chore: replace em dashes with ASCII hyphens.

Co-authored-by: Cursor <cursoragent@cursor.com>
Release PronBox v1.13.0: RU stealth defaults and mixed port 19090.
2026-08-13 09:44:44 +03:00 · 2026-08-13 09:42:51 +03:00
32 changed files with 304 additions and 189 deletions
--- a/.github/workflows/debug.yml
+++ b/.github/workflows/debug.yml
@@ -94,7 +94,7 @@ jobs:
        run: |
          if [ ! -z "${{ secrets.BOT_TOKEN }}" ]; then
            export VERSION=$(cat module.prop | grep 'version=' | awk -F '=' '{print $2}')
-            export COMMIT=$(git log --oneline -n 5 --no-decorate | sed 's/^[0-9a-f]* //' | sed 's/^/— /')
+            export COMMIT=$(git log --oneline -n 5 --no-decorate | sed 's/^[0-9a-f]* //' | sed 's/^/- /')
            FILE=$(find . -name "*.zip")
            pip3 install telethon==1.31.1
            python3 $GITHUB_WORKSPACE/.github/taamarinbot.py "$FILE"
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,5 +104,5 @@ jobs:
          [ -z "$FILE" ] && echo "No ZIP file found!" && exit 1

          export VERSION=$(git rev-parse --short HEAD)
-          export COMMIT=$(git log --oneline -n 10 --no-decorate | sed 's/^[0-9a-f]* //' | sed 's/^/— /')
+          export COMMIT=$(git log --oneline -n 10 --no-decorate | sed 's/^[0-9a-f]* //' | sed 's/^/- /')
          python3 .github/taamarinbot.py "$FILE"
--- a/CHANGELOG_STEALTH.md
+++ b/CHANGELOG_STEALTH.md
@@ -1,23 +1,22 @@
-# PronBox — v1.12.0
+# PronBox - v1.13.0

-Разработано в стенах **НИИ «ТехноПрон»**. Magisk `id` остаётся `box_for_root` (апгрейд поверх старого модуля).
+Разработано в стенах **НИИ «ТехноПрон»**. Magisk `id` остаётся `box_for_root`.

-## Renamed
- Display name: **PronBox** (больше не VeilBox / «Box for Magisk»)
- Author: **команда НИИ «ТехноПрон»**
- ZIP: `pronbox-v1.12.0.zip`
- Fix: `customize.sh` больше не переименовывает модуль в stock «Box for Magisk»
+## Stealth / RKN mitigation
+- Default **`stealth.list.cfg`**: банки, госуслуги, маркетплейсы, операторы, TG, RKNHardering
+- **`package.list.cfg` blacklist**: чекеры / банки / госуслуги → DIRECT (домашний IP)
+- Mixed inbound sing-box: **7890 → 19090** (меньше Clash-fingerprint)
+- `stealth_extra_ports`: sidecar `10800/10801`, wgobfs `41320`, API, legacy `7890`
+- `box.stealth`: собирает TT/olcrtc/wgobfs порты; IPv6 UDP → `icmp6-port-unreachable`

-## Added
- **wg-obfuscator** ([ClusterM](https://github.com/ClusterM/wg-obfuscator)): `box.wgobfs`, профиль `config-wg-obfs.json`, `box.tool upwgobfs`
- Manage Profiles: `config-trusttunnel` / `config-olcrtc` / `config-wg-obfs`
- Sidecar `both` + `sidecar_set_final=false` для переключения в BFR Manager
- Restore при апгрейде: `trusttunnel_client`, `olcrtc`, `wg-obfuscator`, sidecar configs
+## wg-obfuscator
+- Реальные peer endpoints больше не пишутся в JSON (sing-box ломался) - state-файл `wgobfs-real-peers.txt`

 ## Notes
- wg-obfuscator нужен и на VPS (тот же `key`)
- Repo-шаблоны без секретов WG/Hysteria
+- После установки банка/Госуслуг: `box.stealth renew`
+- Root/Magisk native - по-прежнему Shamiko / MagiskHide, не PronBox
+- wg-obfuscator на VPS всё ещё нужен для профиля WG

 ## Based on
- PronBox / VeilBox v1.11.0
+- PronBox v1.12.0
 - [taamarin/box_for_magisk](https://github.com/taamarin/box_for_magisk) v1.10.2
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # PronBox

-Форк [box_for_magisk](https://github.com/taamarin/box_for_magisk) — прозрачный прокси для Android (root).  
+Форк [box_for_magisk](https://github.com/taamarin/box_for_magisk) - прозрачный прокси для Android (root).  
 Собрано в стенах **НИИ «ТехноПрон»**. Отображаемое имя в Magisk: **PronBox**; module id: `box_for_root` (апгрейд совместим).

 Работает через Magisk, KernelSU и APatch. Ядро по умолчанию: **sing-box**. Anti-detection без LSPosed + sidecar: [olcrtc](https://github.com/openlibrecommunity/olcrtc) / [TrustTunnel](https://github.com/TrustTunnel/TrustTunnel) / [wg-obfuscator](https://github.com/ClusterM/wg-obfuscator).
@@ -14,7 +14,7 @@ Stock [Box for Root](https://github.com/taamarin/box_for_magisk) хорошо п
 1. **Не поддерживает** новые протоколы вроде olcrtc, TrustTunnel и WG-obfuscation «из коробки».
 2. **Легко детектится** проверщиками вроде [RKNHardering](https://github.com/xtclovver/RKNHardering): REST API на `9090`, скан localhost, TUN-интерфейсы.

-PronBox решает это **без LSPosed** — iptables port-hide, hardening конфигов и sidecar-цепочка. Разработано командой НИИ «ТехноПрон».
+PronBox решает это **без LSPosed** - iptables port-hide, hardening конфигов и sidecar-цепочка. Разработано командой НИИ «ТехноПрон».

 ---

@@ -29,15 +29,15 @@ PronBox решает это **без LSPosed** — iptables port-hide, hardening
 | Localhost scan | не защищён | **iptables port-hide** для observer apps |
 | olcrtc / TrustTunnel | нет | **sidecar → SOCKS → sing-box** |
 | WG obfuscator | нет | **wg-obfuscator → WireGuard** |
-| Быстрый профиль | — | **Manage Profiles / `sbfr p …`** |
-| LSPosed / VPN Hide | — | **не требуется** |
-| Автор | — | **команда НИИ «ТехноПрон»** |
+| Быстрый профиль | - | **Manage Profiles / `sbfr p …`** |
+| LSPosed / VPN Hide | - | **не требуется** |
+| Автор | - | **команда НИИ «ТехноПрон»** |

 ---

 ## Возможности

- Прозрачный прокси через **iptables TPROXY** — без `VpnService`, без VPN-иконки, без `TRANSPORT_VPN`.
+- Прозрачный прокси через **iptables TPROXY** - без `VpnService`, без VPN-иконки, без `TRANSPORT_VPN`.
 - **Stealth-слой** (`box.stealth`): скрытие localhost-портов от банков и anti-tamper SDK.
 - **Sidecar** (`box.sidecar`): olcrtc и TrustTunnel как локальный SOCKS5 upstream для sing-box.
 - Авто-hardening sing-box/clash: удаление REST API, запрет TUN, блок QUIC (опционально).
@@ -97,7 +97,7 @@ Observer app (банк, RKNHardering)

 ```powershell
 python tools/build_zip.py
-# → pronbox-v1.12.0.zip
+# → pronbox-v1.13.0.zip
 ```

 **Linux / Git Bash:**
@@ -146,7 +146,7 @@ cp /data/adb/box/sing-box/config.stealth.example.json /data/adb/box/sing-box/con

