再見DPI
GoodbyeDPI
該軟體旨在繞過許多網路服務供應商的深度資料包檢查系統，這些系統會阻止對某些網站的存取。
它處理使用分光器或連接埠鏡像（被動 DPI ）連接的 DPI，不會阻止任何數據，只是比請求的目的地更快地回复，並按順序連接主動 DPI 。
Windows 7、8、8.1、10 或 11需要管理員權限。
這些腳本以建議模式啟動 GoodbyeDPI，並將 DNS 解析器重新導向至非標準連接埠上的 Yandex DNS（以防止 DNS 中毒）。
如果有效——恭喜！您可以按原樣使用它或進一步配置。
從發布頁面下載最新版本並運行。
Usage: goodbyedpi.exe [OPTION...]
-p block passive DPI
-q block QUIC/HTTP3
-r replace Host with hoSt
-s remove space between host header and its value
-m mix Host header case (test.com -> tEsT.cOm)
-f set HTTP fragmentation to value
-k enable HTTP persistent (keep-alive) fragmentation and set it to value
-n do not wait for first segment ACK when -k is enabled
-e set HTTPS fragmentation to value
-a additional space between Method and Request-URI (enables -s, may break sites)
-w try to find and parse HTTP traffic on all processed ports (not only on port 80)
--port additional TCP port to perform fragmentation on (and HTTP tricks with -w)
--ip-id handle additional IP ID (decimal, drop redirects and TCP RSTs with this ID).
This option can be supplied multiple times.
--dns-addr redirect UDP DNS requests to the supplied IP address (experimental)
--dns-port redirect UDP DNS requests to the supplied port (53 by default)
--dnsv6-addr redirect UDPv6 DNS requests to the supplied IPv6 address (experimental)
--dnsv6-port redirect UDPv6 DNS requests to the supplied port (53 by default)
--dns-verb print verbose DNS redirection messages
--blacklist perform circumvention tricks only to host names and subdomains from
supplied text file (HTTP Host/TLS SNI).
This option can be supplied multiple times.
--allow-no-sni perform circumvention if TLS SNI can't be detected with --blacklist enabled.
--frag-by-sni if SNI is detected in TLS packet, fragment the packet right before SNI value.
--set-ttl activate Fake Request Mode and send it with supplied TTL value.
DANGEROUS! May break websites in unexpected ways. Use with care (or --blacklist).
--auto-ttl [a1-a2-m] activate Fake Request Mode, automatically detect TTL and decrease
it based on a distance. If the distance is shorter than a2, TTL is decreased
by a2. If it's longer, (a1; a2) scale is used with the distance as a weight.
If the resulting TTL is more than m(ax), set it to m.
Default (if set): --auto-ttl 1-4-10. Also sets --min-ttl 3.
DANGEROUS! May break websites in unexpected ways. Use with care (or --blacklist).
--min-ttl minimum TTL distance (128/64 - TTL) for which to send Fake Request
in --set-ttl and --auto-ttl modes.
--wrong-chksum activate Fake Request Mode and send it with incorrect TCP checksum.
May not work in a VM or with some routers, but is safer than set-ttl.
--wrong-seq activate Fake Request Mode and send it with TCP SEQ/ACK in the past.
--native-frag fragment (split) the packets by sending them in smaller packets, without
shrinking the Window Size. Works faster (does not slow down the connection)
and better.
--reverse-frag fragment (split) the packets just as --native-frag, but send them in the
reversed order. Works with the websites which could not handle segmented
HTTPS TLS ClientHello (because they receive the TCP flow "combined").
--fake-from-hex Load fake packets for Fake Request Mode from HEX values (like 1234abcDEF).
This option can be supplied multiple times, in this case each fake packet
would be sent on every request in the command line argument order.
--fake-with-sni Generate fake packets for Fake Request Mode with given SNI domain name.
The packets mimic Mozilla Firefox 130 TLS ClientHello packet
(with random generated fake SessionID, key shares and ECH grease).
Can be supplied multiple times for multiple fake packets.
--fake-gen Generate random-filled fake packets for Fake Request Mode, value of them
(up to 30).
--fake-resend Send each fake packet value number of times.
