docs: fix leftover merge conflict markers in README.

Co-authored-by: Cursor <cursoragent@cursor.com>
Release PronBox v1.14.0: protocol setup docs and wg-obfs profile switch.
2026-08-13 12:02:52 +03:00 · 2026-08-13 11:56:47 +03:00 · 2026-08-13 11:56:37 +03:00 · 2026-08-13 11:56:00 +03:00 · 2026-08-13 09:13:58 +03:00
32 changed files with 693 additions and 609 deletions
--- a/.github/workflows/debug.yml
+++ b/.github/workflows/debug.yml
@@ -94,7 +94,7 @@ jobs:
        run: |
          if [ ! -z "${{ secrets.BOT_TOKEN }}" ]; then
            export VERSION=$(cat module.prop | grep 'version=' | awk -F '=' '{print $2}')
-            export COMMIT=$(git log --oneline -n 5 --no-decorate | sed 's/^[0-9a-f]* //' | sed 's/^/— /')
+            export COMMIT=$(git log --oneline -n 5 --no-decorate | sed 's/^[0-9a-f]* //' | sed 's/^/- /')
            FILE=$(find . -name "*.zip")
            pip3 install telethon==1.31.1
            python3 $GITHUB_WORKSPACE/.github/taamarinbot.py "$FILE"
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -104,5 +104,5 @@ jobs:
          [ -z "$FILE" ] && echo "No ZIP file found!" && exit 1

          export VERSION=$(git rev-parse --short HEAD)
-          export COMMIT=$(git log --oneline -n 10 --no-decorate | sed 's/^[0-9a-f]* //' | sed 's/^/— /')
+          export COMMIT=$(git log --oneline -n 10 --no-decorate | sed 's/^[0-9a-f]* //' | sed 's/^/- /')
          python3 .github/taamarinbot.py "$FILE"
--- a/CHANGELOG_STEALTH.md
+++ b/CHANGELOG_STEALTH.md
@@ -1,23 +1,23 @@
-# PronBox — v1.12.0
+# PronBox - v1.14.0

-Разработано в стенах **НИИ «ТехноПрон»**. Magisk `id` остаётся `box_for_root` (апгрейд поверх старого модуля).
+Разработано в стенах **НИИ «ТехноПрон»**. Magisk `id` остаётся `box_for_root`.

-## Renamed
- Display name: **PronBox** (больше не VeilBox / «Box for Magisk»)
- Author: **команда НИИ «ТехноПрон»**
- ZIP: `pronbox-v1.12.0.zip`
- Fix: `customize.sh` больше не переименовывает модуль в stock «Box for Magisk»
+## Docs
+- **README**: примеры настройки всех протоколов (Hysteria2, TrustTunnel, olcrtc, WG+obfs, комбо-профили)
+- Таблица портов, `settings.ini`, sidecar-конфиги, переключение через `sbfr p` / BFR Manager

-## Added
- **wg-obfuscator** ([ClusterM](https://github.com/ClusterM/wg-obfuscator)): `box.wgobfs`, профиль `config-wg-obfs.json`, `box.tool upwgobfs`
- Manage Profiles: `config-trusttunnel` / `config-olcrtc` / `config-wg-obfs`
- Sidecar `both` + `sidecar_set_final=false` для переключения в BFR Manager
- Restore при апгрейде: `trusttunnel_client`, `olcrtc`, `wg-obfuscator`, sidecar configs
+## Profiles
+- `box.profile use wg-obfs` (alias `riga4` / `wg`) - WireGuard через wg-obfuscator
+- При переключении на TT/olcrtc `wgobfs_enable=false` (obfuscator не стартует зря)
+- Шаблон `config-wg-obfs.json`: `route.final=wg-riga4`, endpoint WireGuard + loopback peer
+
+## From v1.13.0
+- RU stealth defaults, mixed inbound **19090**, blacklist банков/госуслуг
+- `wgobfs-real-peers.txt` вместо лишних полей в JSON

 ## Notes
- wg-obfuscator нужен и на VPS (тот же `key`)
- Repo-шаблоны без секретов WG/Hysteria
+- Секреты (WG keys, HY2 password) - только на устройстве, шаблоны в ZIP без них
+- wg-obfuscator на VPS обязателен для профиля WG

 ## Based on
- PronBox / VeilBox v1.11.0
- [taamarin/box_for_magisk](https://github.com/taamarin/box_for_magisk) v1.10.2
+- PronBox v1.13.0
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # PronBox

-Форк [box_for_magisk](https://github.com/taamarin/box_for_magisk) — прозрачный прокси для Android (root).  
+Форк [box_for_magisk](https://github.com/taamarin/box_for_magisk) - прозрачный прокси для Android (root).  
 Собрано в стенах **НИИ «ТехноПрон»**. Отображаемое имя в Magisk: **PronBox**; module id: `box_for_root` (апгрейд совместим).

 Работает через Magisk, KernelSU и APatch. Ядро по умолчанию: **sing-box**. Anti-detection без LSPosed + sidecar: [olcrtc](https://github.com/openlibrecommunity/olcrtc) / [TrustTunnel](https://github.com/TrustTunnel/TrustTunnel) / [wg-obfuscator](https://github.com/ClusterM/wg-obfuscator).
@@ -14,7 +14,7 @@ Stock [Box for Root](https://github.com/taamarin/box_for_magisk) хорошо п
 1. **Не поддерживает** новые протоколы вроде olcrtc, TrustTunnel и WG-obfuscation «из коробки».
 2. **Легко детектится** проверщиками вроде [RKNHardering](https://github.com/xtclovver/RKNHardering): REST API на `9090`, скан localhost, TUN-интерфейсы.

-PronBox решает это **без LSPosed** — iptables port-hide, hardening конфигов и sidecar-цепочка. Разработано командой НИИ «ТехноПрон».
+PronBox решает это **без LSPosed** - iptables port-hide, hardening конфигов и sidecar-цепочка. Разработано командой НИИ «ТехноПрон».

 ---

@@ -29,15 +29,15 @@ PronBox решает это **без LSPosed** — iptables port-hide, hardening
 | Localhost scan | не защищён | **iptables port-hide** для observer apps |
 | olcrtc / TrustTunnel | нет | **sidecar → SOCKS → sing-box** |
 | WG obfuscator | нет | **wg-obfuscator → WireGuard** |
-| Быстрый профиль | — | **Manage Profiles / `sbfr p …`** |
-| LSPosed / VPN Hide | — | **не требуется** |
-| Автор | — | **команда НИИ «ТехноПрон»** |
+| Быстрый профиль | - | **Manage Profiles / `sbfr p …`** |
+| LSPosed / VPN Hide | - | **не требуется** |
+| Автор | - | **команда НИИ «ТехноПрон»** |

 ---

 ## Возможности

- Прозрачный прокси через **iptables TPROXY** — без `VpnService`, без VPN-иконки, без `TRANSPORT_VPN`.
+- Прозрачный прокси через **iptables TPROXY** - без `VpnService`, без VPN-иконки, без `TRANSPORT_VPN`.
 - **Stealth-слой** (`box.stealth`): скрытие localhost-портов от банков и anti-tamper SDK.
 - **Sidecar** (`box.sidecar`): olcrtc и TrustTunnel как локальный SOCKS5 upstream для sing-box.
 - Авто-hardening sing-box/clash: удаление REST API, запрет TUN, блок QUIC (опционально).
@@ -62,11 +62,23 @@ PronBox решает это **без LSPosed** — iptables port-hide, hardening

 ```text
 Приложение
-  → iptables TPROXY
+  → iptables TPROXY (:9898)
  → sing-box
-  → SOCKS 127.0.0.1:10800
-  → olcrtc | trusttunnel_client
-  → сервер (WebRTC / HTTPS-туннель)
+  → SOCKS 127.0.0.1:10800 | :10801
+  → trusttunnel_client | olcrtc
+  → сервер (HTTPS / WebRTC)
+```
+
+### WireGuard + wg-obfuscator
+
+```text
+Приложение
+  → iptables TPROXY
+  → sing-box (route.final = WireGuard endpoint)
+  → UDP 127.0.0.1:41320
+  → wg-obfuscator (client, masking STUN/AUTO)
+  → VPS:13255 (публичный obfuscator)
+  → WireGuard на VPS (10.66.80.1 и т.д.)
 ```

 ### Stealth-слой (параллельно)
@@ -97,7 +109,7 @@ Observer app (банк, RKNHardering)

 ```powershell
 python tools/build_zip.py
-# → pronbox-v1.12.0.zip
+# → pronbox-v1.14.0.zip
 ```

 **Linux / Git Bash:**
@@ -108,75 +120,352 @@ sh build.sh

 ---

-## Быстрый старт
+## Профили и порты (шпаргалка)

-> Перед правкой конфигов **остановите** сервис PronBox.
+| Профиль / протокол | Файл sing-box | Sidecar / UDP | `route.final` | CLI |
+|--------------------|---------------|---------------|---------------|-----|
+| **TrustTunnel** | `config-trusttunnel.json` | SOCKS `:10800` | `sidecar-proxy` | `sbfr p use trusttunnel` |
+| **olcrtc** | `config-olcrtc.json` | SOCKS `:10801` | `olcrtc-proxy` | `sbfr p use olcrtc` |
+| **WG + obfuscator** | `config-wg-obfs.json` | UDP `:41320` | `wg-riga4` (endpoint tag) | `sbfr p use wg-obfs` |
+| **Hysteria2** (нативно) | свой `config.json` / `config-hy2.json` | - | `proxy` (hy2 outbound) | вручную / BFR Manager |
+| **Комбо HY2+WG** | `config-hy2-wg.json` | опционально TT/olc | свой | BFR Manager |

-### 1. Профили TrustTunnel / olcrtc (быстрое переключение)
+Общие порты PronBox:

-В модуле лежат два готовых шаблона:
+| Порт | Назначение |
+|------|------------|
+| `9898` | TPROXY inbound sing-box (прозрачный прокси) |
+| `19090` | mixed inbound (localhost, **не 7890** - меньше Clash-fingerprint) |
+| `10800` | TrustTunnel SOCKS |
+| `10801` | olcrtc SOCKS |
+| `41320` | wg-obfuscator listen (loopback, sing-box WG peer сюда) |

-| Профиль | Файл | SOCKS | `route.final` |
-|---------|------|-------|---------------|
-| TrustTunnel | `config.trusttunnel.json` | `:10800` | `sidecar-proxy` |
-| olcrtc | `config.olcrtc.json` | `:10801` | `olcrtc-proxy` |
+> Перед правкой конфигов **остановите** сервис: `sbfr stop`.

