Possible use for other proctored exams?

[Bleakerzor]

Amazing work, do you think this could likely work similarly for OnVue/Pearson Exams?

[gucci-on-fleek]

It depends on what level your talking about.

At the highest level—running the software in a VM, but convincing the software that it isn't running in a VM—this strategy should pretty much always work.

At a slightly lower level—running the software in a VM, and detouring some Windows API functions—then this should usually work with a few exceptions. First, if the software calls the API functions through some roundabout way (see 1, 2), then the standard solution won't work, although working around this isn't too hard. Second, if the software uses the kernel syscalls directly, then this won't work at all. But the syscalls can change with every update, so very few programs use them. Finally, if the program uses a kernel driver to help with detection, then there's no way to really hide that it's running in a VM, but again, this is unlikely.

At the lowest level—running the software in a VM, while modifying these exact registry entries and hooking these exact API functions—then this strategy won't work. Something very similar will probably work though, but it's all in the details.