chore: replace em dashes with ASCII hyphens.

Co-authored-by: Cursor <cursoragent@cursor.com>
Release PronBox v1.13.0: RU stealth defaults and mixed port 19090.
2026-08-13 09:44:44 +03:00 · 2026-08-13 09:42:51 +03:00
12 changed files with 465 additions and 434 deletions
--- a/CHANGELOG_STEALTH.md
+++ b/CHANGELOG_STEALTH.md
@@ -1,23 +1,22 @@
-# PronBox - v1.14.0
+# PronBox - v1.13.0

 Разработано в стенах **НИИ «ТехноПрон»**. Magisk `id` остаётся `box_for_root`.

-## Docs
- **README**: примеры настройки всех протоколов (Hysteria2, TrustTunnel, olcrtc, WG+obfs, комбо-профили)
- Таблица портов, `settings.ini`, sidecar-конфиги, переключение через `sbfr p` / BFR Manager
+## Stealth / RKN mitigation
+- Default **`stealth.list.cfg`**: банки, госуслуги, маркетплейсы, операторы, TG, RKNHardering
+- **`package.list.cfg` blacklist**: чекеры / банки / госуслуги → DIRECT (домашний IP)
+- Mixed inbound sing-box: **7890 → 19090** (меньше Clash-fingerprint)
+- `stealth_extra_ports`: sidecar `10800/10801`, wgobfs `41320`, API, legacy `7890`
+- `box.stealth`: собирает TT/olcrtc/wgobfs порты; IPv6 UDP → `icmp6-port-unreachable`

-## Profiles
- `box.profile use wg-obfs` (alias `riga4` / `wg`) - WireGuard через wg-obfuscator
- При переключении на TT/olcrtc `wgobfs_enable=false` (obfuscator не стартует зря)
- Шаблон `config-wg-obfs.json`: `route.final=wg-riga4`, endpoint WireGuard + loopback peer
-
-## From v1.13.0
- RU stealth defaults, mixed inbound **19090**, blacklist банков/госуслуг
- `wgobfs-real-peers.txt` вместо лишних полей в JSON
+## wg-obfuscator
+- Реальные peer endpoints больше не пишутся в JSON (sing-box ломался) - state-файл `wgobfs-real-peers.txt`

 ## Notes
- Секреты (WG keys, HY2 password) - только на устройстве, шаблоны в ZIP без них
- wg-obfuscator на VPS обязателен для профиля WG
+- После установки банка/Госуслуг: `box.stealth renew`
+- Root/Magisk native - по-прежнему Shamiko / MagiskHide, не PronBox
+- wg-obfuscator на VPS всё ещё нужен для профиля WG

 ## Based on
- PronBox v1.13.0
+- PronBox v1.12.0
+- [taamarin/box_for_magisk](https://github.com/taamarin/box_for_magisk) v1.10.2
--- a/README.md
+++ b/README.md
@@ -60,25 +60,13 @@ PronBox решает это **без LSPosed** - iptables port-hide, hardening

 ### Sidecar-режим (olcrtc / TrustTunnel)

-```text
-Приложение
-  → iptables TPROXY (:9898)
-  → sing-box
-  → SOCKS 127.0.0.1:10800 | :10801
-  → trusttunnel_client | olcrtc
-  → сервер (HTTPS / WebRTC)
-```
-
-### WireGuard + wg-obfuscator
-
 ```text
 Приложение
  → iptables TPROXY
-  → sing-box (route.final = WireGuard endpoint)
-  → UDP 127.0.0.1:41320
-  → wg-obfuscator (client, masking STUN/AUTO)
-  → VPS:13255 (публичный obfuscator)
-  → WireGuard на VPS (10.66.80.1 и т.д.)
+  → sing-box
+  → SOCKS 127.0.0.1:10800
+  → olcrtc | trusttunnel_client
+  → сервер (WebRTC / HTTPS-туннель)
 ```

 ### Stealth-слой (параллельно)
@@ -109,7 +97,7 @@ Observer app (банк, RKNHardering)

 ```powershell
 python tools/build_zip.py
-# → pronbox-v1.14.0.zip
+# → pronbox-v1.13.0.zip
 ```

 **Linux / Git Bash:**
@@ -120,352 +108,75 @@ sh build.sh

 ---

-## Профили и порты (шпаргалка)
+## Быстрый старт

-| Профиль / протокол | Файл sing-box | Sidecar / UDP | `route.final` | CLI |
-|--------------------|---------------|---------------|---------------|-----|
-| **TrustTunnel** | `config-trusttunnel.json` | SOCKS `:10800` | `sidecar-proxy` | `sbfr p use trusttunnel` |
-| **olcrtc** | `config-olcrtc.json` | SOCKS `:10801` | `olcrtc-proxy` | `sbfr p use olcrtc` |
-| **WG + obfuscator** | `config-wg-obfs.json` | UDP `:41320` | `wg-riga4` (endpoint tag) | `sbfr p use wg-obfs` |
-| **Hysteria2** (нативно) | свой `config.json` / `config-hy2.json` | - | `proxy` (hy2 outbound) | вручную / BFR Manager |
-| **Комбо HY2+WG** | `config-hy2-wg.json` | опционально TT/olc | свой | BFR Manager |
+> Перед правкой конфигов **остановите** сервис PronBox.

