remote control

to change the resolution of android device run this command:

1
2
3
4
5

# <width>x<height>
adb shell wm size 3000x2000
# reset window size
adb shell wm size reset

launch scrcpy with HID simulation and screen off:

1
2

scrcpy -SK

run android in docker, run adb in docker

device discovery, termux daemon, remote unlock

unlock requires screenshot and input events.

https://technastic.com/unlock-android-phone-pin-pattern-adb/

click ok after input password:

https://stackoverflow.com/questions/29072501/how-to-unlock-android-phone-through-adb

scrcpy client

https://github.com/leng-yue/py-scrcpy-client

https://leng-yue.github.io/py-scrcpy-client/guide.html#bind-events

you want to use android emulator on macos m1?

https://github.com/google/android-emulator-m1-preview/releases/tag/0.3

check android screen lock/unlock state

https://android.stackexchange.com/questions/191086/adb-commands-to-get-screen-state-and-locked-state

Bonjour/Avahi/Zeroconf

logic: if the kill switch is off, when no physical input events happens, or not focused on scrcpy window with keyboard/mouse input events on pc for some time, allow to interact with the phone.

get physical events:

warning: this command could be offline for a short period of time after using the scrcpy. must automatically reconnect if the device is not offline.

1
2

adb -s 192.168.10.3:5555 shell getevent

to get focused window title:

hint: for headless ssh sessions, must set apropriate xorg environment variables, eg: env XAUTHORITY="/run/user/0/gdm/Xauthority" DISPLAY=:1 python3

general method:

1
2
3

import pywinctl
pywinctl.getActiveWindowTitle()

for linux:

1
2

watch -n 2 xdotool getactivewindow getwindowname

for macos: (allow permission first, deprecated since it will not get the window title instead of the program name)

https://alvinalexander.com/mac-os-x/applescript-unix-mac-osx-foreground-application-result/

(where is the window name?)

1
2

sleep 3 && osascript -e 'tell application "System Events"' -e 'set frontApp to name of first application process whose frontmost is true' -e 'end tell'

to get input events on macos:

download keylogger here:

https://hackernoon.com/writing-an-keylogger-for-macos-in-python-24adfa22722

https://github.com/beatsbears/pkl?ref=hackernoon.com

1
2

python pkl_nowriting.py

input events on linux:

1
2

xinput test-xi2 --root

debugging

when kali is off, this mac will go crazy and hang everything.

need to scan for kali existance on demand, not all the time.

developing

should we use p2p networks to speed up remote connections like n2n or tinc?

would it be interesting to run all our kali connectors ranged from vscode-ssh-connect, rclone mount and direct ssh connection via kali command dynamically by our kali discovery service, if we can reload the nginx daemon on demand.

using redis to store some daemon reported values.

how about we set the workding directory of redis-server to /tmp so that the dump.rdb file will never take space after reboot?

we need to know if this will successifully launch after reboot since /tmp may not exist by that time

default redis server port: 6379

install redis-server service:

1
2

easyd -w /tmp -l redis_server -- /opt/homebrew/bin/redis-server

first value is online.

next value is kali_ip.

using both value to determine whether to connect to kali or not, and the exact address.

better use nomachine instead, which is based on nx

password: 472831

commands:

1
2
3
4
5
6
7
8

# necessary env for gui target, though may not suitable for xvfb
export XAUTHORITY=/root/.Xauthority
export DISPLAY=:1
# kill previous running x11vnc, if exists
joker list | grep x11vnc | awk '{print $1}' | xargs -iabc kill -s KILL abc
# launch new vnc
joker x11vnc -threads -forever -rfbauth /root/.vnc/passwd

if you install p2p server nodes on primary server (with hard-to-crack password and proper configs (no brute-forcing)?) you might want to add that (n2n) server node at home.

p2p network

nps also supports p2p

(deprecated! does not pass the connectivity test) opengnb p2p network, faster than n2n v3, can run without public ip

gost as an frp alternative

turned out n2n is necessary, since the speed comparasion strongly disencourage the usage of frp directly.

n2n test commands, using compatible v3 protocol to communicate:

supernode v3: n2n.laiyx.win:10090

warning: it is useless to add multiple supernodes.

