-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathRemoteChangelog.html
More file actions
692 lines (624 loc) · 44.6 KB
/
Copy pathRemoteChangelog.html
File metadata and controls
692 lines (624 loc) · 44.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
<!DOCTYPE html>
<html lang="en" itemscope itemtype="https://schema.org/WebPage">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
<title>Web Remote Control System: Changelog & Update History</title>
<meta name="description"
content="Web Remote Control System changelog, updates for the self-hosted Windows remote management stack (Blazor, ASP.NET Core, SignalR, agent).">
<meta name="author" content="OffCrypt">
<meta name="last-modified" content="2026-07-11">
<meta name="robots" content="noindex, follow">
<meta http-equiv="X-Content-Type-Options" content="nosniff">
<meta http-equiv="X-Frame-Options" content="DENY">
<meta http-equiv="X-XSS-Protection" content="1; mode=block">
<meta http-equiv="Referrer-Policy" content="strict-origin-when-cross-origin">
<meta http-equiv="Permissions-Policy" content="camera=(), microphone=(), geolocation=()">
<link rel="canonical" href="https://www.dev-offcode.com/RemoteChangelog.html">
<link rel="alternate" hreflang="en" href="https://www.dev-offcode.com/RemoteChangelog.html">
<link rel="alternate" hreflang="x-default" href="https://www.dev-offcode.com/RemoteChangelog.html">
<link rel="icon" type="image/x-icon" href="/favicon.ico">
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
<link rel="manifest" href="/manifest.json">
<link rel="preload" href="styles.css?v=2.8.0" as="style">
<meta name="theme-color" content="#00ff88">
<meta name="msapplication-TileColor" content="#00ff88">
<meta property="og:type" content="website">
<meta property="og:locale" content="en_US">
<meta property="og:url" content="https://www.dev-offcode.com/RemoteChangelog.html">
<meta property="og:title" content="Web Remote Control System: Changelog">
<meta property="og:description"
content="Release notes for the Web Remote Control System, features, fixes, and improvements.">
<meta property="og:image" content="https://www.dev-offcode.com/RemoteControl1.png">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:url" content="https://www.dev-offcode.com/RemoteChangelog.html">
<meta name="twitter:title" content="Web Remote Control System: Changelog">
<meta name="twitter:description"
content="Release notes for the Web Remote Control System, features, fixes, and improvements.">
<meta name="twitter:image" content="https://www.dev-offcode.com/RemoteControl1.png">
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "SoftwareApplication",
"name": "Web Remote Control System",
"applicationCategory": "UtilitiesApplication",
"operatingSystem": "Windows",
"description": "Self-hosted remote management for Windows devices via browser, SignalR, and AES-GCM encryption.",
"url": "https://www.dev-offcode.com/RemoteControl.html",
"image": "https://www.dev-offcode.com/RemoteControl1.png",
"releaseNotes": {
"@type": "TechArticle",
"headline": "Web Remote Control System changelog",
"dateModified": "2026-07-11",
"url": "https://www.dev-offcode.com/RemoteChangelog.html"
}
}
</script>
<link rel="stylesheet" href="styles.css?v=2.8.0">
</head>
<body>
<aside class="sidebar">
<div class="sidebar-header">
<div class="sidebar-title">OffCode</div>
</div>
<nav class="sidebar-nav">
<ul class="sidebar-menu">
<li class="menu-item">
<a href="index.html" class="menu-link">
<span class="menu-icon">📱</span>
<span class="menu-text">Android App</span>
</a>
</li>
<li class="menu-item">
<a href="OffCryptDesktop.html" class="menu-link">
<span class="menu-icon">💻</span>
<span class="menu-text">Desktop App</span>
</a>
</li>
<li class="menu-item">
<a href="ScreenLockBuilder.html" class="menu-link">
<span class="menu-icon">🔒</span>
<span class="menu-text">Screen Lock Builder</span>
</a>
</li>
<li class="menu-item">
<a href="ScreenLockBuilderPremium.html" class="menu-link">
<span class="menu-icon">⭐</span>
<span class="menu-text">Premium Builder</span>
</a>
