Respondus LockDown Browser: VM Detection, Process Sandboxing & Display Layer Limitations
Technical audit of Respondus LockDown Browser (LDB). Learn how it locks down keyboards, detects virtual machines, and interacts with native desktop overlays.
Unlike browser extensions, Respondus LockDown Browser is a dedicated native desktop application built on an embedded Chromium CEF framework. It enforces a strict kiosk environment.
Architecture of Respondus LockDown Browser (LDB)
LDB runs as an elevated native process. Upon startup, it terminates blacklisted background applications (communication apps like Discord, Skype, and Zoom) before entering full-screen kiosk mode.
How LDB Detects Virtual Machines (VMware, VirtualBox, QEMU)
Running LDB inside a virtual machine frequently fails because LDB checks:
CPUID leaf 0x1 (ECX bit 31): Returns 1 if a hypervisor is present.- Registry hardware keys containing "QEMU", "VBOX", or "VMware".
- System device tree strings (e.g., VirtualBox Guest Additions).
System Keyboard & Clipboard Hooking (WH_KEYBOARD_LL)
On Windows, LDB registers a low-level keyboard hook (SetWindowsHookEx with WH_KEYBOARD_LL) to trap Alt+Tab, Windows Key, and Ctrl+Esc combinations.
Display Layering & Fullscreen Exclusivity Boundaries
Understanding how Windows DWM composites layered windows (WS_EX_LAYERED and WS_EX_TOPMOST) demonstrates how native desktop HUDs can maintain non-intrusive visibility above kiosk layers.