To clarify/simplify and merge the instructions above for workstations using Windows:

To simplify the instructions in both the .bat file and the sbulletsupport topics:

1. Download OpenSSL

The following link should have what you need. You need to select 
==> https://slproweb.com/products/Win32OpenSSL.html

Assuming you are on a 64bit machine, the option "Windows64 OpenSSL v3.0.0" in the list, should be what you download (https://slproweb.com/download/Win64OpenSSL-3_0_0.exe)

2. Once you download, please follow the instructions and install the binaries on your machine.

3. Once everything is installed, create a new directory at a convenient place. Copy and paste the following files from following locations into this newly created directory:

==> From the OpenSSLCreateCertMacWin folder that you downloaded and extracted from sbulletsupport website
- CreateWindowsCertificate.bat
-v3.ext

==> From the C:\Program Files\OpenSSL-Win64\bin (unless you installed the open SSL at a different location)

-openSSL.exe


4. If you do have an existing configuration file for creating OpenSSL certificates, pls provide access to that in the .bat file (right click and edit the .bat file and set the OPENSSLCONFIG= option to point to the right location)

If you DO NOT HAVE one, the batch file will create one for you during execution (Command Prompt). Edit/Delete the OPENSSLCONFIG= option off the .bat file.

Per comments in the .bat file:

==> Common Name (CN) specified in this step should be 127.0.0.1, or the CN must match the wss address used by the app.
Example:
Country Name: US
State: Florida
Locality: Pensacola
Organization: Example Company
Unit Name: EC
Common Name: 127.0.0.1
Email: support@examplecompany.com

==> you can just press enter and skip for "extra" attributes


5. Double check to make sure you have all 3 files needed in the same directory (createWindowsCertificate.bat,v3.ext,openssl.exe) and run the .bat file in command prompt like (createWindowsCertificate.bat) and follow/fillout the attributes.

All necessary certificates will be created.

Once created, all you need to do is to make sure the certificates files are in the same directory as the Ranger Remote installer, and during Ranger Remote installation you choose the wss install option.

Background: Why can't we call Shutdown() in every Ranger state?

Many low-level scanner drivers require that they be shutdown in a specific orderly sequence. If they are abruptly disconnected, it can leave the scanner and/or device driver in an unexpected, and often hung state.

As far as programming documentation goes, the description of a Ranger call in the programming guide mentions the Ranger states that a particular call can be made in.  The state diagram in the manual also graphically describes this.

In the case of Shutdown(), it can be called when Ranger is in the ChangeOptions and ReadyToFeed states.  So the application is responsible for putting Ranger into one of these states before calling Shutdown(). 

When I write applications, I handle it this way:
   A. When the application decides it will call Shutdown(), it checks the current Ranger state.
   B. If Ranger is in a state where Shutdown() is allowed, the application calls Shutdown().

When Ranger is in a state where Shutdown() cannot be called yet, then the application will:
   1. Set a variable to tell itself that it is preparing to shutdown (ex: PreparingToShutdown = true)
   2. Then the application will call the Ranger function(s) required to bring Ranger into the target state, then let Ranger run unimpeded until the target state is reached. 

WARNING: Never use a loop that checks the Ranger state.  The OS message pump needs to run normally for the Ranger state transitions to complete properly.

   3. The application code that handles the Ranger state changing events tests the value of PreparingToShutdown to determine if it is trying to shutdown.
   4. Shutdown() can then be called once Ranger reaches the target state.

There are a few scenarios which may require a couple of state transitions to end up in a state where Shutdown() is allowed.
For example, if Ranger is handling an exception.
So more than one state changing functions, may be required to bring Ranger into the target state.

One of the easiest ways to avoid problems is to disable the ability for the user to exit the application when Ranger is in a state where Shutdown() cannot be called.  So if items are feeding for example, they user would not be given the ability to exit (by as disabling the "exit" button).  However, once feeding has stopped, and Ranger is in the ReadyToFeed state, then the option to exit the application can be enabled.

By default, an insecure loopback URL is used for the socket connection between Ranger and Ranger Remote, listening on port
9002. The IP Address for local loopback is ?127.0.0.1?.

In order to override the target IP address of the Ranger Remote service, the JavaScript application can set the Ranger property
"wsUrl" to the target WebSocket URL address.

Example:
Ranger.wsUrl = ?ws://124.58.31.40:9002?


Ranger JavaScript will uses this URL when Ranger.StartUp() is called to establish a WebSocket connection to Ranger Remote service.

This vulnerability has been addressed by SBT.  Please refer to the following information below to make necessary Ranger updates to prevent this vulnerability on workstations:

1. SBTLogServiceWindows is already a deprecated service. No Ranger Core installer newer than 4.5.x.x should install this service.This Service path will linger even after uninstalling the old plugins, but you can safely delete this service path (without affecting SBTLogService)

2. All other Services Ranger installs have also been certified for quoted paths starting from Ranger Core 4.8.1.6-X.X.X.X. Ranger Core before 4.8.1.6 might install SBT Log Service with an unquoted path.

3. Ranger Remote Service installers starting from 2.2.1.7 will also not install any services with an unquoted path


You can read more about this vulnerability here:
https://medium.com/@harshaunsingh/windows-privileged-escalation-manual-and-using-metasploit-framework-ch-1-fd5f31a7db86

RangerForCanon-CR50CR80CRL1-4.9.4.0-2.1.0.8 is here!

For Ranger versions prior to v5.0, you can make Ranger "forget" about a Ranger license unlock by deleting your Ranger product key from the Windows Registry.  The Ranger FAQ article below describes the location of the key.

---

How-to force eject the document with a Canon CR-120/150?


  Ranger.CallPassthroughMethod("FlushTrack(1)")


...where '1' is the target pocket for flushed documents.


Bryan Clark

---

You should obtain your Ranger software from your check scanning application vendor. Only they know which version(s) of Ranger their application was tested with.

A Ranger product key will be required to activate each Ranger license after your Ranger software is installed.  Canon scanners are exceptions.  A product key is not required to unlock Ranger on new Canon CR-series models.

If your scanning application vendor does not provide Ranger license keys with their software, you can purchase Ranger license keys from one of our Ranger resellers:

• SalesSource International
  Dan Maslich
  Dir: +1 585-662-5255
  Toll Free: +1 877-310-5919 ext 3002
  dmaslich AT salessourceintl.com



• UniLink
  Deanna Diescher
  +1 (800) 666-2980 x119
  deanna AT unilinkinc.com

You can find Ranger license unlocking instructions here: How do I unlock my Ranger software?

---

We are happy to provide Ranger technical support to anyone who meets all of the following criteria:

• The person contacting us is a programmer at a software company.
• The software company is an authorized Ranger reseller.
• The copy of Ranger in question is covered by Ranger software maintenance.

If you work for a bank, credit union, IT staff, or anyone else, contact your scanning software vendor.

---