Skip to content

Commit 45f0bc8

Browse files
PnwcomputersPnwcomputers
authored
Upgrade SystemTester.bat to version 2.5
Updated the script to version 2.5, increasing the download timeout and fixing TLS protocol handling for downloads.
1 parent f6493e5 commit 45f0bc8

1 file changed

Lines changed: 89 additions & 23 deletions

File tree

‎SystemTester.bat‎

Lines changed: 89 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ setlocal enableextensions enabledelayedexpansion
44
:: =====================================================
55
:: Portable Sysinternals System Tester Launcher
66
:: Created by Pacific Northwest Computers - 2025
7-
:: Production Ready Version - v2.4
7+
:: Production Ready Version - v2.5
88
:: =====================================================
99

1010
:: Constants
1111
set "MIN_ZIP_SIZE=10000000"
12-
set "DOWNLOAD_TIMEOUT_SEC=120"
13-
set "SCRIPT_VERSION=2.4"
12+
set "DOWNLOAD_TIMEOUT_SEC=180"
13+
set "SCRIPT_VERSION=2.5"
1414
if not defined ST_DEBUG set "ST_DEBUG=0"
1515
set "LAUNCH_LOG=%TEMP%\SystemTester_launcher.log"
1616

@@ -264,36 +264,92 @@ set "SYSINT_DIR=%SCRIPT_DIR%\Sysinternals"
264264
set "ZIP_FILE=%SCRIPT_DIR%\SysinternalsSuite.zip"
265265
set "DOWNLOAD_URL=https://download.sysinternals.com/files/SysinternalsSuite.zip"
266266

267-
echo This will download ~35MB from Microsoft.
267+
echo This will download ~170MB from Microsoft.
268268
echo Target: %SYSINT_DIR%
269269
echo.
270270
set /p "confirm=Proceed? (Y/N): "
271271
if /i not "%confirm%"=="Y" goto MENU
272272

273273
echo.
274274
echo Downloading...
275-
:: FIX v2.4: Added SSL bypass callback to handle VPN/proxy environments (e.g. Mullvad, Tailscale)
276-
:: that perform TLS interception, which previously caused download failures.
275+
:: ============================================================================
276+
:: FIX v2.5: Root cause of v2.4 breakage (reported 2026-04-28):
277+
:: The line "[Net.ServicePointManager]::SecurityProtocol = [Net...]::Tls12"
278+
:: ASSIGNED (=) the protocol enum, which silently DROPPED TLS 1.3 from the
279+
:: set of negotiated protocols. Microsoft's continued TLS 1.2 deprecation
280+
:: work through Q1 2026 (Azure Storage TLS 1.2-min Feb 2026, ongoing CDN
281+
:: hardening) plus the Akamai endpoint behind download.sysinternals.com
282+
:: appears to have started preferring/requiring TLS 1.3 handshakes,
283+
:: producing "underlying connection was closed" errors that get reported
284+
:: to the user as a generic "check your internet" message.
285+
::
286+
:: Changes:
287+
:: 1. Use -bor (bitwise OR) to ADD TLS 1.2/1.3 to whatever's already
288+
:: enabled instead of replacing the whole protocol mask.
289+
:: 2. Try BITS first (Start-BitsTransfer) - HTTP/2 capable, resumable,
290+
:: uses the BITS service which handles modern protocols cleanly.
291+
:: 3. Fall back to Invoke-WebRequest (matches v2.4 behavior).
292+
:: 4. Final fallback: System.Net.WebClient with cert validation bypass
293+
:: for VPN/proxy TLS-inspection environments (Mullvad, Tailscale).
294+
:: 5. Save and restore both SecurityProtocol and the cert callback so
295+
:: the script doesn't leave the PowerShell session in a weakened state.
296+
:: 6. Each method reports specifically which one failed and which one
297+
:: worked, so future debugging is not a guessing game.
298+
:: ============================================================================
277299
powershell -NoProfile -ExecutionPolicy Bypass -Command ^
278300
"$ProgressPreference='SilentlyContinue';" ^
301+
"$url='%DOWNLOAD_URL%';" ^
302+
"$out='%ZIP_FILE%';" ^
303+
"$timeout=%DOWNLOAD_TIMEOUT_SEC%;" ^
304+
"$origCallback=[Net.ServicePointManager]::ServerCertificateValidationCallback;" ^
305+
"$origProtocol=[Net.ServicePointManager]::SecurityProtocol;" ^
279306
"try {" ^
280-
" [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;" ^
281-
" [Net.ServicePointManager]::ServerCertificateValidationCallback = { $true };" ^
282-
" $iwc = Get-Command Invoke-WebRequest -ErrorAction SilentlyContinue;" ^
283-
" $p = @{ Uri = '%DOWNLOAD_URL%'; OutFile = '%ZIP_FILE%' };" ^
284-
" if ($iwc -and $iwc.Parameters.ContainsKey('UseBasicParsing')) { $p.UseBasicParsing = $true };" ^
285-
" if ($iwc -and $iwc.Parameters.ContainsKey('TimeoutSec')) { $p.TimeoutSec = %DOWNLOAD_TIMEOUT_SEC% };" ^
286-
" Invoke-WebRequest @p;" ^
287-
" [Net.ServicePointManager]::ServerCertificateValidationCallback = $null;" ^
288-
" Write-Host 'Download complete' -ForegroundColor Green" ^
289-
"} catch {" ^
290-
" [Net.ServicePointManager]::ServerCertificateValidationCallback = $null;" ^
291-
" Write-Host ('ERROR: ' + $_.Exception.Message) -ForegroundColor Red; exit 1" ^
307+
" $proto=[Net.ServicePointManager]::SecurityProtocol;" ^
308+
" try { $proto = $proto -bor [Net.SecurityProtocolType]::Tls12 } catch {};" ^
309+
" try { $proto = $proto -bor [Net.SecurityProtocolType]::Tls13 } catch {};" ^
310+
" [Net.ServicePointManager]::SecurityProtocol = $proto;" ^
311+
" $ok=$false; $lastErr='(none)';" ^
312+
" if (-not $ok) {" ^
313+
" try {" ^
314+
" Import-Module BitsTransfer -ErrorAction Stop;" ^
315+
" Start-BitsTransfer -Source $url -Destination $out -ErrorAction Stop;" ^
316+
" if (Test-Path $out) { $ok=$true; Write-Host ' [Method: BITS]' -ForegroundColor DarkGray }" ^
317+
" } catch { $lastErr=$_.Exception.Message; Write-Host (' BITS failed: ' + $lastErr) -ForegroundColor DarkYellow }" ^
318+
" }" ^
319+
" if (-not $ok) {" ^
320+
" try {" ^
321+
" $p=@{ Uri=$url; OutFile=$out; UseBasicParsing=$true; TimeoutSec=$timeout };" ^
322+
" Invoke-WebRequest @p -ErrorAction Stop;" ^
323+
" if (Test-Path $out) { $ok=$true; Write-Host ' [Method: Invoke-WebRequest]' -ForegroundColor DarkGray }" ^
324+
" } catch { $lastErr=$_.Exception.Message; Write-Host (' Invoke-WebRequest failed: ' + $lastErr) -ForegroundColor DarkYellow }" ^
325+
" }" ^
326+
" if (-not $ok) {" ^
327+
" try {" ^
328+
" [Net.ServicePointManager]::ServerCertificateValidationCallback = { $true };" ^
329+
" $wc=New-Object System.Net.WebClient;" ^
330+
" $wc.Headers.Add('User-Agent','Mozilla/5.0 SystemTester/2.5');" ^
331+
" $wc.DownloadFile($url,$out);" ^
332+
" $wc.Dispose();" ^
333+
" if (Test-Path $out) { $ok=$true; Write-Host ' [Method: WebClient + cert bypass]' -ForegroundColor DarkGray }" ^
334+
" } catch { $lastErr=$_.Exception.Message; Write-Host (' WebClient failed: ' + $lastErr) -ForegroundColor DarkYellow }" ^
335+
" }" ^
336+
" if ($ok) {" ^
337+
" Write-Host 'Download complete' -ForegroundColor Green" ^
338+
" } else {" ^
339+
" Write-Host ('ERROR: All download methods failed. Last error: ' + $lastErr) -ForegroundColor Red;" ^
340+
" exit 1" ^
341+
" }" ^
342+
"} finally {" ^
343+
" [Net.ServicePointManager]::ServerCertificateValidationCallback = $origCallback;" ^
344+
" [Net.ServicePointManager]::SecurityProtocol = $origProtocol;" ^
292345
"}"
293346