 ### 3. Observer-приложения (stealth)

-Файл `/data/adb/box/stealth.list.cfg` — приложения, которым **скрываем** localhost-прокси:
+Файл `/data/adb/box/stealth.list.cfg` - приложения, которым **скрываем** localhost-прокси:

 ```text
 # один package на строку
@@ -216,7 +216,7 @@ stealth_extra_ports=("7890" "7891" "1080" "10808" "2080")
 | TUN-интерфейсы (`tun0`, MTU) | Policy routing fwmark (нативно) |
 | REST API на LAN | Установленные VPN-приложения (needsReview) |

-Полный **NOT DETECTED** против RKNHardering + VPS + root недостижим. Цель форка — убрать **hard detect** от localhost, API и TUN.
+Полный **NOT DETECTED** против RKNHardering + VPS + root недостижим. Цель форка - убрать **hard detect** от localhost, API и TUN.

 ---

@@ -247,16 +247,16 @@ sidecar_set_final="true"

 ### olcrtc

-Официального Android-релиза нет — бинарник собирается вручную:
+Официального Android-релиза нет - бинарник собирается вручную:

 ```bash
-# https://github.com/openlibrecommunity/olcrtc — mage mobile
+# https://github.com/openlibrecommunity/olcrtc - mage mobile
 # положите бинарник:
 # /data/adb/box/bin/olcrtc
 chmod 755 /data/adb/box/bin/olcrtc

 cp /data/adb/box/sidecar/olcrtc.example.yaml /data/adb/box/sidecar/olcrtc.yaml
-# room id + crypto.key (64 hex) — одинаковые на клиенте и сервере
+# room id + crypto.key (64 hex) - одинаковые на клиенте и сервере
 ```

 `settings.ini`:
@@ -275,7 +275,7 @@ sidecar_outbound_tag="olcrtc-proxy"

 ## WireGuard Obfuscator ([ClusterM/wg-obfuscator](https://github.com/ClusterM/wg-obfuscator))

-Это **не VPN**, а UDP-обфускатор WireGuard (маскировка под STUN и т.п.). Нужен **на обоих концах** — телефон + VPS с тем же `key`. Со сторонним WG-сервером без своего obfuscator не заработает.
+Это **не VPN**, а UDP-обфускатор WireGuard (маскировка под STUN и т.п.). Нужен **на обоих концах** - телефон + VPS с тем же `key`. Со сторонним WG-сервером без своего obfuscator не заработает.

 ```text
 sing-box WireGuard peer
@@ -411,7 +411,7 @@ Magisk / KernelSU / APatch

 ## Обновление модуля

-Установите новый ZIP поверх старого через Magisk Manager. При запросе **restore settings.ini** — Vol+ сохранит ваши настройки stealth/sidecar.
+Установите новый ZIP поверх старого через Magisk Manager. При запросе **restore settings.ini** - Vol+ сохранит ваши настройки stealth/sidecar.

 ---

@@ -431,7 +431,7 @@ su -c rm -rf /data/adb/modules/box_for_root
 ## Ограничения и disclaimer

 - Модуль требует **root**. Это само по себе детектируется native-проверками.
- Stealth **не маскирует** Java API (`NetworkCapabilities`) — для этого нужен kernel hook (VPN Hide kmod), мы сознательно обходимся без LSPosed.
+- Stealth **не маскирует** Java API (`NetworkCapabilities`) - для этого нужен kernel hook (VPN Hide kmod), мы сознательно обходимся без LSPosed.
 - olcrtc на Android требует **ручной сборки** бинарника.
 - TrustTunnel в sing-box upstream пока через **sidecar SOCKS**, не нативный outbound.
 - Автор не несёт ответственности за блокировки аккаунтов, некорректные конфиги и петли маршрутизации.
@@ -440,13 +440,13 @@ su -c rm -rf /data/adb/modules/box_for_root

 ## Credits

- [taamarin/box_for_magisk](https://github.com/taamarin/box_for_magisk) — базовый модуль
- [CHIZI-0618/box4magisk](https://github.com/CHIZI-0618/box4magisk) — оригинальный Box for Magisk
- [okhsunrog/vpnhide](https://github.com/okhsunrog/vpnhide) — идея port-hide без LSPosed
- [openlibrecommunity/olcrtc](https://github.com/openlibrecommunity/olcrtc) — WebRTC-туннель
- [TrustTunnel/TrustTunnel](https://github.com/TrustTunnel/TrustTunnel) — HTTPS VPN-протокол
- [xtclovver/RKNHardering](https://github.com/xtclovver/RKNHardering) — референс методики детекта
+- [taamarin/box_for_magisk](https://github.com/taamarin/box_for_magisk) - базовый модуль
+- [CHIZI-0618/box4magisk](https://github.com/CHIZI-0618/box4magisk) - оригинальный Box for Magisk
+- [okhsunrog/vpnhide](https://github.com/okhsunrog/vpnhide) - идея port-hide без LSPosed
+- [openlibrecommunity/olcrtc](https://github.com/openlibrecommunity/olcrtc) - WebRTC-туннель
+- [TrustTunnel/TrustTunnel](https://github.com/TrustTunnel/TrustTunnel) - HTTPS VPN-протокол
+- [xtclovver/RKNHardering](https://github.com/xtclovver/RKNHardering) - референс методики детекта

 ## License

-GPL-3.0 — см. [LICENSE](LICENSE).
+GPL-3.0 - см. [LICENSE](LICENSE).
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -1,12 +1,12 @@
-# Release PronBox v1.12.0
+# Release PronBox v1.13.0

 Продукт **НИИ «ТехноПрон»**. Magisk id: `box_for_root`.

 ## Локально

 - Ветка `main`
- Тег: `v1.12.0`
- ZIP: `pronbox-v1.12.0.zip` → `python tools/build_zip.py`
+- Тег: `v1.13.0`
+- ZIP: `pronbox-v1.13.0.zip` → `python tools/build_zip.py`
 - Remote: `gitea@10.2.0.2:M1rs3m/BFR.git`
 - Display name: **PronBox**
 - Author: **команда НИИ «ТехноПрон»**
@@ -16,18 +16,20 @@
 ```powershell
 cd E:\bfr_mod
 git push -u origin main
-git push origin v1.12.0
+git push origin v1.13.0
 ```

+ZIP в релиз на Gitea: `E:\bfr_mod\pronbox-v1.13.0.zip`
+
 ## Release на Gitea

 1. `http://10.2.0.2/M1rs3m/BFR` → **Releases** → **New Release**
-2. Tag: `v1.12.0`
-3. Title: `PronBox v1.12.0 — НИИ «ТехноПрон»`
-4. Description: `CHANGELOG_STEALTH.md`
-5. Attach: `pronbox-v1.12.0.zip`
+2. Tag: `v1.13.0`
+3. Title: `PronBox v1.13.0 - stealth RU + mixed 19090`
+4. Description: содержимое `CHANGELOG_STEALTH.md`
+5. Attach: `pronbox-v1.13.0.zip`
 6. Publish

 OTA (`update.json`):

-`http://10.2.0.2/M1rs3m/BFR/releases/download/v1.12.0/pronbox-v1.12.0.zip`
+`http://10.2.0.2/M1rs3m/BFR/releases/download/v1.13.0/pronbox-v1.13.0.zip`
--- a/box/package.list.cfg
+++ b/box/package.list.cfg
@@ -1,13 +1,34 @@
-# black/white list mode.
+# PronBox package filter - traffic routing
+# mode:blacklist = listed apps go DIRECT (bypass proxy)
+# Recommended for banks / gosuslugi / checkers so they see home RU IP.
 mode:blacklist
-# +----------------+------+
-# |     User       |  ID  |
-# +----------------+------+
-# | Owner          |   0  |
-# | Second Space   |  10  |
-# | App Clone      | 999  |
-# +----------------+------+

