occurs, the security flag is updated to indicate the occurrence thereof. The security flag also is stored in a write-once portion of the system registry. At appropriate times, the security flag stored in the trusted store is compared with the corresponding security flag stored in the write-once registry. If the security flags match within a predetermined tolerance, it is determined that the trusted store has not been subjected to tampering. If the security flags do not match, or if a security flag is missing, it is determined that the trusted store has been subjected to tampering.

Abstract: A mechanism for redirecting a code execution path in a running process. A one-byte interrupt instruction (e.g., INT 3) is inserted into the code path. The interrupt instruction passes control to a kernel handler, which after executing a replacement function, returns to continue executing the process. The replacement function resides in a memory space that is accessible to the kernel handler. The redirection mechanism may be applied without requiring a reboot of the computing device on which the running process is executing. In addition, the redirection mechanism may be applied without overwriting more than one byte in the original code.

Abstract: Upon a first process encountering a triggering device, a second process chooses whether to proxy-execute code corresponding to the triggering device of the first process on behalf of such first process based at least in part on whether a license evaluator of the second process has determined that the first process is to be operated in accordance with the terms and conditions of a corresponding digital license. The license evaluator at least in part performs such determination by running a script corresponding to the triggering device in the code of the first process. Thus, the first process is dependent upon the second process and the license for operation thereof.