-Подставьте свои пароли/ключи (шаблоны в репозитории scrubbed) или на устройстве:
+---
+
+## Примеры настройки всех протоколов
+
+### 0. Базовый `settings.ini` (общее для sidecar)
+
+Файл: `/data/adb/box/settings.ini`
+
+```ini
+bin_name="sing-box"
+network_mode="tproxy"
+name_sing_config="config-trusttunnel.json"
+
+# Stealth (по умолчанию включён)
+stealth_mode="true"
+stealth_hide_loopback="true"
+stealth_disable_api="true"
+
+# Sidecar: оба протокола + переключение final в JSON-профиле (BFR Manager)
+sidecar_enable="true"
+sidecar_protocol="both"
+sidecar_set_final="false"
+sidecar_tt_port="10800"
+sidecar_olc_port="10801"
+sidecar_outbound_tag="sidecar-proxy"
+sidecar_olc_tag="olcrtc-proxy"
+
+# WG obfuscator (только для профиля config-wg-obfs.json)
+wgobfs_enable="false"
+wgobfs_listen_port="41320"
+wgobfs_config="${box_dir}/sidecar/wg-obfuscator.conf"
+wgobfs_patch_config="true"
+```
+
+Установка бинарников sidecar / wg-obfuscator:

 ```bash
-# клонировать текущий рабочий конфиг в оба профиля
-su -c '/data/adb/box/scripts/box.profile seed'
+su -c /data/adb/box/scripts/box.tool upsidercar    # trusttunnel_client + olcrtc (если есть в релизе)
+su -c /data/adb/box/scripts/box.tool upwgobfs     # wg-obfuscator arm64
+```

-# переключение (меняет name_sing_config + sidecar_* и рестартит сервис)
+---
+
+### 1. Hysteria2 (нативный outbound sing-box)
+
+Подходит, если на VPS уже поднят Hysteria2 без sidecar.
+
+**Фрагмент** `/data/adb/box/sing-box/config.json`:
+
+```json
+{
+  "inbounds": [
+    { "type": "tproxy", "tag": "tproxy-in", "listen": "::", "listen_port": 9898 },
+    { "type": "mixed", "tag": "mixed-in", "listen": "127.0.0.1", "listen_port": 19090 }
+  ],
+  "outbounds": [
+    {
+      "type": "hysteria2",
+      "tag": "proxy",
+      "server": "YOUR_SERVER_IP",
+      "server_port": 443,
+      "password": "YOUR_HYSTERIA2_PASSWORD",
+      "tls": {
+        "enabled": true,
+        "server_name": "your.domain.example",
+        "alpn": ["h3"]
+      }
+    },
+    { "type": "direct", "tag": "direct" }
+  ],
+  "route": {
+    "rules": [
+      { "domain_suffix": ["yandex.ru", "ya.ru"], "outbound": "direct" },
+      { "ip_cidr": ["YOUR_SERVER_IP/32"], "outbound": "direct" }
+    ],
+    "final": "proxy"
+  }
+}
+```
+
+В `settings.ini`: `name_sing_config="config.json"`, `sidecar_enable="false"`, `wgobfs_enable="false"`.
+
+Проверка:
+
+```bash
+su -c /data/adb/box/scripts/box.tool check
+sbfr start
+```
+
+---
+
+### 2. TrustTunnel (sidecar → SOCKS :10800)
+
+**Шаг 1.** Экспорт клиентского конфига с вашего TrustTunnel endpoint (на сервере):
+
+```bash
+trusttunnel_endpoint vpn.toml hosts.toml -c client -a server --format toml
+```
+
+**Шаг 2.** Положить на телефон `/data/adb/box/sidecar/trusttunnel.toml` (из экспорта).  
+Обязательно SOCKS на loopback **10800**:
+
+```toml
+[listener]
+type = "socks5"
+address = "127.0.0.1:10800"
+# ... credentials / TLS из экспорта endpoint ...
+```
+
+**Шаг 3.** Профиль sing-box: скопировать шаблон и указать свой HY2/VLESS fallback при необходимости:
+
+```bash
+cp /data/adb/box/sing-box/config-trusttunnel.json /data/adb/box/sing-box/config-trusttunnel.json.bak
+# в config-trusttunnel.json уже есть:
+#   outbounds[].tag = sidecar-proxy → 127.0.0.1:10800
+#   route.final = sidecar-proxy
+```
+
+**Шаг 4.** Переключение:
+
+```bash
 sbfr p use trusttunnel
-sbfr p use olcrtc
-sbfr p status
+# или BFR Manager → Manage Profiles → config-trusttunnel.json
 ```

-В Magisk/терминале то же самое: `su -c '/data/adb/box/scripts/box.profile use olcrtc'`.
+Цепочка: `App → TPROXY → sing-box → SOCKS:10800 → trusttunnel_client → VPS`.

-### 2. Конфиг sing-box (с нуля)
+---

-Скопируйте минимальный шаблон и настройте outbound:
+### 3. olcrtc (sidecar → SOCKS :10801)
+
+**Шаг 1.** Собрать или положить бинарник `olcrtc` в `/data/adb/box/bin/olcrtc` (`chmod 755`).
+
+**Шаг 2.** Конфиг `/data/adb/box/sidecar/olcrtc.yaml`:
+
+```yaml
+mode: cnc
+auth:
+  provider: telemost
+room:
+  id: "YOUR_TELEMOST_NUMERIC_ROOM_ID"
+crypto:
+  key: "64_HEX_CHARS_SAME_ON_SERVER_AND_CLIENT"
+net:
+  transport: vp8channel
+  dns: "192.168.0.1:53"
+socks:
+  host: "127.0.0.1"
+  port: 10801
+data: /data/adb/box/run/olcrtc-data
+```
+
+> `room.id` - **числовой** id комнаты Telemost, не полный URL.  
+> `net.dns` - LAN DNS роутера; публичный DNS из root-контекста olcrtc часто зависает.
+
+**Шаг 3.** Профиль `config-olcrtc.json`: `route.final = olcrtc-proxy`, SOCKS `:10801`.
+
+**Шаг 4.** Переключение:

 ```bash
-cp /data/adb/box/sing-box/config.stealth.example.json /data/adb/box/sing-box/config.json
-# добавьте свой VLESS / другой outbound
+sbfr p use olcrtc
 ```

-### 3. Observer-приложения (stealth)
+---

-Файл `/data/adb/box/stealth.list.cfg` — приложения, которым **скрываем** localhost-прокси:
+### 4. TrustTunnel + olcrtc одновременно (переключение в BFR Manager)
+
+Оба sidecar поднимаются параллельно; **какой exit** - решает `route.final` в выбранном JSON-профиле.
+
+`settings.ini`:
+
+```ini
+sidecar_enable="true"
+sidecar_protocol="both"
+sidecar_set_final="false"
+```
+
+В приложении **BFR Manager → Manage Profiles**:
+
+- `config-trusttunnel.json` → exit через TrustTunnel (`sidecar-proxy`)
+- `config-olcrtc.json` → exit через olcrtc (`olcrtc-proxy`)
+
+CLI то же самое: `sbfr p use trusttunnel` / `sbfr p use olcrtc`.
+
+---
+
+### 5. WireGuard + wg-obfuscator (профиль `config-wg-obfs`)
+
+Нужен **obfuscator на VPS** с тем же `key`. Plain WireGuard на публичный UDP obfuscator **не подключится**.
+
+**Клиент** `/data/adb/box/sidecar/wg-obfuscator.conf`:
+
+```ini
+[client]
+source-if = 127.0.0.1
+source-lport = 41320
+target = YOUR_VPS_IP:13255
+key = YOUR_SHARED_OBFS_KEY
+masking = AUTO
+verbose = INFO
+```
+
+**Сервер (VPS)** - см. `box/sidecar/wg-obfuscator.server.example.conf`:
+
+```ini
+[server]
+source-if = 0.0.0.0
+source-lport = 13255
+target = 127.0.0.1:51820
+key = YOUR_SHARED_OBFS_KEY
+masking = AUTO
+```
+
+WireGuard на VPS слушает `51820`; снаружи клиенты бьют в `13255` (obfuscator).
+
+**Профиль sing-box** `/data/adb/box/sing-box/config-wg-obfs.json` (фрагмент):
+
+```json
+{
+  "endpoints": [{
+    "type": "wireguard",
+    "tag": "wg-riga4",
+    "mtu": 1280,
+    "address": ["10.66.80.3/32"],
+    "private_key": "YOUR_WG_PRIVATE_KEY",
+    "peers": [{
+      "address": "127.0.0.1",
+      "port": 41320,
+      "public_key": "YOUR_WG_PEER_PUBLIC_KEY",
+      "allowed_ips": ["0.0.0.0/0"],
+      "persistent_keepalive_interval": 25
+    }]
+  }],
+  "route": {
+    "rules": [
+      { "ip_cidr": ["YOUR_VPS_IP/32"], "outbound": "direct" },
+      { "ip_cidr": ["10.66.80.0/24"], "outbound": "wg-riga4" },
+      { "ip_cidr": ["192.168.0.0/16", "127.0.0.0/8"], "outbound": "direct" }
+    ],
+    "final": "wg-riga4"
+  }
+}
+```
+
+PronBox при старте перепишет peer на `127.0.0.1:41320` (если `wgobfs_patch_config="true"`), VPS IP уйдёт в `/data/adb/box/run/wgobfs-real-peers.txt`.
+
+**Включение:**
+
+```bash
+sbfr p use wg-obfs
+# alias: sbfr p use wg  |  sbfr p use riga4
+su -c /data/adb/box/scripts/box.wgobfs status
+ping -c 3 10.66.80.1
+```
+
+---
+
+### 6. Комбо Hysteria2 + WireGuard (`config-hy2-wg.json`)
+
+Для сценария «HY2 как основной exit + WG endpoint для LAN/VPS».  
+Создайте файл в `/data/adb/box/sing-box/config-hy2-wg.json`:
+
+- `outbounds`: hysteria2 `proxy` + socks sidecar (если нужны TT/olc)
+- `endpoints`: wireguard `wg-home` с peer на VPS или через obfuscator
+- `route.rules`: `.ru` / private → `direct`, HY2 server IP → `direct`, `final` → `proxy` или sidecar
+
+Выберите профиль в BFR Manager или:
+
+```ini
+name_sing_config="config-hy2-wg.json"
+```
+
+Шаблон можно собрать из рабочего конфига:
+
+```bash
+su -c '/data/adb/box/scripts/box.profile seed'
+cp /data/adb/box/sing-box/config-trusttunnel.json /data/adb/box/sing-box/config-hy2-wg.json
+# добавьте/оставьте endpoints WireGuard и нужный route.final
+```
+
+---
+
+### 7. Stealth + blacklist (банки, RKNHardering)
+
+**Observer apps** (не видят localhost-прокси) - `/data/adb/box/stealth.list.cfg`:

 ```text
-# один package на строку
+com.notcvnt.rknhardering
 ru.sberbankmobile
 com.idamob.tinkoff.android
-ru.rostel
-com.notcvnt.rknhardering
+ru.gosuslugi.gosapp
 ```

-### 4. Blacklist для checker'а
-
-Чтобы RKNHardering **не шёл через прокси**, добавьте в `/data/adb/box/package.list.cfg`:
+**Blacklist** (трафик мимо прокси, домашний IP) - `/data/adb/box/package.list.cfg`:

 ```text
 mode:blacklist
 com.notcvnt.rknhardering
+ru.sberbankmobile
+ru.gosuslugi.gosapp
 ```

-### 5. Запуск
+После установки новых банков:

 ```bash
-su -c /data/adb/box/scripts/box.service start
-su -c /data/adb/box/scripts/box.iptables enable
+su -c /data/adb/box/scripts/box.stealth renew
+su -c /data/adb/box/scripts/box.iptables renew
 ```

-Stealth включается **автоматически** при `stealth_mode="true"` (по умолчанию). Вручную:
+---
+
+## Быстрый старт (чеклист)
+
+1. Установить ZIP, перезагрузка, `sbfr start`
+2. Выбрать протокол (см. таблицу выше) и заполнить sidecar / sing-box конфиг
+3. `sbfr p use trusttunnel` | `olcrtc` | `wg-obfs`
+4. `sbfr p status` - проверить `route.final` и PID процессов
+5. Для RKN: `stealth.list.cfg` + blacklist в `package.list.cfg`
+
+Seed профилей из текущего рабочего конфига:

 ```bash
-su -c /data/adb/box/scripts/box.stealth enable
-su -c /data/adb/box/scripts/box.stealth status
+su -c '/data/adb/box/scripts/box.profile seed'
+sbfr p list
 ```