-# package_name ▼
-# com.topjohnwu.magisk
-# 0:com.termux
+# --- checkers ---
+com.notcvnt.rknhardering
+
+# --- banks ---
+ru.sberbankmobile
+com.idamob.tinkoff.android
+ru.alfabank.mobile.android
+ru.vtb24.mobilebanking.android
+ru.gazprombank.android.mobilebank.app
+com.openbank
+ru.raiffeisennews
+ru.rosbank.android
+ru.sovcomcard.android
+ru.letobank.Promobile
+ru.homecredit.mycredit
+ru.mts.money
+ru.rshb.mbank
+ru.yoo.money
+
+# --- state ---
+ru.gosuslugi.gosapp
+ru.rostel
+ru.gnivc.mobilenalog
+
+# --- marketplaces (optional direct; comment out if you need them via proxy) ---
+# com.wildberries.ru
+# ru.ozon.app.android
+# ru.yandex.market
+# com.avito.android
--- a/box/scripts/box.profile
+++ b/box/scripts/box.profile
@@ -1,5 +1,5 @@
 #!/system/bin/sh
-# VeilBox profile switcher — trusttunnel | olcrtc
+# VeilBox profile switcher - trusttunnel | olcrtc
 # Usage:
 #   su -c '/data/adb/box/scripts/box.profile list'
 #   su -c '/data/adb/box/scripts/box.profile use trusttunnel'
--- a/box/scripts/box.service
+++ b/box/scripts/box.service
@@ -204,7 +204,7 @@ stealth_guard_network_mode() {
  [ "${stealth_mode}" != "true" ] && return 0
  [ "${stealth_forbid_tun}" != "true" ] && return 0
  if [[ "${network_mode}" == @(mixed|tun) ]]; then
-    log Warning "[Stealth] TUN is detectable — switching network_mode to tproxy"
+    log Warning "[Stealth] TUN is detectable - switching network_mode to tproxy"
    sed -i 's/\(network_mode=\)\"[^\"]*\"/\1"tproxy"/g' ${settings}
    network_mode="tproxy"
  fi
--- a/box/scripts/box.sidecar
+++ b/box/scripts/box.sidecar
@@ -1,5 +1,5 @@
 #!/system/bin/sh
-# BFR Sidecar — olcrtc / TrustTunnel local protocol adapters (SOCKS5 upstream for sing-box)
+# BFR Sidecar - olcrtc / TrustTunnel local protocol adapters (SOCKS5 upstream for sing-box)

 if ! /system/bin/sh -n /data/adb/box/settings.ini 2>/dev/null; then
  echo "Err: settings.ini syntax error" >&2
@@ -142,7 +142,7 @@ sidecar_inject_singbox() {
    if command -v yq >/dev/null 2>&1; then
      yq="yq"
    else
-      log Error "[Sidecar] yq not found — cannot inject socks outbound"
+      log Error "[Sidecar] yq not found - cannot inject socks outbound"
      return 1
    fi
  fi
@@ -178,7 +178,7 @@ sidecar_inject_singbox() {
      log Info "[Sidecar] route.final -> ${final_tag}"
    sidecar_patch_dns "${final_tag}"
  else
-    log Info "[Sidecar] sidecar_set_final=false — keep profile route.final (BFR Manager switch)"
+    log Info "[Sidecar] sidecar_set_final=false - keep profile route.final (BFR Manager switch)"
  fi
 }

@@ -209,11 +209,11 @@ sidecar_start_process() {
      # TT + olcrtc for BFR Manager profile flipping; missing one must not block the other
      sidecar_start_one trusttunnel "${box_dir}/bin/trusttunnel_client" "${sidecar_dir}/trusttunnel.toml" \
        "${sidecar_tt_port}" "${sidecar_pid_tt}" || \
-        log Warning "[Sidecar] trusttunnel failed/missing — continue without it"
+        log Warning "[Sidecar] trusttunnel failed/missing - continue without it"
      sleep 2
      sidecar_start_one olcrtc "${box_dir}/bin/olcrtc" "${sidecar_dir}/olcrtc.yaml" \
        "${sidecar_olc_port}" "${sidecar_pid_olc}" || {
-          log Warning "[Sidecar] olcrtc failed to start — continuing without it"
+          log Warning "[Sidecar] olcrtc failed to start - continuing without it"
          log Warning "[Sidecar] Tip: telemost room.id = full https://telemost.yandex.ru/j/<id> URL (or numeric id)"
          log Warning "[Sidecar] Tip: under root:net_admin set net.dns to LAN resolver (e.g. gateway:53)"
        }
--- a/box/scripts/box.stealth
+++ b/box/scripts/box.stealth
@@ -1,5 +1,5 @@
 #!/system/bin/sh
-# BFR Stealth — hardening without LSPosed (iptables port hide + API lockdown)
+# BFR Stealth - hardening without LSPosed (iptables port hide + API lockdown)

 if ! /system/bin/sh -n /data/adb/box/settings.ini 2>/dev/null; then
  echo "Err: settings.ini syntax error" >&2
@@ -26,12 +26,20 @@ fi
 stealth_ports_collect() {
  _ports="${tproxy_port} ${redir_port}"
  [ -n "${sidecar_listen_port}" ] && _ports="${_ports} ${sidecar_listen_port}"
+  [ -n "${sidecar_tt_port}" ] && _ports="${_ports} ${sidecar_tt_port}"
+  [ -n "${sidecar_olc_port}" ] && _ports="${_ports} ${sidecar_olc_port}"
+  [ -n "${wgobfs_listen_port}" ] && _ports="${_ports} ${wgobfs_listen_port}"
  [ -n "${stealth_api_port}" ] && _ports="${_ports} ${stealth_api_port}"

  if [ -f "${clash_config}" ]; then
    _ec=$(busybox awk '!/^ *#/ && /external-controller:/{print $2}' "${clash_config}" 2>/dev/null | head -n1)
    _ec_port=$(echo "${_ec}" | busybox awk -F: '{print $NF}')
    [ -n "${_ec_port}" ] && _ports="${_ports} ${_ec_port}"
+    # Clash mixed/socks ports if present
+    _socks=$(busybox awk '!/^ *#/ && /socks-port:/{print $2}' "${clash_config}" 2>/dev/null | head -n1)
+    [ -n "${_socks}" ] && _ports="${_ports} ${_socks}"
+    _mixed=$(busybox awk '!/^ *#/ && /mixed-port:/{print $2}' "${clash_config}" 2>/dev/null | head -n1)
+    [ -n "${_mixed}" ] && _ports="${_ports} ${_mixed}"
  fi

  if [ -f "${sing_config}" ]; then
@@ -89,7 +97,7 @@ stealth_enable() {
  resolve_stealth_uids

  if [ ! -s "${box_run}/stealth_uids.list" ]; then
-    log Warning "[Stealth] No observer UIDs resolved — add packages to stealth.list.cfg"
+    log Warning "[Stealth] No observer UIDs resolved - add packages to stealth.list.cfg"
    return 0
  fi