1
2
3

-l nton.eu.org:10090 -l n2n.lu8.win:10090 -l n2n.haoren.eu.org:10090 -l
supernode.ntop.org:7777 -l 47.102.102.77:10090 -l n2n.myan.cc:10090 -l n2n.sfcs.eu.org:10090 -l n2n.eriol.cn:10090 -l n2n.x0x.cn:10090 -l n2n.vvcd.win:10090

kali:

1
2

sudo edge -c <name> -k <password> -a 192.168.100.1 -f -l n2n.laiyx.win:10090 -Er -A3 -e auto

macos, since we use sudo you might consider doing it with system service:

1
2

sudo edge -c <name> -k <password> -a 192.168.100.2 -f -l n2n.laiyx.win:10090 -Er -A3 -e auto

public shared n2n supernodes

you could test the speed and decide to use it or not.

in kali discovery service, when local connection is not avaliable, usually the p2p network is preferred than direct frp tunneling.

brew has tinc as a package!

tinc conf

tinc setup with core server

remote access with vps using tinc

install and config tinc on linux

tinc is somehow complex and it may requires some tinkering on tinc-up or using docker.

install n2n without macports

use n2n to send udp packages among clients, try to create direct link between devices which will speed up ssh connection speed. supernode creation could be used along with frpc

somehow brew does not have n2n as a package. macports has it, which requires xcode (huge!) to be installed.

peervpn tutorial

daemonize (launch at startup)

on macos, when crontab is created, cron will be automatically launched by launchd.

cronjobs may need to launch with the $(which env) prefix.

the problem of internet disconnetion will most not likely to interfere with the server since frpc has auto reconnection and the update hook is the filesystem watchdog, which will not run when no changes made (including the offline period)

the watchdog may be replaced by some mirror fuse system, which will report every access request to our dedicated server.

we have seen this behavior (filesystem mirroring) in our gitfuse code. but does that support symlink? should we really take care of that? or should we forget that and just use inotify instead?

maybe it will affect the client when mounting the remote filesystem using sshfs or rclone, but that has to be verified.

serve and mount remote filesystem

before serving, make sure the path /media/root/help/pyjom exists by running our mount script

create htpasswd file:

1
2

htpasswd -bc webdav_htpasswd <username> <password>

use rclone:

1
2

rclone serve webdav /media/root/help/pyjom --addr 0.0.0.0:8468 --key /root/.local/share/code-server/localhost.key --cert /root/.local/share/code-server/localhost.crt --htpasswd /root/Desktop/works/sync_git_repos/remote_deploys/webdav_htpasswd -L

before mounting, use rclone config to setup remote associated with a name. make sure the hostname is localhost instead of ip address to avoid certificate issues. do not install rclone from brew since it does not support fuse. instead, install from here

1
2

rclone mount webdav_local_nginx:/ /Volume/CaseSensitive/pyjom_remote_mountpoint --ca-cert /Users/jamesbrown/Desktop/works/host_discovery_ssh_local_connect/certificates/localhost.crt

after mounting, seems zsh on macos is not working very well with macfuse. bash works. does bash/fish works with sshfs as well? maybe that will save efforts.

encryption and invalid HTTPS certificates

use nginx to redirect remote server as localhost, since the host name on the certificate is localhost we cannot let chrome to trust anything other than that

1
2
3
4
5
6
7
8
9
10

worker_processes auto;
error_log error.log;
events { }
stream {
server {
listen 127.0.0.1:7576;
proxy_pass REMOTE_HOST:7576;
}
}

code-server(browser) color fixes

1
2
3
4
5
6
7
8
9
10
11

.cursor{
background: white;
}
body.web{
caret-color: white;
}
.monaco-editor .view-line span.inline-selected-text{
background: blue;
color: white;
}

connectors other than frp

code-server recommends some other methods like cloudflared and ngrok. 花生壳可能也有用 但是可能不好用

methods

try out code-server by coder, might work?