 ---
@@ -204,7 +493,7 @@ stealth_api_bind="127.0.0.1"
 stealth_api_port="19090"
 stealth_block_quic="false"
 stealth_forbid_tun="true"
-stealth_extra_ports=("7890" "7891" "1080" "10808" "2080")
+stealth_extra_ports=("7890" "7891" "19090" "1080" "10808" "2080" "41320" "10800" "10801" "9090" "9091" "1053")
 ```

 ### Что закрывает / что нет
@@ -216,102 +505,35 @@ stealth_extra_ports=("7890" "7891" "1080" "10808" "2080")
 | TUN-интерфейсы (`tun0`, MTU) | Policy routing fwmark (нативно) |
 | REST API на LAN | Установленные VPN-приложения (needsReview) |

-Полный **NOT DETECTED** против RKNHardering + VPS + root недостижим. Цель форка — убрать **hard detect** от localhost, API и TUN.
+Полный **NOT DETECTED** против RKNHardering + VPS + root недостижим. Цель форка - убрать **hard detect** от localhost, API и TUN.

 ---

-## Sidecar: olcrtc и TrustTunnel
+## Sidecar: olcrtc и TrustTunnel (кратко)

-Sidecar поднимает локальный SOCKS5; sing-box направляет трафик на него.
+Подробные пошаговые примеры - в разделе **[Примеры настройки всех протоколов](#примеры-настройки-всех-протоколов)** (п. 2-4).

-### TrustTunnel
+| Протокол | Конфиг sidecar | SOCKS порт | sing-box outbound tag |
+|----------|----------------|------------|------------------------|
+| TrustTunnel | `/data/adb/box/sidecar/trusttunnel.toml` | `10800` | `sidecar-proxy` |
+| olcrtc | `/data/adb/box/sidecar/olcrtc.yaml` | `10801` | `olcrtc-proxy` |

-```bash
-# Скачать клиент (linux-aarch64/armv7 для Android)
-su -c /data/adb/box/scripts/box.tool upsidercar trusttunnel
-
-# Конфиг с endpoint → trusttunnel.toml
-cp /data/adb/box/sidecar/trusttunnel.example.toml /data/adb/box/sidecar/trusttunnel.toml
-# отредактируйте (экспорт: trusttunnel_endpoint ... --format toml)
-```
-
-`settings.ini`:
-
-```ini
-sidecar_enable="true"
-sidecar_protocol="trusttunnel"
-sidecar_listen_port="10800"
-sidecar_outbound_tag="sidecar-proxy"
-sidecar_set_final="true"
-```
-
-### olcrtc
-
-Официального Android-релиза нет — бинарник собирается вручную:
-
-```bash
-# https://github.com/openlibrecommunity/olcrtc — mage mobile
-# положите бинарник:
-# /data/adb/box/bin/olcrtc
-chmod 755 /data/adb/box/bin/olcrtc
-
-cp /data/adb/box/sidecar/olcrtc.example.yaml /data/adb/box/sidecar/olcrtc.yaml
-# room id + crypto.key (64 hex) — одинаковые на клиенте и сервере
-```
-
-`settings.ini`:
-
-```ini
-sidecar_enable="true"
-sidecar_protocol="olcrtc"
-sidecar_listen_port="10801"
-sidecar_outbound_tag="olcrtc-proxy"
-```
-
-> **Важно:** порт в sidecar-конфиге (`socks.port`) должен совпадать с `sidecar_listen_port` (TT `:10800`, olcrtc `:10801`).
-> Для olcrtc в `olcrtc.yaml` задайте LAN DNS: `net.dns: "192.168.0.1:53"` (публичные DNS через PreferGo от root часто виснут).
+Шаблоны: `box/sidecar/trusttunnel.example.toml`, `box/sidecar/olcrtc.example.yaml`.

 ---

-## WireGuard Obfuscator ([ClusterM/wg-obfuscator](https://github.com/ClusterM/wg-obfuscator))
+## WireGuard Obfuscator (кратко)

-Это **не VPN**, а UDP-обфускатор WireGuard (маскировка под STUN и т.п.). Нужен **на обоих концах** — телефон + VPS с тем же `key`. Со сторонним WG-сервером без своего obfuscator не заработает.
+Полный пример клиент + сервер + `config-wg-obfs.json` - в разделе **[п. 5](#5-wireguard--wg-obfuscator-профиль-config-wg-obfs)**.

-```text
-sing-box WireGuard peer
-  → 127.0.0.1:41320
-  → wg-obfuscator (client)
-  → VPS:public_udp
-  → wg-obfuscator (server)
-  → WireGuard на VPS
-```
-
-### Клиент (Android / PronBox)
+Репозиторий: [ClusterM/wg-obfuscator](https://github.com/ClusterM/wg-obfuscator).  
+Обязателен **на обоих концах** с одинаковым `key`.

 ```bash
 su -c /data/adb/box/scripts/box.tool upwgobfs
-cp /data/adb/box/sidecar/wg-obfuscator.example.conf /data/adb/box/sidecar/wg-obfuscator.conf
-# key=...  target=VPS_IP:PORT  (порт публичного obfuscator на сервере)
+sbfr p use wg-obfs
 ```

-В `settings.ini`:
-
-```ini
-wgobfs_enable="true"
-wgobfs_listen_port="41320"
-wgobfs_patch_config="true"
-```
-
-Или профиль в **Manage Profiles**: `config-wg-obfs.json` (авто-старт wgobfs).
-
-### Сервер (VPS)
-
-См. `box/sidecar/wg-obfuscator.server.example.conf`:
-
-1. Сдвинуть WireGuard `ListenPort` (например на `51820`).
-2. Поставить `wg-obfuscator` на старый публичный порт (`13232`).
-3. `target = 127.0.0.1:51820`, тот же `key`, `masking = AUTO`.
-
 ---

 ## Структура модуля
@@ -321,15 +543,17 @@ wgobfs_patch_config="true"
 | `/data/adb/box/settings.ini` | Главный конфиг |
 | `/data/adb/box/stealth.list.cfg` | Observer apps для port-hide |
 | `/data/adb/box/package.list.cfg` | Blacklist/whitelist приложений |
-| `/data/adb/box/sing-box/config.trusttunnel.json` | Профиль TrustTunnel |
-| `/data/adb/box/sing-box/config.olcrtc.json` | Профиль olcrtc |
+| `/data/adb/box/sing-box/config-trusttunnel.json` | Профиль TrustTunnel |
+| `/data/adb/box/sing-box/config-olcrtc.json` | Профиль olcrtc |
+| `/data/adb/box/sing-box/config-wg-obfs.json` | Профиль WG + wg-obfuscator |
+| `/data/adb/box/sing-box/config-hy2-wg.json` | Комбо HY2 + WG (создаётся вручную) |
 | `/data/adb/box/sing-box/config.json` | Активный конфиг (или через `name_sing_config`) |
-| `/data/adb/box/sidecar/` | Конфиги olcrtc / TrustTunnel |
+| `/data/adb/box/sidecar/` | trusttunnel.toml, olcrtc.yaml, wg-obfuscator.conf |
 | `/data/adb/box/bin/` | Бинарники (sing-box, sidecar) |
 | `/data/adb/box/run/` | Логи, PID, UID-списки |
 | `/data/adb/box/scripts/box.stealth` | Stealth iptables |
 | `/data/adb/box/scripts/box.sidecar` | Sidecar lifecycle |
-| `/data/adb/box/scripts/box.profile` | Переключение TT / olcrtc |
+| `/data/adb/box/scripts/box.profile` | Переключение TT / olcrtc / wg-obfs |
 | `/data/adb/box/scripts/box.service` | Старт/стоп ядра |
 | `/data/adb/box/scripts/box.iptables` | TPROXY правила |

@@ -380,7 +604,8 @@ sbfr s status # статус сервиса
 sbfr i enable # iptables
 sbfr p use trusttunnel  # профиль TT
 sbfr p use olcrtc       # профиль olcrtc
-sbfr t check  # box.tool
+sbfr p use wg-obfs      # WG + wg-obfuscator
+sbfr p list | status
 ```

 ---
@@ -411,7 +636,7 @@ Magisk / KernelSU / APatch

 ## Обновление модуля

-Установите новый ZIP поверх старого через Magisk Manager. При запросе **restore settings.ini** — Vol+ сохранит ваши настройки stealth/sidecar.
+Установите новый ZIP поверх старого через Magisk Manager. При запросе **restore settings.ini** - Vol+ сохранит ваши настройки stealth/sidecar.

 ---

@@ -431,7 +656,7 @@ su -c rm -rf /data/adb/modules/box_for_root
 ## Ограничения и disclaimer

 - Модуль требует **root**. Это само по себе детектируется native-проверками.
- Stealth **не маскирует** Java API (`NetworkCapabilities`) — для этого нужен kernel hook (VPN Hide kmod), мы сознательно обходимся без LSPosed.
+- Stealth **не маскирует** Java API (`NetworkCapabilities`) - для этого нужен kernel hook (VPN Hide kmod), мы сознательно обходимся без LSPosed.
 - olcrtc на Android требует **ручной сборки** бинарника.
 - TrustTunnel в sing-box upstream пока через **sidecar SOCKS**, не нативный outbound.
 - Автор не несёт ответственности за блокировки аккаунтов, некорректные конфиги и петли маршрутизации.
@@ -440,13 +665,13 @@ su -c rm -rf /data/adb/modules/box_for_root

 ## Credits

- [taamarin/box_for_magisk](https://github.com/taamarin/box_for_magisk) — базовый модуль
- [CHIZI-0618/box4magisk](https://github.com/CHIZI-0618/box4magisk) — оригинальный Box for Magisk
- [okhsunrog/vpnhide](https://github.com/okhsunrog/vpnhide) — идея port-hide без LSPosed
- [openlibrecommunity/olcrtc](https://github.com/openlibrecommunity/olcrtc) — WebRTC-туннель
- [TrustTunnel/TrustTunnel](https://github.com/TrustTunnel/TrustTunnel) — HTTPS VPN-протокол
- [xtclovver/RKNHardering](https://github.com/xtclovver/RKNHardering) — референс методики детекта
+- [taamarin/box_for_magisk](https://github.com/taamarin/box_for_magisk) - базовый модуль
+- [CHIZI-0618/box4magisk](https://github.com/CHIZI-0618/box4magisk) - оригинальный Box for Magisk
+- [okhsunrog/vpnhide](https://github.com/okhsunrog/vpnhide) - идея port-hide без LSPosed
+- [openlibrecommunity/olcrtc](https://github.com/openlibrecommunity/olcrtc) - WebRTC-туннель
+- [TrustTunnel/TrustTunnel](https://github.com/TrustTunnel/TrustTunnel) - HTTPS VPN-протокол
+- [xtclovver/RKNHardering](https://github.com/xtclovver/RKNHardering) - референс методики детекта

 ## License

-GPL-3.0 — см. [LICENSE](LICENSE).
+GPL-3.0 - см. [LICENSE](LICENSE).
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -1,33 +1,33 @@
-# Release PronBox v1.12.0
+# Release PronBox v1.14.0

 Продукт **НИИ «ТехноПрон»**. Magisk id: `box_for_root`.

