Projector Replacement with TVs (Teachers missing Freeze Screen Pause Function) - Fix?

[ITMat]

Good afternoon all,

 

We've been keen to replace projectors with TVs as they're easier/cheaper and better in many ways.

 

However - some teachers really miss the freeze screen/pause option that projectors have and we've spent a while trying to find a solution for this.

 

In the end the following seems to be the best/most functional solution that we've found so far (for Windows 11 devices) so I thought I'd better share the info as it might be of use to others.

 

Freeware produced by CamroeStudios called DisplayClone seems to have solved things for us.

 

https://www.comroestudios.com/DisplayClone/Doc/DisplayClone.html

 

With a second screen configured in extend mode users can open this software and clone their active screen to the extended display by pressing ctrl+m. Once cloned cltr+p can be pressed to pause the display on the second screen (allowing teachers to change to work on the next thing they want to display/something else, the software is also configured to keep a history of paused screens that can be scrolled through with ctrl+shift+left/right arrow keys (there are a number of customisable options in the software which are useful too).

 

However - in order to make the software work for non-admin users we had to come up with a solution which allowed it bypass the UAC prompt. This was resolved by creating a custom sdb file in the Windows 11 ADK.

https://techcommunity.microsoft.com/t5/ask-the-performance-team/act-suppressing-elevation-prompts-for-legacy-applications/ba-p/374734

 

Step 1: Install DisplayClone Software.

Step 2: Install sdb file (e.g run the following command from an elevated prompt "sdbinst c:\DisplayCloneInvoker.sdb").

Step 3: Test/Trial.

 

We noticed that differences in some resolutions/screen sizes can cause some artefacts (this seemed to be fixed be making sure scaling was set to the same percentage on both the primary and second screens).

 

Hopefully this helps you out.

 

Mat

DisplayClone.zip

DisplayClone.txt

Edited October 20, 2023 by ITMat

[Brax]

Thank you for sharing. We've also found this is a good solution for those interested: https://github.com/askvictor/PauseToScreen

[ITMat]

Thanks, yes I checked out this solution too, the DisplayClone software has a few extra features that are worth exploring though.

 

Keeping a history of frozen screens as mentioned above for example and there are a bunch of settings that can be customised, like audio notifications that tell you when you have enabled/disabled cloning etc.â€

[DJ_Teach]

Hi guys,

 

if I run the DisplayClone installation file through virustotal and other stuff, it highlights the file as malicious software. Could you please explain this?

 

Thanks!

 

Best

DJ Teach

[ITMat]

Hi DJ_Teach,

 

Based on your post I got in touch with Justin Comroe the chap that built the software (via the contact details on the website listed above) who was enthusiastic to help and very happy that the software was finding a use in Education. He has assured me that the software isn’t malicious in any way and is happy for anyone to submit the setup files and binaries to AV providers for analysis.

 

Basically, his reply was that he's not hugely surprised that the software triggers some heuristic scans through some AV software packages and generates false positives. The original setup file was created with InstallShield (produced by SetupFactory 8) and hasn't been touched since it was pushed out for Shareware review (where it was peer checked and found to be clean) in 2015.

 

He said:

 

“I do see that there's quite a few detections on VirusTotal right now, so you're absolutely right on that part. DisplayClone itself {and all other executables within} are packaged with "Obsidium" [for code-protection / activation], and do contain code-virtualization. Given there's code-signing cert on any of the binaries, I'd suspect that modern heuristics and to blame here coupled with the packing -- {e.g, that the software performs hook injection, uses low level hooks, web-access, window manipulation, shared memory,etc}.

 

For the sake of experimentation, I re-ran the unpacked (unprotected) binaries through VirusTotal. Seems that there's still some false positives on the loader processes, yet everything else in the clear with the exception of "SecureAge" on the TTS module (SpeechCore) and DisplayClone itself. Will look into this a bit more, could probably drop the software protection in future builds as we're no longer charging for the product.”

 

Justin also provided the attached zip-archive with the obfuscation-free test binaries that can be run/analysed individually.

