再见DPI
GoodbyeDPI
该软件旨在绕过许多互联网服务提供商的深度数据包检查系统，这些系统会阻止对某些网站的访问。
它处理使用分光器或端口镜像（被动 DPI ）连接的 DPI，不会阻止任何数据，只是比请求的目的地更快地回复，并按顺序连接主动 DPI 。
Windows 7、8、8.1、10 或 11需要管理员权限。
这些脚本以推荐模式启动 GoodbyeDPI，并将 DNS 解析器重定向到非标准端口上的 Yandex DNS（以防止 DNS 中毒）。
如果有效——恭喜！您可以按原样使用它或进一步配置。
从发布页面下载最新版本并运行。
Usage: goodbyedpi.exe [OPTION...]
-p block passive DPI
-q block QUIC/HTTP3
-r replace Host with hoSt
-s remove space between host header and its value
-m mix Host header case (test.com -> tEsT.cOm)
-f set HTTP fragmentation to value
-k enable HTTP persistent (keep-alive) fragmentation and set it to value
-n do not wait for first segment ACK when -k is enabled
-e set HTTPS fragmentation to value
-a additional space between Method and Request-URI (enables -s, may break sites)
-w try to find and parse HTTP traffic on all processed ports (not only on port 80)
--port additional TCP port to perform fragmentation on (and HTTP tricks with -w)
--ip-id handle additional IP ID (decimal, drop redirects and TCP RSTs with this ID).
This option can be supplied multiple times.
--dns-addr redirect UDP DNS requests to the supplied IP address (experimental)
--dns-port redirect UDP DNS requests to the supplied port (53 by default)
--dnsv6-addr redirect UDPv6 DNS requests to the supplied IPv6 address (experimental)
--dnsv6-port redirect UDPv6 DNS requests to the supplied port (53 by default)
--dns-verb print verbose DNS redirection messages
--blacklist perform circumvention tricks only to host names and subdomains from
supplied text file (HTTP Host/TLS SNI).
This option can be supplied multiple times.
--allow-no-sni perform circumvention if TLS SNI can't be detected with --blacklist enabled.
--frag-by-sni if SNI is detected in TLS packet, fragment the packet right before SNI value.
--set-ttl activate Fake Request Mode and send it with supplied TTL value.
DANGEROUS! May break websites in unexpected ways. Use with care (or --blacklist).
--auto-ttl [a1-a2-m] activate Fake Request Mode, automatically detect TTL and decrease
it based on a distance. If the distance is shorter than a2, TTL is decreased
by a2. If it's longer, (a1; a2) scale is used with the distance as a weight.
If the resulting TTL is more than m(ax), set it to m.
Default (if set): --auto-ttl 1-4-10. Also sets --min-ttl 3.
DANGEROUS! May break websites in unexpected ways. Use with care (or --blacklist).
--min-ttl minimum TTL distance (128/64 - TTL) for which to send Fake Request
in --set-ttl and --auto-ttl modes.
--wrong-chksum activate Fake Request Mode and send it with incorrect TCP checksum.
May not work in a VM or with some routers, but is safer than set-ttl.
--wrong-seq activate Fake Request Mode and send it with TCP SEQ/ACK in the past.
--native-frag fragment (split) the packets by sending them in smaller packets, without
shrinking the Window Size. Works faster (does not slow down the connection)
and better.
--reverse-frag fragment (split) the packets just as --native-frag, but send them in the
reversed order. Works with the websites which could not handle segmented
HTTPS TLS ClientHello (because they receive the TCP flow "combined").
--fake-from-hex Load fake packets for Fake Request Mode from HEX values (like 1234abcDEF).
This option can be supplied multiple times, in this case each fake packet
would be sent on every request in the command line argument order.
--fake-with-sni Generate fake packets for Fake Request Mode with given SNI domain name.
The packets mimic Mozilla Firefox 130 TLS ClientHello packet
(with random generated fake SessionID, key shares and ECH grease).
Can be supplied multiple times for multiple fake packets.
--fake-gen Generate random-filled fake packets for Fake Request Mode, value of them
(up to 30).
--fake-resend Send each fake packet value number of times.
