WandEnhancer
WandEnhancer 架构：补丁器、Proxy DLL、Renderer Scripts 与局域网面板
分析 .NET 补丁器、Electron ASAR 完整性修改、渲染器注入、客户端 API 和 Remote Web Panel 的信任边界。
你将学会
- Map WandEnhancer trust boundaries
- Trace patch and renderer effects
- Review panel protocol and cleanup fixtures
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Model patcher, proxy DLL, renderer scripts, and panel as separate trust surfaces.
- Trace file writes and the ASAR fuse change with a reversible fixture.
- Renderer code and port 3223 are privileged operations requiring least trust and explicit cleanup.
Four boundaries, not one executable
WandEnhancer 应拆成四个边界：.NET 补丁器修改本地安装，version.dll 在 Wand 自身进程内改变 Electron ASAR fuse，renderer scripts 以客户端权限运行，Remote Web Panel 在 3223 端口提供无配对码的 LAN 控制。每个边界都要独立审计、限权和清理。
The README says the patcher does not contact an update or telemetry service, while Wand itself remains an online application. Keep those behaviors separate in a threat model and in logs: a local patch operation, a client network request, and a panel API call should never be conflated.
Follow the patch path
Start at the patch dialog and identify how the selected installation, compatibility options, and optional panel patch become file writes. Record original hashes, the ASAR fuse change, and any generated DLL or script. The key question is reversibility: can the tool restore every file and option when the client version changes or the operator uninstalls it?
Unsigned patching tools can trigger antivirus heuristics, so a warning is not proof of malware—but it is a reason to build from a controlled fork, inspect the workflow, and retain the exact artifact and source revision used.
Renderer injection and panel protocol
Custom `.js` files run in Wand's renderer with DOM access and Node `require`, and the README notes they may run more than once per launch. The `WandEnhancer` helper exposes logging, a remote URL, and an API version. Analyze this as privileged in-process code: understand lifecycle timing, guard one-time work, and avoid scripts that read or transmit secrets.
The panel uses plain HTTP on port 3223 and a WebSocket path for control on a trusted network. It does not include a pairing code; anyone who reaches the port can view the panel and control the active trainer. The protocol deliberately omits the Wand bearer token and installation-path fields, but that does not make the endpoint public-safe.
Architecture review fixtures
Use a disposable Wand installation and four fixtures: patch and restore, one guarded renderer script, panel connect/disconnect, and a blocked remote-network attempt. Capture file hashes, process tree, firewall scope, panel requests, and cleanup results while redacting user data.
A contribution-quality finding should map a symbol or workflow step to an observable effect and include a regression test. Avoid inferring undocumented internals from screenshots or a compiled executable; label hypotheses and verify them against the checked-out source and workflow.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Map patch dialog options to file writes and generated surfaces.
- 2
Record original hashes, proxy/DLL effects, and restore behavior.
- 3
Trace renderer lifecycle and panel HTTP/WebSocket boundaries.
- 4
Run disposable fixtures for patch, script, panel, network, and cleanup.
可复制示例
patch dialog -> .NET file changes -> version.dll/ASAR fuse
renderer-scripts/*.js -> Wand renderer (DOM + require)
Remote Web Panel -> HTTP/WebSocket :3223 -> active trainer常见问题
Does version.dll inject into another process?
The README says it is loaded by Wand and changes an ASAR-integrity fuse byte inside Wand's own process; verify the exact build before relying on that description.
Is the panel protected by pairing?
No pairing code is included. Restrict port 3223 to a trusted LAN or VPN and never expose it directly to the internet.
资料来源
- WandEnhancer README (captured 2026-08-31)来源核查 2026-08-31
- WandEnhancer repository来源核查 2026-08-31