GoodbyeDPI is a Windows-based Deep Packet Inspection (DPI) circumvention utility that bypasses ISP-imposed website blocks. It operates as a monolithic console application or Windows service that uses the WinDivert driver to intercept, analyze, and modify network packets at the NDIS layer. The software implements multiple evasion techniques including TCP fragmentation, HTTP header manipulation (Host header modification, spacing removal, case mixing), DNS redirection, and fake packet generation with altered TTL, checksum, or sequence numbers. It features a modular architecture with separate modules for packet filtering, connection tracking (DNS and TCP TTL), blacklist/whitelist management, and fake packet generation. The application runs with administrator privileges and supports both passive DPI (packet dropping) and active DPI circumvention (packet modification) strategies.
Xray-core is a production-grade network proxy framework written in Go. It implements a wide range of proxy protocols (VMess, VLESS, Shadowsocks, Trojan, Hysteria, WireGuard, SOCKS, HTTP) and transport layers (TCP, WebSocket, gRPC, KCP, SplitHTTP, HTTPUpgrade, QUIC) with advanced obfuscation techniques (Noise, Sudoku, XMC, Realm) for censorship circumvention. The architecture is modular, with pluggable inbound/outbound handlers, a rule-based router with domain/IP/port/protocol matching, a DNS subsystem supporting multiple upstreams (DoH, DoQ, TCP, UDP, FakeDNS), and an observatory for health-based load balancing. Configuration is via JSON/protobuf, and runtime management is exposed through gRPC APIs. The codebase is extensive, well-tested (unit and integration scenarios), and leverages Go's concurrency primitives heavily for performance. However, it includes experimental transports and deprecated features (e.g., legacy Shadowsocks, xtls security), indicating ongoing evolution and some technical drift in the ecosystem.
This repository generates rule sets (RULE-SET) for the Clash Premium proxy tool, specifically tailored for users in China. The core of the repo is a GitHub Actions workflow (run.yml) that daily fetches domain and IP lists from multiple upstream sources (e.g., v2ray-rules-dat, domain-list-custom, dnsmasq-china-list, geoip) and transforms them into Clash-compatible YAML payload files. The output rule sets categorize domains into direct, proxy, reject, private, Apple, Google, GFW, etc. The codebase itself is minimal (only CI configuration) and the actual data artifacts are stored in a separate 'release' branch. The repository acts as a data pipeline, not an application, with the workflow serving as the sole processing logic. The pipeline is straightforward but effective, relying on standard Unix tools (curl, grep, perl, sed) for data transformation.
This repository hosts the GFWList, a community-maintained blocklist of domains and URLs blocked by the Great Firewall of China. The primary data asset is `list.txt`, a plain-text file in AutoProxy format containing thousands of rules (domains, IPs, patterns) used by proxy tools to bypass censorship. A GitHub Actions workflow automatically updates the checksum and date via a Perl script from the `apollyon` submodule, then base64-encodes the list into `gfwlist.txt` for distribution. The repository is purely a data source with minimal code; its value lies in the curated list itself, not in software engineering. It is widely used as a subscription feed for VPNs and proxy clients.