</li>
<li class="menu-item">
<a href="AutomationTool.html" class="menu-link">
<span class="menu-icon">🤖</span>
<span class="menu-text">Automation Tool</span>
</a>
</li>
<li class="menu-item active">
<a href="RemoteControl.html" class="menu-link">
<span class="menu-icon">🌐</span>
<span class="menu-text">Web Remote Control</span>
</a>
</li>
<li class="menu-item">
<a href="TorChatPage.html" class="menu-link">
<span class="menu-icon">🧅</span>
<span class="menu-text">Tor Chat</span>
</a>
</li>
<li class="menu-item">
<a href="https://ko-fi.com/emptyc0de" class="menu-link" target="_blank" rel="noopener noreferrer">
<span class="menu-icon">💝</span>
<span class="menu-text">Donate</span>
</a>
</li>
<li class="menu-item">
<a href="PrivacyPolicy.html" class="menu-link">
<span class="menu-icon">🔐</span>
<span class="menu-text">Privacy Policy</span>
</a>
</li>
</ul>
</nav>
<div class="sidebar-footer">
<p class="footer-text">Social media</p>
<div class="sidebar-social-divider"></div>
<div class="sidebar-social">
<a href="https://x.com/OffCryptAndroid" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on X">
<span class="sidebar-social-icon">🐦</span>
<span class="sidebar-social-label">X</span>
</a>
<a href="https://www.instagram.com/off.crypt86/" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on Instagram">
<span class="sidebar-social-icon">📸</span>
<span class="sidebar-social-label">Instagram</span>
</a>
<a href="https://www.tiktok.com/@offcrypt0" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on TikTok">
<span class="sidebar-social-icon">🎵</span>
<span class="sidebar-social-label">TikTok</span>
</a>
<a href="https://www.youtube.com/@OffCrypt" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on YouTube">
<span class="sidebar-social-icon">▶️</span>
<span class="sidebar-social-label">YouTube</span>
</a>
<a href="https://bsky.app/profile/off-crypt86.bsky.social" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on Bluesky">
<span class="sidebar-social-icon">🦋</span>
<span class="sidebar-social-label">Bluesky</span>
</a>
<a href="https://www.linkedin.com/in/off-crypt-b94175382/" target="_blank" rel="noopener noreferrer"
aria-label="Follow OffCrypt on LinkedIn">
<span class="sidebar-social-icon">💼</span>
<span class="sidebar-social-label">LinkedIn</span>
</a>
</div>
</div>
</aside>
<button class="mobile-menu-toggle" aria-label="Toggle Menu">
<span class="hamburger"></span>
</button>
<div class="main-wrapper">
<main>
<nav aria-label="Breadcrumb"
style="position: absolute; left: -10000px; width: 1px; height: 1px; overflow: hidden;">
<ol style="list-style: none; padding: 0; margin: 0; display: flex; gap: 0.5rem; font-size: 0.9rem;">
<li><a href="https://www.dev-offcode.com/">Home</a></li>
<li>›</li>
<li><a href="https://www.dev-offcode.com/RemoteControl.html">Web Remote Control System</a></li>
<li>›</li>
<li>Changelog</li>
</ol>
</nav>
<div class="changelog-hero">
<div class="changelog-container">
<div class="changelog-header">
<h1 class="changelog-title">📝 Changelog</h1>
<p class="changelog-subtitle">Web Remote Control System, updates, fixes, and new features</p>
</div>
</div>
</div>
<div class="changelog-content">
<div class="changelog-container">
<div class="changelog-intro">
<p>Release notes for the <strong>Web Remote Control System</strong>: self-hosted ASP.NET Core
backend, Blazor dashboard, SignalR hub, Windows agent, and Server Manager tooling.</p>
<p><strong>Latest:</strong> VER 1.0 (July 11, 2026), Dashboard Lock hardening, CORS/rate limits, agent path guard, encrypted file transfer (chunked AES-GCM), and Tor Network support.</p>
</div>
<div class="changelog-wrapper">
<!-- VER 1.0 -->
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 1.0</span>
