WandEnhancer
WandEnhancer 安全与运维：约束补丁、脚本与局域网控制
覆盖构件溯源、本地文件变更、Renderer 权限、面板暴露、防火墙范围和事件恢复。
你将学会
- Verify artifact and patch provenance
- Threat-model renderer and panel privileges
- Design containment and clean restoration
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Build and verify artifacts from a controlled fork; avoid third-party executables.
- Back up and hash every local patch surface and fail closed on unexpected paths.
- Treat renderer scripts and port 3223 as privileged, unpaired control surfaces.
Establish artifact provenance
由于项目不发布官方预编译文件，应从受控 fork 建构件并核验来源；补丁前备份并哈希文件，renderer scripts 以客户端权限运行，3223 面板无配对码且只能放在可信 LAN/VPN，事件处理要能停止面板、恢复干净客户端并验证完整清理。
Unsigned patchers can trigger generic antivirus heuristics. Investigate the file and source path, but do not disable endpoint protection broadly just to make a build run; use a disposable machine or approved allow-list process instead.
Constrain local patch effects
The patcher modifies a selected Wand installation and may write `version.dll`, change an Electron integrity fuse, or bundle renderer scripts. Require an explicit path, verify it belongs to the intended client, back up original files, and show a complete diff or hash list before applying. Reject partial or unexpected paths and fail closed when a restore copy is missing.
Keep the patcher's privileges narrow and separate build dependencies from runtime access. A workflow that builds an artifact should not receive production secrets, and the runtime should not inherit credentials unrelated to Wand.
Treat renderer scripts and the panel as privileged
Injected scripts run in Wand's renderer with DOM access and Node `require`, and may execute more than once. Review every script, prohibit secret collection or unexpected egress, guard initialization, and log only redacted diagnostics. Remove scripts that are not needed for the current client version.
The Remote Web Panel uses plain HTTP on port 3223 without a pairing code. Bind and firewall it to a trusted LAN or VPN, monitor connections, and never expose it through port forwarding. Anyone who reaches the port can control the active trainer, even though the protocol omits the bearer token and installation path.
Operate and recover
Monitor unexpected file changes, panel connections, renderer errors, process lifetime, and client updates. If compromise is suspected, stop the panel, disconnect the client, preserve redacted hashes and workflow metadata, revoke affected credentials, restore the clean client, and rebuild from a reviewed revision.
After recovery, add a fixture for the triggering boundary and verify that uninstall removes DLLs, scripts, firewall rules, panel processes, and temporary artifacts. Security is complete only when the operator can prove both containment and clean restoration.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Establish fork, workflow, scan, and source-to-artifact provenance.
- 2
Scope path, privileges, backups, hashes, and restore before patching.
- 3
Review scripts and restrict panel bind/firewall to a trusted LAN/VPN.
- 4
Rehearse stop, restore, credential response, cleanup, and regression fixtures.
可复制示例
wand_security:
artifact: reviewed_fork_workflow
install_path: explicit_and_backed_up
renderer_scripts: allow_listed
panel_port: 3223
panel_scope: trusted_lan_or_vpn
internet_exposure: false
uninstall_test: required常见问题
Should antivirus be disabled for WandEnhancer?
No. Investigate heuristic alerts and use an approved, isolated workflow; do not broadly disable endpoint protection.
Does omitting the bearer token make the panel safe?
No. The panel still has no pairing code and anyone reaching port 3223 can control the trainer; restrict network reachability.
资料来源
- WandEnhancer README (captured 2026-08-31)来源核查 2026-08-31
- WandEnhancer repository来源核查 2026-08-31