Some of them use state of the art obfuscation to make this a PIA, others are not that good[0]
The one I've taken a look at(forgot it's name) was using VMProtect and had a competently written VM detection routine.
It wasn't my exam so I recommended that they use a kvm switch instead of fumbling around with vm hiding tools.