<span class="version-date">11/07/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Security:</strong> <strong>Dashboard Lock access hardening</strong>: Strengthened dashboard authentication around the lock/JWT path: password hashing uses ASP.NET <code>PasswordHasher</code> (PBKDF2 with salt); related account-store encryption keys are loaded from environment / configuration (or derived from <code>AES_MASTER_KEY_HEX</code>); optional first-admin bootstrap via <code>INITIAL_ADMIN_USERNAME</code> + <code>INITIAL_ADMIN_PASSWORD</code>. Legacy <code>/api/user/*</code> requires a <code>DashboardAccess</code> JWT and is marked obsolete in favor of Dashboard Lock.</li>
<li><strong>Security:</strong> <strong>Production CORS fail-closed</strong>: Wildcard <code>*</code> with credentials is no longer allowed; explicit <code>Cors:AllowedOrigins</code> or <code>ALLOWED_ORIGINS</code> required outside Development.</li>
<li><strong>Security:</strong> <strong>Rate limiting</strong>: ASP.NET <code>AddRateLimiter</code> policies <code>login</code> (dashboard-lock verify + legacy user login) and <code>hub-negotiate</code> (SignalR <code>/devicehub</code>); in-hub <code>ShareJoinRateLimiter</code> for anonymous <code>JoinShare</code>.</li>
<li><strong>Security:</strong> <strong>Agent path guard</strong>: <code>RemoteAgent/Security/AgentPathGuard.cs</code> (<code>Path.GetFullPath</code>, reject <code>..</code>, allowlist of drives + shell folders) on browse/search/upload/download paths.</li>
<li><strong>Security:</strong> <strong>Encrypted file transfer (chunked AES-GCM)</strong>: File payloads on <code>agent-download</code> / <code>agent-upload</code> are streamed as AES-256-GCM chunks (<code>AesGcmChunkStream</code>) with a per-transfer key delivered inside encrypted SignalR metadata (<code>FileUploadCommand</code> / <code>FileDownloadCommand</code>). Agent HTTP calls require <code>X-Transfer-Token</code> (HMAC). Server temp files are stored as ciphertext (<code>.rcenc</code>). Admin <code>upload</code> / <code>client-download</code> remain JWT-protected; the BackEnd encrypts on ingest and decrypts before browser download. Upload notifications use per-agent encryption (<code>EncryptForDevice</code>). When Tor is enabled, the agent’s <code>FileTransferService</code> routes HTTP through the same SOCKS5 proxy as SignalR.</li>
<li><strong>Added:</strong> <strong>Tor Network Support</strong>: Integrated native Tor routing capabilities. Added a <code>Tor connection</code> checkbox to the Server Manager that automatically runs a local <code>tor.exe</code> instance, generates a persistent Tor Hidden Service key pair for the BackEnd, and populates the resulting <code>.onion</code> address. The Remote Agent builder then bundles the Tor Expert binaries (<code>TorBundle</code>) alongside the generated stub. When executed on the target machine, the agent spins up a local Tor SOCKS5 proxy and routes all SignalR traffic seamlessly through the Tor network to the <code>.onion</code> address using Long Polling, bypassing NAT and removing the need for port forwarding.</li>
</ul>
</div>
</div>
<!-- VER 0.9 -->
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.9</span>
<span class="version-date">10/07/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Security:</strong> <strong>ConnectAsDevice bypass fix</strong>: Fixed a security vulnerability in <code>DeviceControlHub.ConnectAsDevice</code>. When <code>AgentSecurity:RequireConnectToken</code> was set to <code>true</code>, an attacker could bypass the enforcement by sending any unknown <code>agentKeyId</code>: <code>TryGetConnectToken</code> returned <code>false</code> for the unknown ID, causing the code to skip token validation and allow the connection as a legacy agent. Added an <code>else if (requireToken)</code> branch inside the <code>agentKeyId</code> block: if <code>agentKeyId</code> is provided but not found in the <code>AgentKeys.json</code> registry in strict mode, the connection is now rejected with <code>HubException("Unauthorized")</code> and a warning is logged (<code>ConnectAsDevice: unknown agentKeyId rejected</code>). The attacker would still need the shared <code>AES_MASTER_KEY_HEX</code> to communicate, but the <code>RequireConnectToken</code> enforcement now correctly covers all cases.</li>