-Общие порты PronBox:
+### 1. Профили TrustTunnel / olcrtc (быстрое переключение)

-| Порт | Назначение |
-|------|------------|
-| `9898` | TPROXY inbound sing-box (прозрачный прокси) |
-| `19090` | mixed inbound (localhost, **не 7890** - меньше Clash-fingerprint) |
-| `10800` | TrustTunnel SOCKS |
-| `10801` | olcrtc SOCKS |
-| `41320` | wg-obfuscator listen (loopback, sing-box WG peer сюда) |
+В модуле лежат два готовых шаблона:

-> Перед правкой конфигов **остановите** сервис: `sbfr stop`.
+| Профиль | Файл | SOCKS | `route.final` |
+|---------|------|-------|---------------|
+| TrustTunnel | `config.trusttunnel.json` | `:10800` | `sidecar-proxy` |
+| olcrtc | `config.olcrtc.json` | `:10801` | `olcrtc-proxy` |

---
-
-## Примеры настройки всех протоколов
-
-### 0. Базовый `settings.ini` (общее для sidecar)
-
-Файл: `/data/adb/box/settings.ini`
-
-```ini
-bin_name="sing-box"
-network_mode="tproxy"
-name_sing_config="config-trusttunnel.json"
-
-# Stealth (по умолчанию включён)
-stealth_mode="true"
-stealth_hide_loopback="true"
-stealth_disable_api="true"
-
-# Sidecar: оба протокола + переключение final в JSON-профиле (BFR Manager)
-sidecar_enable="true"
-sidecar_protocol="both"
-sidecar_set_final="false"
-sidecar_tt_port="10800"
-sidecar_olc_port="10801"
-sidecar_outbound_tag="sidecar-proxy"
-sidecar_olc_tag="olcrtc-proxy"
-
-# WG obfuscator (только для профиля config-wg-obfs.json)
-wgobfs_enable="false"
-wgobfs_listen_port="41320"
-wgobfs_config="${box_dir}/sidecar/wg-obfuscator.conf"
-wgobfs_patch_config="true"
-```
-
-Установка бинарников sidecar / wg-obfuscator:
-
-```bash
-su -c /data/adb/box/scripts/box.tool upsidercar    # trusttunnel_client + olcrtc (если есть в релизе)
-su -c /data/adb/box/scripts/box.tool upwgobfs     # wg-obfuscator arm64
-```
-
---
-
-### 1. Hysteria2 (нативный outbound sing-box)
-
-Подходит, если на VPS уже поднят Hysteria2 без sidecar.
-
-**Фрагмент** `/data/adb/box/sing-box/config.json`:
-
-```json
-{
-  "inbounds": [
-    { "type": "tproxy", "tag": "tproxy-in", "listen": "::", "listen_port": 9898 },
-    { "type": "mixed", "tag": "mixed-in", "listen": "127.0.0.1", "listen_port": 19090 }
-  ],
-  "outbounds": [
-    {
-      "type": "hysteria2",
-      "tag": "proxy",
-      "server": "YOUR_SERVER_IP",
-      "server_port": 443,
-      "password": "YOUR_HYSTERIA2_PASSWORD",
-      "tls": {
-        "enabled": true,
-        "server_name": "your.domain.example",
-        "alpn": ["h3"]
-      }
-    },
-    { "type": "direct", "tag": "direct" }
-  ],
-  "route": {
-    "rules": [
-      { "domain_suffix": ["yandex.ru", "ya.ru"], "outbound": "direct" },
-      { "ip_cidr": ["YOUR_SERVER_IP/32"], "outbound": "direct" }
-    ],
-    "final": "proxy"
-  }
-}
-```
-
-В `settings.ini`: `name_sing_config="config.json"`, `sidecar_enable="false"`, `wgobfs_enable="false"`.
-
-Проверка:
-
-```bash
-su -c /data/adb/box/scripts/box.tool check
-sbfr start
-```
-
---
-
-### 2. TrustTunnel (sidecar → SOCKS :10800)
-
-**Шаг 1.** Экспорт клиентского конфига с вашего TrustTunnel endpoint (на сервере):
-
-```bash
-trusttunnel_endpoint vpn.toml hosts.toml -c client -a server --format toml
-```
-
-**Шаг 2.** Положить на телефон `/data/adb/box/sidecar/trusttunnel.toml` (из экспорта).  
-Обязательно SOCKS на loopback **10800**:
-
-```toml
-[listener]
-type = "socks5"
-address = "127.0.0.1:10800"
-# ... credentials / TLS из экспорта endpoint ...
-```
-
-**Шаг 3.** Профиль sing-box: скопировать шаблон и указать свой HY2/VLESS fallback при необходимости:
-
-```bash
-cp /data/adb/box/sing-box/config-trusttunnel.json /data/adb/box/sing-box/config-trusttunnel.json.bak
-# в config-trusttunnel.json уже есть:
-#   outbounds[].tag = sidecar-proxy → 127.0.0.1:10800
-#   route.final = sidecar-proxy
-```
-
-**Шаг 4.** Переключение:
-
-```bash
-sbfr p use trusttunnel
-# или BFR Manager → Manage Profiles → config-trusttunnel.json
-```
-
-Цепочка: `App → TPROXY → sing-box → SOCKS:10800 → trusttunnel_client → VPS`.
-
---
-
-### 3. olcrtc (sidecar → SOCKS :10801)
-
-**Шаг 1.** Собрать или положить бинарник `olcrtc` в `/data/adb/box/bin/olcrtc` (`chmod 755`).
-
