Some of them use state of the art obfuscation to make this a PIA, others are not that good[0]
The one I've taken a look at(forgot it's name) was using VMProtect and had a competently written VM detection routine.
It wasn't my exam so I recommended that they use a kvm switch instead of fumbling around with vm hiding tools.
The one I've taken a look at(forgot it's name) was using VMProtect and had a competently written VM detection routine. It wasn't my exam so I recommended that they use a kvm switch instead of fumbling around with vm hiding tools.
[0]: https://secret.club/2019/05/16/exam-surveillance2.html