This repository implements a local MTProto proxy for Telegram Desktop, designed to bypass network censorship by wrapping Telegram's protocol in WebSocket connections, often routed through Cloudflare. It is a fully-featured desktop application with CLI and GUI modes, providing a robust solution for circumventing DPI-based blocking. The architecture is a monolithic asyncio application with a clear separation of concerns: the `proxy/` package handles the core protocol translation (MTProto to WebSocket, Fake TLS, HTTP/2 multiplexing), the `ui/` package provides a cross-platform tray interface using CustomTkinter, and `utils/` contains supporting infrastructure like update management and diagnostics. The system employs a sophisticated fallback chain (WebSocket pool -> Cloudflare Proxy -> Cloudflare Worker -> Direct TCP) to ensure reliability. The codebase demonstrates high engineering craftsmanship. It features several genuinely reusable components, including a custom `httpx` HTTP/2 transport, a robust connection pool with exponential backoff, and an atomic self-update mechanism with rollback. While tightly coupled to Telegram's specific protocol, the underlying patterns for network resource management, protocol obfuscation, and desktop application lifecycle are well-isolated and could be extracted for other projects. The extensive test suite and professional CI/CD pipeline further attest to its quality.
spoofdpi is a cross-platform proxy tool that bypasses Deep Packet Inspection (DPI) by fragmenting and desynchronizing TLS handshakes. It operates in three modes: HTTP proxy, SOCKS5 proxy, or TUN interface (transparent proxy). In production, it intercepts outgoing connections, reads the TLS ClientHello, splits it into segments using configurable strategies (SNI-split, random, chunk, first-byte, or custom plans), optionally sends fake packets before the real data, and may disorder segments by manipulating the TTL field so that DPI middleboxes misparse the connection while the destination server reassembles it correctly. It also includes a built-in DNS resolver with UDP, HTTPS (DoH), and system backends, and a rule system for per-domain/per-IP configuration. The architecture is a single Go binary with modular internal packages: config (TOML+CLI loading), desync (TLS/UDP desynchronization), dns (multi-backend resolver), netutil (connection management, dialing, TTL setting), packet (raw packet capture/injection via pcap or Linux raw sockets), proto (HTTP, SOCKS5, TLS parsing), rule (domain and CIDR matching), server (HTTP, SOCKS5, TUN server implementations), session (context-based tracing), trie (generic trie structures), cache (sharded LRU and TTL caches), and logging (zerolog-based structured logging). The TUI mode uses bubbletea for a terminal interface showing real-time speed and logs. Key entry points are cmd/spoofdpi/main.go (main function) which parses CLI flags, loads configuration, and starts the selected server. External dependencies include gopacket for packet manipulation, wireguard-tun for TUN device support, gvisor for TCP/IP stack in TUN mode, and various Go packages for CLI, TOML, DNS, and logging. The code is well-structured with extensive use of interfaces, generics, and concurrency primitives (context, channels, goroutines).
GreenTunnel is a local proxy that bypasses DPI (Deep Packet Inspection) censorship by fragmenting the TLS ClientHello so the SNI never appears whole in a single packet, and by resolving DNS over encrypted channels (DoH/DoT). It is a ground-up TypeScript rewrite of the original GreenTunnel, fixing numerous bugs from v2 (backpressure, timeouts, HTTP framing corruption, DNS cache expiry, system proxy crash safety). The repository is a monorepo containing a core engine library, a CLI tool (`gt`), and an Electron desktop app. The engine implements a full HTTP/HTTPS proxy with TLS fragmentation, HTTP request rewriting (absolute-form to origin-form), a caching DNS resolver with TTL-based expiration and in-flight deduplication, and a system-proxy management layer with snapshot/restore and crash recovery. The desktop app provides a 340px frameless window with a live log panel (virtual list), tray integration, and non-intrusive advocacy prompts. The codebase is exceptionally well-documented (CLAUDE.md serves as the authoritative design document), uses modern Node.js features (parseArgs, styleText, pipeline), and has a strong emphasis on correctness and edge-case handling (e.g., stranded proxy detection, HTTP framing awareness, signal handling for clean shutdown).
GoodbyeDPI is a Windows-based Deep Packet Inspection (DPI) circumvention utility that bypasses ISP-imposed website blocks. It operates as a monolithic console application or Windows service that uses the WinDivert driver to intercept, analyze, and modify network packets at the NDIS layer. The software implements multiple evasion techniques including TCP fragmentation, HTTP header manipulation (Host header modification, spacing removal, case mixing), DNS redirection, and fake packet generation with altered TTL, checksum, or sequence numbers. It features a modular architecture with separate modules for packet filtering, connection tracking (DNS and TCP TTL), blacklist/whitelist management, and fake packet generation. The application runs with administrator privileges and supports both passive DPI (packet dropping) and active DPI circumvention (packet modification) strategies.
This is the Shadowsocks Android client, a secure proxy/VPN application for circumventing internet censorship. It operates as a multi-module Android project with a core library providing the proxy engine, VPN service, and plugin management, plus separate mobile and TV UI modules. The application routes traffic through a remote SOCKS5 proxy, supporting multiple service modes (VPN, proxy, transproxy), per-app routing via ACL (Access Control List) rules, and native binaries (tun2socks, shadowsocks-rust) compiled via NDK or Rust. Key features include QR code import/export, subscription-based server list updates, and a plugin system that allows third-party native executables (e.g., v2ray, kcptun) to be integrated. The architecture follows Android best practices with Room for persistence, Coroutines for async work, and AIDL for inter-process communication between the UI and foreground services. The codebase is well-organized with extensive testing, CI/CD (CircleCI, GitHub Actions), and localization in over a dozen languages, but shows some technical drift with deprecated APIs and complex native build scripts.