-**Шаг 2.** Конфиг `/data/adb/box/sidecar/olcrtc.yaml`:
-
-```yaml
-mode: cnc
-auth:
-  provider: telemost
-room:
-  id: "YOUR_TELEMOST_NUMERIC_ROOM_ID"
-crypto:
-  key: "64_HEX_CHARS_SAME_ON_SERVER_AND_CLIENT"
-net:
-  transport: vp8channel
-  dns: "192.168.0.1:53"
-socks:
-  host: "127.0.0.1"
-  port: 10801
-data: /data/adb/box/run/olcrtc-data
-```
-
-> `room.id` - **числовой** id комнаты Telemost, не полный URL.  
-> `net.dns` - LAN DNS роутера; публичный DNS из root-контекста olcrtc часто зависает.
-
-**Шаг 3.** Профиль `config-olcrtc.json`: `route.final = olcrtc-proxy`, SOCKS `:10801`.
-
-**Шаг 4.** Переключение:
-
-```bash
-sbfr p use olcrtc
-```
-
---
-
-### 4. TrustTunnel + olcrtc одновременно (переключение в BFR Manager)
-
-Оба sidecar поднимаются параллельно; **какой exit** - решает `route.final` в выбранном JSON-профиле.
-
-`settings.ini`:
-
-```ini
-sidecar_enable="true"
-sidecar_protocol="both"
-sidecar_set_final="false"
-```
-
-В приложении **BFR Manager → Manage Profiles**:
-
- `config-trusttunnel.json` → exit через TrustTunnel (`sidecar-proxy`)
- `config-olcrtc.json` → exit через olcrtc (`olcrtc-proxy`)
-
-CLI то же самое: `sbfr p use trusttunnel` / `sbfr p use olcrtc`.
-
---
-
-### 5. WireGuard + wg-obfuscator (профиль `config-wg-obfs`)
-
-Нужен **obfuscator на VPS** с тем же `key`. Plain WireGuard на публичный UDP obfuscator **не подключится**.
-
-**Клиент** `/data/adb/box/sidecar/wg-obfuscator.conf`:
-
-```ini
-[client]
-source-if = 127.0.0.1
-source-lport = 41320
-target = YOUR_VPS_IP:13255
-key = YOUR_SHARED_OBFS_KEY
-masking = AUTO
-verbose = INFO
-```
-
-**Сервер (VPS)** - см. `box/sidecar/wg-obfuscator.server.example.conf`:
-
-```ini
-[server]
-source-if = 0.0.0.0
-source-lport = 13255
-target = 127.0.0.1:51820
-key = YOUR_SHARED_OBFS_KEY
-masking = AUTO
-```
-
-WireGuard на VPS слушает `51820`; снаружи клиенты бьют в `13255` (obfuscator).
-
-**Профиль sing-box** `/data/adb/box/sing-box/config-wg-obfs.json` (фрагмент):
-
-```json
-{
-  "endpoints": [{
-    "type": "wireguard",
-    "tag": "wg-riga4",
-    "mtu": 1280,
-    "address": ["10.66.80.3/32"],
-    "private_key": "YOUR_WG_PRIVATE_KEY",
-    "peers": [{
-      "address": "127.0.0.1",
-      "port": 41320,
-      "public_key": "YOUR_WG_PEER_PUBLIC_KEY",
-      "allowed_ips": ["0.0.0.0/0"],
-      "persistent_keepalive_interval": 25
-    }]
-  }],
-  "route": {
-    "rules": [
-      { "ip_cidr": ["YOUR_VPS_IP/32"], "outbound": "direct" },
-      { "ip_cidr": ["10.66.80.0/24"], "outbound": "wg-riga4" },
-      { "ip_cidr": ["192.168.0.0/16", "127.0.0.0/8"], "outbound": "direct" }
-    ],
-    "final": "wg-riga4"
-  }
-}
-```
-
-PronBox при старте перепишет peer на `127.0.0.1:41320` (если `wgobfs_patch_config="true"`), VPS IP уйдёт в `/data/adb/box/run/wgobfs-real-peers.txt`.
-
-**Включение:**
-
-```bash
-sbfr p use wg-obfs
-# alias: sbfr p use wg  |  sbfr p use riga4
-su -c /data/adb/box/scripts/box.wgobfs status
-ping -c 3 10.66.80.1
-```
-
---
-
-### 6. Комбо Hysteria2 + WireGuard (`config-hy2-wg.json`)
-
-Для сценария «HY2 как основной exit + WG endpoint для LAN/VPS».  
-Создайте файл в `/data/adb/box/sing-box/config-hy2-wg.json`:
-
- `outbounds`: hysteria2 `proxy` + socks sidecar (если нужны TT/olc)
- `endpoints`: wireguard `wg-home` с peer на VPS или через obfuscator
- `route.rules`: `.ru` / private → `direct`, HY2 server IP → `direct`, `final` → `proxy` или sidecar
-
-Выберите профиль в BFR Manager или:
-
-```ini
-name_sing_config="config-hy2-wg.json"
-```
-
-Шаблон можно собрать из рабочего конфига:
+Подставьте свои пароли/ключи (шаблоны в репозитории scrubbed) или на устройстве:

 ```bash
+# клонировать текущий рабочий конфиг в оба профиля
 su -c '/data/adb/box/scripts/box.profile seed'
-cp /data/adb/box/sing-box/config-trusttunnel.json /data/adb/box/sing-box/config-hy2-wg.json
-# добавьте/оставьте endpoints WireGuard и нужный route.final
+
+# переключение (меняет name_sing_config + sidecar_* и рестартит сервис)
+sbfr p use trusttunnel
+sbfr p use olcrtc
+sbfr p status
 ```

---
+В Magisk/терминале то же самое: `su -c '/data/adb/box/scripts/box.profile use olcrtc'`.

