I’m always open to feature suggestions. In the next update, I’m planning to improve the live remote control feature.
UPDATE AVAILABLE!
13/06/2026
VER: 0.5
Added: Process Blocker — Prevent specific applications from running on the remote device. Enter the process name in the Task Manager section, and the background agent service will instantly kill it whenever it attempts to start. The blocking setting is saved directly to the Windows Registry and persists across reboots and network reconnects.
Added: Startup Programs — Remove — Each startup program entry in Computer Info now has a Remove button. Clicking it sends an encrypted RequestRemoveStartupProgram command through the hub to the agent, which deletes the registry key (HKCU\..\Run, HKLM\..\Run, or Wow6432Node) or the startup folder shortcut. The result is returned over the same encrypted channel and displayed as a toast notification (success / error). HKLM removal requires the agent to be running as Administrator.
Added: File Manager — Search — Search for files by name in the current directory (including subdirectories) directly from the web dashboard. Results are capped at 500 items for safety and use the encrypted SignalR tunnel for communication.
Jun 18, 2026 07:57 AM
(This post was last modified: Jun 18, 2026 07:58 AM by OffCode.)
NEW UPDATE! 18/06/2026
VER: 0.6
Changes - Security: Request Timeout / Slowloris Protection — RequestTimeout middleware added (30 s global, 10 min for file transfers, ∞ for SignalR). Kestrel hardened with RequestHeadersTimeout: 15 s and KeepAliveTimeout: 120 s. HTTP/2 stream limit set to 100 per connection.
- Security: Error Message Hardening — Internal ex.Message no longer exposed in HTTP responses across UserController, DeviceController, and FileManagerController (12 locations fixed). All 500 responses now return a safe generic message; full exception details logged server-side only. Global fallback exception handler added to BackEnd/Program.cs with correlationId for log tracing.
- Fixed: Script Execution Timeout Removed — Scripts now run indefinitely until manually stopped by the user. The previous 5-minute hard timeout (CancellationTokenSource(TimeSpan.FromMinutes(5))) has been removed from ScriptExecutionService. Output buffer size limit also removed.
- Improved: UI Modernization (Glassmorphism) — The Blazor FrontEnd has been significantly upgraded with a sleek “glassmorphism” theme featuring emerald/teal accents. This applies to LiveStream, DeviceControl, AgentSettingsPanel, and authentication pages.
- Fixed: Mobile Layout — Connected devices and history views are now fully responsive on mobile devices via a robust Flexbox layout, fixing overflowing text and stretched elements.
- Improved: Live Stream Viewer — Added dynamic zoom controls allowing users to zoom in/out with the mouse wheel while tracking the cursor position. Added support for up to 240 FPS and dynamic quality settings (10–100%) for incredibly smooth playback, with 30 FPS set as the new default.
- Fixed: Share Screen Link Copy — The “Copy Link” button in the Live Stream view now uses synchronous JavaScript logic for improved reliability across all environments.
- Added: Stealth Mode — You can now hide the agent’s tray icon directly from the “Agent settings” panel. When Stealth Mode is enabled, the agent runs silently in the background and is only visible in the Windows Task Manager.
- Added: Chat — Real-time two-way chat window between the dashboard administrator and the remote agent’s user, complete with customizable administrator nickname and message history.
- Added: Script Manager Enhancements (Job-based) — The Remote Agent now tracks all running and completed scripts directly in its RAM. The dashboard automatically fetches this real-time status, ensuring you never lose track of a script’s progress, even if you close the browser. Includes a new “Clear Recent” functionality, safe asynchronous script stopping, and the ability to download execution output.
UPDATE AVAILABLE!
VER: 0.7
20/06/2026
Changes
- Added: Reverse Proxy Support — Built-in support for Nginx and Cloudflare Tunnels utilizing X-Forwarded-For and X-Forwarded-Proto headers. The servers now seamlessly track real client IP addresses securely when placed behind a reverse proxy.
- Added: Auto Startup Name modal — Enabling Windows auto startup from Agent settings now opens a modal where you can choose a custom startup name (or keep default RemoteControlAgent).
- Improved: Live Stream Cursor Visibility — The real system cursor from the agent machine is now rendered directly into captured livestream frames, including scaled captures.
- Improved: Live Stream Smoothness — Streaming lag/stutter has been significantly reduced with pipeline optimizations, resulting in much smoother playback and fewer frame hiccups.
- Fixed: Remote Control Right Click — Right-click from dashboard now correctly executes as right-click on the agent side, and right mouse button no longer triggers left-button down/up drag events.
05/07/2026
UPDATE AVAILABLE!