@@ -104,7 +112,7 @@ stealth_enable() {
      ${IPV} -A "${STEALTH_CHAIN}" -m owner --uid-owner "${uid}" -d 127.0.0.0/8 -p tcp -j REJECT --reject-with tcp-reset
      ${IPV} -A "${STEALTH_CHAIN}" -m owner --uid-owner "${uid}" -d 127.0.0.0/8 -p udp -j REJECT --reject-with icmp-port-unreachable
      ${IP6V} -A "${STEALTH_CHAIN6}" -m owner --uid-owner "${uid}" -d ::1/128 -p tcp -j REJECT --reject-with tcp-reset
-      ${IP6V} -A "${STEALTH_CHAIN6}" -m owner --uid-owner "${uid}" -d ::1/128 -p udp -j REJECT --reject-with icmp-port-unreachable
+      ${IP6V} -A "${STEALTH_CHAIN6}" -m owner --uid-owner "${uid}" -d ::1/128 -p udp -j REJECT --reject-with icmp6-port-unreachable
    fi
  done < "${box_run}/stealth_uids.list"

--- a/box/scripts/box.tool
+++ b/box/scripts/box.tool
@@ -1233,7 +1233,7 @@ upwgobfs() {
    fi
    if [ ! -f "${box_dir}/sidecar/wg-obfuscator.conf" ] && [ -f "${box_dir}/sidecar/wg-obfuscator.example.conf" ]; then
      cp -f "${box_dir}/sidecar/wg-obfuscator.example.conf" "${box_dir}/sidecar/wg-obfuscator.conf"
-      log Warning "Created sidecar/wg-obfuscator.conf — set key= and target="
+      log Warning "Created sidecar/wg-obfuscator.conf - set key= and target="
    fi
  else
    log Error "Download failed: ${url}"
--- a/box/scripts/box.wgobfs
+++ b/box/scripts/box.wgobfs
@@ -1,5 +1,5 @@
 #!/system/bin/sh
-# VeilBox — WireGuard Obfuscator (ClusterM/wg-obfuscator) lifecycle
+# VeilBox - WireGuard Obfuscator (ClusterM/wg-obfuscator) lifecycle
 # Docs: https://github.com/ClusterM/wg-obfuscator
 #
 # Client flow:
@@ -47,7 +47,7 @@ wgobfs_wait_udp() {
 }

 # Rewrite sing-box wireguard peers to localhost obfuscator listen port.
-# Saves originals into .peers[]._veilbox_real_address / _veilbox_real_port (ignored by sing-box).
+# Real endpoints are saved to ${box_run}/wgobfs-real-peers.txt (sing-box rejects unknown JSON fields).
 wgobfs_patch_singbox() {
  [ "${wgobfs_patch_config}" = "true" ] || return 0
  [ "${bin_name}" != "sing-box" ] && return 0
@@ -56,44 +56,49 @@ wgobfs_patch_singbox() {
  yq="${box_dir}/bin/yq"
  [ -x "${yq}" ] || yq="yq"
  if ! command -v "${yq}" >/dev/null 2>&1 && [ ! -x "${yq}" ]; then
-    log Warning "[wgobfs] yq missing — cannot patch WireGuard endpoint"
+    log Warning "[wgobfs] yq missing - cannot patch WireGuard endpoint"
    return 1
  fi

-  # Ensure we have at least one wireguard endpoint
  if ! "${yq}" -e '.endpoints[] | select(.type == "wireguard")' "${sing_config}" >/dev/null 2>&1; then
    log Warning "[wgobfs] no wireguard endpoint in ${sing_config}"
    return 1
  fi

-  # Stash real address/port once, then point peers at local obfuscator
+  state="${box_run}/wgobfs-real-peers.txt"
+  mkdir -p "${box_run}"
+  : > "${state}"
+
+  # Capture current non-loopback peers, then rewrite to local obfuscator
+  "${yq}" -r '
+    .endpoints[]? | select(.type == "wireguard") | .peers[]? |
+    ((.address // "") + ":" + ((.port // 0)|tostring))
+  ' "${sing_config}" 2>/dev/null | while read -r ep; do
+    case "${ep}" in
+      127.*|""|:0) continue ;;
+      *) echo "${ep}" >> "${state}" ;;
+    esac
+  done
+
  "${yq}" -i -o=json '
-    (.endpoints[] | select(.type == "wireguard") | .peers[] |
-      select(._veilbox_real_address == null) |
-      ._veilbox_real_address) = .address |
-    (.endpoints[] | select(.type == "wireguard") | .peers[] |
-      select(._veilbox_real_port == null) |
-      ._veilbox_real_port) = .port |
    (.endpoints[] | select(.type == "wireguard") | .peers[] | .address) = "127.0.0.1" |
    (.endpoints[] | select(.type == "wireguard") | .peers[] | .port) = '"${wgobfs_listen_port}"'
  ' "${sing_config}" && \
    log Info "[wgobfs] WireGuard peers → 127.0.0.1:${wgobfs_listen_port}"

  # Direct route for real WG/obfuscator server IPs (avoid TPROXY loop)
-  real_ips=$("${yq}" -r '
-    .endpoints[]? | select(.type == "wireguard") | .peers[]? |
-    (._veilbox_real_address // empty)
-  ' "${sing_config}" 2>/dev/null | sort -u)
-
-  for ip in ${real_ips}; do
-    case "${ip}" in
-      127.*|"" ) continue ;;
-    esac
-    if ! "${yq}" -e ".route.rules[] | select(.ip_cidr[] == \"${ip}/32\")" "${sing_config}" >/dev/null 2>&1; then
-      "${yq}" -i -o=json ".route.rules = [{\"ip_cidr\":[\"${ip}/32\"],\"outbound\":\"direct\"}] + (.route.rules // [])" "${sing_config}" && \
-        log Info "[wgobfs] route direct ${ip}/32"
-    fi
-  done
+  if [ -f "${state}" ]; then
+    while read -r ep; do
+      ip="${ep%%:*}"
+      case "${ip}" in
+        127.*|"") continue ;;
+      esac
+      if ! "${yq}" -e ".route.rules[] | select(.ip_cidr[] == \"${ip}/32\")" "${sing_config}" >/dev/null 2>&1; then
+        "${yq}" -i -o=json ".route.rules = [{\"ip_cidr\":[\"${ip}/32\"],\"outbound\":\"direct\"}] + (.route.rules // [])" "${sing_config}" && \
+          log Info "[wgobfs] route direct ${ip}/32"
+      fi
+    done < "${state}"
+  fi
 }

 wgobfs_ensure_conf() {
@@ -103,7 +108,7 @@ wgobfs_ensure_conf() {
  fi
  if [ -f "${box_dir}/sidecar/wg-obfuscator.example.conf" ]; then
    cp -f "${box_dir}/sidecar/wg-obfuscator.example.conf" "${wgobfs_config}"
-    log Warning "[wgobfs] created ${wgobfs_config} from example — edit key/target"
+    log Warning "[wgobfs] created ${wgobfs_config} from example - edit key/target"
    return 0
  fi
  log Error "[wgobfs] missing ${wgobfs_config}"
@@ -134,7 +139,7 @@ wgobfs_start() {
  if wgobfs_wait_udp; then
    log Info "[wgobfs] running (listen see config source-lport, default ${wgobfs_listen_port})"
  else
-    log Error "[wgobfs] process died — see ${wgobfs_log}"
+    log Error "[wgobfs] process died - see ${wgobfs_log}"
    tail -n 15 "${wgobfs_log}" 2>/dev/null | while read -r line; do log Error "[wgobfs] ${line}"; done
    return 1
  fi
--- a/box/settings.ini
+++ b/box/settings.ini
@@ -103,10 +103,10 @@ clash_provide_rules="${box_dir}/clash/subscription/${name_provide_clash_rules}"