-### 7. Stealth + blacklist (банки, RKNHardering)
+### 2. Конфиг sing-box (с нуля)

-**Observer apps** (не видят localhost-прокси) - `/data/adb/box/stealth.list.cfg`:
+Скопируйте минимальный шаблон и настройте outbound:
+
+```bash
+cp /data/adb/box/sing-box/config.stealth.example.json /data/adb/box/sing-box/config.json
+# добавьте свой VLESS / другой outbound
+```
+
+### 3. Observer-приложения (stealth)
+
+Файл `/data/adb/box/stealth.list.cfg` - приложения, которым **скрываем** localhost-прокси:

 ```text
-com.notcvnt.rknhardering
+# один package на строку
 ru.sberbankmobile
 com.idamob.tinkoff.android
-ru.gosuslugi.gosapp
+ru.rostel
+com.notcvnt.rknhardering
 ```

-**Blacklist** (трафик мимо прокси, домашний IP) - `/data/adb/box/package.list.cfg`:
+### 4. Blacklist для checker'а
+
+Чтобы RKNHardering **не шёл через прокси**, добавьте в `/data/adb/box/package.list.cfg`:

 ```text
 mode:blacklist
 com.notcvnt.rknhardering
-ru.sberbankmobile
-ru.gosuslugi.gosapp
 ```

-После установки новых банков:
+### 5. Запуск

 ```bash
-su -c /data/adb/box/scripts/box.stealth renew
-su -c /data/adb/box/scripts/box.iptables renew
+su -c /data/adb/box/scripts/box.service start
+su -c /data/adb/box/scripts/box.iptables enable
 ```

---
-
-## Быстрый старт (чеклист)
-
-1. Установить ZIP, перезагрузка, `sbfr start`
-2. Выбрать протокол (см. таблицу выше) и заполнить sidecar / sing-box конфиг
-3. `sbfr p use trusttunnel` | `olcrtc` | `wg-obfs`
-4. `sbfr p status` - проверить `route.final` и PID процессов
-5. Для RKN: `stealth.list.cfg` + blacklist в `package.list.cfg`
-
-Seed профилей из текущего рабочего конфига:
+Stealth включается **автоматически** при `stealth_mode="true"` (по умолчанию). Вручную:

 ```bash
-su -c '/data/adb/box/scripts/box.profile seed'
-sbfr p list
+su -c /data/adb/box/scripts/box.stealth enable
+su -c /data/adb/box/scripts/box.stealth status
 ```

 ---
@@ -493,7 +204,7 @@ stealth_api_bind="127.0.0.1"
 stealth_api_port="19090"
 stealth_block_quic="false"
 stealth_forbid_tun="true"
-stealth_extra_ports=("7890" "7891" "19090" "1080" "10808" "2080" "41320" "10800" "10801" "9090" "9091" "1053")
+stealth_extra_ports=("7890" "7891" "1080" "10808" "2080")
 ```

 ### Что закрывает / что нет
@@ -509,31 +220,98 @@ stealth_extra_ports=("7890" "7891" "19090" "1080" "10808" "2080" "41320" "10800"

 ---

-## Sidecar: olcrtc и TrustTunnel (кратко)
+## Sidecar: olcrtc и TrustTunnel

-Подробные пошаговые примеры - в разделе **[Примеры настройки всех протоколов](#примеры-настройки-всех-протоколов)** (п. 2-4).
+Sidecar поднимает локальный SOCKS5; sing-box направляет трафик на него.

-| Протокол | Конфиг sidecar | SOCKS порт | sing-box outbound tag |
-|----------|----------------|------------|------------------------|
-| TrustTunnel | `/data/adb/box/sidecar/trusttunnel.toml` | `10800` | `sidecar-proxy` |
-| olcrtc | `/data/adb/box/sidecar/olcrtc.yaml` | `10801` | `olcrtc-proxy` |
+### TrustTunnel

-Шаблоны: `box/sidecar/trusttunnel.example.toml`, `box/sidecar/olcrtc.example.yaml`.
+```bash
+# Скачать клиент (linux-aarch64/armv7 для Android)
+su -c /data/adb/box/scripts/box.tool upsidercar trusttunnel
+
+# Конфиг с endpoint → trusttunnel.toml
+cp /data/adb/box/sidecar/trusttunnel.example.toml /data/adb/box/sidecar/trusttunnel.toml
+# отредактируйте (экспорт: trusttunnel_endpoint ... --format toml)
+```
+
+`settings.ini`:
+
+```ini
+sidecar_enable="true"
+sidecar_protocol="trusttunnel"
+sidecar_listen_port="10800"
+sidecar_outbound_tag="sidecar-proxy"
+sidecar_set_final="true"
+```
+
+### olcrtc
+
+Официального Android-релиза нет - бинарник собирается вручную:
+
+```bash
+# https://github.com/openlibrecommunity/olcrtc - mage mobile
+# положите бинарник:
+# /data/adb/box/bin/olcrtc
+chmod 755 /data/adb/box/bin/olcrtc
+
+cp /data/adb/box/sidecar/olcrtc.example.yaml /data/adb/box/sidecar/olcrtc.yaml
+# room id + crypto.key (64 hex) - одинаковые на клиенте и сервере
+```
+
+`settings.ini`:
+
+```ini
+sidecar_enable="true"
+sidecar_protocol="olcrtc"
+sidecar_listen_port="10801"
+sidecar_outbound_tag="olcrtc-proxy"
+```
+
+> **Важно:** порт в sidecar-конфиге (`socks.port`) должен совпадать с `sidecar_listen_port` (TT `:10800`, olcrtc `:10801`).
+> Для olcrtc в `olcrtc.yaml` задайте LAN DNS: `net.dns: "192.168.0.1:53"` (публичные DNS через PreferGo от root часто виснут).

 ---

-## WireGuard Obfuscator (кратко)
+## WireGuard Obfuscator ([ClusterM/wg-obfuscator](https://github.com/ClusterM/wg-obfuscator))

-Полный пример клиент + сервер + `config-wg-obfs.json` - в разделе **[п. 5](#5-wireguard--wg-obfuscator-профиль-config-wg-obfs)**.
+Это **не VPN**, а UDP-обфускатор WireGuard (маскировка под STUN и т.п.). Нужен **на обоих концах** - телефон + VPS с тем же `key`. Со сторонним WG-сервером без своего obfuscator не заработает.

-Репозиторий: [ClusterM/wg-obfuscator](https://github.com/ClusterM/wg-obfuscator).  
-Обязателен **на обоих концах** с одинаковым `key`.
+```text
+sing-box WireGuard peer
+  → 127.0.0.1:41320
+  → wg-obfuscator (client)
+  → VPS:public_udp
+  → wg-obfuscator (server)
+  → WireGuard на VPS
+```
+
+### Клиент (Android / PronBox)