also we use builtin vscode connectors, using ssh.

currently we only have one, which uses direct ip address instead of a hijacked domain. maybe it is time to consider some faster server providers.

use a universal ssh as workspace extension called SSH FS

drawbacks of SSH FS extension

some drawbacks of this SSH FS plugin is that it cannot use the plugins from remote machine, also having issue whe jumping to remote files from terminal output. to run code-insider instead of code-oss, maybe we could spin up the official ssh connector, which can only be automated by publickey authentication.

syncing, updating and viewing using watchdog and sshfs(deprecated since it shares connection with vscode remote and maybe slower than rclone serve webdav?)

to mount the filesystem via sshfs:

1
2

sshfs root@192.168.10.4:/media/root/help/pyjom /Volumes/CaseSensitive/pyjom_remote_mountpoint -o follow_symlinks

to make sure the changes are updated regularly, we need a filesystem watchdog on kali, which will trigger the action of syncing, utilizing inotify. shall that be adopted on macos? maybe. but my extra editors can be vim or nvim, so it is not so hard to predict. but if it can monitor the file read events, we don’t need those legacy editor program hooks.

at least we need to see the output, so we need to mount the remote filesystem as sshfs, then use ffplay to view it.

solution

for now, two viable ways:

one using code-server, the other using code-server-insider provided by code-insider. when using builtin code-server-insider, remember it will not share the plugins installed by code-insider. the remote executable location is at /root/.vscode-server-insiders/bin/12b08be500f8a307f30e92cbc3ee39ba115eab69/bin/code-server-insider or something. must set the local setting remote.SSH.useLocalServer to false.

when using code-server, one can connect to the workspace using browser, instead of vscode builtin remote connector.

universal termsrv.dll patch

use patched termsrv.dll

x11vnc can proxy existing x11 desktop on web.

1
2

sudo apt install x11vnc

for hardware kvm over ip, there is pikvm swite for turning rpi3b+ into ipkvm and armkvm series that are dedicated low cost ipkvm hardwares.

to persist ssh connection:

1
2

ssh -o ControlMaster=auto -o ControlPersist=yes -o BatchMode=yes user@hostname

ssh port forwarding:

1
2
3

# requires sudo
sudo ssh -v -N -L <local_addr>:<remote_addr> -R <remote_addr>:<local_addr> <user>@<remote_host>

remote or local address must at least have port number specified, optionally with host address like: [host]:<port>

-L opens a local port at local address and forward to remote address. -R opens a remote port at remote address and forward to local address. -N disable the tty connection. -v shows the debug info.

enable pubkey authentication for nomachine:

first generate the key with ssh-keygen, copy your pubkey content at .ssh/id_rsa.pub (local host) to remote host at ~/.nx/config/authorized.crt, one pubkey per line.

next change the setting AcceptedAuthenticationMethods as NX-private-key in file /usr/NX/etc/server.cfg at remote host.

no need to restart the service. change your connection method to key based authentication and select the private key file path.

NoMachine NX

FreeNX

Moonlight for NVIDIA Windows

parsec for windows/macos host

ssh-rdp for linux host/client

somehow usable on localhost:

x11vnc -localhost -display :0 -threads -forever

vncviewer -PreferredEncoding=ZRLE localhoat:0

sunshine host for windows/linux

https://github.com/SunshineStream/Sunshine/blob/master/README.md#macos

https://github.com/loki-47-6F-64/sunshine

openstream-server a fork of sunshine

https://open-stream.net/

synergy mouse keyboard sharing tool

ssh -X/-Y allowX11forwarding

hardware solution: kvm switch (high grade with audio redirection separate usb ports)

Primary function of NAS is to download massive amount of (media) files. The NAS setup guides include many platforms to download movies.

https://www.zhihu.com/question/22129197/answer/1050613901

NAS is different from server, which may have thr same storage capacity but much more computational power.