 # Sing configuration
 # BFR Manager → Manage Profiles lists *.json here. Switchable profiles:
-#   config-trusttunnel.json  — final → sidecar-proxy (:10800 TrustTunnel)
-#   config-olcrtc.json       — final → olcrtc-proxy (:10801 olcrtc)
-#   config-wg-obfs.json      — WireGuard via local wg-obfuscator (:41320)
-#   config-hy2-wg.json       — your hysteria/wg base (etc.)
+#   config-trusttunnel.json  - final → sidecar-proxy (:10800 TrustTunnel)
+#   config-olcrtc.json       - final → olcrtc-proxy (:10801 olcrtc)
+#   config-wg-obfs.json      - WireGuard via local wg-obfuscator (:41320)
+#   config-hy2-wg.json       - your hysteria/wg base (etc.)
 # For TT/olcrtc app switching keep sidecar_protocol=both and sidecar_set_final=false
 # For WG obfuscation set wgobfs_enable=true (needs VPS-side obfuscator)
 name_sing_config="config.json"
@@ -222,7 +222,7 @@ wifi_ssids_list=("WiFi1" "WiFi-2" "WiFi 3")
 inotify_log_enabled="true"

 # -----------------------------------------------------------------
-# PronBox stealth — anti-detection without LSPosed (iptables port-hide)
+# PronBox stealth - anti-detection without LSPosed (iptables port-hide)
 # -----------------------------------------------------------------

 # Master switch: enables loopback port-hide for observer apps + API lockdown
@@ -241,31 +241,34 @@ stealth_disable_api="true"
 stealth_api_bind="127.0.0.1"
 stealth_api_port="19090"

-# Block QUIC (UDP 443/80) — reduces fingerprint, may break some sites
+# Block QUIC (UDP 443/80) - reduces fingerprint, may break some sites
 stealth_block_quic="false"

-# Force tproxy mode — TUN interfaces are trivially detected by RKNHardering
+# Force tproxy mode - TUN interfaces are trivially detected by RKNHardering
 stealth_forbid_tun="true"

 # Extra ports to hide from external INPUT (space-separated in stealth_extra_ports)
-stealth_extra_ports=("7890" "7891" "1080" "10808" "2080" "41320")
+stealth_extra_ports=("7890" "7891" "19090" "1080" "10808" "2080" "41320" "10800" "10801" "9090" "9091" "1053")

-# Observer apps — packages that probe for VPN/proxy (see stealth.list.cfg)
+# Observer apps - packages that probe for VPN/proxy (see stealth.list.cfg)
 stealth_config=$(dirname "$settings")/stealth.list.cfg
 [ -d "${stealth_config}" ] && rm -rf "${stealth_config}"
 [ ! -f "${stealth_config}" ] && cat > "${stealth_config}"<<'stealth_init'
-# Apps that scan for localhost proxy / VPN (one package per line)
-# Examples (uncomment and adjust):
-# ru.sberbankmobile
-# com.idamob.tinkoff.android
-# ru.rostel
-# com.notcvnt.rknhardering
+# See box/stealth.list.cfg in module for full default RU list.
+# This stub is only used on first boot if file is missing.
+com.notcvnt.rknhardering
+ru.sberbankmobile
+com.idamob.tinkoff.android
+ru.alfabank.mobile.android
+ru.vtb24.mobilebanking.android
+ru.gosuslugi.gosapp
+ru.rostel
 stealth_init

 stealth_packages_list=($(sed -n '/^[^#]/s/^\([^ ]*\.[^ ]*\).*/\1/p' ${stealth_config}))

 # -----------------------------------------------------------------
-# Sidecar protocols — olcrtc / TrustTunnel via local SOCKS5 chain
+# Sidecar protocols - olcrtc / TrustTunnel via local SOCKS5 chain
 # -----------------------------------------------------------------

 sidecar_enable="false"
@@ -287,7 +290,7 @@ sidecar_set_final="false"
 sidecar_dir="${box_dir}/sidecar"

 # -----------------------------------------------------------------
-# WireGuard Obfuscator — https://github.com/ClusterM/wg-obfuscator
+# WireGuard Obfuscator - https://github.com/ClusterM/wg-obfuscator
 # Requires matching obfuscator on the VPS (same key). Not a VPN itself.
 # -----------------------------------------------------------------
 wgobfs_enable="false"
--- a/box/sidecar/trusttunnel.example.toml
+++ b/box/sidecar/trusttunnel.example.toml
@@ -2,7 +2,7 @@
 # Generate with TrustTunnel endpoint: trusttunnel_endpoint vpn.toml hosts.toml -c client -a server --format toml
 # Docs: https://github.com/TrustTunnel/TrustTunnelClient

-# Minimal placeholder — replace with exported client config from your endpoint.
+# Minimal placeholder - replace with exported client config from your endpoint.
 # Ensure SOCKS listener matches sidecar_listen_port in settings.ini (default 10800).

 [listener]
--- a/box/sidecar/wg-obfuscator.example.conf
+++ b/box/sidecar/wg-obfuscator.example.conf
@@ -1,4 +1,4 @@
-# VeilBox client — WireGuard Obfuscator (ClusterM)
+# VeilBox client - WireGuard Obfuscator (ClusterM)
 # https://github.com/ClusterM/wg-obfuscator
 #
 # CRITICAL: the same `key` must be configured on the VPS obfuscator.
@@ -14,7 +14,7 @@ source-if = 127.0.0.1
 source-lport = 41320

 # Real remote: your VPS wg-obfuscator public endpoint
-# Example uses the previous raw WG host — after you wrap WG with obfuscator on the VPS,
+# Example uses the previous raw WG host - after you wrap WG with obfuscator on the VPS,
 # keep the public host:port here (obfuscator listens where WG used to).
 target = YOUR_VPS_IP:13232

--- a/box/sing-box/README.md
+++ b/box/sing-box/README.md
@@ -5,7 +5,7 @@
 | `config-trusttunnel.json` | TrustTunnel | `127.0.0.1:10800` | `sidecar-proxy` |
 | `config-olcrtc.json` | olcrtc | `127.0.0.1:10801` | `olcrtc-proxy` |
 | `config-wg-obfs.json` | wg-obfuscator | UDP `:41320` | WG peers → localhost obfuscator |
-| `config.stealth.example.json` | — | — | minimal template |
+| `config.stealth.example.json` | - | - | minimal template |

 These files appear in **BFR Manager → Manage Profiles** (all `*.json` in `/data/adb/box/sing-box/`).