 ## Локально

 - Ветка `main`
- Тег: `v1.12.0`
- ZIP: `pronbox-v1.12.0.zip` → `python tools/build_zip.py`
+- Тег: `v1.14.0`
+- ZIP: `pronbox-v1.14.0.zip` → `python tools/build_zip.py`
 - Remote: `gitea@10.2.0.2:M1rs3m/BFR.git`
- Display name: **PronBox**
- Author: **команда НИИ «ТехноПрон»**

 ## Push + tag

 ```powershell
 cd E:\bfr_mod
 git push -u origin main
-git push origin v1.12.0
+git push origin v1.14.0
 ```

+Готовый ZIP для Gitea / скачивания: **`E:\bfr_mod\pronbox-v1.14.0.zip`**
+
 ## Release на Gitea

 1. `http://10.2.0.2/M1rs3m/BFR` → **Releases** → **New Release**
-2. Tag: `v1.12.0`
-3. Title: `PronBox v1.12.0 — НИИ «ТехноПрон»`
+2. Tag: `v1.14.0`
+3. Title: `PronBox v1.14.0 - docs all protocols + wg-obfs profile`
 4. Description: `CHANGELOG_STEALTH.md`
-5. Attach: `pronbox-v1.12.0.zip`
+5. Attach: `pronbox-v1.14.0.zip`
 6. Publish

-OTA (`update.json`):
+OTA:

-`http://10.2.0.2/M1rs3m/BFR/releases/download/v1.12.0/pronbox-v1.12.0.zip`
+`http://10.2.0.2/M1rs3m/BFR/releases/download/v1.14.0/pronbox-v1.14.0.zip`
--- a/box/package.list.cfg
+++ b/box/package.list.cfg
@@ -1,13 +1,34 @@
-# black/white list mode.
+# PronBox package filter - traffic routing
+# mode:blacklist = listed apps go DIRECT (bypass proxy)
+# Recommended for banks / gosuslugi / checkers so they see home RU IP.
 mode:blacklist
-# +----------------+------+
-# |     User       |  ID  |
-# +----------------+------+
-# | Owner          |   0  |
-# | Second Space   |  10  |
-# | App Clone      | 999  |
-# +----------------+------+

-# package_name ▼
-# com.topjohnwu.magisk
-# 0:com.termux
+# --- checkers ---
+com.notcvnt.rknhardering
+
+# --- banks ---
+ru.sberbankmobile
+com.idamob.tinkoff.android
+ru.alfabank.mobile.android
+ru.vtb24.mobilebanking.android
+ru.gazprombank.android.mobilebank.app
+com.openbank
+ru.raiffeisennews
+ru.rosbank.android
+ru.sovcomcard.android
+ru.letobank.Promobile
+ru.homecredit.mycredit
+ru.mts.money
+ru.rshb.mbank
+ru.yoo.money
+
+# --- state ---
+ru.gosuslugi.gosapp
+ru.rostel
+ru.gnivc.mobilenalog
+
+# --- marketplaces (optional direct; comment out if you need them via proxy) ---
+# com.wildberries.ru
+# ru.ozon.app.android
+# ru.yandex.market
+# com.avito.android
--- a/box/scripts/box.profile
+++ b/box/scripts/box.profile
@@ -1,5 +1,5 @@
 #!/system/bin/sh
-# VeilBox profile switcher — trusttunnel | olcrtc
+# VeilBox profile switcher - trusttunnel | olcrtc
 # Usage:
 #   su -c '/data/adb/box/scripts/box.profile list'
 #   su -c '/data/adb/box/scripts/box.profile use trusttunnel'
@@ -28,6 +28,8 @@ profile_apply_settings() {
      sed -i 's/^sidecar_listen_port=.*/sidecar_listen_port="10800"/' "${ini}"
      sed -i 's/^sidecar_outbound_tag=.*/sidecar_outbound_tag="sidecar-proxy"/' "${ini}"
      sed -i 's/^sidecar_set_final=.*/sidecar_set_final="false"/' "${ini}"
+      sed -i 's/^wgobfs_enable=.*/wgobfs_enable="false"/' "${ini}"
+      grep -q '^wgobfs_enable=' "${ini}" || echo 'wgobfs_enable="false"' >> "${ini}"
      echo "trusttunnel"
      ;;
    olcrtc|olc)
@@ -37,16 +39,22 @@ profile_apply_settings() {
      sed -i 's/^sidecar_listen_port=.*/sidecar_listen_port="10801"/' "${ini}"
      sed -i 's/^sidecar_outbound_tag=.*/sidecar_outbound_tag="sidecar-proxy"/' "${ini}"
      sed -i 's/^sidecar_set_final=.*/sidecar_set_final="false"/' "${ini}"
+      sed -i 's/^wgobfs_enable=.*/wgobfs_enable="false"/' "${ini}"
+      grep -q '^wgobfs_enable=' "${ini}" || echo 'wgobfs_enable="false"' >> "${ini}"
      # Prefer LAN DNS for olcrtc PreferGo resolver under root:net_admin
      if [ -f "${box_dir}/sidecar/olcrtc.yaml" ] && [ -x "${box_dir}/bin/yq" ]; then
        "${box_dir}/bin/yq" -i '.net.dns = "192.168.0.1:53"' "${box_dir}/sidecar/olcrtc.yaml" 2>/dev/null || true
      fi
      echo "olcrtc"
      ;;
-    wg-obfs|wgobfs|wg)
+    wg-obfs|wgobfs|wg|riga4)
      sed -i 's/^name_sing_config=.*/name_sing_config="config-wg-obfs.json"/' "${ini}"
      sed -i 's/^wgobfs_enable=.*/wgobfs_enable="true"/' "${ini}"
      grep -q '^wgobfs_enable=' "${ini}" || echo 'wgobfs_enable="true"' >> "${ini}"
+      sed -i 's/^wgobfs_listen_port=.*/wgobfs_listen_port="41320"/' "${ini}"
+      grep -q '^wgobfs_listen_port=' "${ini}" || echo 'wgobfs_listen_port="41320"' >> "${ini}"
+      # sidecars optional; WG is the exit - keep both ready but don't force final rewrite
+      sed -i 's/^sidecar_set_final=.*/sidecar_set_final="false"/' "${ini}"
      echo "wg-obfs"
      ;;
    *)
@@ -103,9 +111,9 @@ profile_list() {
  echo "Profiles (also visible in BFR Manager → Manage Profiles):"
  echo "  trusttunnel  -> config-trusttunnel.json  (final=sidecar-proxy :10800)"
  echo "  olcrtc       -> config-olcrtc.json       (final=olcrtc-proxy :10801)"
-  echo "  wg-obfs      -> config-wg-obfs.json      (WG via wg-obfuscator :41320)"
+  echo "  wg-obfs      -> config-wg-obfs.json      (Riga4 WG via wg-obfuscator :41320)"
  echo "  sidecar mode -> both (set_final=false) so app switching keeps finals"
-  echo "  NOTE: wg-obfs needs matching obfuscator on the VPS (same key)"
+  echo "  NOTE: wg-obfs needs VPS obfuscator on :13255 + same key"
  echo
  echo "Files in ${profiles_dir}:"
  ls -1 "${profiles_dir}"/config*.json 2>/dev/null
@@ -129,7 +137,7 @@ profile_status() {

 profile_use() {
  name="$1"
-  [ -n "${name}" ] || { echo "usage: $0 use {trusttunnel|olcrtc}"; exit 1; }
+  [ -n "${name}" ] || { echo "usage: $0 use {trusttunnel|olcrtc|wg-obfs}"; exit 1; }
  profile_seed_from_active || true
  applied=$(profile_apply_settings "${name}") || exit 1

@@ -162,7 +170,7 @@ case "$1" in
    profile_seed_from_active
    ;;
  *)
-    echo "usage: $0 {list|status|use trusttunnel|use olcrtc|seed}"
+    echo "usage: $0 {list|status|use trusttunnel|use olcrtc|use wg-obfs|seed}"
    exit 1
    ;;
 esac
--- a/box/scripts/box.service
+++ b/box/scripts/box.service
@@ -204,7 +204,7 @@ stealth_guard_network_mode() {
  [ "${stealth_mode}" != "true" ] && return 0
  [ "${stealth_forbid_tun}" != "true" ] && return 0
  if [[ "${network_mode}" == @(mixed|tun) ]]; then
-    log Warning "[Stealth] TUN is detectable — switching network_mode to tproxy"
+    log Warning "[Stealth] TUN is detectable - switching network_mode to tproxy"
    sed -i 's/\(network_mode=\)\"[^\"]*\"/\1"tproxy"/g' ${settings}
    network_mode="tproxy"
  fi
--- a/box/scripts/box.sidecar
+++ b/box/scripts/box.sidecar
@@ -1,5 +1,5 @@
 #!/system/bin/sh
-# BFR Sidecar — olcrtc / TrustTunnel local protocol adapters (SOCKS5 upstream for sing-box)
+# BFR Sidecar - olcrtc / TrustTunnel local protocol adapters (SOCKS5 upstream for sing-box)

 if ! /system/bin/sh -n /data/adb/box/settings.ini 2>/dev/null; then
  echo "Err: settings.ini syntax error" >&2
@@ -142,7 +142,7 @@ sidecar_inject_singbox() {
    if command -v yq >/dev/null 2>&1; then
      yq="yq"
    else
-      log Error "[Sidecar] yq not found — cannot inject socks outbound"
+      log Error "[Sidecar] yq not found - cannot inject socks outbound"
      return 1
    fi
  fi
@@ -178,7 +178,7 @@ sidecar_inject_singbox() {
      log Info "[Sidecar] route.final -> ${final_tag}"
    sidecar_patch_dns "${final_tag}"
  else
-    log Info "[Sidecar] sidecar_set_final=false — keep profile route.final (BFR Manager switch)"
+    log Info "[Sidecar] sidecar_set_final=false - keep profile route.final (BFR Manager switch)"
  fi
 }

@@ -209,11 +209,11 @@ sidecar_start_process() {
      # TT + olcrtc for BFR Manager profile flipping; missing one must not block the other
      sidecar_start_one trusttunnel "${box_dir}/bin/trusttunnel_client" "${sidecar_dir}/trusttunnel.toml" \
        "${sidecar_tt_port}" "${sidecar_pid_tt}" || \
-        log Warning "[Sidecar] trusttunnel failed/missing — continue without it"
+        log Warning "[Sidecar] trusttunnel failed/missing - continue without it"
      sleep 2
      sidecar_start_one olcrtc "${box_dir}/bin/olcrtc" "${sidecar_dir}/olcrtc.yaml" \
        "${sidecar_olc_port}" "${sidecar_pid_olc}" || {
-          log Warning "[Sidecar] olcrtc failed to start — continuing without it"
+          log Warning "[Sidecar] olcrtc failed to start - continuing without it"
          log Warning "[Sidecar] Tip: telemost room.id = full https://telemost.yandex.ru/j/<id> URL (or numeric id)"
          log Warning "[Sidecar] Tip: under root:net_admin set net.dns to LAN resolver (e.g. gateway:53)"
        }
--- a/box/scripts/box.stealth
+++ b/box/scripts/box.stealth
@@ -1,5 +1,5 @@
 #!/system/bin/sh
-# BFR Stealth — hardening without LSPosed (iptables port hide + API lockdown)
+# BFR Stealth - hardening without LSPosed (iptables port hide + API lockdown)

 if ! /system/bin/sh -n /data/adb/box/settings.ini 2>/dev/null; then
  echo "Err: settings.ini syntax error" >&2
@@ -26,12 +26,20 @@ fi
 stealth_ports_collect() {
  _ports="${tproxy_port} ${redir_port}"
  [ -n "${sidecar_listen_port}" ] && _ports="${_ports} ${sidecar_listen_port}"
+  [ -n "${sidecar_tt_port}" ] && _ports="${_ports} ${sidecar_tt_port}"
+  [ -n "${sidecar_olc_port}" ] && _ports="${_ports} ${sidecar_olc_port}"
+  [ -n "${wgobfs_listen_port}" ] && _ports="${_ports} ${wgobfs_listen_port}"
  [ -n "${stealth_api_port}" ] && _ports="${_ports} ${stealth_api_port}"

  if [ -f "${clash_config}" ]; then
    _ec=$(busybox awk '!/^ *#/ && /external-controller:/{print $2}' "${clash_config}" 2>/dev/null | head -n1)
    _ec_port=$(echo "${_ec}" | busybox awk -F: '{print $NF}')
    [ -n "${_ec_port}" ] && _ports="${_ports} ${_ec_port}"
+    # Clash mixed/socks ports if present
+    _socks=$(busybox awk '!/^ *#/ && /socks-port:/{print $2}' "${clash_config}" 2>/dev/null | head -n1)
+    [ -n "${_socks}" ] && _ports="${_ports} ${_socks}"
+    _mixed=$(busybox awk '!/^ *#/ && /mixed-port:/{print $2}' "${clash_config}" 2>/dev/null | head -n1)
+    [ -n "${_mixed}" ] && _ports="${_ports} ${_mixed}"
  fi

  if [ -f "${sing_config}" ]; then
@@ -89,7 +97,7 @@ stealth_enable() {
  resolve_stealth_uids

  if [ ! -s "${box_run}/stealth_uids.list" ]; then
-    log Warning "[Stealth] No observer UIDs resolved — add packages to stealth.list.cfg"
+    log Warning "[Stealth] No observer UIDs resolved - add packages to stealth.list.cfg"
    return 0
  fi