 ```bash
 su -c /data/adb/box/scripts/box.tool upwgobfs
-sbfr p use wg-obfs
+cp /data/adb/box/sidecar/wg-obfuscator.example.conf /data/adb/box/sidecar/wg-obfuscator.conf
+# key=...  target=VPS_IP:PORT  (порт публичного obfuscator на сервере)
 ```

+В `settings.ini`:
+
+```ini
+wgobfs_enable="true"
+wgobfs_listen_port="41320"
+wgobfs_patch_config="true"
+```
+
+Или профиль в **Manage Profiles**: `config-wg-obfs.json` (авто-старт wgobfs).
+
+### Сервер (VPS)
+
+См. `box/sidecar/wg-obfuscator.server.example.conf`:
+
+1. Сдвинуть WireGuard `ListenPort` (например на `51820`).
+2. Поставить `wg-obfuscator` на старый публичный порт (`13232`).
+3. `target = 127.0.0.1:51820`, тот же `key`, `masking = AUTO`.
+
 ---

 ## Структура модуля
@@ -543,17 +321,15 @@ sbfr p use wg-obfs
 | `/data/adb/box/settings.ini` | Главный конфиг |
 | `/data/adb/box/stealth.list.cfg` | Observer apps для port-hide |
 | `/data/adb/box/package.list.cfg` | Blacklist/whitelist приложений |
-| `/data/adb/box/sing-box/config-trusttunnel.json` | Профиль TrustTunnel |
-| `/data/adb/box/sing-box/config-olcrtc.json` | Профиль olcrtc |
-| `/data/adb/box/sing-box/config-wg-obfs.json` | Профиль WG + wg-obfuscator |
-| `/data/adb/box/sing-box/config-hy2-wg.json` | Комбо HY2 + WG (создаётся вручную) |
+| `/data/adb/box/sing-box/config.trusttunnel.json` | Профиль TrustTunnel |
+| `/data/adb/box/sing-box/config.olcrtc.json` | Профиль olcrtc |
 | `/data/adb/box/sing-box/config.json` | Активный конфиг (или через `name_sing_config`) |
-| `/data/adb/box/sidecar/` | trusttunnel.toml, olcrtc.yaml, wg-obfuscator.conf |
+| `/data/adb/box/sidecar/` | Конфиги olcrtc / TrustTunnel |
 | `/data/adb/box/bin/` | Бинарники (sing-box, sidecar) |
 | `/data/adb/box/run/` | Логи, PID, UID-списки |
 | `/data/adb/box/scripts/box.stealth` | Stealth iptables |
 | `/data/adb/box/scripts/box.sidecar` | Sidecar lifecycle |
-| `/data/adb/box/scripts/box.profile` | Переключение TT / olcrtc / wg-obfs |
+| `/data/adb/box/scripts/box.profile` | Переключение TT / olcrtc |
 | `/data/adb/box/scripts/box.service` | Старт/стоп ядра |
 | `/data/adb/box/scripts/box.iptables` | TPROXY правила |

@@ -604,8 +380,7 @@ sbfr s status # статус сервиса
 sbfr i enable # iptables
 sbfr p use trusttunnel  # профиль TT
 sbfr p use olcrtc       # профиль olcrtc
-sbfr p use wg-obfs      # WG + wg-obfuscator
-sbfr p list | status
+sbfr t check  # box.tool
 ```

 ---
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -1,33 +1,35 @@
-# Release PronBox v1.14.0
+# Release PronBox v1.13.0

 Продукт **НИИ «ТехноПрон»**. Magisk id: `box_for_root`.

 ## Локально

 - Ветка `main`
- Тег: `v1.14.0`
- ZIP: `pronbox-v1.14.0.zip` → `python tools/build_zip.py`
+- Тег: `v1.13.0`
+- ZIP: `pronbox-v1.13.0.zip` → `python tools/build_zip.py`
 - Remote: `gitea@10.2.0.2:M1rs3m/BFR.git`
+- Display name: **PronBox**
+- Author: **команда НИИ «ТехноПрон»**

 ## Push + tag

 ```powershell
 cd E:\bfr_mod
 git push -u origin main
-git push origin v1.14.0
+git push origin v1.13.0
 ```

-Готовый ZIP для Gitea / скачивания: **`E:\bfr_mod\pronbox-v1.14.0.zip`**
+ZIP в релиз на Gitea: `E:\bfr_mod\pronbox-v1.13.0.zip`

 ## Release на Gitea

 1. `http://10.2.0.2/M1rs3m/BFR` → **Releases** → **New Release**
-2. Tag: `v1.14.0`
-3. Title: `PronBox v1.14.0 - docs all protocols + wg-obfs profile`
-4. Description: `CHANGELOG_STEALTH.md`
-5. Attach: `pronbox-v1.14.0.zip`
+2. Tag: `v1.13.0`
+3. Title: `PronBox v1.13.0 - stealth RU + mixed 19090`
+4. Description: содержимое `CHANGELOG_STEALTH.md`
+5. Attach: `pronbox-v1.13.0.zip`
 6. Publish