<li><strong>Added:</strong> <strong>Share Link Expiry</strong>: Live Stream share links can now have a configurable lifetime. In the stream toolbar, set <strong>Hours</strong> and <strong>Minutes</strong> or enable <strong>No time limit</strong>. The backend registers sessions in <code>ShareSessionService</code>; <code>ShareExpiryService</code> expires them and notifies viewers via <code>ShareExpired</code>. Admin UI shows a countdown while sharing. Server validates links on <code>JoinShare</code> and <code>BroadcastSharedFrame</code> (1 min: 7 days, or unlimited).</li>
<li><strong>Added:</strong> <strong>Real-time Device Ping</strong>: <code>DevicePingService</code> pings connected agents every 10 s; agents respond with <code>Pong</code>; RTT is shown in the connected devices list (<code>PingMs</code>, color-coded). Cleartext ping IDs only (no sensitive payload).</li>
<li><strong>Added:</strong> <strong>Telegram Notifications</strong>: Optional global setting in <strong>Agent settings</strong>: Telegram message when a device comes online. Settings persisted in <code>telegram-settings.json</code> (hot-reload); REST API <code>api/telegram/settings</code> + test endpoint; in-modal BotFather setup help.</li>
<li><strong>Added:</strong> <strong>Telegram <code>/Get_info</code> Command</strong>: <code>TelegramCommandService</code> polls Bot API <code>getUpdates</code>; <code>/Get_info</code> requests Computer Info from an online agent (multi-device selection in chat). Responses routed via hub (<code>SendComputerInfoRequestToAgentAsync</code>, <code>telegram-</code> requestId prefix). Only the configured chat ID is accepted.</li>
<li><strong>Fixed:</strong> <strong>Share Screen anonymous join</strong>: <code>JoinShare</code> added to hub anonymous allow-list so public viewers can connect without dashboard JWT.</li>
<li><strong>Security:</strong> <strong>Replay Attack Protection (EncryptedPacket)</strong>: All incoming <code>EncryptedPacket</code> messages are now protected against replay attacks on both the BackEnd and RemoteAgent sides. A new <code>ReplayCache</code> (in-memory nonce-cache, <code>BackEnd/Security/ReplayCache.cs</code> and <code>RemoteAgent/Security/ReplayCache.cs</code>) registers the SHA-256 fingerprint of every received encrypted blob; an identical blob is rejected immediately. In addition, <code>packet.Timestamp</code> is validated against a configurable time window (default <strong>60 seconds</strong>, tunable via <code>ReplayProtection:MaxAgeSeconds</code> in <code>appsettings.json</code>), stale packets are dropped with a warning log. Validation runs in <code>DeviceControlHub.ReceiveEncryptedFromAdmin</code>, <code>DeviceControlHub.ReceiveEncryptedFromAgent</code> and <code>SignalRService.HandleReceiveEncryptedPacketAsync</code>. AES-GCM already guaranteed confidentiality and integrity; <code>ReplayCache</code> adds <strong>freshness</strong> so a captured valid ciphertext (e.g. a shutdown or kill-process command) cannot be replayed later.</li>
</ul>
</div>
</div>
<!-- VER 0.8 -->
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.8</span>
<span class="version-date">05/07/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Security:</strong> <strong>Agent encryption & identity (v2)</strong>: Server Manager now generates a unique AES-256 key, <code>AgentKeyId</code>, and <code>AGENT_CONNECT_TOKEN</code> (256-bit random hex) for each new stub. All three are embedded in the stub trailer/<code>.env</code> and registered in <code>BackEnd/AgentKeys.json</code> (hot-reloaded via <code>AgentKeyStore</code>, no BackEnd restart). Per-agent keys limit blast radius: leaking one stub no longer decrypts every agent’s traffic (the shared <code>AES_MASTER_KEY_HEX</code> remains BackEnd↔FrontEnd dashboard only). Connect token closes identity spoofing on the anonymous <code>ConnectAsDevice</code> hub method: the BackEnd validates the token with constant-time hex comparison before registration; new agents call <code>ConnectAsDevice</code> directly over TLS. Validation activates per registry entry (legacy rows without <code>connectToken</code> still work until updated). The encrypted <code>ReceiveEncryptedFromAgent</code> → <code>ConnectAsDevice</code> bypass is restricted when <code>AgentSecurity:RequireConnectToken</code> is <code>true</code> (<code>false</code> in dev, <code>true</code> in <code>appsettings.Production.json</code>). <strong>Production:</strong> rebuild all agent stubs after upgrading the BackEnd, then enable <code>RequireConnectToken=true</code>. Use HTTPS/WSS so the connect token is not visible on the wire. LoadTester supports direct token-based registration.</li>