@@ -104,7 +112,7 @@ stealth_enable() {
      ${IPV} -A "${STEALTH_CHAIN}" -m owner --uid-owner "${uid}" -d 127.0.0.0/8 -p tcp -j REJECT --reject-with tcp-reset
      ${IPV} -A "${STEALTH_CHAIN}" -m owner --uid-owner "${uid}" -d 127.0.0.0/8 -p udp -j REJECT --reject-with icmp-port-unreachable
      ${IP6V} -A "${STEALTH_CHAIN6}" -m owner --uid-owner "${uid}" -d ::1/128 -p tcp -j REJECT --reject-with tcp-reset
-      ${IP6V} -A "${STEALTH_CHAIN6}" -m owner --uid-owner "${uid}" -d ::1/128 -p udp -j REJECT --reject-with icmp-port-unreachable
+      ${IP6V} -A "${STEALTH_CHAIN6}" -m owner --uid-owner "${uid}" -d ::1/128 -p udp -j REJECT --reject-with icmp6-port-unreachable
    fi
  done < "${box_run}/stealth_uids.list"

--- a/box/scripts/box.tool
+++ b/box/scripts/box.tool
@@ -1233,7 +1233,7 @@ upwgobfs() {
    fi
    if [ ! -f "${box_dir}/sidecar/wg-obfuscator.conf" ] && [ -f "${box_dir}/sidecar/wg-obfuscator.example.conf" ]; then
      cp -f "${box_dir}/sidecar/wg-obfuscator.example.conf" "${box_dir}/sidecar/wg-obfuscator.conf"
-      log Warning "Created sidecar/wg-obfuscator.conf — set key= and target="
+      log Warning "Created sidecar/wg-obfuscator.conf - set key= and target="
    fi
  else
    log Error "Download failed: ${url}"
--- a/box/scripts/box.wgobfs
+++ b/box/scripts/box.wgobfs
@@ -1,5 +1,5 @@
 #!/system/bin/sh
-# VeilBox — WireGuard Obfuscator (ClusterM/wg-obfuscator) lifecycle
+# VeilBox - WireGuard Obfuscator (ClusterM/wg-obfuscator) lifecycle
 # Docs: https://github.com/ClusterM/wg-obfuscator
 #
 # Client flow:
@@ -47,7 +47,7 @@ wgobfs_wait_udp() {
 }

 # Rewrite sing-box wireguard peers to localhost obfuscator listen port.
-# Saves originals into .peers[]._veilbox_real_address / _veilbox_real_port (ignored by sing-box).
+# Real endpoints are saved to ${box_run}/wgobfs-real-peers.txt (sing-box rejects unknown JSON fields).
 wgobfs_patch_singbox() {
  [ "${wgobfs_patch_config}" = "true" ] || return 0
  [ "${bin_name}" != "sing-box" ] && return 0
@@ -56,44 +56,49 @@ wgobfs_patch_singbox() {
  yq="${box_dir}/bin/yq"
  [ -x "${yq}" ] || yq="yq"
  if ! command -v "${yq}" >/dev/null 2>&1 && [ ! -x "${yq}" ]; then
-    log Warning "[wgobfs] yq missing — cannot patch WireGuard endpoint"
+    log Warning "[wgobfs] yq missing - cannot patch WireGuard endpoint"
    return 1
  fi

-  # Ensure we have at least one wireguard endpoint
  if ! "${yq}" -e '.endpoints[] | select(.type == "wireguard")' "${sing_config}" >/dev/null 2>&1; then
    log Warning "[wgobfs] no wireguard endpoint in ${sing_config}"
    return 1
  fi

-  # Stash real address/port once, then point peers at local obfuscator
+  state="${box_run}/wgobfs-real-peers.txt"
+  mkdir -p "${box_run}"
+  : > "${state}"
+
+  # Capture current non-loopback peers, then rewrite to local obfuscator
+  "${yq}" -r '
+    .endpoints[]? | select(.type == "wireguard") | .peers[]? |
+    ((.address // "") + ":" + ((.port // 0)|tostring))
+  ' "${sing_config}" 2>/dev/null | while read -r ep; do
+    case "${ep}" in
+      127.*|""|:0) continue ;;
+      *) echo "${ep}" >> "${state}" ;;
+    esac
+  done
+
  "${yq}" -i -o=json '
-    (.endpoints[] | select(.type == "wireguard") | .peers[] |
-      select(._veilbox_real_address == null) |
-      ._veilbox_real_address) = .address |
-    (.endpoints[] | select(.type == "wireguard") | .peers[] |
-      select(._veilbox_real_port == null) |
-      ._veilbox_real_port) = .port |
    (.endpoints[] | select(.type == "wireguard") | .peers[] | .address) = "127.0.0.1" |
    (.endpoints[] | select(.type == "wireguard") | .peers[] | .port) = '"${wgobfs_listen_port}"'
  ' "${sing_config}" && \
    log Info "[wgobfs] WireGuard peers → 127.0.0.1:${wgobfs_listen_port}"

  # Direct route for real WG/obfuscator server IPs (avoid TPROXY loop)
-  real_ips=$("${yq}" -r '
-    .endpoints[]? | select(.type == "wireguard") | .peers[]? |
-    (._veilbox_real_address // empty)
-  ' "${sing_config}" 2>/dev/null | sort -u)
-
-  for ip in ${real_ips}; do
-    case "${ip}" in
-      127.*|"" ) continue ;;
-    esac
-    if ! "${yq}" -e ".route.rules[] | select(.ip_cidr[] == \"${ip}/32\")" "${sing_config}" >/dev/null 2>&1; then
-      "${yq}" -i -o=json ".route.rules = [{\"ip_cidr\":[\"${ip}/32\"],\"outbound\":\"direct\"}] + (.route.rules // [])" "${sing_config}" && \
-        log Info "[wgobfs] route direct ${ip}/32"
-    fi
-  done
+  if [ -f "${state}" ]; then
+    while read -r ep; do
+      ip="${ep%%:*}"
+      case "${ip}" in
+        127.*|"") continue ;;
+      esac
+      if ! "${yq}" -e ".route.rules[] | select(.ip_cidr[] == \"${ip}/32\")" "${sing_config}" >/dev/null 2>&1; then
+        "${yq}" -i -o=json ".route.rules = [{\"ip_cidr\":[\"${ip}/32\"],\"outbound\":\"direct\"}] + (.route.rules // [])" "${sing_config}" && \
+          log Info "[wgobfs] route direct ${ip}/32"
+      fi
+    done < "${state}"
+  fi
 }

 wgobfs_ensure_conf() {
@@ -103,7 +108,7 @@ wgobfs_ensure_conf() {
  fi
  if [ -f "${box_dir}/sidecar/wg-obfuscator.example.conf" ]; then
    cp -f "${box_dir}/sidecar/wg-obfuscator.example.conf" "${wgobfs_config}"
-    log Warning "[wgobfs] created ${wgobfs_config} from example — edit key/target"
+    log Warning "[wgobfs] created ${wgobfs_config} from example - edit key/target"
    return 0
  fi
  log Error "[wgobfs] missing ${wgobfs_config}"
@@ -134,7 +139,7 @@ wgobfs_start() {
  if wgobfs_wait_udp; then
    log Info "[wgobfs] running (listen see config source-lport, default ${wgobfs_listen_port})"
  else
-    log Error "[wgobfs] process died — see ${wgobfs_log}"
+    log Error "[wgobfs] process died - see ${wgobfs_log}"
    tail -n 15 "${wgobfs_log}" 2>/dev/null | while read -r line; do log Error "[wgobfs] ${line}"; done
    return 1
  fi
--- a/box/settings.ini
+++ b/box/settings.ini
@@ -103,10 +103,10 @@ clash_provide_rules="${box_dir}/clash/subscription/${name_provide_clash_rules}"

 # Sing configuration
 # BFR Manager → Manage Profiles lists *.json here. Switchable profiles:
-#   config-trusttunnel.json  — final → sidecar-proxy (:10800 TrustTunnel)
-#   config-olcrtc.json       — final → olcrtc-proxy (:10801 olcrtc)
-#   config-wg-obfs.json      — WireGuard via local wg-obfuscator (:41320)
-#   config-hy2-wg.json       — your hysteria/wg base (etc.)
+#   config-trusttunnel.json  - final → sidecar-proxy (:10800 TrustTunnel)
+#   config-olcrtc.json       - final → olcrtc-proxy (:10801 olcrtc)
+#   config-wg-obfs.json      - WireGuard via local wg-obfuscator (:41320)
+#   config-hy2-wg.json       - your hysteria/wg base (etc.)
 # For TT/olcrtc app switching keep sidecar_protocol=both and sidecar_set_final=false
 # For WG obfuscation set wgobfs_enable=true (needs VPS-side obfuscator)
 name_sing_config="config.json"
@@ -222,7 +222,7 @@ wifi_ssids_list=("WiFi1" "WiFi-2" "WiFi 3")
 inotify_log_enabled="true"

 # -----------------------------------------------------------------
-# PronBox stealth — anti-detection without LSPosed (iptables port-hide)
+# PronBox stealth - anti-detection without LSPosed (iptables port-hide)
 # -----------------------------------------------------------------

 # Master switch: enables loopback port-hide for observer apps + API lockdown
@@ -241,31 +241,34 @@ stealth_disable_api="true"
 stealth_api_bind="127.0.0.1"
 stealth_api_port="19090"

-# Block QUIC (UDP 443/80) — reduces fingerprint, may break some sites
+# Block QUIC (UDP 443/80) - reduces fingerprint, may break some sites
 stealth_block_quic="false"

-# Force tproxy mode — TUN interfaces are trivially detected by RKNHardering
+# Force tproxy mode - TUN interfaces are trivially detected by RKNHardering
 stealth_forbid_tun="true"

 # Extra ports to hide from external INPUT (space-separated in stealth_extra_ports)
-stealth_extra_ports=("7890" "7891" "1080" "10808" "2080" "41320")
+stealth_extra_ports=("7890" "7891" "19090" "1080" "10808" "2080" "41320" "10800" "10801" "9090" "9091" "1053")

-# Observer apps — packages that probe for VPN/proxy (see stealth.list.cfg)
+# Observer apps - packages that probe for VPN/proxy (see stealth.list.cfg)
 stealth_config=$(dirname "$settings")/stealth.list.cfg
 [ -d "${stealth_config}" ] && rm -rf "${stealth_config}"
 [ ! -f "${stealth_config}" ] && cat > "${stealth_config}"<<'stealth_init'
-# Apps that scan for localhost proxy / VPN (one package per line)
-# Examples (uncomment and adjust):
-# ru.sberbankmobile
-# com.idamob.tinkoff.android
-# ru.rostel
-# com.notcvnt.rknhardering
+# See box/stealth.list.cfg in module for full default RU list.
+# This stub is only used on first boot if file is missing.
+com.notcvnt.rknhardering
+ru.sberbankmobile
+com.idamob.tinkoff.android
+ru.alfabank.mobile.android
+ru.vtb24.mobilebanking.android
+ru.gosuslugi.gosapp
+ru.rostel
 stealth_init

 stealth_packages_list=($(sed -n '/^[^#]/s/^\([^ ]*\.[^ ]*\).*/\1/p' ${stealth_config}))

