spoofdpi is a high-performance, cross-platform proxy tool written in Go that bypasses Deep Packet Inspection (DPI) by fragmenting and desynchronizing TLS handshakes and UDP packets. It operates in three modes: HTTP proxy, SOCKS5 proxy, and TUN interface (transparent proxy). The architecture is modular and clean, with clear separation of concerns: a config layer (TOML + CLI flags), a rule engine for domain/CIDR-based policy matching, a DNS resolver with multiple backends (UDP, DoH, system), a packet capture/injection layer using pcap or Linux raw sockets, and a desync engine that applies configurable split strategies (SNI, chunk, random, custom) and fake packets. The codebase demonstrates strong engineering practices: extensive use of interfaces for platform-specific code (Darwin/Linux/FreeBSD stubs), generic data structures (sharded LRU cache, TTL cache, domain trie with wildcard/globstar), concurrent connection management with idle timeouts, and structured logging with trace IDs. It includes a TUI mode using Bubble Tea. The project is actively maintained with recent commits, comprehensive CI/CD, and thorough test coverage for configuration parsing, rule matching, and desync logic. The code is of high quality and contains several reusable components.
This repository implements a local MTProto proxy for Telegram Desktop, designed to bypass network censorship by wrapping Telegram's protocol in WebSocket connections, often routed through Cloudflare. It is a fully-featured desktop application with CLI and GUI modes, providing a robust solution for circumventing DPI-based blocking. The architecture is a monolithic asyncio application with a clear separation of concerns: the `proxy/` package handles the core protocol translation (MTProto to WebSocket, Fake TLS, HTTP/2 multiplexing), the `ui/` package provides a cross-platform tray interface using CustomTkinter, and `utils/` contains supporting infrastructure like update management and diagnostics. The system employs a sophisticated fallback chain (WebSocket pool -> Cloudflare Proxy -> Cloudflare Worker -> Direct TCP) to ensure reliability. The codebase demonstrates high engineering craftsmanship. It features several genuinely reusable components, including a custom `httpx` HTTP/2 transport, a robust connection pool with exponential backoff, and an atomic self-update mechanism with rollback. While tightly coupled to Telegram's specific protocol, the underlying patterns for network resource management, protocol obfuscation, and desktop application lifecycle are well-isolated and could be extracted for other projects. The extensive test suite and professional CI/CD pipeline further attest to its quality.
GoodbyeDPI is a Windows-based Deep Packet Inspection (DPI) circumvention utility that bypasses ISP-imposed website blocks. It operates as a monolithic console application or Windows service that uses the WinDivert driver to intercept, analyze, and modify network packets at the NDIS layer. The software implements multiple evasion techniques including TCP fragmentation, HTTP header manipulation (Host header modification, spacing removal, case mixing), DNS redirection, and fake packet generation with altered TTL, checksum, or sequence numbers. It features a modular architecture with separate modules for packet filtering, connection tracking (DNS and TCP TTL), blacklist/whitelist management, and fake packet generation. The application runs with administrator privileges and supports both passive DPI (packet dropping) and active DPI circumvention (packet modification) strategies.
This is the Shadowsocks Android client, a secure proxy/VPN application for circumventing internet censorship. It operates as a multi-module Android project with a core library providing the proxy engine, VPN service, and plugin management, plus separate mobile and TV UI modules. The application routes traffic through a remote SOCKS5 proxy, supporting multiple service modes (VPN, proxy, transproxy), per-app routing via ACL (Access Control List) rules, and native binaries (tun2socks, shadowsocks-rust) compiled via NDK or Rust. Key features include QR code import/export, subscription-based server list updates, and a plugin system that allows third-party native executables (e.g., v2ray, kcptun) to be integrated. The architecture follows Android best practices with Room for persistence, Coroutines for async work, and AIDL for inter-process communication between the UI and foreground services. The codebase is well-organized with extensive testing, CI/CD (CircleCI, GitHub Actions), and localization in over a dozen languages, but shows some technical drift with deprecated APIs and complex native build scripts.
This repository is a DPI bypass toolkit that intercepts and manipulates network packets to evade Deep Packet Inspection systems. It uses a modular architecture with a core daemon (nfqws2/dvtws2/winws2) that processes packets via NFQUEUE (Linux), divert sockets (*BSD), or WinDivert (Windows/Cygwin). Packet manipulation logic is implemented in Lua scripts, allowing flexible obfuscation strategies like packet splitting, reordering, and fake packet generation. The system includes automatic IP/host list management from external sources (antizapret, reestr), connection tracking for flow state, and cross-platform service integration. Key entry points are the main daemon, installation scripts, and list management utilities. Data flow involves packet interception β dissection β profile-based Lua processing β verdict (PASS/MODIFY/DROP) β reinjection. External dependencies include kernel interfaces (netfilter/WinDivert), Lua, zlib, and shell utilities for list updates.