294347
if errorlevel 1 (
295348
echo.
296-
echo Download failed. Check internet connection.
349+
echo Download failed via all methods ^(BITS, Invoke-WebRequest, WebClient^).
350+
echo If you are on a VPN with TLS inspection, try disconnecting it and retrying.
351+
echo Manual fallback: %DOWNLOAD_URL%
352+
echo Extract to: %SYSINT_DIR%
297353
if exist "%ZIP_FILE%" del "%ZIP_FILE%" 2>nul
298354
pause
299355
goto MENU
@@ -644,7 +700,15 @@ echo ========================================================
644700
echo HELP / TROUBLESHOOTING GUIDE v%SCRIPT_VERSION%
645701
echo ========================================================
646702
echo.
647-
echo NEW IN v2.4:
703+
echo NEW IN v2.5:
704+
echo - Fixed Sysinternals download failure (post 2026-04-28)
705+
echo - Root cause: TLS protocol assignment dropped TLS 1.3 support
706+
echo - Now uses BITS first, falls back to IWR, then WebClient
707+
echo - Properly preserves and restores SecurityProtocol state
708+
echo - Updated download size estimate (~170MB, was ~35MB)
709+
echo - Increased download timeout to 180s for larger payload
710+
echo.
711+
echo PREVIOUS (v2.4):
648712
echo - Fixed Test-NetConnection port=0 error (latency test)
649713
echo - Fixed SSL/TLS download failure under VPN/proxy (Mullvad, Tailscale)
650714
echo - Multiple fallback URLs for internet speed test
@@ -667,9 +731,11 @@ echo 3. TOOLS MAY BE CORRUPTED
667731
echo Solution: Use Menu Option 4 to verify integrity
668732
echo Then Option 5 to re-download if needed
669733
echo.
670-
echo 4. DOWNLOAD FAILS (SSL/TLS error)
671-
echo Cause: VPN or proxy performing TLS inspection
672-
echo This is auto-handled in v2.4 for most cases.
734+
echo 4. DOWNLOAD FAILS (SSL/TLS / connection closed)
735+
echo Cause: Forced TLS 1.2-only (v2.4) dropped TLS 1.3 support after
736+
echo Microsoft/Akamai endpoint hardening around April 2026.
737+
echo v2.5 fix: tries BITS, then Invoke-WebRequest, then WebClient,
738+
echo with TLS 1.2 + 1.3 negotiated additively.
673739
echo Manual fallback:
674740
echo https://download.sysinternals.com/files/SysinternalsSuite.zip
675741
echo Extract to: %SCRIPT_DIR%\Sysinternals\

0 commit comments

Comments
 (0)