fix(cmd): add windivert rules, add new variants, add 4pda.to tls payload

kodx · kodx · commit ebca650466ac · 2025-11-08T15:42:01.000+03:00
diff --git a/config/lists.txt b/config/lists.txt
@@ -3,8 +3,6 @@ DIS_LIST="%LIST_PATH%\list-discord.txt"
 CF_IPSET="%LIST_PATH%\ipset-cloudflare.txt"
 CUSTOM_LIST="%LIST_PATH%\list-custom.txt"
 CUSTOM_IPSET="%LIST_PATH%\ipset-custom.txt"
-GAME_LIST="%LIST_PATH%\list-game.txt"
-GAME_IPSET="%LIST_PATH%\ipset-game.txt"
 BLACK_LIST="%LIST_PATH%\list-blacklist.txt"
 AUTO_LIST="%LIST_PATH%\list-auto.txt"
 EXCLUDE_LIST="%LIST_PATH%\list-exclude.txt"
diff --git a/config/params.txt b/config/params.txt
@@ -41,7 +41,7 @@ p[40]=--dpi-desync=fake,multisplit --dpi-desync-fooling=md5sig --dpi-desync-auto
 p[41]=--dpi-desync=fake,multisplit --dpi-desync-split-seqovl=1 --dpi-desync-split-pos=midsld-1 --dpi-desync-fooling=md5sig,badseq --dpi-desync-fake-tls=%TLS_IANA% --dpi-desync-autottl
 p[42]=--dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-cutoff=d2 --dpi-desync-fake-unknown-udp=0x00
 p[43]=--filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6
-p[44]=--dpi-desync=fake,multidisorder --dpi-desync-split-pos=midsld --dpi-desync-repeats=6 --dpi-desync-fooling=md5sig,badseq
+p[44]=--dpi-desync=fake,multidisorder --dpi-desync-split-pos=midsld --dpi-desync-repeats=6 --dpi-desync-fooling=badseq,md5sig
 p[45]=--dpi-desync=fake,fakedsplit --dpi-desync-autottl=5 --dpi-desync-repeats=6 --dpi-desync-fooling=badseq --dpi-desync-fake-tls=%TLS_GOOGLE%
 p[46]=--filter-l3=ipv4 --dpi-desync=syndata
 p[47]=--dpi-desync=fake --dpi-desync-fooling=md5sig --dpi-desync-fake-tls-mod=rnd,rndsni,padencap
@@ -57,3 +57,12 @@ p[56]=--dpi-desync=fakeddisorder --dpi-desync-ttl=1 --dpi-desync-autottl=5 --dpi
 p[57]=--dpi-desync=fake,split2 --dpi-desync-autottl=2 --dpi-desync-fooling=md5sig
 p[58]=--dpi-desync=fake --dpi-desync-autottl=2 --dpi-desync-repeats=10 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp=%QUIC_GOOGLE% --dpi-desync-cutoff=n2
 p[59]=--dpi-desync=multisplit --dpi-desync-repeats=2 --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern=%TLS_GOOGLE%
+p[60]=--methodeol
+p[61]=--dpi-desync=fakedsplit --dpi-desync-fooling=badseq --dpi-desync-split-pos=1 --dpi-desync-fakedsplit-mod=altorder=1
+p[62]=--dpi-desync=fakedsplit --dpi-desync-fooling=ts --dpi-desync-split-pos=1
+p[63]=--dpi-desync=fakedsplit --dpi-desync-fooling=md5sig --dup=1 --dup-cutoff=n2 --dup-fooling=md5sig --dpi-desync-split-pos=1 --dpi-desync-fakedsplit-mod=altorder=1
+p[64]=--dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic=%QUIC_VK%
+p[65]=--dpi-desync=fake,multisplit --dpi-desync-fooling=badseq --dpi-desync-badseq-increment=0 --dpi-desync-split-pos=1
+p[66]=--ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=681 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern=%TLS_GOOGLE%
+p[67]=--ip-id=zero --dpi-desync=multisplit --dpi-desync-split-seqovl=652 --dpi-desync-split-pos=2 --dpi-desync-split-seqovl-pattern=%TLS_GOOGLE%
