| Info | Message |
|---|---|
| 1) Message boards : Questions and problems : Windows Exploit Protection Settings - Which exe to whitelist to avoid memory errors?
Message 116046 Posted 3 May 2025 by SoCrunchy |
Personally, just whitelisting C:\ProgramData\BOINC is a whole lot easier. FYI only individual applications can be whitelisted, not entire folders. Sorta like Microsoft EMET, which Windows Exploit Protection replaces. I think the protection works by DLL injection or something, but I don't remember. I tried to edit the Original Post (and the title) to put "Solved," but this forum must have a time limit on post and thread edits. I figured it out though. |
| 2) Message boards : Questions and problems : Windows Exploit Protection Settings - Which exe to whitelist to avoid memory errors?
Message 116044 Posted 3 May 2025 by SoCrunchy |
(Cross-posted from WCG Forums) The tl;dr is that it's the individual science application that has to be excluded in the Windows Exploit settings, not any of the BOINC application executables (boinc.exe, boinctray.exe, boincmgr.exe, boinccmd.exe, etc.). But since the Windows GUI forces you to only select applications ending in "exe," it wouldn't let me add the science application that was crashing. But if you use the PowerShell command, it'll force add it to the list. You can then use the Windows GUI like usual. Full text below. This example specifically refers to the World Community Grid's Mapping Cancer Markers application, but the solution can be applied to any science application in any BOINC project that crashes. In this case, it was "Bottom Up ASLR" that was causing the memory crash. --------------- Got it!!! I was curious why ARP1 was working just fine but MCM1 would error out, all else being equal. I even deleted the exclusions for boinc.exe, boinctray.exe, boincmgr.exe, and boinccmd.exe. All gone, meaning the protections are active for BOINC as a whole. So since ARP1 worked and MCM1 gave an error, that meant I really needed to figure out a way to exclude the science application itself. But since the science application's name is wcgrid_mcm1_map_7.61_windows_x86_64 and not wcgrid_mcm1_map_7.61_windows_x86_64.exe, if you use the GUI way (mouse, keyboard, etc.), Windows does not let you make a new exclusion. It's hell-bent on exe only. So I did a quick web search and found that MS article, and there's a PowerShell way to enable/disable all that stuff. From this Microsoft documentation article Enable exploit protection, it describes multiple ways to enable, disable, or fine-tune the Windows Exploit protections, both for individual apps as well as system-wide. So the first thing I did was turn off 4 of the protections for MCM1 using this command: Set-ProcessMitigation -Name wcgrid_mcm1_map_7.61_windows_x86_64 -Disable CFG, BottomUp, SEHOP, TerminateOnError MCM1 worked!!! But since I am stubborn and wanted to narrow it down to the EXACT root cause (while still turning on as much protection as possible), I did more trial and error. It turns out that "Bottom up ASLR" is the protection that causes MCM1 to crash. It doesn't like that. So here are the steps to add an exclusion. 1. Open up a PowerShell command prompt as Administrator. 2. Use this command: Set-ProcessMitigation -Name wcgrid_mcm1_map_7.61_windows_x86_64 -Disable BottomUp (Of course, exit out of BOINC Manager before you do this.) Working great! I assume if any individual science applications crash, then we have to exclude the science application for that particular sub-project. Feels good to beat something up and find an answer even if it's frustrating as heck in the meantime. Hope this helps any other security nerds who are running Windows and trying to max out security settings. Most people have them turned off so none of this applies. |
| 3) Message boards : Questions and problems : Windows Exploit Protection Settings - Which exe to whitelist to avoid memory errors?