--- a/box/sing-box/config-olcrtc.json
+++ b/box/sing-box/config-olcrtc.json
@@ -32,7 +32,7 @@
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
-      "listen_port": 7890
+      "listen_port": 19090
    }
  ],
  "outbounds": [
--- a/box/sing-box/config-trusttunnel.json
+++ b/box/sing-box/config-trusttunnel.json
@@ -32,7 +32,7 @@
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
-      "listen_port": 7890
+      "listen_port": 19090
    }
  ],
  "outbounds": [
--- a/box/sing-box/config-wg-obfs.json
+++ b/box/sing-box/config-wg-obfs.json
@@ -41,8 +41,7 @@
          "port": 41320,
          "public_key": "YOUR_PEER_PUBLIC_KEY",
          "allowed_ips": "10.0.0.0/8",
-          "persistent_keepalive_interval": 25,
-          "_example_real_address": "YOUR_VPS_IP"
+          "persistent_keepalive_interval": 25
        }
      ]
    }
@@ -58,7 +57,7 @@
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
-      "listen_port": 7890
+      "listen_port": 19090
    }
  ],
  "outbounds": [
--- a/box/stealth.list.cfg
+++ b/box/stealth.list.cfg
@@ -0,0 +1,78 @@
+# PronBox stealth.list.cfg - apps that must NOT see localhost proxy ports
+# One package per line. Used by box.stealth (iptables UID → REJECT 127.0.0.0/8)
+
+# --- checkers / anti-tamper ---
+com.notcvnt.rknhardering
+
+# --- banks ---
+ru.sberbankmobile
+ru.sberbank.sberbankid
+com.idamob.tinkoff.android
+ru.alfabank.mobile.android
+ru.vtb24.mobilebanking.android
+ru.gazprombank.android.mobilebank.app
+com.openbank
+ru.raiffeisennews
+ru.rosbank.android
+ru.sovcomcard.android
+ru.letobank.Promobile
+ru.homecredit.mycredit
+ru.mts.money
+ru.rshb.mbank
+com.unicredit
+ru.yoo.money
+ru.sberm.mobile
+com.bm.android.toolsmobile
+ru.vtb.android.banking
+com.bssys.android.vtb
+
+# --- state / taxes / ID ---
+ru.gosuslugi.gosapp
+ru.rostel
+ru.gnivc.mobilenalog
+ru.mos.sudya
+ru.mos.mobile
+ru.mosparking.parking
+ru.esia
+ru.smev.esia
+
+# --- marketplaces / retail ---
+com.wildberries.ru
+ru.ozon.app.android
+ru.yandex.market
+com.avito.android
+ru.dns.shop.android
+ru.leroymerlin.customer
+com.magnit.mobile
+ru.x5.auth
+ru.pyaterochka.app.browser
+ru.detmir.app
+com.citilink.applink
+
+# --- telecom / ISP ---
+ru.mts.mymts
+ru.beeline.services
+ru.megafon.mlk
+ru.tele2.mytele2
+ru.yota.android
+ru.rt.mobile.android
+com.rostelecom.lk
+ru.domru.android
+
+# --- mail / docs that probe ---
+ru.mail.mailapp
+ru.yandex.mail
+com.yandex.browser
+ru.vk.store
+com.vkontakte.android
+ru.ok.android
+org.telegram.messenger
+# org.telegram.messenger.web
+
+# --- delivery / taxi / finance misc ---
+ru.yandex.taxi
+com.uber.android.passenger.rider
+ru.cdek.mobile
+ru.pochta.android
+ru.sberbank_sbol_android
+com.sberbank.sberbankid
--- a/customize.sh
+++ b/customize.sh
@@ -21,27 +21,27 @@ fi

 service_dir="/data/adb/service.d"
 if [ "$KSU" = "true" ]; then
-  ui_print "— KernelSU version: $KSU_VER ($KSU_VER_CODE)"
+  ui_print "- KernelSU version: $KSU_VER ($KSU_VER_CODE)"
  [ "$KSU_VER_CODE" -lt 10683 ] && service_dir="/data/adb/ksu/service.d"
 elif [ "$APATCH" = "true" ]; then
  APATCH_VER=$(cat "/data/adb/ap/version")
-  ui_print "— APatch version: $APATCH_VER"
+  ui_print "- APatch version: $APATCH_VER"
 else
-  ui_print "— Magisk version: $MAGISK_VER ($MAGISK_VER_CODE)"
+  ui_print "- Magisk version: $MAGISK_VER ($MAGISK_VER_CODE)"
 fi

 # Set up service directory and clean old installations
 mkdir -p "${service_dir}"
 if [ -d "/data/adb/modules/box_for_magisk" ]; then
  rm -rf "/data/adb/modules/box_for_magisk"
-  ui_print "— Old module deleted."
+  ui_print "- Old module deleted."
 fi

 # Extract files and configure directories
-ui_print "— Installing PronBox (НИИ «ТехноПрон»)"
+ui_print "- Installing PronBox (НИИ «ТехноПрон»)"
 unzip -o "$ZIPFILE" -x 'META-INF/*' -x 'webroot/*' -d "$MODPATH" >&2
 if [ -d "/data/adb/box" ]; then
-  ui_print "— Backup existing box data"
+  ui_print "- Backup existing box data"
  temp_bak=$(mktemp -d "/data/adb/box/box.XXXXXXXXXX")
  temp_dir="${temp_bak}"
  mv /data/adb/box/* "${temp_dir}/"
@@ -52,11 +52,11 @@ else
 fi

 # Directory creation and file extraction
-ui_print "— Create directories..."
+ui_print "- Create directories..."
 mkdir -p /data/adb/box/ /data/adb/box/run/ /data/adb/box/bin/xclash/
 mkdir -p $MODPATH/system/bin

-ui_print "— Extracting..."
+ui_print "- Extracting..."
 ui_print "     ↳  uninstall.sh → $MODPATH"
 ui_print "     ↳  box_service.sh → ${service_dir}"
 ui_print "     ↳  sbfr → $MODPATH/system/bin"
@@ -65,7 +65,7 @@ unzip -j -o "$ZIPFILE" 'box_service.sh' -d "${service_dir}" >&2
 unzip -j -o "$ZIPFILE" 'sbfr' -d "$MODPATH/system/bin" >&2

 # Set permissions
-ui_print "— Setting permissions..."
+ui_print "- Setting permissions..."
 set_perm_recursive $MODPATH 0 0 0755 0644
 set_perm_recursive /data/adb/box/ 0 3005 0755 0644
 set_perm_recursive /data/adb/box/scripts/ 0 3005 0755 0700
@@ -77,25 +77,25 @@ chmod ugo+x ${service_dir}/box_service.sh $MODPATH/uninstall.sh /data/adb/box/sc

 apply_mirror() {
  ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  ui_print "— Do you want to use the 'ghfast.top' ?"
+  ui_print "- Do you want to use the 'ghfast.top' ?"
  ui_print "     ↳  mirror to speed up downloads"
-  ui_print "— [ Vol UP(+): Yes ]"
-  ui_print "— [ Vol DOWN(-): No ]"
+  ui_print "- [ Vol UP(+): Yes ]"
+  ui_print "- [ Vol DOWN(-): No ]"
  START_TIME=$(date +%s)
  while true ; do
    NOW_TIME=$(date +%s)
    timeout 1 getevent -lc 1 2>&1 | grep KEY_VOLUME > "$TMPDIR/events"
    if [ $(( NOW_TIME - START_TIME )) -gt 9 ]; then
-      ui_print "— No input detected after 10 seconds..."
-      ui_print "— ghfast acceleration enabled."
+      ui_print "- No input detected after 10 seconds..."
+      ui_print "- ghfast acceleration enabled."
      sed -i 's/use_ghproxy=.*/use_ghproxy="true"/' /data/adb/box/scripts/box.tool
      break
    elif $(cat $TMPDIR/events | grep -q KEY_VOLUMEUP); then
-      ui_print "— ghfast acceleration enabled."
+      ui_print "- ghfast acceleration enabled."
      sed -i 's/use_ghproxy=.*/use_ghproxy="true"/' /data/adb/box/scripts/box.tool
      break
    elif $(cat $TMPDIR/events | grep -q KEY_VOLUMEDOWN); then
-      ui_print "— ghfast acceleration disabled."
+      ui_print "- ghfast acceleration disabled."
      sed -i 's/use_ghproxy=.*/use_ghproxy="false"/' /data/adb/box/scripts/box.tool
      break
    fi
@@ -113,10 +113,10 @@ find_bin() {
    local path="$bin_dir/bin/$name"
    if [ -e "$path" ]; then
        ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        ui_print "— $name → ⭕ FOUND"
+        ui_print "- $name → ⭕ FOUND"
    else
        ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        ui_print "— $name → ❌ NOT FOUND"
+        ui_print "- $name → ❌ NOT FOUND"
    fi
  }