-OTA:
+OTA (`update.json`):

-`http://10.2.0.2/M1rs3m/BFR/releases/download/v1.14.0/pronbox-v1.14.0.zip`
+`http://10.2.0.2/M1rs3m/BFR/releases/download/v1.13.0/pronbox-v1.13.0.zip`
--- a/box/scripts/box.profile
+++ b/box/scripts/box.profile
@@ -28,8 +28,6 @@ profile_apply_settings() {
      sed -i 's/^sidecar_listen_port=.*/sidecar_listen_port="10800"/' "${ini}"
      sed -i 's/^sidecar_outbound_tag=.*/sidecar_outbound_tag="sidecar-proxy"/' "${ini}"
      sed -i 's/^sidecar_set_final=.*/sidecar_set_final="false"/' "${ini}"
-      sed -i 's/^wgobfs_enable=.*/wgobfs_enable="false"/' "${ini}"
-      grep -q '^wgobfs_enable=' "${ini}" || echo 'wgobfs_enable="false"' >> "${ini}"
      echo "trusttunnel"
      ;;
    olcrtc|olc)
@@ -39,22 +37,16 @@ profile_apply_settings() {
      sed -i 's/^sidecar_listen_port=.*/sidecar_listen_port="10801"/' "${ini}"
      sed -i 's/^sidecar_outbound_tag=.*/sidecar_outbound_tag="sidecar-proxy"/' "${ini}"
      sed -i 's/^sidecar_set_final=.*/sidecar_set_final="false"/' "${ini}"
-      sed -i 's/^wgobfs_enable=.*/wgobfs_enable="false"/' "${ini}"
-      grep -q '^wgobfs_enable=' "${ini}" || echo 'wgobfs_enable="false"' >> "${ini}"
      # Prefer LAN DNS for olcrtc PreferGo resolver under root:net_admin
      if [ -f "${box_dir}/sidecar/olcrtc.yaml" ] && [ -x "${box_dir}/bin/yq" ]; then
        "${box_dir}/bin/yq" -i '.net.dns = "192.168.0.1:53"' "${box_dir}/sidecar/olcrtc.yaml" 2>/dev/null || true
      fi
      echo "olcrtc"
      ;;
-    wg-obfs|wgobfs|wg|riga4)
+    wg-obfs|wgobfs|wg)
      sed -i 's/^name_sing_config=.*/name_sing_config="config-wg-obfs.json"/' "${ini}"
      sed -i 's/^wgobfs_enable=.*/wgobfs_enable="true"/' "${ini}"
      grep -q '^wgobfs_enable=' "${ini}" || echo 'wgobfs_enable="true"' >> "${ini}"
-      sed -i 's/^wgobfs_listen_port=.*/wgobfs_listen_port="41320"/' "${ini}"
-      grep -q '^wgobfs_listen_port=' "${ini}" || echo 'wgobfs_listen_port="41320"' >> "${ini}"
-      # sidecars optional; WG is the exit - keep both ready but don't force final rewrite
-      sed -i 's/^sidecar_set_final=.*/sidecar_set_final="false"/' "${ini}"
      echo "wg-obfs"
      ;;
    *)
@@ -111,9 +103,9 @@ profile_list() {
  echo "Profiles (also visible in BFR Manager → Manage Profiles):"
  echo "  trusttunnel  -> config-trusttunnel.json  (final=sidecar-proxy :10800)"
  echo "  olcrtc       -> config-olcrtc.json       (final=olcrtc-proxy :10801)"
-  echo "  wg-obfs      -> config-wg-obfs.json      (Riga4 WG via wg-obfuscator :41320)"
+  echo "  wg-obfs      -> config-wg-obfs.json      (WG via wg-obfuscator :41320)"
  echo "  sidecar mode -> both (set_final=false) so app switching keeps finals"
-  echo "  NOTE: wg-obfs needs VPS obfuscator on :13255 + same key"
+  echo "  NOTE: wg-obfs needs matching obfuscator on the VPS (same key)"
  echo
  echo "Files in ${profiles_dir}:"
  ls -1 "${profiles_dir}"/config*.json 2>/dev/null
@@ -137,7 +129,7 @@ profile_status() {

 profile_use() {
  name="$1"
-  [ -n "${name}" ] || { echo "usage: $0 use {trusttunnel|olcrtc|wg-obfs}"; exit 1; }
+  [ -n "${name}" ] || { echo "usage: $0 use {trusttunnel|olcrtc}"; exit 1; }
  profile_seed_from_active || true
  applied=$(profile_apply_settings "${name}") || exit 1