<li><strong>Fixed:</strong> <strong>FrontEnd Hardcoded Dev Fallback Key Removed</strong>: The FrontEnd’s encryption service previously fell back to a hardcoded AES key when <code>ASPNETCORE_ENVIRONMENT=Development</code> and <code>AES_MASTER_KEY_HEX</code> was unset. It now fails fast and refuses to start without a valid key, matching the BackEnd and RemoteAgent behavior exactly.</li>
</ul>
</div>
</div>
<!-- VER 0.7 -->
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.7</span>
<span class="version-date">20/06/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Added:</strong> <strong>Reverse Proxy Support</strong>: Built-in support for Nginx and Cloudflare Tunnels utilizing <code>X-Forwarded-For</code> and <code>X-Forwarded-Proto</code> headers. The servers now seamlessly track real client IP addresses securely when placed behind a reverse proxy.</li>
<li><strong>Added:</strong> <strong>Auto Startup Name modal</strong>: Enabling Windows auto startup from Agent settings now opens a modal where you can choose a custom startup name (or keep default <code>RemoteControlAgent</code>).</li>
<li><strong>Improved:</strong> <strong>Live Stream Cursor Visibility</strong>: The real system cursor from the agent machine is now rendered directly into captured livestream frames, including scaled captures.</li>
<li><strong>Improved:</strong> <strong>Live Stream Smoothness</strong>: Streaming lag/stutter has been significantly reduced with pipeline optimizations, resulting in much smoother playback and fewer frame hiccups.</li>
<li><strong>Fixed:</strong> <strong>Remote Control Right Click</strong>: Right-click from dashboard now correctly executes as right-click on the agent side, and right mouse button no longer triggers left-button down/up drag events.</li>
</ul>
</div>
</div>
<!-- VER 0.6 -->
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.6</span>
<span class="version-date">18/06/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Security:</strong> <strong>Request Timeout / Slowloris Protection</strong>: <code>RequestTimeout</code> middleware added (30 s global, 10 min for file transfers, ∞ for SignalR). Kestrel hardened with <code>RequestHeadersTimeout: 15 s</code> and <code>KeepAliveTimeout: 120 s</code>. HTTP/2 stream limit set to 100 per connection.</li>
<li><strong>Security:</strong> <strong>Error Message Hardening</strong>: Internal <code>ex.Message</code> no longer exposed in HTTP responses across <code>UserController</code>, <code>DeviceController</code>, and <code>FileManagerController</code> (12 locations fixed). All 500 responses now return a safe generic message; full exception details logged server-side only. Global fallback exception handler added to <code>BackEnd/Program.cs</code> with <code>correlationId</code> for log tracing.</li>
<li><strong>Fixed:</strong> <strong>Script Execution Timeout Removed</strong>: Scripts now run indefinitely until manually stopped by the user. The previous 5-minute hard timeout (<code>CancellationTokenSource(TimeSpan.FromMinutes(5))</code>) has been removed from <code>ScriptExecutionService</code>. Output buffer size limit also removed.</li>
<li><strong>Improved:</strong> <strong>UI Modernization (Glassmorphism)</strong>: The Blazor FrontEnd has been significantly upgraded with a sleek “glassmorphism” theme featuring emerald/teal accents. This applies to <code>LiveStream</code>, <code>DeviceControl</code>, <code>AgentSettingsPanel</code>, and authentication pages.</li>