@@ -135,20 +135,20 @@ find_bin() {
    timeout 1 getevent -lc 1 2>&1 | grep KEY_VOLUME > "$TMPDIR/events"
    
    if [ $(( NOW_TIME - START_TIME )) -gt 9 ]; then
-      ui_print "— No input detected after 10 seconds..."
+      ui_print "- No input detected after 10 seconds..."
      if [ "$bin" = "clash" ]; then
-        ui_print "— Download enabled for clash."
+        ui_print "- Download enabled for clash."
        /data/adb/box/scripts/box.tool $action
      else
-        ui_print "— Download disabled for $bin."
+        ui_print "- Download disabled for $bin."
      fi
      break
    elif grep -q KEY_VOLUMEUP "$TMPDIR/events"; then
-      ui_print "— Download enabled."
+      ui_print "- Download enabled."
      /data/adb/box/scripts/box.tool $action
      break
    elif grep -q KEY_VOLUMEDOWN "$TMPDIR/events"; then
-      ui_print "— Download disabled."
+      ui_print "- Download disabled."
      break
    fi
    done
@@ -159,9 +159,9 @@ find_bin() {
    timeout 1 getevent -cl >/dev/null

    check_bin "$bin"
-    ui_print "— Do you want to download or update it?"
-    ui_print "— [ Vol UP(+): Yes ]"
-    ui_print "— [ Vol DOWN(-): No ]"
+    ui_print "- Do you want to download or update it?"
+    ui_print "- [ Vol UP(+): Yes ]"
+    ui_print "- [ Vol DOWN(-): No ]"
    handle_download "$bin"
    sleep 1
  done
@@ -169,17 +169,17 @@ find_bin() {
  # Special case for clash
  if [ -e "$bin_dir/bin/xclash/mihomo" ]; then
      ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      ui_print "— mihomo → ⭕ FOUND"
+      ui_print "- mihomo → ⭕ FOUND"
      ui_print "-- Do you want to download or update clash?"
-      ui_print "— [ Vol UP(+): Yes ]"
-      ui_print "— [ Vol DOWN(-): No ]"
+      ui_print "- [ Vol UP(+): Yes ]"
+      ui_print "- [ Vol DOWN(-): No ]"
      handle_download "clash"
  else
      ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      ui_print "— mihomo → ❌ NOT FOUND  "
-      ui_print "— Do you want to download or update mihomo?"
-      ui_print "— [ Vol UP(+): Yes ]"
-      ui_print "— [ Vol DOWN(-): No ]"
+      ui_print "- mihomo → ❌ NOT FOUND  "
+      ui_print "- Do you want to download or update mihomo?"
+      ui_print "- [ Vol UP(+): Yes ]"
+      ui_print "- [ Vol DOWN(-): No ]"
      handle_download "clash"
  fi
 }
@@ -208,30 +208,30 @@ restore_ini() {
              # Append at the end of the file
              echo "$value" >> "$target_ini"
          fi
-          ui_print "— Restored: $key"
+          ui_print "- Restored: $key"
      else
-          ui_print "— Skipped: $key not found in backup"
+          ui_print "- Skipped: $key not found in backup"
      fi
  done
 }

 apply_ini() {
  ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  ui_print "— Would you like to restore settings.ini?"
-  ui_print "— [ Vol UP(+): Yes ]"
-  ui_print "— [ Vol DOWN(-): No ]"
+  ui_print "- Would you like to restore settings.ini?"
+  ui_print "- [ Vol UP(+): Yes ]"
+  ui_print "- [ Vol DOWN(-): No ]"
  START_TIME=$(date +%s)
  while true ; do
    NOW_TIME=$(date +%s)
    timeout 1 getevent -lc 1 2>&1 | grep KEY_VOLUME > "$TMPDIR/events"
    if [ $(( NOW_TIME - START_TIME )) -gt 9 ]; then
-      ui_print "— Skipped restoring settings.ini"
+      ui_print "- Skipped restoring settings.ini"
      break
    elif $(cat $TMPDIR/events | grep -q KEY_VOLUMEUP); then
      restore_ini
      break
    elif $(cat $TMPDIR/events | grep -q KEY_VOLUMEDOWN); then
-      ui_print "— Skipped restoring settings.ini"
+      ui_print "- Skipped restoring settings.ini"
      break
    fi
  done
@@ -242,7 +242,7 @@ timeout 1 getevent -cl >/dev/null

 # Restore backup configurations if present
 if [ "${backup_box}" = "true" ]; then
-  ui_print "— Restoring configurations..."
+  ui_print "- Restoring configurations..."
  ui_print "     ↳  xray"
  ui_print "     ↳  hysteria"
  ui_print "     ↳  clash"
@@ -259,7 +259,7 @@ if [ "${backup_box}" = "true" ]; then
  restore_kernel() {
    kernel_name="$1"
    if [ ! -f "/data/adb/box/bin/$kernel_name" ] && [ -f "${temp_dir}/bin/${kernel_name}" ]; then
-      ui_print "— Restoring kernel ${kernel_name}..."
+      ui_print "- Restoring kernel ${kernel_name}..."
      cp -rf "${temp_dir}/bin/${kernel_name}" "/data/adb/box/bin/${kernel_name}"
    fi
  }
@@ -268,21 +268,21 @@ if [ "${backup_box}" = "true" ]; then
    restore_kernel "$kernel"
  done

-  # Sidecar configs (TrustTunnel / olcrtc) — not shipped with secrets in ZIP
+  # Sidecar configs (TrustTunnel / olcrtc) - not shipped with secrets in ZIP
  if [ -d "${temp_dir}/sidecar" ]; then
-    ui_print "— Restoring sidecar configs..."
+    ui_print "- Restoring sidecar configs..."
    mkdir -p /data/adb/box/sidecar
    cp -rf "${temp_dir}/sidecar/"* "/data/adb/box/sidecar/" 2>/dev/null
  fi
  [ -f "${temp_dir}/stealth.list.cfg" ] && cp -f "${temp_dir}/stealth.list.cfg" "/data/adb/box/stealth.list.cfg"

-  ui_print "— Restoring..."
+  ui_print "- Restoring..."
  ui_print "     ↳  *.logs"
  ui_print "     ↳  box.pid"
  ui_print "     ↳  uid.list"
  cp -rf "${temp_dir}/run/"* "/data/adb/box/run/"

-  ui_print "— Restoring..."
+  ui_print "- Restoring..."
  ui_print "     ↳  ap.list.cfg"
  ui_print "     ↳  crontab.cfg"
  ui_print "     ↳  package.list.cfg"
@@ -303,7 +303,7 @@ fi
 # # nameserver 114.114.114.114
 # EOF
  # fi
-  # ui_print "— create $MODPATH/system/etc/resolv.conf"
+  # ui_print "- create $MODPATH/system/etc/resolv.conf"
 # }
 # create_resolv

@@ -323,15 +323,15 @@ sed -i "s/^author=.*/author=команда НИИ «ТехноПрон»/g" $MOD
 unzip -o "$ZIPFILE" 'webroot/*' -d "$MODPATH" >&2