Default: 1 (send each packet once).
--max-payload [value] packets with TCP payload data more than [value] won't be processed.
Use this option to reduce CPU usage by skipping huge amount of data
(like file transfers) in already established sessions.
May skip some huge HTTP requests from being processed.
Default (if set): --max-payload 1200.
LEGACY modesets:
-1 -p -r -s -f 2 -k 2 -n -e 2 (most compatible mode)
-2 -p -r -s -f 2 -k 2 -n -e 40 (better speed for HTTPS yet still compatible)
-3 -p -r -s -e 40 (better speed for HTTP and HTTPS)
-4 -p -r -s (best speed)
Modern modesets (more stable, more compatible, faster):
-5 -f 2 -e 2 --auto-ttl --reverse-frag --max-payload
-6 -f 2 -e 2 --wrong-seq --reverse-frag --max-payload
-7 -f 2 -e 2 --wrong-chksum --reverse-frag --max-payload
-8 -f 2 -e 2 --wrong-seq --wrong-chksum --reverse-frag --max-payload
-9 -f 2 -e 2 --wrong-seq --wrong-chksum --reverse-frag --max-payload -q (this is the default)
Note: combination of --wrong-seq and --wrong-chksum generates two different fake packets.
若要檢查您的 ISP 的 DPI 是否可以被規避，請先確保您的提供者不會透過在瀏覽器中啟用「安全 DNS（基於 HTTPS 的 DNS）」選項來毒害 DNS 答案。
然後運行goodbyedpi.exe可執行文件，不帶任何選項。如果有效——恭喜！您可以按原樣使用它或進一步配置，例如，如果您所在的國家/地區已知並可使用阻止的網站列表，則可以使用--blacklist選項。
如果您的提供者攔截 DNS 請求，您可能需要對在非標準連接埠（例如 Yandex DNS 77.88.8.8:1253 ）上執行的公共 DNS 解析器使用--dns-addr選項，或使用第三方設定通過HTTPS/ TLS 的DNS黨的申請。
檢查.cmd腳本並根據您的偏好和網路條件進行修改。
如果您嘗試透過 HTTP 存取被封鎖的網站，大多數被動 DPI 會傳送 HTTP 302 重新導向，如果使用 HTTPS，則傳送 TCP 重置，速度比目標網站更快。 DPI 發送的資料包通常具有等於0x0000或0x0001 IP 標識字段，如俄羅斯提供者所見。如果這些資料包將您重新導向到另一個網站（審查頁面），則會被 GoodbyeDPI 封鎖。
主動 DPI 更難欺騙。目前該軟體使用7種方法來規避Active DPI：
hoSt替換Host標頭Host標頭中標頭名稱和值之間的空格這些方法不應破壞任何網站，因為它們與 TCP 和 HTTP 標準完全相容，但足以防止 DPI 資料分類並規避審查。額外的空間可能會破壞某些網站，儘管 HTTP/1.1 規格可以接受（請參閱 19.3 容忍應用程式）。
該程式會載入 WinDivert 驅動程序，該驅動程式使用 Windows 過濾平台來設定篩選器並將封包重定向到用戶空間。只要控制台視窗可見，它就會運行，並在您關閉視窗時終止。
該專案可以使用GNU Make和mingw建置。唯一的依賴項是 WinDivert。
要建置 x86 exe，請執行：
make CPREFIX=i686-w64-mingw32- WINDIVERTHEADERS=/path/to/windivert/include WINDIVERTLIBS=/path/to/windivert/x86
對於 x86_64：
make CPREFIX=x86_64-w64-mingw32- BIT64=1 WINDIVERTHEADERS=/path/to/windivert/include WINDIVERTLIBS=/path/to/windivert/amd64
檢查service_install_russia_blacklist.cmd 、 service_install_russia_blacklist_dnsredir.cmd和service_remove.cmd腳本中的範例。
根據您自己的需求修改它們。
Advanced Stream Detect與 GoodbyeDPI 不相容，停用它。感謝 @basil00 的 WinDivert。這是這個程序的主要部分。
感謝每一位 BlockCheck 貢獻者。如果沒有這個實用程序，就不可能理解 DPI 行為。
