214
edits
Changes
basic installer reversing
== Analysis ==
The initially downloaded .exe is an InstallShield self-extracting installer. The 9-digit ID is not checked by this installer during the extraction process whatsoever -- it is simply copied from the filename into a temporary file in the extraction working directory (on Wine, <code>c/users/hokietux/AppData/Local/Temp/ldz<some string>/id.txt</code>, though this is dynamically generated using winapi's <code>GetTempPathA</code> then <code>GetTempFileNameA</code>).
Only cursory analysis has been done thus far, as the author of this article doesn't have a native windows box to run Respondus on. It appears that on launch, it first connects to an unencrypted http server running in AWS, presumably to check if the version is current, then it checks if it is in a virtualized environment.