<li><strong>Fixed:</strong> <strong>Mobile Layout</strong>: Connected devices and history views are now fully responsive on mobile devices via a robust Flexbox layout, fixing overflowing text and stretched elements.</li>
<li><strong>Improved:</strong> <strong>Live Stream Viewer</strong>: Added dynamic zoom controls allowing users to zoom in/out with the mouse wheel while tracking the cursor position. Added support for up to 240 FPS and dynamic quality settings (10–100%) for incredibly smooth playback, with 30 FPS set as the new default.</li>
<li><strong>Fixed:</strong> <strong>Share Screen Link Copy</strong>: The “Copy Link” button in the Live Stream view now uses synchronous JavaScript logic for improved reliability across all environments.</li>
<li><strong>Added:</strong> <strong>Stealth Mode</strong>: You can now hide the agent’s tray icon directly from the “Agent settings” panel. When Stealth Mode is enabled, the agent runs silently in the background and is only visible in the Windows Task Manager.</li>
<li><strong>Added:</strong> <strong>Chat</strong>: Real-time two-way chat window between the dashboard administrator and the remote agent’s user, complete with customizable administrator nickname and message history.</li>
<li><strong>Added:</strong> <strong>Script Manager Enhancements (Job-based)</strong>: The Remote Agent now tracks all running and completed scripts directly in its RAM. The dashboard automatically fetches this real-time status, ensuring you never lose track of a script’s progress, even if you close the browser. Includes a new “Clear Recent” functionality, safe asynchronous script stopping, and the ability to download execution output.</li>
</ul>
</div>
</div>
<!-- VER 0.5 -->
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.5</span>
<span class="version-date">13/06/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Added:</strong> <strong>Process Blocker</strong>: Prevent specific applications from running on the remote device. Enter the process name in the Task Manager section, and the background agent service will instantly kill it whenever it attempts to start. The blocking setting is saved directly to the Windows Registry and persists across reboots and network reconnects.</li>
<li><strong>Added:</strong> <strong>Startup Programs, Remove</strong>: Each startup program entry in Computer Info now has a <strong>Remove</strong> button. Clicking it sends an encrypted <code>RequestRemoveStartupProgram</code> command through the hub to the agent, which deletes the registry key (<code>HKCU\..\Run</code>, <code>HKLM\..\Run</code>, or <code>Wow6432Node</code>) or the startup folder shortcut. The result is returned over the same encrypted channel and displayed as a toast notification (success / error). HKLM removal requires the agent to be running as Administrator.</li>
<li><strong>Added:</strong> <strong>File Manager, Search</strong>: Search for files by name in the current directory (including subdirectories) directly from the web dashboard. Results are capped at 500 items for safety and use the encrypted SignalR tunnel for communication.</li>
</ul>
</div>
</div>
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.4</span>
<span class="version-date">18/05/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Added:</strong> Script manager tab / Scheduled Script Execution, which allows setting a specific date and time for a script to run automatically, independently managed by the backend server.</li>
<li><strong>Added:</strong> Server Manager Changelog, In-app changelog viewer that fetches and parses the latest release notes automatically, along with a quick link to download new versions.</li>
</ul>
</div>
</div>
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.3</span>
<span class="version-date">14/05/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Added:</strong> Share Screen - Share the agent's live stream with anyone via a secure, public link without requiring a dashboard login. The public viewer connects anonymously while your dashboard acts as the decryption relay.</li>