@@ -170,7 +162,7 @@ case "$1" in
    profile_seed_from_active
    ;;
  *)
-    echo "usage: $0 {list|status|use trusttunnel|use olcrtc|use wg-obfs|seed}"
+    echo "usage: $0 {list|status|use trusttunnel|use olcrtc|seed}"
    exit 1
    ;;
 esac
--- a/box/sidecar/wg-obfuscator.example.conf
+++ b/box/sidecar/wg-obfuscator.example.conf
@@ -1,9 +1,28 @@
-# PronBox client - WireGuard Obfuscator (ClusterM)
-# Fill key/target to match VPS obfuscator. Listen on loopback for sing-box WG peer.
+# VeilBox client - WireGuard Obfuscator (ClusterM)
+# https://github.com/ClusterM/wg-obfuscator
+#
+# CRITICAL: the same `key` must be configured on the VPS obfuscator.
+# Without a server-side wg-obfuscator this will NOT connect.
+#
+# Typical server layout (on VPS):
+#   public UDP 13232 → wg-obfuscator → 127.0.0.1:<real WireGuard ListenPort>
+# Client target below must point at that public obfuscator host:port.
+
 [client]
+# Listen only on loopback (sing-box WireGuard peer connects here)
 source-if = 127.0.0.1
 source-lport = 41320
-target = YOUR_VPS_IP:13255
+
+# Real remote: your VPS wg-obfuscator public endpoint
+# Example uses the previous raw WG host - after you wrap WG with obfuscator on the VPS,
+# keep the public host:port here (obfuscator listens where WG used to).
+target = YOUR_VPS_IP:13232
+
+# Shared obfuscation key (plain string, same on both sides)
 key = CHANGE_ME_WG_OBFS_KEY
-masking = AUTO
+
+# STUN masking helps against DPI that only allows "video call" UDP
+# AUTO | STUN | NONE
+masking = STUN
+
 verbose = INFO
--- a/box/sing-box/README.md
+++ b/box/sing-box/README.md
@@ -1,17 +1,17 @@
 # PronBox sing-box profiles

-| File | Sidecar / UDP | `route.final` | Switch |
-|------|---------------|---------------|--------|
-| `config-trusttunnel.json` | TrustTunnel SOCKS `:10800` | `sidecar-proxy` | `sbfr p use trusttunnel` |
-| `config-olcrtc.json` | olcrtc SOCKS `:10801` | `olcrtc-proxy` | `sbfr p use olcrtc` |
-| `config-wg-obfs.json` | wg-obfuscator UDP `:41320` | `wg-riga4` (endpoint) | `sbfr p use wg-obfs` |
-| `config-hy2-wg.json` | optional TT/olc | custom | BFR Manager |
-| `config.stealth.example.json` | - | minimal template | - |
+| File | Sidecar | SOCKS / UDP | `route.final` / note |
+|------|---------|-------------|----------------------|
+| `config-trusttunnel.json` | TrustTunnel | `127.0.0.1:10800` | `sidecar-proxy` |
+| `config-olcrtc.json` | olcrtc | `127.0.0.1:10801` | `olcrtc-proxy` |
+| `config-wg-obfs.json` | wg-obfuscator | UDP `:41320` | WG peers → localhost obfuscator |
+| `config.stealth.example.json` | - | - | minimal template |

-Files in `/data/adb/box/sing-box/*.json` appear in **BFR Manager → Manage Profiles**.
+These files appear in **BFR Manager → Manage Profiles** (all `*.json` in `/data/adb/box/sing-box/`).

-**TT + olcrtc flip:** `sidecar_protocol="both"` + `sidecar_set_final="false"`.
+For TT/olcrtc flipping in the app:
+- `sidecar_protocol="both"` + `sidecar_set_final="false"`