+p[68]=--dpi-desync=multisplit --dpi-desync-split-seqovl=568 --dpi-desync-split-pos=1 --dpi-desync-split-seqovl-pattern=%TLS_4PDA%
diff --git a/config/payloads.txt b/config/payloads.txt
@@ -3,3 +3,4 @@ QUIC_GOOGLE="%PAYLOAD_PATH%\quic_initial_www_google_com.bin"
 QUIC_VK="%PAYLOAD_PATH%\quic_initial_vk_com.bin"
 QUIC_SHORT="%PAYLOAD_PATH%\quic_short.bin"
 TLS_IANA="%PAYLOAD_PATH%\tls_clienthello_iana_org.bin"
+TLS_4PDA="%PAYLOAD_PATH%\tls_clienthello_4pda_to.bin"
diff --git a/config/variants.csv b/config/variants.csv
@@ -1,21 +1,24 @@
-YT_HTTP,DIS_HTTP,CF_HTTP,CUSTOM_HTTP,GAME_HTTP,BLACK_HTTP,AUTO_HTTP,YT_HTTPS,DIS_HTTPS,CF_HTTPS,CUSTOM_HTTPS,GAME_HTTPS,BLACK_HTTPS,AUTO_HTTPS,YT_UDP,DIS_UDP,CF_UDP,CUSTOM_UDP,GAME_UDP,AUTO_UDP,DIS_PORT,GAME_PORT
-1,1,1,1,1,1,1,12,7,7,7,7,7,7,13,8,8,8,8,8,43,57
-1,1,1,1,1,1,1,4,7,7,7,7,7,7,6,8,8,8,8,8,43,57
-1,1,1,1,1,1,1,12,3,3,3,3,3,11,13,14,13,13,13,13,43,57
-1,1,1,1,1,1,1,26,26,44,44,44,44,44,18,18,18,18,18,18,43,57
-1,1,1,1,1,1,1,45,45,45,45,45,45,45,18,18,18,18,18,18,43,57
-1,1,1,1,1,1,1,16,16,16,16,16,16,16,18,18,18,18,18,18,43,57
-1,1,1,1,1,1,1,20,20,20,20,20,20,20,18,18,18,18,18,18,43,57
-1,1,1,1,1,1,1,21,21,21,21,21,21,21,18,18,18,18,18,18,43,57
-1,1,1,1,1,1,1,46,46,46,46,46,46,46,18,18,18,18,18,18,43,57
-1,1,1,1,1,1,1,47,47,47,47,47,47,47,18,18,18,18,18,18,43,57
-1,1,1,1,1,1,1,48,48,48,48,48,48,48,18,18,18,18,18,18,43,57
-50,50,50,50,50,50,50,51,51,51,51,51,51,51,52,52,52,52,52,52,43,57
-1,1,1,1,1,1,1,24,24,24,24,24,24,24,18,18,18,18,18,18,43,57
-1,1,1,1,1,1,1,27,27,27,27,27,27,27,18,18,18,18,18,18,43,57
-55,55,55,55,55,55,55,56,54,54,54,54,54,54,17,17,17,17,17,17,43,57
-1,1,1,1,1,1,1,4,7,7,7,7,7,7,6,8,8,8,8,8,10,57
-1,1,1,1,1,1,1,12,3,3,2,2,41,11,13,14,13,13,13,13,15,57
-53,53,53,53,53,53,53,54,54,54,54,54,54,54,18,18,18,18,18,18,19,57
-1,1,1,1,1,1,1,12,20,20,20,20,20,20,13,31,13,12,12,12,43,57
-1,1,1,1,1,1,1,59,59,59,59,59,59,59,18,18,18,18,18,18,43,57
+YT_HTTP,DIS_HTTP,CF_HTTP,CUSTOM_HTTP,YT_HTTPS,DIS_HTTPS,CF_HTTPS,CUSTOM_HTTPS,YT_QUIC,DIS_QUIC,CF_QUIC,CUSTOM_QUIC,DIS_UDP,DIS_MEDIA
+1,1,1,1,12,7,7,7,13,8,8,8,43,26
+1,1,1,1,4,7,7,7,6,8,8,8,43,26
+1,1,1,1,12,3,3,3,13,14,13,13,43,26
+1,1,1,1,26,26,44,44,18,18,18,18,43,26
+1,1,1,1,45,45,45,45,18,18,18,18,43,26
+1,1,1,1,16,16,16,16,18,18,18,18,43,26
+1,1,1,1,20,20,20,20,18,18,18,18,43,26
+1,1,1,1,21,21,21,21,18,18,18,18,43,26
+1,1,1,1,46,46,46,46,18,18,18,18,43,26
+1,1,1,1,47,47,47,47,18,18,18,18,43,26
+1,1,1,1,48,48,48,48,18,18,18,18,43,26
+50,50,50,50,51,51,51,51,52,52,52,52,43,26
+1,1,1,1,24,24,24,24,18,18,18,18,43,26
+1,1,1,1,27,27,27,27,18,18,18,18,43,26
+55,55,55,55,56,54,54,54,17,17,17,17,43,26
+1,1,1,1,4,7,7,7,6,8,8,8,10,26
+1,1,1,1,12,3,3,2,13,14,13,13,15,26
+53,53,53,53,54,54,54,54,18,18,18,18,19,26
+1,1,1,1,12,20,20,20,13,31,13,12,43,26
+1,1,1,1,59,59,59,59,18,18,18,18,43,26
+60,60,60,60,59,65,65,65,18,64,64,64,43,26
+60,60,60,60,66,68,68,68,18,18,18,18,43,26
+60,60,60,60,67,16,16,16,18,18,18,18,43,26
diff --git a/config/windivert.filter/README.txt b/config/windivert.filter/README.txt