VER: 0.8
Changes
Security: Agent encryption & identity (v2) — Server Manager now generates a unique AES-256 key, AgentKeyId, and AGENT_CONNECT_TOKEN (256-bit random hex) for each new stub. All three are embedded in the stub trailer/.env and registered in BackEnd/AgentKeys.json (hot-reloaded via AgentKeyStore, no BackEnd restart). Per-agent keys limit blast radius: leaking one stub no longer decrypts every agent’s traffic (the shared AES_MASTER_KEY_HEX remains BackEnd↔FrontEnd dashboard only). Connect token closes identity spoofing on the anonymous ConnectAsDevice hub method: the BackEnd validates the token with constant-time hex comparison before registration; new agents call ConnectAsDevice directly over TLS. Validation activates per registry entry (legacy rows without connectToken still work until updated). The encrypted ReceiveEncryptedFromAgent → ConnectAsDevice bypass is restricted when AgentSecurity:RequireConnectToken is true (false in dev, true in appsettings.Production.json). Production: rebuild all agent stubs after upgrading the BackEnd, then enable RequireConnectToken=true. Use HTTPS/WSS so the connect token is not visible on the wire. LoadTester supports direct token-based registration.
Fixed: FrontEnd Hardcoded Dev Fallback Key Removed — The FrontEnd’s encryption service previously fell back to a hardcoded AES key when ASPNETCORE_ENVIRONMENT=Development and AES_MASTER_KEY_HEX was unset. It now fails fast and refuses to start without a valid key, matching the BackEnd and RemoteAgent behavior exactly.
Anyone have an actual review? Curious..
(Jul 8, 2026 02:33 PM)MadScientist Wrote: Anyone have an actual review? Curious..
Not yet, unfortunately. I'd really appreciate some honest feedback. I've done a lot of testing myself and spent a lot of time hunting for bugs and making the software as easy to use as possible, but feedback from other people is always valuable.
NEW UPDATE: 10/07/2026
VER: 0.9
Changes:
- Security: ConnectAsDevice bypass fix — Fixed a security vulnerability in DeviceControlHub.ConnectAsDevice. When AgentSecurity:RequireConnectToken was set to true, an attacker could bypass the enforcement by sending any unknown agentKeyId — TryGetConnectToken returned false for the unknown ID, causing the code to skip token validation and allow the connection as a legacy agent. Added an else if (requireToken) branch inside the agentKeyId block: if agentKeyId is provided but not found in the AgentKeys.json registry in strict mode, the connection is now rejected with HubException("Unauthorized") and a warning is logged (ConnectAsDevice: unknown agentKeyId rejected). The attacker would still need the shared AES_MASTER_KEY_HEX to communicate, but the RequireConnectToken enforcement now correctly covers all cases.
- Added: Share Link Expiry — Live Stream share links can now have a configurable lifetime. In the stream toolbar, set Hours and Minutes or enable No time limit. The backend registers sessions in ShareSessionService; ShareExpiryService expires them and notifies viewers via ShareExpired. Admin UI shows a countdown while sharing. Server validates links on JoinShare and BroadcastSharedFrame (1 min – 7 days, or unlimited).
- Added: Real-time Device Ping — DevicePingService pings connected agents every 10 s; agents respond with Pong; RTT is shown in the connected devices list (PingMs, color-coded). Cleartext ping IDs only (no sensitive payload).
- Added: Telegram Notifications — Optional global setting in Agent settings: Telegram message when a device comes online. Settings persisted in telegram-settings.json (hot-reload); REST API api/telegram/settings + test endpoint; in-modal BotFather setup help.
- Added: Telegram /Get_info Command — TelegramCommandService polls Bot API getUpdates; /Get_info requests Computer Info from an online agent (multi-device selection in chat). Responses routed via hub (SendComputerInfoRequestToAgentAsync, telegram- requestId prefix). Only the configured chat ID is accepted.
- Fixed: Share Screen anonymous join — JoinShare added to hub anonymous allow-list so public viewers can connect without dashboard JWT.
- Security: Replay Attack Protection (EncryptedPacket) — All incoming EncryptedPacket messages are now protected against replay attacks on both the BackEnd and RemoteAgent sides. A new ReplayCache (in-memory nonce-cache, BackEnd/Security/ReplayCache.cs and RemoteAgent/Security/ReplayCache.cs) registers the SHA-256 fingerprint of every received encrypted blob; an identical blob is rejected immediately. In addition, packet.Timestamp is validated against a configurable time window (default 60 seconds, tunable via ReplayProtection:MaxAgeSeconds in appsettings.json) — stale packets are dropped with a warning log. Validation runs in DeviceControlHub.ReceiveEncryptedFromAdmin, DeviceControlHub.ReceiveEncryptedFromAgent and SignalRService.HandleReceiveEncryptedPacketAsync. AES-GCM already guaranteed confidentiality and integrity; ReplayCache adds freshness so a captured valid ciphertext (e.g. a shutdown or kill-process command) cannot be replayed later.
Upcoming update!
Remote control android phones
-Gps tracking
-Live remote control
-File manager
-Open chat
![[Image: AndroidRemote.png]](https://pngup.com/EoKt/AndroidRemote.png)
Next week update is ready!
Android support!
|