 # -----------------------------------------------------------------
-# Sidecar protocols — olcrtc / TrustTunnel via local SOCKS5 chain
+# Sidecar protocols - olcrtc / TrustTunnel via local SOCKS5 chain
 # -----------------------------------------------------------------

 sidecar_enable="false"
@@ -287,7 +290,7 @@ sidecar_set_final="false"
 sidecar_dir="${box_dir}/sidecar"

 # -----------------------------------------------------------------
-# WireGuard Obfuscator — https://github.com/ClusterM/wg-obfuscator
+# WireGuard Obfuscator - https://github.com/ClusterM/wg-obfuscator
 # Requires matching obfuscator on the VPS (same key). Not a VPN itself.
 # -----------------------------------------------------------------
 wgobfs_enable="false"
--- a/box/sidecar/trusttunnel.example.toml
+++ b/box/sidecar/trusttunnel.example.toml
@@ -2,7 +2,7 @@
 # Generate with TrustTunnel endpoint: trusttunnel_endpoint vpn.toml hosts.toml -c client -a server --format toml
 # Docs: https://github.com/TrustTunnel/TrustTunnelClient

-# Minimal placeholder — replace with exported client config from your endpoint.
+# Minimal placeholder - replace with exported client config from your endpoint.
 # Ensure SOCKS listener matches sidecar_listen_port in settings.ini (default 10800).

 [listener]
--- a/box/sidecar/wg-obfuscator.example.conf
+++ b/box/sidecar/wg-obfuscator.example.conf
@@ -1,28 +1,9 @@
-# VeilBox client — WireGuard Obfuscator (ClusterM)
-# https://github.com/ClusterM/wg-obfuscator
-#
-# CRITICAL: the same `key` must be configured on the VPS obfuscator.
-# Without a server-side wg-obfuscator this will NOT connect.
-#
-# Typical server layout (on VPS):
-#   public UDP 13232 → wg-obfuscator → 127.0.0.1:<real WireGuard ListenPort>
-# Client target below must point at that public obfuscator host:port.
-
+# PronBox client - WireGuard Obfuscator (ClusterM)
+# Fill key/target to match VPS obfuscator. Listen on loopback for sing-box WG peer.
 [client]
-# Listen only on loopback (sing-box WireGuard peer connects here)
 source-if = 127.0.0.1
 source-lport = 41320
-
-# Real remote: your VPS wg-obfuscator public endpoint
-# Example uses the previous raw WG host — after you wrap WG with obfuscator on the VPS,
-# keep the public host:port here (obfuscator listens where WG used to).
-target = YOUR_VPS_IP:13232
-
-# Shared obfuscation key (plain string, same on both sides)
+target = YOUR_VPS_IP:13255
 key = CHANGE_ME_WG_OBFS_KEY
-
-# STUN masking helps against DPI that only allows "video call" UDP
-# AUTO | STUN | NONE
-masking = STUN
-
+masking = AUTO
 verbose = INFO
--- a/box/sing-box/README.md
+++ b/box/sing-box/README.md
@@ -1,17 +1,17 @@
 # PronBox sing-box profiles

-| File | Sidecar | SOCKS / UDP | `route.final` / note |
-|------|---------|-------------|----------------------|
-| `config-trusttunnel.json` | TrustTunnel | `127.0.0.1:10800` | `sidecar-proxy` |
-| `config-olcrtc.json` | olcrtc | `127.0.0.1:10801` | `olcrtc-proxy` |
-| `config-wg-obfs.json` | wg-obfuscator | UDP `:41320` | WG peers → localhost obfuscator |
-| `config.stealth.example.json` | — | — | minimal template |
+| File | Sidecar / UDP | `route.final` | Switch |
+|------|---------------|---------------|--------|
+| `config-trusttunnel.json` | TrustTunnel SOCKS `:10800` | `sidecar-proxy` | `sbfr p use trusttunnel` |
+| `config-olcrtc.json` | olcrtc SOCKS `:10801` | `olcrtc-proxy` | `sbfr p use olcrtc` |
+| `config-wg-obfs.json` | wg-obfuscator UDP `:41320` | `wg-riga4` (endpoint) | `sbfr p use wg-obfs` |
+| `config-hy2-wg.json` | optional TT/olc | custom | BFR Manager |
+| `config.stealth.example.json` | - | minimal template | - |

-These files appear in **BFR Manager → Manage Profiles** (all `*.json` in `/data/adb/box/sing-box/`).
+Files in `/data/adb/box/sing-box/*.json` appear in **BFR Manager → Manage Profiles**.

-For TT/olcrtc flipping in the app:
- `sidecar_protocol="both"` + `sidecar_set_final="false"`
+**TT + olcrtc flip:** `sidecar_protocol="both"` + `sidecar_set_final="false"`.

-For WG obfuscation (`config-wg-obfs.json`):
- matching [wg-obfuscator](https://github.com/ClusterM/wg-obfuscator) on the VPS with the same `key`
- client conf: `/data/adb/box/sidecar/wg-obfuscator.conf`
+**WG obfs:** matching [wg-obfuscator](https://github.com/ClusterM/wg-obfuscator) on VPS, client `/data/adb/box/sidecar/wg-obfuscator.conf`.
+
+Full setup examples: [README.md](../../README.md#примеры-настройки-всех-протоколов).
--- a/box/sing-box/config-olcrtc.json
+++ b/box/sing-box/config-olcrtc.json
@@ -32,7 +32,7 @@
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
-      "listen_port": 7890
+      "listen_port": 19090
    }
  ],
  "outbounds": [
@@ -78,69 +78,6 @@
        ],
        "outbound": "direct"
      },
-      {
-        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
-        ],
-        "outbound": "direct"
-      },
-      {
-        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
-        ],
-        "outbound": "direct"
-      },
-      {
-        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
-        ],
-        "outbound": "direct"
-      },
      {
        "action": "sniff"
      },
@@ -150,7 +87,6 @@
      },
      {
        "ip_cidr": [
-          "YOUR_VPS_IP/32",
          "YOUR_VPS_IP/32"
        ],
        "outbound": "direct"
--- a/box/sing-box/config-trusttunnel.json
+++ b/box/sing-box/config-trusttunnel.json
@@ -32,7 +32,7 @@
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
-      "listen_port": 7890
+      "listen_port": 19090
    }
  ],
  "outbounds": [
@@ -78,69 +78,6 @@
        ],
        "outbound": "direct"
      },
-      {
-        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
-        ],
-        "outbound": "direct"
-      },
-      {
-        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
-        ],
-        "outbound": "direct"
-      },
-      {
-        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
-        ],
-        "outbound": "direct"
-      },
      {
        "action": "sniff"
      },
@@ -150,7 +87,6 @@
      },
      {
        "ip_cidr": [
-          "YOUR_VPS_IP/32",
          "YOUR_VPS_IP/32"
        ],
        "outbound": "direct"
--- a/box/sing-box/config-wg-obfs.json
+++ b/box/sing-box/config-wg-obfs.json
@@ -10,39 +10,35 @@
        "tag": "dns-direct"
      },
      {
-        "type": "https",
-        "tag": "dns-remote",
-        "detour": "olcrtc-proxy",
+        "type": "udp",
+        "tag": "dns-wg",
        "server": "1.1.1.1",
-        "path": "/dns-query"
-      },
-      {
-        "type": "https",
-        "tag": "dns-hy2",
-        "detour": "sidecar-proxy",
-        "server": "1.1.1.1",
-        "path": "/dns-query"
+        "server_port": 53,
+        "detour": "wg-riga4"
      }
    ],
-    "final": "dns-remote",
+    "final": "dns-wg",
    "strategy": "ipv4_only",
    "independent_cache": true
  },
  "endpoints": [
    {
      "type": "wireguard",
-      "tag": "wg-home",
+      "tag": "wg-riga4",
      "mtu": 1280,
-      "address": "10.0.10.16/32",
+      "address": [
+        "10.66.80.3/32"
+      ],
      "private_key": "YOUR_WIREGUARD_PRIVATE_KEY",
      "peers": [
        {
          "address": "127.0.0.1",
          "port": 41320,
          "public_key": "YOUR_PEER_PUBLIC_KEY",
-          "allowed_ips": "10.0.0.0/8",
-          "persistent_keepalive_interval": 25,
-          "_example_real_address": "YOUR_VPS_IP"
+          "allowed_ips": [
+            "0.0.0.0/0"
+          ],
+          "persistent_keepalive_interval": 25
        }
      ]
    }
@@ -58,22 +54,10 @@
      "type": "mixed",
      "tag": "mixed-in",
      "listen": "127.0.0.1",
-      "listen_port": 7890
+      "listen_port": 19090
    }
  ],
  "outbounds": [
-    {
-      "type": "hysteria2",
-      "tag": "proxy",
-      "server": "YOUR_SERVER_IP",
-      "server_port": 443,
-      "password": "YOUR_HYSTERIA2_PASSWORD",
-      "tls": {
-        "enabled": true,
-        "server_name": "assets.m1rs3m.org",
-        "alpn": "h3"
-      }
-    },
    {
      "type": "direct",
      "tag": "direct"
@@ -95,75 +79,9 @@
  ],
  "route": {
    "rules": [
-      {
-        "domain_suffix": [
-          "yandex.ru",
-          "yandex.net",
-          "yandex.com",
-          "ya.ru"
-        ],
-        "outbound": "direct"
-      },
      {
        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
-        ],
-        "outbound": "direct"
-      },
-      {
-        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
-        ],
-        "outbound": "direct"
-      },
-      {
-        "ip_cidr": [
-          "1",
-          "3",
-          ".",
-          "1",
-          "4",
-          "0",
-          ".",
-          "1",
-          "7",
-          ".",
-          "1",
-          "6",
-          "3",
-          "/",
-          "3",
-          "2"
+          "YOUR_VPS_IP/32"
        ],
        "outbound": "direct"
      },
@@ -176,59 +94,24 @@
      },
      {
        "ip_cidr": [
-          "YOUR_VPS_IP/32"
+          "10.66.80.0/24"
        ],
-        "outbound": "direct"
+        "outbound": "wg-riga4"
      },
      {
        "ip_cidr": [
+          "10.0.0.0/8",
          "192.168.0.0/16",
          "172.16.0.0/12",
          "127.0.0.0/8",
          "169.254.0.0/16"
        ],
        "outbound": "direct"
-      },
-      {
-        "rule_set": "geoip-private",
-        "outbound": "direct"
-      },
-      {
-        "domain_suffix": [
-          ".ru",
-          ".su",
-          ".xn--p1ai"
-        ],
-        "outbound": "direct"
-      },
-      {
-        "rule_set": "geosite-category-ru",
-        "outbound": "direct"
-      },
-      {
-        "rule_set": "geoip-ru",
-        "outbound": "direct"
      }
    ],
-    "rule_set": [
-      {
-        "type": "local",
-        "tag": "geoip-private",
-        "path": "ruleset/geoip-private.srs"
-      },
-      {
-        "type": "local",
-        "tag": "geoip-ru",
-        "path": "ruleset/geoip-ru.srs"
-      },
-      {
-        "type": "local",
-        "tag": "geosite-category-ru",
-        "path": "ruleset/geosite-category-ru.srs"
-      }
-    ],
-    "final": "olcrtc-proxy",
-    "default_domain_resolver": "dns-direct"
+    "final": "wg-riga4",
+    "default_domain_resolver": "dns-direct",
+    "auto_detect_interface": true
  },
  "experimental": {
    "cache_file": {
--- a/box/stealth.list.cfg
+++ b/box/stealth.list.cfg
@@ -0,0 +1,78 @@
+# PronBox stealth.list.cfg - apps that must NOT see localhost proxy ports
+# One package per line. Used by box.stealth (iptables UID → REJECT 127.0.0.0/8)
+
+# --- checkers / anti-tamper ---
+com.notcvnt.rknhardering
+
+# --- banks ---
+ru.sberbankmobile
+ru.sberbank.sberbankid
+com.idamob.tinkoff.android
+ru.alfabank.mobile.android
+ru.vtb24.mobilebanking.android
+ru.gazprombank.android.mobilebank.app
+com.openbank
+ru.raiffeisennews
+ru.rosbank.android
+ru.sovcomcard.android
+ru.letobank.Promobile
+ru.homecredit.mycredit
+ru.mts.money
+ru.rshb.mbank
+com.unicredit
+ru.yoo.money
+ru.sberm.mobile
+com.bm.android.toolsmobile
+ru.vtb.android.banking
+com.bssys.android.vtb
+
+# --- state / taxes / ID ---
+ru.gosuslugi.gosapp
+ru.rostel
+ru.gnivc.mobilenalog
+ru.mos.sudya
+ru.mos.mobile
+ru.mosparking.parking
+ru.esia
+ru.smev.esia
+
+# --- marketplaces / retail ---
+com.wildberries.ru
+ru.ozon.app.android
+ru.yandex.market
+com.avito.android
+ru.dns.shop.android
+ru.leroymerlin.customer
+com.magnit.mobile
+ru.x5.auth
+ru.pyaterochka.app.browser
+ru.detmir.app
+com.citilink.applink
+
+# --- telecom / ISP ---
+ru.mts.mymts
+ru.beeline.services
+ru.megafon.mlk
+ru.tele2.mytele2
+ru.yota.android
+ru.rt.mobile.android
+com.rostelecom.lk
+ru.domru.android
+
+# --- mail / docs that probe ---
+ru.mail.mailapp
+ru.yandex.mail
+com.yandex.browser
+ru.vk.store
+com.vkontakte.android
+ru.ok.android
+org.telegram.messenger
+# org.telegram.messenger.web
+
+# --- delivery / taxi / finance misc ---
+ru.yandex.taxi
+com.uber.android.passenger.rider
+ru.cdek.mobile
+ru.pochta.android
+ru.sberbank_sbol_android
+com.sberbank.sberbankid
--- a/customize.sh
+++ b/customize.sh
@@ -21,27 +21,27 @@ fi