<li><strong>Added:</strong> Remote Terminal - Fully interactive PowerShell and Command Prompt terminal directly in the web dashboard.</li>
<li><strong>Added:</strong> Script Manager - Built-in code editor to write, save, and execute scripts (Python, PowerShell, Batch, VBScript) on remote agent machines. Scripts are safely stored in browser's local storage for easy reuse.</li>
</ul>
</div>
</div>
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.2</span>
<span class="version-date">09/05/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Added:</strong> Software Manager, Remotely list and uninstall
applications via Windows Registry.</li>
<li><strong>Added:</strong> Power Controls, Shutdown and Restart devices remotely
from the Task Manager panel.</li>
<li><strong>Added:</strong> Device History, Track and manage previously connected
devices.</li>
<li><strong>Added:</strong> File Manager, dynamic drives, Quick-access buttons for
all ready drives (fixed, removable, network) fetched from the agent over the
encrypted SignalR channel.</li>
<li><strong>Added:</strong> File Manager, quick folders, Program Files, Program
Files (x86), and Roaming AppData shortcuts (resolved on the agent via shell
folder tokens, same pattern as Desktop/Documents/Downloads).</li>
<li><strong>Improved:</strong> File Manager UX, Open folders with a single click on
the row; upload target automatically follows the current browse path (no separate
“Set as Target” step).</li>
<li><strong>Added:</strong> File Manager, upload and run, Optional checkbox to
open uploaded files automatically on the agent after transfer completes.</li>
<li><strong>Added:</strong> Desktop Screenshot, Close Image, Dismiss the
screenshot preview from the device control UI.</li>
<li><strong>Added:</strong> Server Manager, log toggle, Checkbox to turn
application logging on or off.</li>
<li><strong>Fixed:</strong> Server Manager, Stopping or restarting the frontend no
longer stops the backend (independent service controls).</li>
<li><strong>Added:</strong> Dashboard Lock (optional), Cookie session for the Blazor
UI, lock-aware redirects, <code>/authentication/continue</code> when lock is
disabled, safe <code>returnUrl</code> handling; backend stores the dashboard
password as a secure hash; short-lived JWT for admin SignalR and protected REST
(<code>DeviceController</code>, admin FileManager routes); agent HTTP file
endpoints (<code>agent-download</code> / <code>agent-upload</code>) remain
reachable without JWT; <code>configure</code> requires auth or
<code>DASHBOARD_LOCK_ADMIN_SECRET</code>.</li>
<li><strong>Added:</strong> Remove Agent, Remote uninstall flow with confirmation;
offline queue in SQLite (<code>PendingAgentCommands</code>) until the agent
reconnects.</li>
<li><strong>Added:</strong> Lock settings UI, Dashboard button on
<code>/authentication/settings</code> opens the devices page (<code>/devices</code>).</li>
</ul>
</div>
</div>
<div class="changelog-entry">
<div class="changelog-version">
<span class="version-tag">VER: 0.1</span>
<span class="version-date">08/05/2026</span>
</div>
<div class="changelog-changes">
<h3>Changes</h3>
<ul>
<li><strong>Fixed:</strong> Empty secret key generation issue in Server Manager.
</li>
<li><strong>Fixed:</strong> Auto-detect project path and Server Manager crashing
issues.</li>
</ul>
</div>
</div>
</div>
<div class="purchase-instructions-box" style="margin-top: 2rem;">
<h3 class="instructions-title">Back to Web Remote Control</h3>
<p class="instructions-intro">Return to the product page or download flow.</p>
<div
style="display: flex; flex-wrap: wrap; gap: 1rem; justify-content: center; margin-top: 1.5rem;">
<a href="RemoteControl.html" class="button secondary-download">Web Remote Control</a>
<a href="AutomationTool.html" class="button secondary-download">Automation Tool</a>
</div>
</div>
</div>
</div>
</main>
</div>
<style>
.changelog-hero {
background: var(--gradient-card);
padding: 80px 20px 60px 20px;
margin: 0;
position: relative;
overflow: hidden;