Message 116032 Posted 2 May 2025 by SoCrunchy |
OS: Windows 10 Pro 22H2 64-bit BOINC: 8.02 - not running as a service Project: World Community Grid Regarding Windows 10/11's Exploit Protection Settings, which replace the [discontinued] EMET: I recently learned that "Use default (On)" is not the same as "On by default" in Windows Exploit Protection system-wide settings. The wording is not the best. The former is optional, and the latter is mandatory. Since turning a bunch of settings to "On by default" and rebooting, I can't run any tasks in BOINC / World Community Grid anymore. (Using the latest 8.0.2). I have changed: * Control flow guard (CFG) * Force randomization for images (Mandatory ASLR) * Randomize memory allocations (Bottom-up ASLR) * High-entropy ASLR * Validate exception chains (SEHOP) * Validate heap integrity So when downloading a Mapping Cancer Markers (MCM1) task, it gives me an error immediately. So in "Program settings" in Exploit protection, you can whitelist exe's and turn off individual protections just so the app will work. I've turned off ALL of these settings for "boinc.exe" and MCM1 tasks still fail immediately. It won't let me whitelist "wcgrid_mcm1_map_7.61_windows_x86_64" since it only allows the exe extension. So I totally thought boinc.exe was the wrapper executable that runs all the science applications underneath it. I haven't tried with boinctray.exe or boincmgr.exe but I think those are just for the Graphical User Interface of BOINC Manager and have nothing to do with running the actual science apps, no? Still getting the computation error immediately, even after whitelisting the following executables: boinc.exe boinccmd.exe boincmgr.exe boinctray.exe I have the following 7 system overrides for all of the above: * Control flow guard (CFG) * Data Execution Prevention (DEP) * Force randomization for images (Mandatory ASLR) * Randomize memory allocations (Bottom-up ASLR) * High-entropy ASLR * Validate exception chains (SEHOP) * Validate heap integrity I've also restarted BOINC/BOINC Manager/etc. before testing with a new task. I've confirmed that -- at least in the GUI -- I can only add files with a "exe" extension, meaning I can't specifically whitelist the "wcgrid_mcm1_map_7.61_windows_x86_64" MCM1 science application. But I thought "boinc.exe" was basically the wrapper executable that runs all the science binaries underneath it, so I was hoping that turning off exploit mitigations on that exe would solve the problem. So anyone here have any guidance or solutions on 1) which exe to whitelist; and 2) which specific mitigations to disable that are causing the crash? Thank you. |
| 4) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111572 Posted 15 Apr 2023 by SoCrunchy |
BOINC 7.20.2 on Windows 7 Pro SP1 64-bit works fine:4/15/2023 8:53:43 AM | World Community Grid | update requested by user 4/15/2023 8:53:43 AM | | [http] HTTP_OP::init_get(): https://www.worldcommunitygrid.org/viewNoticesRSSFeed.action?userIdHash=blah 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Too old connection (127 seconds idle), disconnect it 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Connection 3 seems to be dead 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Closing connection 3 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: schannel: shutting down SSL/TLS connection with boinc.berkeley.edu port 443 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Too old connection (127 seconds idle), disconnect it 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Connection 2 seems to be dead 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Closing connection 2 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: schannel: shutting down SSL/TLS connection with scheduler.worldcommunitygrid.org port 443 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Too old connection (124 seconds idle), disconnect it 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Connection 4 seems to be dead 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Closing connection 4 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: schannel: shutting down SSL/TLS connection with download.worldcommunitygrid.org port 443 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Found bundle for host: 0x2b06da0 [serially] 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Trying 199.241.167.118:443... 