238
edits
Changes
basic installer reversing
LockDown Browser's download website shows the download option based on your OS. Since it does not support Linux, it does not let you download it. So, to download this <s>shitty</s> browser, you need to change the OS in your User Agent to Windows.
The file name must include the school's 9-digit ID code (for VT: 776344934776344933). This must be immediately preceded by a '-' hyphen. If there are multiple numeric sequences '''exactly''' 9-digits long and preceded by a hyphen, the first one is interpreted as the ID code.
The following file names would work:
<code>776344933.exe</code>The ID code is not preceded by a hyphen<br>
<code>Lockdown.exe</code>The ID code simply isn't in the file name<br>
To pull down VT's executable with the default name, try
<code>
curl -LO $(curl -L "https://download.respondus.com/lockdown/$(curl -L "https://download.respondus.com/lockdown/download.php?ID=776344933" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.3" 2>/dev/null | grep -ioE "download[0-9].php\?id=[0-9]*")" 2>/dev/null| grep -ioE "https.*.exe" | uniq)
</code>
===Wine===
There are multiple tutorials available by a quick web search which claim to get this working in Wine, <s>however, to date, no member of
VTLUUG has succeeded in doing so and existing information indicates it varies by version of the browser.</s>
This solution requires [https://github.com/Winetricks/winetricks winetricks]
== Analysis ==
The initially downloaded .exe is an InstallShield self-extracting installer. The 9-digit ID is not checked by this installer during the extraction process whatsoever -- it is simply copied from the filename into a temporary file in the extraction working directory (on Wine, <code>c/users/hokietux/AppData/Local/Temp/ldz<some string>/id.txt</code>, though this is dynamically generated using winapi's <code>GetTempPathA</code> then <code>GetTempFileNameA</code>).
Only cursory analysis has been done thus far, as the author of this article doesn't have a native windows box to run Respondus on. It appears that on launch, it first connects to an unencrypted http server running in AWS, presumably to check if the version is current, then it checks if it is in a virtualized environment.