 service_dir="/data/adb/service.d"
 if [ "$KSU" = "true" ]; then
-  ui_print "— KernelSU version: $KSU_VER ($KSU_VER_CODE)"
+  ui_print "- KernelSU version: $KSU_VER ($KSU_VER_CODE)"
  [ "$KSU_VER_CODE" -lt 10683 ] && service_dir="/data/adb/ksu/service.d"
 elif [ "$APATCH" = "true" ]; then
  APATCH_VER=$(cat "/data/adb/ap/version")
-  ui_print "— APatch version: $APATCH_VER"
+  ui_print "- APatch version: $APATCH_VER"
 else
-  ui_print "— Magisk version: $MAGISK_VER ($MAGISK_VER_CODE)"
+  ui_print "- Magisk version: $MAGISK_VER ($MAGISK_VER_CODE)"
 fi

 # Set up service directory and clean old installations
 mkdir -p "${service_dir}"
 if [ -d "/data/adb/modules/box_for_magisk" ]; then
  rm -rf "/data/adb/modules/box_for_magisk"
-  ui_print "— Old module deleted."
+  ui_print "- Old module deleted."
 fi

 # Extract files and configure directories
-ui_print "— Installing PronBox (НИИ «ТехноПрон»)"
+ui_print "- Installing PronBox (НИИ «ТехноПрон»)"
 unzip -o "$ZIPFILE" -x 'META-INF/*' -x 'webroot/*' -d "$MODPATH" >&2
 if [ -d "/data/adb/box" ]; then
-  ui_print "— Backup existing box data"
+  ui_print "- Backup existing box data"
  temp_bak=$(mktemp -d "/data/adb/box/box.XXXXXXXXXX")
  temp_dir="${temp_bak}"
  mv /data/adb/box/* "${temp_dir}/"
@@ -52,11 +52,11 @@ else
 fi

 # Directory creation and file extraction
-ui_print "— Create directories..."
+ui_print "- Create directories..."
 mkdir -p /data/adb/box/ /data/adb/box/run/ /data/adb/box/bin/xclash/
 mkdir -p $MODPATH/system/bin

-ui_print "— Extracting..."
+ui_print "- Extracting..."
 ui_print "     ↳  uninstall.sh → $MODPATH"
 ui_print "     ↳  box_service.sh → ${service_dir}"
 ui_print "     ↳  sbfr → $MODPATH/system/bin"
@@ -65,7 +65,7 @@ unzip -j -o "$ZIPFILE" 'box_service.sh' -d "${service_dir}" >&2
 unzip -j -o "$ZIPFILE" 'sbfr' -d "$MODPATH/system/bin" >&2

 # Set permissions
-ui_print "— Setting permissions..."
+ui_print "- Setting permissions..."
 set_perm_recursive $MODPATH 0 0 0755 0644
 set_perm_recursive /data/adb/box/ 0 3005 0755 0644
 set_perm_recursive /data/adb/box/scripts/ 0 3005 0755 0700
@@ -77,25 +77,25 @@ chmod ugo+x ${service_dir}/box_service.sh $MODPATH/uninstall.sh /data/adb/box/sc

 apply_mirror() {
  ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  ui_print "— Do you want to use the 'ghfast.top' ?"
+  ui_print "- Do you want to use the 'ghfast.top' ?"
  ui_print "     ↳  mirror to speed up downloads"
-  ui_print "— [ Vol UP(+): Yes ]"
-  ui_print "— [ Vol DOWN(-): No ]"
+  ui_print "- [ Vol UP(+): Yes ]"
+  ui_print "- [ Vol DOWN(-): No ]"
  START_TIME=$(date +%s)
  while true ; do
    NOW_TIME=$(date +%s)
    timeout 1 getevent -lc 1 2>&1 | grep KEY_VOLUME > "$TMPDIR/events"
    if [ $(( NOW_TIME - START_TIME )) -gt 9 ]; then
-      ui_print "— No input detected after 10 seconds..."
-      ui_print "— ghfast acceleration enabled."
+      ui_print "- No input detected after 10 seconds..."
+      ui_print "- ghfast acceleration enabled."
      sed -i 's/use_ghproxy=.*/use_ghproxy="true"/' /data/adb/box/scripts/box.tool
      break
    elif $(cat $TMPDIR/events | grep -q KEY_VOLUMEUP); then
-      ui_print "— ghfast acceleration enabled."
+      ui_print "- ghfast acceleration enabled."
      sed -i 's/use_ghproxy=.*/use_ghproxy="true"/' /data/adb/box/scripts/box.tool
      break
    elif $(cat $TMPDIR/events | grep -q KEY_VOLUMEDOWN); then
-      ui_print "— ghfast acceleration disabled."
+      ui_print "- ghfast acceleration disabled."
      sed -i 's/use_ghproxy=.*/use_ghproxy="false"/' /data/adb/box/scripts/box.tool
      break
    fi
@@ -113,10 +113,10 @@ find_bin() {
    local path="$bin_dir/bin/$name"
    if [ -e "$path" ]; then
        ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        ui_print "— $name → ⭕ FOUND"
+        ui_print "- $name → ⭕ FOUND"
    else
        ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-        ui_print "— $name → ❌ NOT FOUND"
+        ui_print "- $name → ❌ NOT FOUND"
    fi
  }

@@ -135,20 +135,20 @@ find_bin() {
    timeout 1 getevent -lc 1 2>&1 | grep KEY_VOLUME > "$TMPDIR/events"
    
    if [ $(( NOW_TIME - START_TIME )) -gt 9 ]; then
-      ui_print "— No input detected after 10 seconds..."
+      ui_print "- No input detected after 10 seconds..."
      if [ "$bin" = "clash" ]; then
-        ui_print "— Download enabled for clash."
+        ui_print "- Download enabled for clash."
        /data/adb/box/scripts/box.tool $action
      else
-        ui_print "— Download disabled for $bin."
+        ui_print "- Download disabled for $bin."
      fi
      break
    elif grep -q KEY_VOLUMEUP "$TMPDIR/events"; then
-      ui_print "— Download enabled."
+      ui_print "- Download enabled."
      /data/adb/box/scripts/box.tool $action
      break
    elif grep -q KEY_VOLUMEDOWN "$TMPDIR/events"; then
-      ui_print "— Download disabled."
+      ui_print "- Download disabled."
      break
    fi
    done
@@ -159,9 +159,9 @@ find_bin() {
    timeout 1 getevent -cl >/dev/null

    check_bin "$bin"
-    ui_print "— Do you want to download or update it?"
-    ui_print "— [ Vol UP(+): Yes ]"
-    ui_print "— [ Vol DOWN(-): No ]"
+    ui_print "- Do you want to download or update it?"
+    ui_print "- [ Vol UP(+): Yes ]"
+    ui_print "- [ Vol DOWN(-): No ]"
    handle_download "$bin"
    sleep 1
  done
@@ -169,17 +169,17 @@ find_bin() {
  # Special case for clash
  if [ -e "$bin_dir/bin/xclash/mihomo" ]; then
      ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      ui_print "— mihomo → ⭕ FOUND"
+      ui_print "- mihomo → ⭕ FOUND"
      ui_print "-- Do you want to download or update clash?"
-      ui_print "— [ Vol UP(+): Yes ]"
-      ui_print "— [ Vol DOWN(-): No ]"
+      ui_print "- [ Vol UP(+): Yes ]"
+      ui_print "- [ Vol DOWN(-): No ]"
      handle_download "clash"
  else
      ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-      ui_print "— mihomo → ❌ NOT FOUND  "
-      ui_print "— Do you want to download or update mihomo?"
-      ui_print "— [ Vol UP(+): Yes ]"
-      ui_print "— [ Vol DOWN(-): No ]"
+      ui_print "- mihomo → ❌ NOT FOUND  "
+      ui_print "- Do you want to download or update mihomo?"
+      ui_print "- [ Vol UP(+): Yes ]"
+      ui_print "- [ Vol DOWN(-): No ]"
      handle_download "clash"
  fi
 }
@@ -208,30 +208,30 @@ restore_ini() {
              # Append at the end of the file
              echo "$value" >> "$target_ini"
          fi
-          ui_print "— Restored: $key"
+          ui_print "- Restored: $key"
      else
-          ui_print "— Skipped: $key not found in backup"
+          ui_print "- Skipped: $key not found in backup"
      fi
  done
 }

 apply_ini() {
  ui_print "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
-  ui_print "— Would you like to restore settings.ini?"
-  ui_print "— [ Vol UP(+): Yes ]"
-  ui_print "— [ Vol DOWN(-): No ]"
+  ui_print "- Would you like to restore settings.ini?"
+  ui_print "- [ Vol UP(+): Yes ]"
+  ui_print "- [ Vol DOWN(-): No ]"
  START_TIME=$(date +%s)
  while true ; do
    NOW_TIME=$(date +%s)
    timeout 1 getevent -lc 1 2>&1 | grep KEY_VOLUME > "$TMPDIR/events"
    if [ $(( NOW_TIME - START_TIME )) -gt 9 ]; then
-      ui_print "— Skipped restoring settings.ini"
+      ui_print "- Skipped restoring settings.ini"
      break
    elif $(cat $TMPDIR/events | grep -q KEY_VOLUMEUP); then
      restore_ini
      break
    elif $(cat $TMPDIR/events | grep -q KEY_VOLUMEDOWN); then
-      ui_print "— Skipped restoring settings.ini"
+      ui_print "- Skipped restoring settings.ini"
      break
    fi
  done
@@ -242,7 +242,7 @@ timeout 1 getevent -cl >/dev/null