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: Connected to www.worldcommunitygrid.org (199.241.167.118) port 443 (#6) 4/15/2023 8:53:44 AM | | [http] [ID#0] Info: schannel: disabled automatic use of client certificate 4/15/2023 8:53:44 AM | | [http] [ID#0] Sent header to server: GET /viewNoticesRSSFeed.action?userIdHash=blahblahHTTP/1.1 4/15/2023 8:53:44 AM | | [http] [ID#0] Sent header to server: Host: www.worldcommunitygrid.org 4/15/2023 8:53:44 AM | | [http] [ID#0] Sent header to server: User-Agent: BOINC client (windows_x86_64 7.20.2) 4/15/2023 8:53:44 AM | | [http] [ID#0] Sent header to server: Accept: */* 4/15/2023 8:53:44 AM | | [http] [ID#0] Sent header to server: Accept-Encoding: deflate, gzip 4/15/2023 8:53:44 AM | | [http] [ID#0] Sent header to server: Accept-Language: en_US 4/15/2023 8:53:44 AM | | [http] [ID#0] Sent header to server: |
| 5) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111571 Posted 15 Apr 2023 by SoCrunchy |
The change from ca-bundle.crt to schannel was the subject of intense discussion and testing in early October 2021 - I was heavily involved in that process. The first Windows release for v7.20 (7.20.0) became available in mid-June 2022. Details in https://github.com/BOINC/boinc/pull/4545. Hi Richard! I've posted a little on the GitHub over the years but made an account here. Been out of the loop a couple years. This only affects BOINC 7.20.0+ and only BOINC 7.20.0+ on the affected machines. Windows Updates and everything works without any issue. All web browsers (including Internet Explorer, Edge) connect to https sites without issue. No proxy or VPN or anything out of the ordinary. The only thing that comes to mind is I've disabled IPv6 on the adapters, leaving only IPv4. I haven't done anything in the Registry except disable the Windows Script Host, which prevents execution of .js and .vbs files. I can't think of anything out of the ordinary on these machines. Everything works except BOINC 7.20 and above. Desktop 1: Firefox Beta, Firefox Developer, Chromium, Thunderbird, messaging apps, MS Office, Spotify, dozens more normal apps that typically use https. Desktop 2: Firefox Beta, Google Chrome, Android Studio, etc. Laptop 3: Currently never had BOINC installed, but is a fresher Windows 10 install than the desktops. I can try BOINC 7.20.0 on it (and assume it will work lol). Worst case scenario: It's not the end of the world. I plan on retiring both of these desktops sometime in 2023. Selling one and putting Linux on the other. I can get by just fine with 7.16 which uses ca-bundle.crt. This is more of a curiosity and wanting to be on the latest stable release. |
| 6) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111568 Posted 14 Apr 2023 by SoCrunchy |
Btw, something you said: 2nd line in the Wiki release notes. It wasn't immediately clear at first since it didn't say "CA" or "certificate" bundle, but it's clear if you think about it. Changes in 7.20.0 In other words: * In 7.16: Event Log with http_debug turned on: See BOINC mention using C:\Program Files\BOINC\ca-bundle.crt specifically and then successfully connect to WCG, Berkeley, Google, etc. * In 7.20+: Event Log with http_debug turned on: See BOINC mention Microsoft Schannel, which means BOINC now relies on Windows to set up the TLS session using built-in CA certificate store and built-in cryptographic libraries I can post the Event Log that 7.16 uses. But yes, I do believe since 7.20.0 that the OS's cert bundle is used. |
| 7) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111563 Posted 14 Apr 2023 by SoCrunchy |