@@ -0,0 +1,14 @@
+﻿Цель этих фильтров - отсекать полезную нагрузку в режиме ядра, не насилуя процессор перенаправлением целого потока на winws.
+Задействуются через `winws --wf-raw-part=@filename`. Может быть несколько частичных фильтров. Они могут сочетаться с --wf-tcp и --wf-udp.
+Однако, язык фильтров windivert не содержит операций с битовыми полями, сдвигов и побитовой логики.
+Поэтому фильтры получились более слабыми, способными передавать неправильную нагрузку.
+Дофильтрация производится силами winws.
+
+Описание языка фильтров : https://reqrypt.org/windivert-doc.html#filter_language
+Пример инстанса для пробития медиапотоков в discord : `winws --wf-raw-part=@windivert_part.discord_media.txt --wf-raw-part=@windivert_part.stun.txt --filter-l7=stun,discord --dpi-desync=fake`
+
+
+These filters are invoked using `winws --wf-raw-part=@filename`. Multiple filter parts are supported. They can be combined with --wf-tcp and --wf-udp.
+Filters are kernel mode and save great amount of CPU.
+However windivert cannot filter by bit fields, lacks shift and bitwise logic operations.
+Filters are relaxed and can pass wrong payloads. Finer filtering is done by winws.
diff --git a/config/windivert.filter/windivert_part.discord_media.txt b/config/windivert.filter/windivert_part.discord_media.txt
@@ -0,0 +1,20 @@
+  outbound and ip and
+  udp.DstPort>=50000 and udp.DstPort<=50099 and
+  udp.PayloadLength=74 and
+  udp.Payload32[0]=0x00010046 and
+  udp.Payload32[2]=0 and
+  udp.Payload32[3]=0 and
+  udp.Payload32[4]=0 and
+  udp.Payload32[5]=0 and
+  udp.Payload32[6]=0 and
+  udp.Payload32[7]=0 and
+  udp.Payload32[8]=0 and
+  udp.Payload32[9]=0 and
+  udp.Payload32[10]=0 and
+  udp.Payload32[11]=0 and
+  udp.Payload32[12]=0 and
+  udp.Payload32[13]=0 and
+  udp.Payload32[14]=0 and
+  udp.Payload32[15]=0 and
+  udp.Payload32[16]=0 and
+  udp.Payload32[17]=0
diff --git a/config/windivert.filter/windivert_part.quic_initial_ietf.txt b/config/windivert.filter/windivert_part.quic_initial_ietf.txt
@@ -0,0 +1,4 @@
+  outbound and
+  udp.PayloadLength>=256 and
+  udp.Payload[0]>=0xC0 and udp.Payload[0]<0xD0 and
+  udp.Payload[1]=0 and udp.Payload16[1]=0 and udp.Payload[4]=1
diff --git a/config/windivert.filter/windivert_part.stun.txt b/config/windivert.filter/windivert_part.stun.txt
@@ -0,0 +1,3 @@
+  outbound and
+  udp.PayloadLength>=20 and
+  udp.Payload32[1]=0x2112A442 and udp.Payload[0]<0x40
diff --git a/config/windivert.filter/windivert_part.wireguard.txt b/config/windivert.filter/windivert_part.wireguard.txt
@@ -0,0 +1,3 @@
+  outbound and
+  udp.PayloadLength=148 and
+  udp.Payload[0]=0x01
diff --git a/payloads/tls_clienthello_4pda_to.bin b/payloads/tls_clienthello_4pda_to.bin
diff --git a/zapret-winws-kodx.cmd b/zapret-winws-kodx.cmd
@@ -43,6 +43,7 @@ set "WINWS_BIN=%~dp0bin\winws\winws.exe"
 set "PAYLOAD_PATH=%~dp0payloads"
 set "LIST_PATH=%~dp0lists"
 set "CONFIG_PATH=%~dp0config"
+set "WINDIVERT_FILTER_PATH=%CONFIG_PATH%\windivert.filter"
 
