$ show ValdikSS/GoodbyeDPI
GoodbyeDPI is a Windows-based Deep Packet Inspection (DPI) circumvention utility that bypasses ISP-imposed website blocks. It operates as a monolithic console application or Windows service that uses the WinDivert driver to intercept, analyze, and modify network packets at the NDIS layer. The software implements multiple evasion techniques including TCP fragmentation, HTTP header manipulation (Host header modification, spacing removal, case mixing), DNS redirection, and fake packet generation with altered TTL, checksum, or sequence numbers. It features a modular architecture with separate modules for packet filtering, connection tracking (DNS and TCP TTL), blacklist/whitelist management, and fake packet generation. The application runs with administrator privileges and supports both passive DPI (packet dropping) and active DPI circumvention (packet modification) strategies.
The LLM identified 3 files worth highlighting for reuse:
Self-contained DNS UDP connection tracker that intercepts outgoing DNS requests and redirects responses to specified DNS servers. Implements efficient connection tracking with automatic cleanup using uthash hash tables. Handles both IPv4 and IPv6 DNS packets with proper source/destination IP and port preservation. Demonstrates skilled network programming with minimal dependencies and clear separation of concerns.
TCP connection tracker that monitors SYN/ACK packets to extract TTL values from remote servers for use in fake packet generation. Uses uthash for connection tracking with periodic cleanup. Provides functions to track incoming connections and lookup outgoing connections to retrieve stored TTL values. Shows expertise in network state tracking and efficient hash table usage patterns.
Domain blacklist/whitelist implementation using uthash hash tables for efficient lookups. Loads domains from text files and checks if hostnames match (including subdomain matching). Features proper memory management, warning logs for invalid entries, and case-sensitive matching. Demonstrates skilled use of third-party hash libraries and clean separation of data loading versus lookup logic.