The revocation function was unable to check revocation because the revocation server was offlineHow do you connect to the internet? Via a proxy? A VPN? Any other means that uses its own certificate or certificate server, like a corporate server (active server or domain) or firewall? No proxy. No VPN. No special certificate or CA situation. No corporate server, just home user and home network. No special firewall or TLS decryption/deep packet inspection stuff. No Active Directory domain or anything fancy like that. No fancy HIDS/HIPS or even 3rd party antivirus. Just using Windows Defender. BOINC 7.16.x version works perfectly fine, but it uses C:\Program Files\BOINC\ca-bundle.crt instead of relying on Windows. Edited to Add: I tried BOINC 7.22.0 for Windows (unreleased I believe), and it's the same error. Here's a part where it tries to access the reference site: 4/14/2023 11:00:03 AM | | [http] [ID#0] Info: Trying 64.233.185.147:443... 4/14/2023 11:00:03 AM | | [http] [ID#0] Info: Connected to www.google.com (64.233.185.147) port 443 (#1) 4/14/2023 11:00:03 AM | | [http] [ID#0] Info: schannel: disabled automatic use of client certificate 4/14/2023 11:00:03 AM | | [http] [ID#0] Info: ALPN: offers http/1.1 4/14/2023 11:00:03 AM | | [http] [ID#0] Info: schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline. 4/14/2023 11:00:03 AM | | [http] [ID#0] Info: Closing connection 1 4/14/2023 11:00:03 AM | | [http] HTTP error: SSL connect error 4/14/2023 11:00:03 AM | | BOINC can't access Internet - check network connection or proxy configuration. |
| 8) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111561 Posted 14 Apr 2023 by SoCrunchy |
Thanks for the http_debug idea. I upgraded one of the boxes from 7.16.11 to 7.20.2 4/14/2023 10:27:11 AM | World Community Grid | update requested by user 4/14/2023 10:27:12 AM | | [http] HTTP_OP::init_get(): https://www.worldcommunitygrid.org/viewNoticesRSSFeed.action?userIdHash=[hash-redacted] 4/14/2023 10:27:12 AM | | [http] [ID#0] Info: Hostname in DNS cache was stale, zapped 4/14/2023 10:27:12 AM | | [http] [ID#0] Info: Trying 199.241.167.118:443... 4/14/2023 10:27:12 AM | | [http] [ID#0] Info: Connected to www.worldcommunitygrid.org (199.241.167.118) port 443 (#3) 4/14/2023 10:27:12 AM | | [http] [ID#0] Info: schannel: disabled automatic use of client certificate 4/14/2023 10:27:12 AM | | [http] [ID#0] Info: ALPN: offers http/1.1 4/14/2023 10:27:12 AM | | [http] [ID#0] Info: schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline. 4/14/2023 10:27:12 AM | | [http] [ID#0] Info: Closing connection 3 4/14/2023 10:27:12 AM | | [http] HTTP error: SSL connect error 4/14/2023 10:27:15 AM | World Community Grid | Sending scheduler request: Requested by user. 4/14/2023 10:27:15 AM | World Community Grid | Reporting 1 completed tasks 4/14/2023 10:27:15 AM | World Community Grid | Not requesting tasks: don't need () 4/14/2023 10:27:15 AM | World Community Grid | [http] HTTP_OP::init_post(): https://scheduler.worldcommunitygrid.org/boinc/wcg_cgi/fcgi 4/14/2023 10:27:15 AM | | [http] HTTP_OP::init_get(): https://boinc.berkeley.edu/download.php?xml=1 4/14/2023 10:27:15 AM | | [http] [ID#0] Info: Trying 208.68.240.115:443... 4/14/2023 10:27:15 AM | World Community Grid | [http] [ID#1] Info: Trying 199.241.167.118:443... 4/14/2023 10:27:15 AM | World Community Grid | [http] [ID#1] Info: Connected to scheduler.worldcommunitygrid.org (199.241.167.118) port 443 (#4) 4/14/2023 10:27:15 AM | World Community Grid | [http] [ID#1] Info: schannel: disabled automatic use of client certificate 4/14/2023 10:27:15 AM | World Community Grid | [http] [ID#1] Info: ALPN: offers http/1.1 4/14/2023 10:27:15 AM | | [http] [ID#0] Info: Connected to boinc.berkeley.edu (208.68.240.115) port 443 (#5) 4/14/2023 10:27:15 AM | | [http] [ID#0] Info: schannel: disabled automatic use of client certificate 4/14/2023 10:27:15 AM | | [http] [ID#0] Info: ALPN: offers http/1.1 4/14/2023 10:27:15 AM | World Community Grid | [http] [ID#1] Info: schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline. 4/14/2023 10:27:15 AM | World Community Grid | [http] [ID#1] Info: Closing connection 4 4/14/2023 10:27:15 AM | World Community Grid | [http] HTTP error: SSL connect error 4/14/2023 10:27:15 AM | | [http] [ID#0] Info: schannel: next InitializeSecurityContext failed: Unknown error (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline. 4/14/2023 10:27:15 AM | | [http] [ID#0] Info: Closing connection 5 4/14/2023 10:27:15 AM | | [http] HTTP error: SSL connect error 4/14/2023 10:27:16 AM | World Community Grid | Scheduler request failed: SSL connect error |
| 9) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111559 Posted 14 Apr 2023 by SoCrunchy |