 set "BLACK_LIST_URL=https://p.thenewone.lol/domains-export.txt"
 
@@ -59,14 +60,20 @@ set "PAYLOADS_FILE=%CONFIG_PATH%\payloads.txt"
 set "LISTS_FILE=%CONFIG_PATH%\lists.txt"
 set "CUSTOM_SETTINGS_FILE=%CONFIG_PATH%\custom.txt"
 
+:: windivert filter files
+set "WINDIVERT_DISCORD_MEDIA_FILE=%WINDIVERT_FILTER_PATH%\windivert_part.discord_media.txt"
+set "WINDIVERT_QUIC_INITIAL_FILE=%WINDIVERT_FILTER_PATH%\windivert_part.quic_initial_ietf.txt"
+set "WINDIVERT_STUN_FILE=%WINDIVERT_FILTER_PATH%\windivert_part.stun.txt"
+set "WINDIVERT_WIREGUARD_FILE=%WINDIVERT_FILTER_PATH%\windivert_part.wireguard.txt"
+
 :: load payload vars from file
 call :ReadVarsFromFile "%PAYLOADS_FILE%"
 :: set address list from lists file
 call :SetAddrlist "%LISTS_FILE%"
 :: set row count from variants file
 call :SetRowCount "%VARIANTS_FILE%"
 
-goto :main
+goto main
 
 :UpdateRussiaBlacklist
     bitsadmin /transfer blacklist %BLACK_LIST_URL% "%BLACK_LIST%"
@@ -106,7 +113,7 @@ exit /b 0
     set "_result="
 
     if not defined _in_path (
-        goto :SetAddrlistVarExit
+        goto SetAddrlistVarExit
     )
 