 # Restore backup configurations if present
 if [ "${backup_box}" = "true" ]; then
-  ui_print "— Restoring configurations..."
+  ui_print "- Restoring configurations..."
  ui_print "     ↳  xray"
  ui_print "     ↳  hysteria"
  ui_print "     ↳  clash"
@@ -259,7 +259,7 @@ if [ "${backup_box}" = "true" ]; then
  restore_kernel() {
    kernel_name="$1"
    if [ ! -f "/data/adb/box/bin/$kernel_name" ] && [ -f "${temp_dir}/bin/${kernel_name}" ]; then
-      ui_print "— Restoring kernel ${kernel_name}..."
+      ui_print "- Restoring kernel ${kernel_name}..."
      cp -rf "${temp_dir}/bin/${kernel_name}" "/data/adb/box/bin/${kernel_name}"
    fi
  }
@@ -268,21 +268,21 @@ if [ "${backup_box}" = "true" ]; then
    restore_kernel "$kernel"
  done

-  # Sidecar configs (TrustTunnel / olcrtc) — not shipped with secrets in ZIP
+  # Sidecar configs (TrustTunnel / olcrtc) - not shipped with secrets in ZIP
  if [ -d "${temp_dir}/sidecar" ]; then
-    ui_print "— Restoring sidecar configs..."
+    ui_print "- Restoring sidecar configs..."
    mkdir -p /data/adb/box/sidecar
    cp -rf "${temp_dir}/sidecar/"* "/data/adb/box/sidecar/" 2>/dev/null
  fi
  [ -f "${temp_dir}/stealth.list.cfg" ] && cp -f "${temp_dir}/stealth.list.cfg" "/data/adb/box/stealth.list.cfg"

-  ui_print "— Restoring..."
+  ui_print "- Restoring..."
  ui_print "     ↳  *.logs"
  ui_print "     ↳  box.pid"
  ui_print "     ↳  uid.list"
  cp -rf "${temp_dir}/run/"* "/data/adb/box/run/"

-  ui_print "— Restoring..."
+  ui_print "- Restoring..."
  ui_print "     ↳  ap.list.cfg"
  ui_print "     ↳  crontab.cfg"
  ui_print "     ↳  package.list.cfg"
@@ -303,7 +303,7 @@ fi
 # # nameserver 114.114.114.114
 # EOF
  # fi
-  # ui_print "— create $MODPATH/system/etc/resolv.conf"
+  # ui_print "- create $MODPATH/system/etc/resolv.conf"
 # }
 # create_resolv

@@ -323,15 +323,15 @@ sed -i "s/^author=.*/author=команда НИИ «ТехноПрон»/g" $MOD
 unzip -o "$ZIPFILE" 'webroot/*' -d "$MODPATH" >&2

 # Clean up temporary files
-ui_print "— Cleaning up leftover files"
+ui_print "- Cleaning up leftover files"
 rm -rf /data/adb/box/bin/.bin $MODPATH/box $MODPATH/sbfr $MODPATH/box_service.sh

 ui_print ""
 # Create a symbolic link to run /dev/sbfr as a shortcut to sbfr
 ln -sf "$MODPATH/system/bin/sbfr" /dev/sbfr
-ui_print "— Shortcut '/dev/sbfr' created."
+ui_print "- Shortcut '/dev/sbfr' created."
 ui_print "     ↳  You can now run: su -c /dev/sbfr"
 ui_print ""
 # Complete installation
-ui_print "— Installation complete. Please reboot your device."
-ui_print "— Report issues to t.me.taamarin"
+ui_print "- Installation complete. Please reboot your device."
+ui_print "- Report issues to t.me.taamarin"
--- a/module.prop
+++ b/module.prop
@@ -1,6 +1,6 @@
 id=box_for_root
 name=PronBox
-version=v1.12.0
-versionCode=2026081301
+version=v1.14.0
+versionCode=2026081303
 author=команда НИИ «ТехноПрон»
-description=PronBox — прозрачный TPROXY-прокси из стен НИИ «ТехноПрон». Stealth без LSPosed, TrustTunnel/olcrtc/wg-obfuscator, sing-box. Magisk id: box_for_root.
+description=PronBox - прозрачный TPROXY-прокси из стен НИИ «ТехноПрон». Stealth без LSPosed, TrustTunnel/olcrtc/wg-obfuscator, sing-box. Magisk id: box_for_root.
--- a/2
+++ b/2
@@ -20,7 +20,7 @@ help() {
    echo -e "  ${YELLOW}stop${RESET}     : Stop PronBox (iptables and service)"
    echo -e "  ${YELLOW}s <args>${RESET} : Run command to box.service with extra arguments"
    echo -e "  ${YELLOW}i <args>${RESET} : Run command to box.iptables with extra arguments"
-    echo -e "  ${YELLOW}p <args>${RESET} : Profile switch — list | status | use trusttunnel | use olcrtc"
+    echo -e "  ${YELLOW}p <args>${RESET} : Profile switch - list | status | use trusttunnel | use olcrtc | use wg-obfs"
    echo -e "  ${YELLOW}t <args>${RESET} : Run tools from box.tool with extra arguments"
    echo -e "  ${YELLOW}u${RESET}        : API to upgrade core[clash] (POST to /upgrade)"
    echo -e "  ${YELLOW}x${RESET}        : API to upgrade Dashboard UI [clash/sing] (POST to /upgrade/ui)"
--- a/tools/fix_doh_debug.sh
+++ b/tools/fix_doh_debug.sh
@@ -3,7 +3,7 @@ export PATH="/data/adb/magisk:/data/adb/box/bin:/system/bin:$PATH"
 CFG=/data/adb/box/sing-box/config.json
 YQ=/data/adb/box/bin/yq

-# Use HTTPS DoH via sidecar (port 443 — TT allows this; TCP/53 often blocked by SOCKS policy)
+# Use HTTPS DoH via sidecar (port 443 - TT allows this; TCP/53 often blocked by SOCKS policy)
 # Also try DoH via legacy hysteria outbound as fallback dns-hy2
 "$YQ" -i -o=json '
  .dns.servers = [
--- a/tools/fix_olc_yq.sh
+++ b/tools/fix_olc_yq.sh
@@ -35,7 +35,7 @@ CFG=/data/adb/box/sing-box/config-hy2-wg.json
 # Restart sing-box briefly to apply route, keep TT
 kill -HUP "$(pidof sing-box)" 2>/dev/null || true
 sleep 1
-# soft reload may not reload route; restart service is safer but heavy — kill/start sing-box only
+# soft reload may not reload route; restart service is safer but heavy - kill/start sing-box only
 # Use full renew
 sh /data/adb/box/scripts/box.service restart
 sleep 6
--- a/tools/fix_ru_dns.sh
+++ b/tools/fix_ru_dns.sh
@@ -3,7 +3,7 @@ export PATH="/data/adb/magisk:/data/adb/box/bin:/system/bin:$PATH"
 YQ=/data/adb/box/bin/yq
 CFG=/data/adb/box/sing-box/config.json

-# RU DNS also via sidecar DoH — route rules still send .ru traffic direct after resolve
+# RU DNS also via sidecar DoH - route rules still send .ru traffic direct after resolve
 # (old dns-direct to 77.88.8.8 was timing out under tproxy)
 $YQ '(.dns.rules[] | .server) = "dns-remote"' -i --output-format=json "$CFG"
 $YQ '.dns.final = "dns-remote"' -i --output-format=json "$CFG"
--- a/tools/gen_bfr_manager_profiles.py
+++ b/tools/gen_bfr_manager_profiles.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Build BFR Manager–visible profiles (hyphen names) from live config."""
+"""Build BFR Manager-visible profiles (hyphen names) from live config."""
 from __future__ import annotations

 import copy
--- a/tools/install_on_device.sh
+++ b/tools/install_on_device.sh
@@ -28,7 +28,7 @@ if ! grep -q '^stealth_mode=' /data/adb/box/settings.ini; then
  cat >> /data/adb/box/settings.ini <<'EOF'

 # -----------------------------------------------------------------
-# BFR Stealth — anti-detection without LSPosed (iptables port-hide)
+# BFR Stealth - anti-detection without LSPosed (iptables port-hide)
 # -----------------------------------------------------------------
 stealth_mode="true"
 stealth_hide_loopback="true"
--- a/tools/install_wgobfs.sh
+++ b/tools/install_wgobfs.sh
@@ -34,7 +34,7 @@ key = CHANGE_ME_WG_OBFS_KEY
 masking = STUN
 verbose = INFO
 EOF
-  echo "CREATED $SC/wg-obfuscator.conf — set key= to match VPS"
+  echo "CREATED $SC/wg-obfuscator.conf - set key= to match VPS"
 else
  echo "keep existing $SC/wg-obfuscator.conf"
 fi
--- a/tools/probe_tt3.sh
+++ b/tools/probe_tt3.sh
@@ -13,6 +13,6 @@ elif [ -x /data/adb/box/bin/curl ]; then
  /data/adb/box/bin/curl -x socks5h://127.0.0.1:10800 -m 20 -sS https://1.1.1.1/cdn-cgi/trace | head -5
 else
  # minimal SOCKS5 handshake via toybox/dd? skip
-  echo "NO_CURL — checking CONNECTED in log"
+  echo "NO_CURL - checking CONNECTED in log"
  grep 'Successfully connected' /data/adb/box/run/sidecar.log | tail -3
 fi
--- a/tools/tt_deeplink_to_toml.py
+++ b/tools/tt_deeplink_to_toml.py
@@ -78,7 +78,7 @@ def to_toml(fields: dict, socks_port: int = 10800) -> str:
    proto = fields.get("upstream_protocol", "http2")
    anti = str(fields.get("anti_dpi", False)).lower()
    name = fields.get("name", "trusttunnel")
-    return f'''# Generated from tt:// deep link — {name}
+    return f'''# Generated from tt:// deep link - {name}
 loglevel = "info"
 vpn_mode = "general"
 killswitch_enabled = false
--- a/update.json
+++ b/update.json
@@ -1,6 +1,6 @@
 {
-  "version": "v1.12.0",
-  "versionCode": "2026081301",
-  "zipUrl": "http://10.2.0.2/M1rs3m/BFR/releases/download/v1.12.0/pronbox-v1.12.0.zip",
+  "version": "v1.14.0",
+  "versionCode": "2026081303",
+  "zipUrl": "http://10.2.0.2/M1rs3m/BFR/releases/download/v1.14.0/pronbox-v1.14.0.zip",
  "changelog": "http://10.2.0.2/M1rs3m/BFR/src/branch/main/CHANGELOG_STEALTH.md"
 }
Author	SHA1	Message	Date
M1rsem	59ea41e454	docs: fix leftover merge conflict markers in README. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 12:02:52 +03:00
M1rsem	5278561f13	Release PronBox v1.14.0: protocol setup docs and wg-obfs profile switch. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 11:56:47 +03:00
M1rsem	d447adc133	chore: replace em dashes with ASCII hyphens. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 11:56:37 +03:00
M1rsem	1337e31579	Release PronBox v1.13.0: RU stealth defaults and mixed port 19090. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-13 11:56:00 +03:00
M1rs3m	4cbcff303f	Обновить README.md	2026-08-13 09:13:58 +03:00