Exam Lockdown & Security

Relevant source files

The following files were used as context for generating this wiki page:

• PeP.ExamApp/Pages/AntiCheatPage.xaml.cs
• PeP.ExamApp/NativeMethods.cs
• PeP.ExamApp/MainWindow.xaml.cs
• PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs
• PeP.ExamApp/Controls/ExamTaskbar.xaml.cs
• Services/ExamAppService.cs
• Models/ExamAppModels.cs

The Exam Lockdown & Security system is a core feature of the PeP Exam App, a WPF desktop application designed to provide a secure and controlled environment for students taking exams. Its primary purpose is to prevent cheating by restricting the student's access to other applications, system functions, and unauthorized resources during an exam session. This is achieved through a multi-layered approach that includes pre-exam system validation, a comprehensive runtime lockdown (kiosk mode), continuous violation monitoring, and hardening of the web-based exam interface.

The system is orchestrated by the ExamModeManager and involves several key components that work together. The process begins with the AntiCheatPage, which performs a series of security checks. If the system is compliant, the student can proceed to the ExamRunnerPage, which initiates the full lockdown and displays the exam content within a secured WebView2 control.

System Architecture

The lockdown system is primarily managed by the ExamModeManager, which is instantiated and controlled by the main application window, MainWindow. It leverages native Windows API calls, exposed via the NativeMethods class, to enforce system-level restrictions.

The following diagram illustrates the relationship between the main components of the lockdown and security system.

Pre-Exam Security Checks

Before an exam can be launched, the AntiCheatPage performs a series of checks to ensure the student's system is in a compliant state. The RunChecks method calls SecurityChecks.RunFullSecurityCheck() and updates the UI to reflect the status of each check. The exam can only be launched if all checks pass.

Sources: PeP.ExamApp/Pages/AntiCheatPage.xaml.cs:88-92

The flow of the pre-exam check is as follows:

The following security checks are performed:

Check	Description	Pass Condition	Source File & Lines
Administrator	Verifies if the application is running with administrative privileges.	report.IsAdmin is true.	AntiCheatPage.xaml.cs:96-97
Single Monitor	Ensures only one display is connected to prevent content from being shown on a second screen.	report.MonitorCount == 1.	AntiCheatPage.xaml.cs:99-100
Remote Session	Checks if the user is in a remote desktop session (e.g., RDP, TeamViewer).	report.IsRemoteSession is false.	AntiCheatPage.xaml.cs:102-103
Virtual Machine	Detects if the application is running inside a virtual machine.	report.IsVM is false.	AntiCheatPage.xaml.cs:105-106
Debugger	Checks if a debugger is attached to the application process.	report.IsDebuggerAttached is false.	AntiCheatPage.xaml.cs:108-109
Blacklisted Processes	Scans for running processes associated with screen recording, remote access, or cheating tools.	report.BlacklistedProcesses.Count == 0.	AntiCheatPage.xaml.cs:111-113
Screen Recording	Checks for active screen recording sessions using system APIs.	report.IsScreenRecording is false.	AntiCheatPage.xaml.cs:124-125

If blacklisted processes are found, the user is given an option to close them automatically via the KillBlacklistedProcesses method.

Sources: PeP.ExamApp/Pages/AntiCheatPage.xaml.cs:43-45

Exam Mode Lockdown

Once the security checks pass, the ExamRunnerPage is loaded, which immediately calls _mainWindow.EnterExamMode(). This triggers the ExamModeManager to apply a series of system-level restrictions using native Windows API calls.

Sources: PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs:64-68, PeP.ExamApp/MainWindow.xaml.cs:55-58

Lockdown Activation and Deactivation

The following sequence diagram shows the process of entering and exiting exam mode.

Lockdown Features

When exam mode is active, the following restrictions are enforced:

• Keyboard Shortcut Blocking: A low-level keyboard hook (WH_KEYBOARD_LL) is installed to intercept and block system-wide key combinations.
• Focus Locking: The application window is locked as the foreground window to prevent switching to other applications.
• Window Topmost: The main window is set to be Topmost and covers the entire screen, including the taskbar.
• Screen Capture Prevention: SetWindowDisplayAffinity is used with WDA_MONITOR to prevent the window content from being captured by most screen recording or screenshot tools.
• Closing Prevention: The OnClosing event of the MainWindow is handled to prevent the user from closing the application while the exam is in progress.