     :: if ends with "_LIST"
@@ -129,12 +136,12 @@ exit /b 0
     )
 
     if not defined _file_type (
-        goto :SetAddrlistVarExit
+        goto SetAddrlistVarExit
     )
 
     if not %_in_name% == AUTO_LIST (
         if not exist %_in_path% (
-            goto :SetAddrlistVarExit
+            goto SetAddrlistVarExit
         )
     )
     set "_result=%_file_type%=%_in_path%"
@@ -229,7 +236,7 @@ exit /b 0
             echo.Custom settings file %CUSTOM_SETTINGS_FILE% doesn't exists.
             goto SetArgsExit
         )
-        goto :SetArgsStr
+        goto SetArgsStr
     )
 
     call :SetRowCount %_IN_VARIANTS_FILE%
@@ -238,68 +245,47 @@ exit /b 0
     :: Read one selected row from variants file
     for /f "skip=%_IN_CHOICE_NUM% usebackq delims=" %%R in (`type !_IN_VARIANTS_FILE!`) do (
         set "_ARG_ROW=%%R"
-        goto :SetArgsRowFindEnd
+        goto SetArgsRowFindEnd
     )
     :SetArgsRowFindEnd
 
     call :ParseRow "%_ARG_ROW%"
 
     :SetArgsStr
-    set ARGS=--wf-tcp=80,443 --wf-udp=443,596-599,1400,50000-50099 ^
+
+    set ARGS=--wf-tcp=80,443,2053,2083,2087,2096,8443 --wf-udp=19294-19344,50000-50100 ^
+--wf-raw-part=@"%WINDIVERT_QUIC_INITIAL_FILE%" ^
+--wf-raw-part=@"%WINDIVERT_WIREGUARD_FILE%" ^
 --filter-tcp=80 %YT_LIST% %YT_HTTP% --new ^
 --filter-tcp=443 %YT_LIST% %YT_HTTPS% --new ^
---filter-udp=443 %YT_LIST% %YT_UDP% --new ^
+--filter-l7=quic %YT_LIST% %YT_QUIC% --new ^
 --filter-tcp=80 %DIS_LIST% %DIS_HTTP% --new ^
 --filter-tcp=443 %DIS_LIST% %DIS_HTTPS% --new ^
---filter-udp=443 %DIS_LIST% %DIS_UDP% --new ^
---filter-udp=596-599,1400,50000-50099 %DIS_PORT%
+--filter-l7=quic %DIS_LIST% %DIS_QUIC% --new ^
+--filter-udp=19294-19344,50000-50100 %DIS_UDP% --new ^
+--filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media %DIS_MEDIA%
 
     if defined CF_IPSET (
         set ARGS=%ARGS% --new ^
 --filter-tcp=80 %CF_IPSET% %CF_HTTP% --new ^
 --filter-tcp=443 %CF_IPSET% %CF_HTTPS% --new ^
---filter-udp=443 %CF_IPSET% %CF_UDP%
+--filter-l7=quic %CF_IPSET% %CF_QUIC%
     )
 
-    if defined CUSTOM_LIST (
+    set "CUSTOM_LIST=%CUSTOM_LIST% %CUSTOM_IPSET% %BLACK_LIST%"
+    :: remove spaces
+    set "TMP_STR=%CUSTOM_LIST: =%"
+    if defined TMP_STR (
         set ARGS=%ARGS% --new ^
 --filter-tcp=80 %CUSTOM_LIST% %CUSTOM_HTTP% --new ^
 --filter-tcp=443 %CUSTOM_LIST% %CUSTOM_HTTPS% --new ^
---filter-udp=443 %CUSTOM_LIST% %CUSTOM_UDP%
-    )
-
-    if defined CUSTOM_IPSET (
-        set ARGS=%ARGS% --new ^
---filter-tcp=80 %CUSTOM_IPSET% %CUSTOM_HTTP% --new ^
---filter-tcp=443 %CUSTOM_IPSET% %CUSTOM_HTTPS% --new ^
---filter-udp=443 %CUSTOM_IPSET% %CUSTOM_UDP%
-    )
-
-    if defined GAME_LIST (
-        set ARGS=%ARGS% --new ^
---filter-tcp=80 %GAME_LIST% %GAME_HTTP% --new ^
---filter-tcp=443 %GAME_LIST% %GAME_HTTPS% --new ^
---filter-udp=443 %GAME_LIST% %GAME_UDP%
-    )
-
-    if defined GAME_IPSET (
-        set ARGS=%ARGS% --new ^
---filter-tcp=80 %GAME_IPSET% %GAME_HTTP% --new ^
---filter-tcp=443 %GAME_IPSET% %GAME_HTTPS% --new ^
---filter-udp=443 %GAME_IPSET% %GAME_UDP% --new ^
---filter-tcp=2099 %GAME_IPSET% %GAME_PORT%
-    )
-
-    if defined BLACK_LIST (
-        set ARGS=%ARGS% --new ^
---filter-tcp=80 %BLACK_LIST% %BLACK_HTTP% --new ^
---filter-tcp=443 %BLACK_LIST% %BLACK_HTTPS%
+--filter-l7=quic %CUSTOM_LIST% %CUSTOM_QUIC%
     )
 
