This repository contains zapret2, a high-performance network daemon designed to bypass Deep Packet Inspection (DPI) censorship systems. It operates by intercepting network packets at the kernel level (using NFQUEUE on Linux, ipfw divert on BSD, and WinDivert on Windows), dissecting them to identify censorship triggers (TLS SNI, HTTP Host, QUIC, etc.), and applying real-time desynchronization and obfuscation techniques to evade blocking. It is a sophisticated anti-censorship tool used primarily on routers and servers in restrictive network environments. The architecture is a hybrid C/Lua system. The C core (nfqws2, dvtws2, winws2) handles high-performance packet capture, dissection, connection tracking, and raw socket I/O. The Lua scripting engine (lua.c) provides an extensible platform for defining desync strategies, automation logic, and protocol dissectors. This separation of concerns allows the complex, evolving DPI evasion logic to be developed and customized in Lua without modifying the core C daemon. Key features include a comprehensive blockcheck testing framework (blockcheck2.sh) for discovering effective bypass strategies against specific DPI systems, an automation module (zapret-auto.lua) for dynamic strategy switching, and a full suite of cryptographic primitives (AES-GCM, SHA-256, HKDF) for traffic obfuscation. The project supports a wide range of platforms including Linux, FreeBSD, OpenBSD, Windows, and OpenWrt routers. The codebase demonstrates strong engineering craftsmanship. The C code is clean, well-structured, and handles complex networking edge cases. It contains several genuinely reusable components, such as standalone AES-GCM and SHA-256 implementations, embedded data structures (uthash, kavl), a multi-threaded DNS resolver (mdig), and an IP subnet aggregator (ip2net). While the heavy use of platform-specific #ifdef blocks and reliance on deprecated kernel interfaces (WinDivert, iptables) introduce some technical drift, the core architecture and Lua API are exceptionally well-designed for their domain.