NaΓ―veProxy is a censorship circumvention proxy that repurposes Chromium's network stack to mimic genuine Chrome HTTPS traffic at the TLS, HTTP/2, and QUIC protocol levels. The repository is a heavily trimmed Chromium source tree with custom patches for traffic padding, SOCKS5 client support, and a padding layer between proxy endpoints. It produces a statically linked `naive` binary (client and server) and an Android APK plugin (SagerNet). The architecture is a monolithic executable that bundles Chromium's networking libraries (BoringSSL, HTTP/2, QUIC) with a thin custom layer for configuration parsing and protocol padding. Key entry points are the `naive` binary (via command-line and config.json) and the Android plugin service. External dependencies include the Chromium source base (fetched at build time), BoringSSL, and system libs. The custom components (padding framer, config parser) are small, well-tested, and can be extracted for reuse in other proxy or traffic analysis projects.
Slipstream is a high-performance covert channel that tunnels TCP traffic over DNS queries and responses using the QUIC protocol. The client runs inside a restricted network, accepting TCP connections and forwarding data via DNS to the server, which acts as an authoritative DNS server for a configured domain and forwards data to a target TCP service. The architecture leverages picoquic for QUIC implementation with custom packet loops to handle UDP (DNS) and TCP sockets, incorporating innovations like QUIC multipath for aggregating bandwidth from multiple resolvers, a server-side congestion control disable to maximize response opportunities, and a spoofed source address technique to prevent QUIC path migration based on fluctuating DNS resolver addresses. The codebase demonstrates careful engineering in integrating picoquic with DNS transport, featuring efficient base32 encoding with dotification for DNS label splitting and utility functions for connection ID handling and socket address manipulation. Notable reusable components include the dotification/undotification functions for DNS label encoding and a set of picoquic utility functions. The project is actively maintained with modern build tools (Meson/Ninja), regular releases, and clear documentation, indicating ongoing development and low technical debt relative to its ecosystem.
This repository is a comprehensive collection of tools, tutorials, and applications for bypassing internet censorship ("ηΏ»ε’") in China. The core application is FQNews (fqnews2), an Android RSS/Atom/JSONFeed reader that integrates proxy/VPN functionality (based on sing-box, V2Ray, Shadowsocks, etc.) to fetch content from blocked websites without requiring a separate VPN app. The app is a fork of Feeder (an open-source RSS reader) with added circumvention capabilities. The repository also includes pre-packaged "one-click" proxy bundles for Chrome, Edge, Firefox on Windows/Mac/Linux, extensive platform-specific tutorials (Windows, macOS, iOS, Android, Linux, routers, game consoles), and server-side configuration files for V2Ray, Xray, Shadowsocks, Trojan, and other proxy protocols. The codebase shows active development on the Android app (fqnews2) with recent commits, Jetpack Compose UI rewrite, multi-device sync, and regular dependency updates. However, the tutorial/documentation portion appears less maintained with many outdated references.
This repository hosts the GFWList, a community-maintained blocklist of domains and URLs blocked by the Great Firewall of China. The primary data asset is `list.txt`, a plain-text file in AutoProxy format containing thousands of rules (domains, IPs, patterns) used by proxy tools to bypass censorship. A GitHub Actions workflow automatically updates the checksum and date via a Perl script from the `apollyon` submodule, then base64-encodes the list into `gfwlist.txt` for distribution. The repository is purely a data source with minimal code; its value lies in the curated list itself, not in software engineering. It is widely used as a subscription feed for VPNs and proxy clients.
XX-Net is a desktop application for circumventing internet censorship, primarily targeting the Great Firewall of China. It operates as a multi-protocol proxy client that supports Google App Engine (GAE) fronting, custom X-Tunnel, Cloudflare, CloudFront, and direct connections. The system consists of a launcher with a web-based control panel, a smart router for DNS and traffic routing, and multiple frontend modules that implement various obfuscation and tunneling techniques. The codebase is a large, monolithic Python 2/3 project with heavy use of vendored libraries (tlslite, hyper, ecdsa, asn1crypto, dnslib) for custom TLS, HTTP/2, and cryptographic operations. It is not a data research project; it is a pure application focused on network proxy functionality.