 # Clean up temporary files
-ui_print "— Cleaning up leftover files"
+ui_print "- Cleaning up leftover files"
 rm -rf /data/adb/box/bin/.bin $MODPATH/box $MODPATH/sbfr $MODPATH/box_service.sh

 ui_print ""
 # Create a symbolic link to run /dev/sbfr as a shortcut to sbfr
 ln -sf "$MODPATH/system/bin/sbfr" /dev/sbfr
-ui_print "— Shortcut '/dev/sbfr' created."
+ui_print "- Shortcut '/dev/sbfr' created."
 ui_print "     ↳  You can now run: su -c /dev/sbfr"
 ui_print ""
 # Complete installation
-ui_print "— Installation complete. Please reboot your device."
-ui_print "— Report issues to t.me.taamarin"
+ui_print "- Installation complete. Please reboot your device."
+ui_print "- Report issues to t.me.taamarin"
--- a/module.prop
+++ b/module.prop
@@ -1,6 +1,6 @@
 id=box_for_root
 name=PronBox
-version=v1.12.0
-versionCode=2026081301
+version=v1.13.0
+versionCode=2026081302
 author=команда НИИ «ТехноПрон»
-description=PronBox — прозрачный TPROXY-прокси из стен НИИ «ТехноПрон». Stealth без LSPosed, TrustTunnel/olcrtc/wg-obfuscator, sing-box. Magisk id: box_for_root.
+description=PronBox - прозрачный TPROXY-прокси из стен НИИ «ТехноПрон». Stealth без LSPosed, TrustTunnel/olcrtc/wg-obfuscator, sing-box. Magisk id: box_for_root.
--- a/2
+++ b/2
@@ -20,7 +20,7 @@ help() {
    echo -e "  ${YELLOW}stop${RESET}     : Stop PronBox (iptables and service)"
    echo -e "  ${YELLOW}s <args>${RESET} : Run command to box.service with extra arguments"
    echo -e "  ${YELLOW}i <args>${RESET} : Run command to box.iptables with extra arguments"
-    echo -e "  ${YELLOW}p <args>${RESET} : Profile switch — list | status | use trusttunnel | use olcrtc"
+    echo -e "  ${YELLOW}p <args>${RESET} : Profile switch - list | status | use trusttunnel | use olcrtc"
    echo -e "  ${YELLOW}t <args>${RESET} : Run tools from box.tool with extra arguments"
    echo -e "  ${YELLOW}u${RESET}        : API to upgrade core[clash] (POST to /upgrade)"
    echo -e "  ${YELLOW}x${RESET}        : API to upgrade Dashboard UI [clash/sing] (POST to /upgrade/ui)"
--- a/tools/fix_doh_debug.sh
+++ b/tools/fix_doh_debug.sh
@@ -3,7 +3,7 @@ export PATH="/data/adb/magisk:/data/adb/box/bin:/system/bin:$PATH"
 CFG=/data/adb/box/sing-box/config.json
 YQ=/data/adb/box/bin/yq

-# Use HTTPS DoH via sidecar (port 443 — TT allows this; TCP/53 often blocked by SOCKS policy)
+# Use HTTPS DoH via sidecar (port 443 - TT allows this; TCP/53 often blocked by SOCKS policy)
 # Also try DoH via legacy hysteria outbound as fallback dns-hy2
 "$YQ" -i -o=json '
  .dns.servers = [
--- a/tools/fix_olc_yq.sh
+++ b/tools/fix_olc_yq.sh
@@ -35,7 +35,7 @@ CFG=/data/adb/box/sing-box/config-hy2-wg.json
 # Restart sing-box briefly to apply route, keep TT
 kill -HUP "$(pidof sing-box)" 2>/dev/null || true
 sleep 1
-# soft reload may not reload route; restart service is safer but heavy — kill/start sing-box only
+# soft reload may not reload route; restart service is safer but heavy - kill/start sing-box only
 # Use full renew
 sh /data/adb/box/scripts/box.service restart
 sleep 6
--- a/tools/fix_ru_dns.sh
+++ b/tools/fix_ru_dns.sh
@@ -3,7 +3,7 @@ export PATH="/data/adb/magisk:/data/adb/box/bin:/system/bin:$PATH"
 YQ=/data/adb/box/bin/yq
 CFG=/data/adb/box/sing-box/config.json

-# RU DNS also via sidecar DoH — route rules still send .ru traffic direct after resolve
+# RU DNS also via sidecar DoH - route rules still send .ru traffic direct after resolve
 # (old dns-direct to 77.88.8.8 was timing out under tproxy)
 $YQ '(.dns.rules[] | .server) = "dns-remote"' -i --output-format=json "$CFG"
 $YQ '.dns.final = "dns-remote"' -i --output-format=json "$CFG"
--- a/tools/gen_bfr_manager_profiles.py
+++ b/tools/gen_bfr_manager_profiles.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Build BFR Manager–visible profiles (hyphen names) from live config."""
+"""Build BFR Manager-visible profiles (hyphen names) from live config."""
 from __future__ import annotations

 import copy
--- a/tools/install_on_device.sh
+++ b/tools/install_on_device.sh
@@ -28,7 +28,7 @@ if ! grep -q '^stealth_mode=' /data/adb/box/settings.ini; then
  cat >> /data/adb/box/settings.ini <<'EOF'

 # -----------------------------------------------------------------
-# BFR Stealth — anti-detection without LSPosed (iptables port-hide)
+# BFR Stealth - anti-detection without LSPosed (iptables port-hide)
 # -----------------------------------------------------------------
 stealth_mode="true"
 stealth_hide_loopback="true"
--- a/tools/install_wgobfs.sh
+++ b/tools/install_wgobfs.sh
@@ -34,7 +34,7 @@ key = CHANGE_ME_WG_OBFS_KEY
 masking = STUN
 verbose = INFO
 EOF
-  echo "CREATED $SC/wg-obfuscator.conf — set key= to match VPS"
+  echo "CREATED $SC/wg-obfuscator.conf - set key= to match VPS"
 else
  echo "keep existing $SC/wg-obfuscator.conf"
 fi
--- a/tools/probe_tt3.sh
+++ b/tools/probe_tt3.sh
@@ -13,6 +13,6 @@ elif [ -x /data/adb/box/bin/curl ]; then
  /data/adb/box/bin/curl -x socks5h://127.0.0.1:10800 -m 20 -sS https://1.1.1.1/cdn-cgi/trace | head -5
 else
  # minimal SOCKS5 handshake via toybox/dd? skip
-  echo "NO_CURL — checking CONNECTED in log"
+  echo "NO_CURL - checking CONNECTED in log"
  grep 'Successfully connected' /data/adb/box/run/sidecar.log | tail -3
 fi
--- a/tools/tt_deeplink_to_toml.py
+++ b/tools/tt_deeplink_to_toml.py
@@ -78,7 +78,7 @@ def to_toml(fields: dict, socks_port: int = 10800) -> str:
    proto = fields.get("upstream_protocol", "http2")
    anti = str(fields.get("anti_dpi", False)).lower()
    name = fields.get("name", "trusttunnel")
-    return f'''# Generated from tt:// deep link — {name}
+    return f'''# Generated from tt:// deep link - {name}
 loglevel = "info"
 vpn_mode = "general"
 killswitch_enabled = false
--- a/update.json
+++ b/update.json
@@ -1,6 +1,6 @@
 {
-  "version": "v1.12.0",
-  "versionCode": "2026081301",
-  "zipUrl": "http://10.2.0.2/M1rs3m/BFR/releases/download/v1.12.0/pronbox-v1.12.0.zip",
+  "version": "v1.13.0",
+  "versionCode": "2026081302",
+  "zipUrl": "http://10.2.0.2/M1rs3m/BFR/releases/download/v1.13.0/pronbox-v1.13.0.zip",
  "changelog": "http://10.2.0.2/M1rs3m/BFR/src/branch/main/CHANGELOG_STEALTH.md"
 }
Author	SHA1	Message	Date
M1rsem	3ca3c8fcf6	chore: replace em dashes with ASCII hyphens. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 09:44:44 +03:00
M1rsem	d8519acf36	Release PronBox v1.13.0: RU stealth defaults and mixed port 19090. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 09:42:51 +03:00