I'm gonna try this tool and see if I'm compromised by malware that installed a rogue CA certificate. https://www.ghacks.net/2015/11/25/give-your-windows-certificate-store-a-thorough-scan-for-suspicious-certs/ But even if I was, BOINC would still be able to hit the Google.com test site. It'd just be MITM to the attacker. Edit: Microsoft Sigcheck seems newer and part of their SysInternals suite. I'll run that. |
| 10) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111558 Posted 14 Apr 2023 by SoCrunchy |
I'm on Win10Pro 22H2 and make sure to get the monthly Windows Updates. Currently on April 2023 patch level. I just wish there was a way to troubleshoot this. Maybe I can run a packet capture on the router and see if the Windows boxes are even making an outbound attempt to Google from BOINC, but I think they're not even leaving the system. I do have Secure Boot disabled on these boxes unfortunately. It's weird that it affects two of my desktops instead of just one. There was a known issue in Windows 11 where TLS handshakes would fail, but I couldn't find a known issue in Windows 10 for the same thing. I could somehow try to find the source code on GitHub on how BOINC 7.20+ uses the Windows API for TLS, but... my programming is rusty. I have a newer laptop on Windows as well and could try BOINC 7.20 and see if the problem occurs on the laptop too or not. For now, 7.16 works fine, and I do plan on selling or retiring both of these PCs. It's just annoying I can't find out root cause. |
| 11) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111556 Posted 14 Apr 2023 by SoCrunchy |
This has nothing to do with WCG being up or down and everything to do with why 7.20 (which uses Windows's CA certificate bundle instead of BOINC's ca-bundle.crt) doesn't work. In case it's not clear from my OP: 1. In 7.20 on Windows, even the reference site connectivity fails to https://google.com 2. Downgrading to 7.16 on Windows works fine. I need help identifying the reason BOINC 7.20.x on Windows fails to set up a TLS handshake. |
| 12) Message boards : BOINC client : "SSL Connect Error" BOINC 7.20.2 for Windows 10 22H2
Message 111552 Posted 14 Apr 2023 by SoCrunchy |
Originally asked on the WCG forums: https://www.worldcommunitygrid.org/forums/wcg/viewthread_thread,44701 Hi, first post on the BOINC forums. I tend to prefer using the latest stable release of software and was excited to upgrade to the 7.20 branch of BOINC client/manager. I noticed in the changelog that instead of using C:\Program Files\BOINC\ca-bundle.crt like earlier branches, the 7.20 branch uses Windows's built-in CA certificates. Yet when attempting to use 7.20.x, I get: 11/10/2022 7:23:25 PM | World Community Grid | Requesting new tasks for CPU 11/10/2022 7:23:26 PM | | Project communication failed: attempting access to reference site 11/10/2022 7:23:26 PM | World Community Grid | Scheduler request failed: Couldn't connect to server 11/10/2022 7:23:27 PM | | BOINC can't access Internet - check network connection or proxy configuration. 11/10/2022 7:24:13 PM | World Community Grid | update requested by user 11/10/2022 7:24:16 PM | World Community Grid | Sending scheduler request: Requested by user. 11/10/2022 7:24:16 PM | World Community Grid | Requesting new tasks for CPU 11/10/2022 7:24:17 PM | World Community Grid | Scheduler request failed: SSL connect error Note: I'm able to connect to other local computers on the local network, which means that networking works fine in BOINC Manager. The issue is solely with connectivity to the outside world, since 1) connectivity to WCG fails; and 2) connectivity to the reference site (I believe BOINC uses https://google.com) also fails. I've since reverted back to the 7.16.11 version, which works fine. Can someone help me troubleshoot and resolve this? I'm not using a proxy or anything. Just a home user on Windows 10 Pro 22H2. This SSL error occurs on two PCs, and the workaround to downgrade to 7.16 worked on both PCs. Either BOINC cannot access the Windows CA certificates, or maybe my computers are compromised, which would be creepy. Any ideas? I didn't get any solutions on the WCG forums. |
Copyright © 2026 University of California.
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License,
Version 1.2 or any later version published by the Free Software Foundation.