Hey all,
Seeing as I was introduced by Mat here, I indeed went ahead and created an account on the EduGeek forums to engage with you all a bit more direct. As you might have guessed by the username, this is ‘Justin Comroe’ – the author of the DisplayClone software that was brought up in this thread. I’ve been having a back-and-forth chat with Mat here {over emails} with his efforts of getting the software working on Windows 11, along with some other concerns.
That said, this tool was created with the educational setting specifically in-mind about a decade ago. It never received much traction: be it perhaps a bit niche in use-case, having released at the wrong time [before sufficient transition away from projectors], or simply not having gone through the appropriate channels {getting in touch with the education IT-Community on forums such as this one} … whatever the case may be, I’m quite glad to see that DisplayClone might see some more use in the classroom.
To clarify a bit on the behavior of the software and the AV heuristics / detection. Likely triggers of AV’s in their behavior-analysis:
-- mouse [hooks]. {for clamping the mouse cursor to the primary display}
-- keyboard [hooks]. {for hotkey detection, and “blocking” key combinations of said hotkeys to prevent unintended interactions with software where bindings cannot be re-mapped. e.g, to allow combinations such as “CTRL + P” without triggering a print dialog}
-- Windows [hooks]. {positions of all open dialogs are tracked. If a window extends beyond the boundaries of the primary display when in clone-mode, it’s moved to the primary display. If it would not fit, it’s resized to fit that display. }
-- Hook-chain insertion hijacking. {keeping ourselves at the top of the hook-chain to prevent other software that uses keyboard / mouse hooks to get infront of DisplayClone / prevent input filtering from happening}
-- Input sending. {kicking the cursor over to the primary display, releasing keyboard keys [debug option] }
-- web-access. {phoning home, activation / update-checking}
-- creation / editing of files in %USERPROFILE%\Documents\ComroeStudios\
-- display capture. {GDI / Direct3D}
-- no EV code-signing on the binaries.
-- Obsidium integration. [anti-debugger, code obfuscation & byte-code virtualization / encryption of licensing implementation]
Unfortunately, I’d imagine that the above would look just like a keylogger or some other form of invasive malware. A-lot of stuff is done to emulate a look-alike single display mode of the desktop, while in a display span. Couple that with low user-coverage {not many copies in the wild}, and that’s likely doubly bad for AV trust. Back in 2014 and 2015 we did test quite a few AV's, and submit copies to their teams where problems were found -- though time has passed and that situation definitely looks like it's changed.
It’s my hopes that the unpacked binaries will help reduce concerns of various security software, and make any human analysis easier. -- Though be aware that as the activation system is tightly tied with Obsidium and not active until post packaging, the license fields will show dummy-strings in the ‘no obsidium’ binaries.
I’ll be reachable on this forum through direct-messages, by email, and also will be watching this thread. Like Mat has indicated, I’m quite curious to see what type of interest exists in DisplayClone .. and especially of prospective features and other-ideas that might be useful to instructors in any future rewrites.
{beyond the obvious stuff of making sure it works properly with modern Windows -- splitting the software into a service-model to get around the rights-issues, etc}