border: 1px solid var(--border-primary);
backdrop-filter: blur(30px);
-webkit-backdrop-filter: blur(30px);
border-top: none;
border-bottom: none;
}
.changelog-hero::before {
content: '';
position: absolute;
top: 0;
left: 0;
right: 0;
height: 1px;
background: var(--gradient-border);
z-index: 1;
}
.changelog-hero::after {
content: '';
position: absolute;
bottom: 0;
left: 0;
right: 0;
height: 1px;
background: var(--gradient-border);
z-index: 1;
}
.changelog-container {
max-width: 1000px;
margin: 0 auto;
position: relative;
z-index: 1;
}
.changelog-header {
text-align: center;
color: white;
}
.changelog-title {
font-size: 3rem;
font-weight: 700;
margin-bottom: 20px;
background: linear-gradient(45deg, #00bcd4, #00e676);
-webkit-background-clip: text;
-webkit-text-fill-color: transparent;
background-clip: text;
text-shadow: none;
}
.changelog-subtitle {
font-size: 1.2rem;
color: #b0b0b0;
margin: 0;
opacity: 0.9;
}
.changelog-content {
background: var(--gradient-card);
padding: 80px 20px;
min-height: 60vh;
border: 1px solid var(--border-primary);
backdrop-filter: blur(30px);
-webkit-backdrop-filter: blur(30px);
border-top: none;
border-bottom: none;
position: relative;
}
.changelog-content::before {
content: '';
position: absolute;
top: 0;
left: 0;
right: 0;
height: 1px;
background: var(--gradient-border);
z-index: 1;
}
.changelog-content::after {
content: '';
position: absolute;
bottom: 0;
left: 0;
right: 0;
height: 1px;
background: var(--gradient-border);
z-index: 1;
}
.changelog-intro {
background: var(--gradient-card);
border: 1px solid var(--border-primary);
border-radius: 0;
padding: 30px;
margin-bottom: 40px;
color: var(--text-primary);
line-height: 1.6;
backdrop-filter: blur(30px);
-webkit-backdrop-filter: blur(30px);
border-left: 3px solid var(--accent-primary);
}
.changelog-intro p {
margin: 0 0 15px 0;
}
.changelog-intro p:last-child {
margin-bottom: 0;
}
.changelog-intro strong {
color: var(--accent-primary);
}
.changelog-wrapper {
background: var(--gradient-card);
border-radius: 0;
border: 1px solid var(--border-primary);
box-shadow: var(--shadow-subtle);
backdrop-filter: blur(30px);
-webkit-backdrop-filter: blur(30px);
overflow: hidden;
border-left: 3px solid var(--accent-primary);
}
.changelog-entry {
border-bottom: 1px solid var(--border-primary);
padding: 40px;
position: relative;
}
.changelog-entry:last-child {
border-bottom: none;
}
.changelog-version {
display: flex;
align-items: center;
gap: 15px;
margin-bottom: 20px;
}
.version-tag {
background: linear-gradient(45deg, #00bcd4, #00e676);
color: #1f1f1f;
padding: 8px 16px;
border-radius: 20px;
font-weight: 700;
font-size: 0.9rem;
}
.version-date {
color: var(--text-secondary);
font-size: 0.95rem;
}
.changelog-changes {
color: var(--text-primary);
}
.changelog-changes h3 {
color: var(--accent-primary);
font-size: 1.3rem;
margin: 0 0 15px 0;
font-weight: 700;
}
.changelog-changes ul {
list-style: none;
padding: 0;
margin: 0 0 20px 0;
}
.changelog-changes li {
padding: 5px 0 5px 25px;
position: relative;
line-height: 1.5;
}
.changelog-changes li::before {
content: "•";
position: absolute;
left: 0;
color: var(--accent-primary);
font-weight: bold;
}
.changelog-changes code {
font-size: 0.9em;
padding: 0.1em 0.35em;
border-radius: 4px;
background: rgba(0, 0, 0, 0.25);
}
@media (max-width: 768px) {
.changelog-hero {
padding: 60px 20px 50px 20px;
}
.changelog-title {
font-size: 2.2rem;
}
.changelog-subtitle {
font-size: 1rem;
padding: 0 20px;
}
.changelog-content {
padding: 60px 15px;
}
.changelog-entry {
padding: 30px 25px;
}
.changelog-version {
flex-direction: column;
align-items: flex-start;
gap: 10px;
}
}
@media (max-width: 480px) {
.changelog-hero {
padding: 50px 15px 40px 15px;
}
.changelog-title {
font-size: 1.8rem;
}
.changelog-subtitle {
font-size: 0.9rem;
}
.changelog-content {
padding: 50px 10px;
}
.changelog-entry {
padding: 25px 20px;
}
}
</style>
<script src="script.js" defer></script>
<link rel="stylesheet" href="cookie-consent.css">
<script src="cookie-consent.js" defer></script>
</body>
</html>