Default: 1 (send each packet once).
--max-payload [value] packets with TCP payload data more than [value] won't be processed.
Use this option to reduce CPU usage by skipping huge amount of data
(like file transfers) in already established sessions.
May skip some huge HTTP requests from being processed.
Default (if set): --max-payload 1200.
LEGACY modesets:
-1 -p -r -s -f 2 -k 2 -n -e 2 (most compatible mode)
-2 -p -r -s -f 2 -k 2 -n -e 40 (better speed for HTTPS yet still compatible)
-3 -p -r -s -e 40 (better speed for HTTP and HTTPS)
-4 -p -r -s (best speed)
Modern modesets (more stable, more compatible, faster):
-5 -f 2 -e 2 --auto-ttl --reverse-frag --max-payload
-6 -f 2 -e 2 --wrong-seq --reverse-frag --max-payload
-7 -f 2 -e 2 --wrong-chksum --reverse-frag --max-payload
-8 -f 2 -e 2 --wrong-seq --wrong-chksum --reverse-frag --max-payload
-9 -f 2 -e 2 --wrong-seq --wrong-chksum --reverse-frag --max-payload -q (this is the default)
Note: combination of --wrong-seq and --wrong-chksum generates two different fake packets.
要检查您的 ISP 的 DPI 是否可以被规避，请首先确保您的提供商不会通过在浏览器中启用“安全 DNS（基于 HTTPS 的 DNS）”选项来毒害 DNS 答案。
然后运行goodbyedpi.exe可执行文件，不带任何选项。如果有效——恭喜！您可以按原样使用它或进一步配置，例如，如果您所在的国家/地区已知并可使用阻止的网站列表，则可以使用--blacklist选项。
如果您的提供商拦截 DNS 请求，您可能需要对在非标准端口（例如 Yandex DNS 77.88.8.8:1253 ）上运行的公共 DNS 解析器使用--dns-addr选项，或者使用第三方配置通过 HTTPS/TLS 的 DNS党的申请。
检查.cmd脚本并根据您的偏好和网络条件进行修改。
如果您尝试通过 HTTP 访问被阻止的网站，大多数被动 DPI 会发送 HTTP 302 重定向，如果使用 HTTPS，则发送 TCP 重置，速度比目标网站更快。 DPI 发送的数据包通常具有等于0x0000或0x0001 IP 标识字段，如俄罗斯提供商所见。如果这些数据包将您重定向到另一个网站（审查页面），则会被 GoodbyeDPI 阻止。
主动 DPI 更难欺骗。目前该软件使用7种方法来规避Active DPI：
hoSt替换Host标头Host标头中标头名称和值之间的空格这些方法不应破坏任何网站，因为它们与 TCP 和 HTTP 标准完全兼容，但足以防止 DPI 数据分类并规避审查。额外的空间可能会破坏某些网站，尽管 HTTP/1.1 规范可以接受（请参阅 19.3 容忍应用程序）。
该程序加载 WinDivert 驱动程序，该驱动程序使用 Windows 过滤平台来设置过滤器并将数据包重定向到用户空间。只要控制台窗口可见，它就会运行，并在您关闭窗口时终止。
该项目可以使用GNU Make和mingw构建。唯一的依赖项是 WinDivert。
要构建 x86 exe，请运行：
make CPREFIX=i686-w64-mingw32- WINDIVERTHEADERS=/path/to/windivert/include WINDIVERTLIBS=/path/to/windivert/x86
对于 x86_64：
make CPREFIX=x86_64-w64-mingw32- BIT64=1 WINDIVERTHEADERS=/path/to/windivert/include WINDIVERTLIBS=/path/to/windivert/amd64
检查service_install_russia_blacklist.cmd 、 service_install_russia_blacklist_dnsredir.cmd和service_remove.cmd脚本中的示例。
根据您自己的需要修改它们。
Advanced Stream Detect与 GoodbyeDPI 不兼容，禁用它。感谢 @basil00 的 WinDivert。这是这个程序的主要部分。
感谢每一位 BlockCheck 贡献者。如果没有这个实用程序，就不可能理解 DPI 行为。