-**WG obfs:** matching [wg-obfuscator](https://github.com/ClusterM/wg-obfuscator) on VPS, client `/data/adb/box/sidecar/wg-obfuscator.conf`.
-
-Full setup examples: [README.md](../../README.md#примеры-настройки-всех-протоколов).
+For WG obfuscation (`config-wg-obfs.json`):
+- matching [wg-obfuscator](https://github.com/ClusterM/wg-obfuscator) on the VPS with the same `key`
+- client conf: `/data/adb/box/sidecar/wg-obfuscator.conf`
--- a/box/sing-box/config-olcrtc.json
+++ b/box/sing-box/config-olcrtc.json
@@ -78,6 +78,69 @@
        ],
        "outbound": "direct"
      },
+      {
+        "ip_cidr": [
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "ip_cidr": [
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "ip_cidr": [
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
+        ],
+        "outbound": "direct"
+      },
      {
        "action": "sniff"
      },
@@ -87,6 +150,7 @@
      },
      {
        "ip_cidr": [
+          "YOUR_VPS_IP/32",
          "YOUR_VPS_IP/32"
        ],
        "outbound": "direct"
--- a/box/sing-box/config-trusttunnel.json
+++ b/box/sing-box/config-trusttunnel.json
@@ -78,6 +78,69 @@
        ],
        "outbound": "direct"
      },
+      {
+        "ip_cidr": [
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "ip_cidr": [
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "ip_cidr": [
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
+        ],
+        "outbound": "direct"
+      },
      {
        "action": "sniff"
      },
@@ -87,6 +150,7 @@
      },
      {
        "ip_cidr": [
+          "YOUR_VPS_IP/32",
          "YOUR_VPS_IP/32"
        ],
        "outbound": "direct"
--- a/box/sing-box/config-wg-obfs.json
+++ b/box/sing-box/config-wg-obfs.json
@@ -10,34 +10,37 @@
        "tag": "dns-direct"
      },
      {
-        "type": "udp",
-        "tag": "dns-wg",
+        "type": "https",
+        "tag": "dns-remote",
+        "detour": "olcrtc-proxy",
        "server": "1.1.1.1",
-        "server_port": 53,
-        "detour": "wg-riga4"
+        "path": "/dns-query"
+      },
+      {
+        "type": "https",
+        "tag": "dns-hy2",
+        "detour": "sidecar-proxy",
+        "server": "1.1.1.1",
+        "path": "/dns-query"
      }
    ],
-    "final": "dns-wg",
+    "final": "dns-remote",
    "strategy": "ipv4_only",
    "independent_cache": true
  },
  "endpoints": [
    {
      "type": "wireguard",
-      "tag": "wg-riga4",
+      "tag": "wg-home",
      "mtu": 1280,
-      "address": [
-        "10.66.80.3/32"
-      ],
+      "address": "10.0.10.16/32",
      "private_key": "YOUR_WIREGUARD_PRIVATE_KEY",
      "peers": [
        {
          "address": "127.0.0.1",
          "port": 41320,
          "public_key": "YOUR_PEER_PUBLIC_KEY",
-          "allowed_ips": [
-            "0.0.0.0/0"
-          ],
+          "allowed_ips": "10.0.0.0/8",
          "persistent_keepalive_interval": 25
        }
      ]
@@ -58,6 +61,18 @@
    }
  ],
  "outbounds": [
+    {
+      "type": "hysteria2",
+      "tag": "proxy",
+      "server": "YOUR_SERVER_IP",
+      "server_port": 443,
+      "password": "YOUR_HYSTERIA2_PASSWORD",
+      "tls": {
+        "enabled": true,
+        "server_name": "assets.m1rs3m.org",
+        "alpn": "h3"
+      }
+    },
    {
      "type": "direct",
      "tag": "direct"
@@ -79,9 +94,75 @@
  ],
  "route": {
    "rules": [
+      {
+        "domain_suffix": [
+          "yandex.ru",
+          "yandex.net",
+          "yandex.com",
+          "ya.ru"
+        ],
+        "outbound": "direct"
+      },
      {
        "ip_cidr": [
-          "YOUR_VPS_IP/32"
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "ip_cidr": [
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "ip_cidr": [
+          "1",
+          "3",
+          ".",
+          "1",
+          "4",
+          "0",
+          ".",
+          "1",
+          "7",
+          ".",
+          "1",
+          "6",
+          "3",
+          "/",
+          "3",
+          "2"
        ],
        "outbound": "direct"
      },
@@ -94,24 +175,59 @@
      },
      {
        "ip_cidr": [
-          "10.66.80.0/24"
+          "YOUR_VPS_IP/32"
        ],
-        "outbound": "wg-riga4"
+        "outbound": "direct"
      },
      {
        "ip_cidr": [
-          "10.0.0.0/8",
          "192.168.0.0/16",
          "172.16.0.0/12",
          "127.0.0.0/8",
          "169.254.0.0/16"
        ],
        "outbound": "direct"
+      },
+      {
+        "rule_set": "geoip-private",
+        "outbound": "direct"
+      },
+      {
+        "domain_suffix": [
+          ".ru",
+          ".su",
+          ".xn--p1ai"
+        ],
+        "outbound": "direct"
+      },
+      {
+        "rule_set": "geosite-category-ru",
+        "outbound": "direct"
+      },
+      {
+        "rule_set": "geoip-ru",
+        "outbound": "direct"
      }
    ],
-    "final": "wg-riga4",
-    "default_domain_resolver": "dns-direct",
-    "auto_detect_interface": true
+    "rule_set": [
+      {
+        "type": "local",
+        "tag": "geoip-private",
+        "path": "ruleset/geoip-private.srs"
+      },
+      {
+        "type": "local",
+        "tag": "geoip-ru",
+        "path": "ruleset/geoip-ru.srs"
+      },
+      {
+        "type": "local",
+        "tag": "geosite-category-ru",
+        "path": "ruleset/geosite-category-ru.srs"
+      }
+    ],
+    "final": "olcrtc-proxy",
+    "default_domain_resolver": "dns-direct"
  },
  "experimental": {
    "cache_file": {
--- a/module.prop
+++ b/module.prop
@@ -1,6 +1,6 @@
 id=box_for_root
 name=PronBox
-version=v1.14.0
-versionCode=2026081303
+version=v1.13.0
+versionCode=2026081302
 author=команда НИИ «ТехноПрон»
 description=PronBox - прозрачный TPROXY-прокси из стен НИИ «ТехноПрон». Stealth без LSPosed, TrustTunnel/olcrtc/wg-obfuscator, sing-box. Magisk id: box_for_root.
--- a/2
+++ b/2
@@ -20,7 +20,7 @@ help() {
    echo -e "  ${YELLOW}stop${RESET}     : Stop PronBox (iptables and service)"
    echo -e "  ${YELLOW}s <args>${RESET} : Run command to box.service with extra arguments"
    echo -e "  ${YELLOW}i <args>${RESET} : Run command to box.iptables with extra arguments"
-    echo -e "  ${YELLOW}p <args>${RESET} : Profile switch - list | status | use trusttunnel | use olcrtc | use wg-obfs"
+    echo -e "  ${YELLOW}p <args>${RESET} : Profile switch - list | status | use trusttunnel | use olcrtc"
    echo -e "  ${YELLOW}t <args>${RESET} : Run tools from box.tool with extra arguments"
    echo -e "  ${YELLOW}u${RESET}        : API to upgrade core[clash] (POST to /upgrade)"
    echo -e "  ${YELLOW}x${RESET}        : API to upgrade Dashboard UI [clash/sing] (POST to /upgrade/ui)"
--- a/update.json
+++ b/update.json
@@ -1,6 +1,6 @@
 {
-  "version": "v1.14.0",
-  "versionCode": "2026081303",
-  "zipUrl": "http://10.2.0.2/M1rs3m/BFR/releases/download/v1.14.0/pronbox-v1.14.0.zip",
+  "version": "v1.13.0",
+  "versionCode": "2026081302",
+  "zipUrl": "http://10.2.0.2/M1rs3m/BFR/releases/download/v1.13.0/pronbox-v1.13.0.zip",
  "changelog": "http://10.2.0.2/M1rs3m/BFR/src/branch/main/CHANGELOG_STEALTH.md"
 }
Author	SHA1	Message	Date
M1rsem	3ca3c8fcf6	chore: replace em dashes with ASCII hyphens. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 09:44:44 +03:00
M1rsem	d8519acf36	Release PronBox v1.13.0: RU stealth defaults and mixed port 19090. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 09:42:51 +03:00