Sources: PeP.ExamApp/MainWindow.xaml.cs:28-39, 218-226, PeP.ExamApp/NativeMethods.cs:100, 150, 290

The following keyboard shortcuts are explicitly blocked by the low-level hook:

• Alt + Tab
• Alt + F4
• Left/Right Windows Key
• Ctrl + Esc
• Ctrl + Shift + Esc
• Print Screen (VK_SNAPSHOT)
• Ctrl + Alt + Del (The hook attempts to block this, though its success can depend on OS version and policy)

Sources: PeP.ExamApp/NativeMethods.cs:122-140

Violation Detection and Handling

The ExamModeManager detects attempts to bypass the lockdown, such as trying to switch applications. When a violation is detected, it raises the SecurityViolationDetected event.

• The MainWindow listens for this event and calls OnSecurityViolationDetected.
• Inside this handler, a counter _securityViolationCount is incremented.
• A temporary, semi-transparent overlay is displayed to notify the user of the violation.
• The ExamTaskbar control periodically checks the violation count via _mainWindow.GetSecurityViolationCount() and displays the total number of detected violations.

Sources: PeP.ExamApp/MainWindow.xaml.cs:14, 98-105, 126-129, PeP.ExamApp/Controls/ExamTaskbar.xaml.cs:98-111

WebView2 Hardening

The exam content is displayed within a Microsoft.Web.WebView2.Wpf.WebView2 control. To enhance security, this control is "hardened" in the ExamRunnerPage by disabling features that could be exploited.

The HardenWebView2 method applies the following settings:

Setting	Value	Purpose
AreDevToolsEnabled	false	Prevents access to browser developer tools.
AreDefaultContextMenusEnabled	false	Disables the right-click context menu.
AreBrowserAcceleratorKeysEnabled	false	Disables keys like Ctrl+P, Ctrl+F, etc.
IsStatusBarEnabled	false	Hides the status bar.
IsZoomControlEnabled	false	Prevents zooming in or out.
IsBuiltInErrorPageEnabled	false	Disables the default WebView2 error page.

Additionally, the following event handlers are implemented:

• OnNewWindowRequested: Blocks popups and new windows by setting e.Handled = true.
• OnDownloadStarting: Prevents file downloads by setting e.Cancel = true.
• OnNavigationStarting: Restricts navigation to only allow URLs that match the authority of the initial server URI.
• OnPermissionRequested: Denies requests for permissions like ClipboardRead, Camera, and Microphone.

Sources: PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs:158-201

Native API Integration

The entire lockdown mechanism relies on the Windows API, accessed via P/Invoke through the static NativeMethods class. This class serves as a C# wrapper for unmanaged functions in user32.dll, kernel32.dll, etc.

Key functions used for security include:

Native Function	Purpose in Exam App
SetWindowsHookEx	Installs a low-level keyboard hook to intercept and block system-wide key presses.
UnhookWindowsHookEx	Removes the keyboard hook when exam mode ends.
LockSetForegroundWindow	Prevents other windows from stealing focus from the exam app.
SetWindowDisplayAffinity	Makes the window content appear black in screenshots and screen recordings.
IsDebuggerPresent	Detects if a debugger is attached to the process.
GetSystemMetrics	Used with SM_REMOTESESSION to detect remote desktop connections and SM_CMONITORS for multiple displays.
SetWindowPos	Used to ensure the main window is always on top and covers the full screen.
FindWindow, ShowWindow	Used to find and hide the system taskbar and Start button.

Sources: PeP.ExamApp/NativeMethods.cs

Conclusion

The Exam Lockdown & Security system in PeP5 employs a robust, layered strategy to ensure academic integrity. It combines proactive system checks, a restrictive runtime environment that locks down the user's desktop, and hardening of the web-based exam content view. By leveraging low-level Windows APIs, it effectively transforms a standard PC into a single-purpose kiosk for the duration of the exam, minimizing opportunities for cheating and providing a controlled, fair testing environment.