 

“The more well known that the software is, the less false-positives that should exist as each company does their malware analysis.”

 

Justin is aware of this thread, so he might register and get involved himself. He’s said if there is enough interest he may rewrite/update the software too.

 

Zip/Hashes included below.

 

DisplayClone -- no obsidium.zip

--

SHA1 Size Name

1F19066DF22C5384AD9A427F508A1828C84E1E02 3732932 DisplayClone_Setup.exe

4B6B594BFAE7AE542EC4F9DC8BFC6C2D4FFB4043 4669361 DisplayClone -- no obsidium.zip

Edited November 22, 2023 by ITMat

[JustinC]

Hey all,

 

Seeing as I was introduced by Mat here, I indeed went ahead and created an account on the EduGeek forums to engage with you all a bit more direct. As you might have guessed by the username, this is ‘Justin Comroe’ – the author of the DisplayClone software that was brought up in this thread. I’ve been having a back-and-forth chat with Mat here {over emails} with his efforts of getting the software working on Windows 11, along with some other concerns.

 

That said, this tool was created with the educational setting specifically in-mind about a decade ago. It never received much traction: be it perhaps a bit niche in use-case, having released at the wrong time [before sufficient transition away from projectors], or simply not having gone through the appropriate channels {getting in touch with the education IT-Community on forums such as this one} … whatever the case may be, I’m quite glad to see that DisplayClone might see some more use in the classroom.

 

 

To clarify a bit on the behavior of the software and the AV heuristics / detection. Likely triggers of AV’s in their behavior-analysis:

 

-- mouse [hooks]. {for clamping the mouse cursor to the primary display}

-- keyboard [hooks]. {for hotkey detection, and “blocking” key combinations of said hotkeys to prevent unintended interactions with software where bindings cannot be re-mapped. e.g, to allow combinations such as “CTRL + P” without triggering a print dialog}

-- Windows [hooks]. {positions of all open dialogs are tracked. If a window extends beyond the boundaries of the primary display when in clone-mode, it’s moved to the primary display. If it would not fit, it’s resized to fit that display. }

-- Hook-chain insertion hijacking. {keeping ourselves at the top of the hook-chain to prevent other software that uses keyboard / mouse hooks to get infront of DisplayClone / prevent input filtering from happening}

-- Input sending. {kicking the cursor over to the primary display, releasing keyboard keys [debug option] }

 

-- web-access. {phoning home, activation / update-checking}

-- creation / editing of files in %USERPROFILE%\Documents\ComroeStudios\

-- display capture. {GDI / Direct3D}

-- no EV code-signing on the binaries.

 

-- Obsidium integration. [anti-debugger, code obfuscation & byte-code virtualization / encryption of licensing implementation]

 

 

Unfortunately, I’d imagine that the above would look just like a keylogger or some other form of invasive malware. A-lot of stuff is done to emulate a look-alike single display mode of the desktop, while in a display span. Couple that with low user-coverage {not many copies in the wild}, and that’s likely doubly bad for AV trust. Back in 2014 and 2015 we did test quite a few AV's, and submit copies to their teams where problems were found -- though time has passed and that situation definitely looks like it's changed.

 

It’s my hopes that the unpacked binaries will help reduce concerns of various security software, and make any human analysis easier. -- Though be aware that as the activation system is tightly tied with Obsidium and not active until post packaging, the license fields will show dummy-strings in the ‘no obsidium’ binaries.

 

 

I’ll be reachable on this forum through direct-messages, by email, and also will be watching this thread. Like Mat has indicated, I’m quite curious to see what type of interest exists in DisplayClone .. and especially of prospective features and other-ideas that might be useful to instructors in any future rewrites.

 

{beyond the obvious stuff of making sure it works properly with modern Windows -- splitting the software into a service-model to get around the rights-issues, etc}

Edited November 22, 2023 by JustinC

[DJ_Teach]

Dear all,

 

Thanks so much for the quick replies and detailed feedback!

I also assumed that there might be a false positive in the AV's threat detection but I lack proper expertise in this field.

 

Cheers