Reverse engineering an anti cheating exam software for fun

WARNING! DO NOT USE THE INFORMATION PROVIDED TO CHEAT ON ANY EXAMS OR QUIZZES. THIS INFORMATION IS PROVIDED FOR EDUCATIONAL PURPOSES ONLY. IF YOU ARE CAUGHT CHEATING, I AM NOT RESPONSIBLE FOR YOUR ACTIONS

and if you are a cheater, I wish you hell :)

this research was done on the 3rd of June 2024

So my school uses a computer-based test where their local network or LAN has a server that can only be accessed from the LAN internet (presumably because I found an access point that gives the same web page of the login portal that I can access using the open internet, but this is a story for another time).

Anyways, they made the students install a specific exam browser software on each of their computers this year

and it interested my hacker mind a bit, how does it work, can I break it, can I find a way to modify it so I can do stuff that it blocks and tries to prevents? only one way to find out

Now before we get digging into the binary, let's set a few questions for us to answer:

• Where did this program come from?

• Who made it and how was it made?

• How does it work and how can we hack it?

So with the binary on hand, it's time for some digging.

Where did this program come from?

To find out where my school's staff got this program from, I do what most researchers do first: google it.

My first search was to use the exe file name without the extension and the word client, so I searched "ExamBrowser client". I searched this because I wanted a broader search result because I knew that the client I had was not something from safeexambrowser.org

From the search results, I hadn't found anything perfectly matching what I intended to find.

I remember finding the exact page the staff used to download and modify the program but I can't find it.

But an interesting idea came into my head, I remember the page had a screenshot of the program, so I thought, why not reverse image search a screenshot of the program?

After doing that, I finally found the page that I think the staff used to get the software, https://rukim.id/cbt/exambro-client I don't know if this is exactly where they got it from, but it's the only source I can find the exact software, and other pages that have similar programs are either different clients or dead links.

Who made it and how was it made?

The question of who made it exactly is still a mystery, but I have some theories.

My first theory is that it was made by the Ministry of Education for special tests, though it must be an older version of it since now they use SEB and other pieces of software that might be custom.

My second theory is that it was a custom version of some old project that somebody made and published somewhere on the internet and just got spread around.

Now for the question of how was it made, let's first check what exact type of executable file it is.

From the command here, we see that it uses .NET assembly, meaning it could well possibly be programmed using C#, and I have a high certainty that this was programmed using C# because, who would make something like this out of visual basic?!?!

How does it work and how can we hack it?

Now that we know it uses .NET, we can decompile it to something more readable like C#

The tool I'm going to be using is dnSpy, the newer forked version of it because the older version got archived and is no longer being maintained.

Anyway, here are the functions that I found while dissecting the program using dnSpy

We have 3 classes

1. Form_Main where the main process and logic of the programs starts

2. Form_Passwrod where a user must know the password (which is saved in the config file and is stored in plain text) to be able to edit things (which you can do in the config file) or to exit the program while it's running and you finished a test

3. Form_Settings where some hardcoded rules and lists are set

Now what can we do?

Well with this knowledge, we can explore more of the program and modify it so we can do some evil stuff >:3

here we have 2 functions that contain a list of keys and programs to block

we can modify them to return a list that contains nothing, I mean I can modify the functions that block these keys and programs, but I'm too lazy right now and I'll just modify the list function because it's easier to modify.

I'll be modifying the LoadApplication function that lists the programs to detect and block. I'll be removing the task manager program.

Now to modify the program itself we can't edit the source code directly, we have to modify the IL instruction.

I'll be removing the instructions that are highlighted, and then I'll be changing the array length to only 10 so it won't cause any problems.

Now the function has been changed and the taskmgr string is nowhere to be found.

Now to save the changes to the file, we can go to the file menu bar on the top left of dnSpy and click on "save module" and confirm the write.

After writing it to the executable, let's test it out :D

Ok after testing it out there were some errors that just broke the function that loads the programs, I probably should have read more about the IL instructions. but yeah that's the hard part about binary patching, if you're not careful, you can break things.

but hey, the fact that the load application function broke and didn't return stuff is a good sign for us hackers, as now we can finally load up task manager :3

I also set up a custom config that makes the exam browser load up a custom html page ;3

now even though we can bypass the exam browser executable, doesn't mean that we have successfully found a way to cheat.

The website that hosts the exam questions can still load up Javascript to run on Chrome which can detect if the user has changed tabs or changed windows.

So yeah, you also have to bypass the custom Javascript that is given to your Chrome browser, and run client-sided without breaking the whole site, because most LMSs like Moodle tend to use a lot of Javascript to function properly.

And I'm not going to teach you guys how to bypass it, because what I just gave was probably a lot. Plus if I were to research bypassing the javascript code, it would require me to retrieve the code during an active exam, which makes it nearly impossible.

But hey if my school lets me test their systems for security, maybe I'll make a blog post on how I did it.

Anyway, that's all from me, remember to stay safe, stay secure, and I'll see yall later :D