This repository is a DPI bypass toolkit that intercepts and manipulates network packets to evade Deep Packet Inspection systems. It uses a modular architecture with a core daemon (nfqws2/dvtws2/winws2) that processes packets via NFQUEUE (Linux), divert sockets (*BSD), or WinDivert (Windows/Cygwin). Packet manipulation logic is implemented in Lua scripts, allowing flexible obfuscation strategies like packet splitting, reordering, and fake packet generation. The system includes automatic IP/host list management from external sources (antizapret, reestr), connection tracking for flow state, and cross-platform service integration. Key entry points are the main daemon, installation scripts, and list management utilities. Data flow involves packet interception β dissection β profile-based Lua processing β verdict (PASS/MODIFY/DROP) β reinjection. External dependencies include kernel interfaces (netfilter/WinDivert), Lua, zlib, and shell utilities for list updates.
NaΓ―veProxy is a censorship circumvention proxy that repurposes Chromium's network stack to mimic genuine Chrome HTTPS traffic at the TLS, HTTP/2, and QUIC protocol levels. The repository is a heavily trimmed Chromium source tree with custom patches for traffic padding, SOCKS5 client support, and a padding layer between proxy endpoints. It produces a statically linked `naive` binary (client and server) and an Android APK plugin (SagerNet). The architecture is a monolithic executable that bundles Chromium's networking libraries (BoringSSL, HTTP/2, QUIC) with a thin custom layer for configuration parsing and protocol padding. Key entry points are the `naive` binary (via command-line and config.json) and the Android plugin service. External dependencies include the Chromium source base (fetched at build time), BoringSSL, and system libs. The custom components (padding framer, config parser) are small, well-tested, and can be extracted for reuse in other proxy or traffic analysis projects.
Slipstream is a high-performance covert channel that tunnels TCP traffic over DNS queries and responses using the QUIC protocol. The client runs inside a restricted network, accepting TCP connections and forwarding data via DNS to the server, which acts as an authoritative DNS server for a configured domain and forwards data to a target TCP service. The architecture leverages picoquic for QUIC implementation with custom packet loops to handle UDP (DNS) and TCP sockets, incorporating innovations like QUIC multipath for aggregating bandwidth from multiple resolvers, a server-side congestion control disable to maximize response opportunities, and a spoofed source address technique to prevent QUIC path migration based on fluctuating DNS resolver addresses. The codebase demonstrates careful engineering in integrating picoquic with DNS transport, featuring efficient base32 encoding with dotification for DNS label splitting and utility functions for connection ID handling and socket address manipulation. Notable reusable components include the dotification/undotification functions for DNS label encoding and a set of picoquic utility functions. The project is actively maintained with modern build tools (Meson/Ninja), regular releases, and clear documentation, indicating ongoing development and low technical debt relative to its ecosystem.
This repository is a comprehensive collection of tools, tutorials, and applications for bypassing internet censorship ("ηΏ»ε’") in China. The core application is FQNews (fqnews2), an Android RSS/Atom/JSONFeed reader that integrates proxy/VPN functionality (based on sing-box, V2Ray, Shadowsocks, etc.) to fetch content from blocked websites without requiring a separate VPN app. The app is a fork of Feeder (an open-source RSS reader) with added circumvention capabilities. The repository also includes pre-packaged "one-click" proxy bundles for Chrome, Edge, Firefox on Windows/Mac/Linux, extensive platform-specific tutorials (Windows, macOS, iOS, Android, Linux, routers, game consoles), and server-side configuration files for V2Ray, Xray, Shadowsocks, Trojan, and other proxy protocols. The codebase shows active development on the Android app (fqnews2) with recent commits, Jetpack Compose UI rewrite, multi-device sync, and regular dependency updates. However, the tutorial/documentation portion appears less maintained with many outdated references.
This repository hosts the GFWList, a community-maintained blocklist of domains and URLs blocked by the Great Firewall of China. The primary data asset is `list.txt`, a plain-text file in AutoProxy format containing thousands of rules (domains, IPs, patterns) used by proxy tools to bypass censorship. A GitHub Actions workflow automatically updates the checksum and date via a Perl script from the `apollyon` submodule, then base64-encodes the list into `gfwlist.txt` for distribution. The repository is purely a data source with minimal code; its value lies in the curated list itself, not in software engineering. It is widely used as a subscription feed for VPNs and proxy clients.
XX-Net is a desktop application for circumventing internet censorship, primarily targeting the Great Firewall of China. It operates as a multi-protocol proxy client that supports Google App Engine (GAE) fronting, custom X-Tunnel, Cloudflare, CloudFront, and direct connections. The system consists of a launcher with a web-based control panel, a smart router for DNS and traffic routing, and multiple frontend modules that implement various obfuscation and tunneling techniques. The codebase is a large, monolithic Python 2/3 project with heavy use of vendored libraries (tlslite, hyper, ecdsa, asn1crypto, dnslib) for custom TLS, HTTP/2, and cryptographic operations. It is not a data research project; it is a pure application focused on network proxy functionality.