     set ARGS=%ARGS% --new ^
---filter-tcp=80 %AUTO_LIST% %EXCLUDE_LIST% %AUTO_HTTP% --new ^
---filter-tcp=443 %AUTO_LIST% %EXCLUDE_LIST% %AUTO_HTTPS% --new ^
---filter-udp=443 %AUTO_LIST% %EXCLUDE_LIST% %AUTO_UDP%
+--filter-tcp=80 %AUTO_LIST% %EXCLUDE_LIST% %CUSTOM_HTTP% --new ^
+--filter-tcp=443 %AUTO_LIST% %EXCLUDE_LIST% %CUSTOM_HTTPS% --new ^
+--filter-l7=quic %AUTO_LIST% %EXCLUDE_LIST% %CUSTOM_QUIC%
 
     :SetArgsExit
 exit /b 0
@@ -314,7 +300,7 @@ exit /b 0
     sc query "%_svc_name%" >nul 2>&1
     if errorlevel 1 (
         echo Служба "%_svc_name%" не найдена \ Service "%_svc_name%" not found
-        exit /b 0
+        goto ServiceControlExit
     )
 
     if %_svc_control_cmd%==start (
@@ -337,13 +323,13 @@ exit /b 0
         echo Удаляем \ Deleting "%_svc_name%" ...
         sc delete %_svc_name%
     )
+    :ServiceControlExit
 exit /b 0
 
 :ServiceCleanup
-    for %%I in ("%SVC_NAME%" "WinDivert" "WinDivert14") do (
+    for %%I in ( "%SVC_NAME%" "WinDivert" "WinDivert14" ) do (
         call :ServiceControl %%I delete
     )
-ivert14"
 exit /b 0
 
 :ServiceCleanupOthers
@@ -400,12 +386,14 @@ exit /b 0
 :RunExe
     if not defined ARGS (
         echo "Настройки не определены, остановка \ The settings are not defined, break"
-        exit /b 0
+        goto RunExeExit
     )
     call :SaveCurrentConfig
     set EXEC_STR="%WINWS_BIN%" @"%CONFIG_FILE%"
     echo Запускаем программу с параметрами \ Starting winws with cmd %EXEC_STR%
     start "zapret: http,https,quic" /min %EXEC_STR%
+
+    :RunExeExit
 exit /b 0
 
 :ChooseVariant
@@ -489,7 +477,7 @@ exit /b 0
     if %op%==6 (
         goto end
     )
-    goto :MainMenu
+    goto MainMenu
 exit /b 0
 
 :main

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+ outbound and`
	`2`	`+ udp.PayloadLength>=20 and`
	`3`	`+ udp.Payload32[1]=0x2112A442 and udp.Payload[0]<0x40`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+ outbound and`
	`2`	`+ udp.PayloadLength=148 and`
	`3`	`+ udp.Payload[0]=0x01`