zapret-win-bundle

The zapret-win-bundle is a combined compilation of zapret1 and zapret2 for Windows. It includes a minimal Cygwin environment and the blockcheck tool.

Important Note: This is not a 'one-button' solution. It does not provide ready-made strategies or a single button to 'open sites'. Users must understand how zapret works to configure it effectively.

You can create a custom strategy tester by defining your own list of strategies in a dedicated directory.

1. Copy this directory to a new name inside blockcheck2.d/.
2. Edit the list files within your new directory and enter your desired strategies.
3. Run blockcheck2.sh and select the test corresponding to your new directory name from the dialog.

Formatting rules for strategy files:

• Use # at the start of a line to comment out a strategy.
• Any parameters containing special characters (such as <) must be escaped according to shell rules.

You can use WinDivert filters to drop or intercept payloads directly in kernel mode, which significantly reduces CPU usage by preventing entire streams from being redirected to winws.

To use these filters, invoke winws with the --wf-raw-part=@filename flag. You can specify multiple partial filters by repeating this flag. These partial filters can be combined with --wf-tcp and --wf-udp flags.

Limitations:

• The WinDivert filter language does not support bit fields, shifts, or bitwise logic operations.
• Because of these limitations, filters are 'relaxed' and may allow incorrect payloads to pass through.
• winws performs the final, finer-grained filtering on any payloads that pass the initial kernel-mode filter.

winws --wf-raw-part=@windivert_part.discord_media.txt --wf-raw-part=@windivert_part.stun.txt --filter-l7=stun,discord --dpi-desync=fake

This utility attempts to hide the presence of WinDivert from software (such as games or anti-cheat systems) that specifically look for a service named windivert or a driver file named WinDivert64.sys.

It works by renaming the driver service to Monkey and the driver file to Monkey64.sys. Note that Monkey64.sys is an exact copy of WinDivert64.sys, and WinDivert.dll has been rebuilt with minor code patching.

Limitations:

• This will not work if the software checks for the specific device name created by the driver or uses other detection methods not tied to the service or file name.
• The original name remains in certain contexts because changing it would require recompiling and resigning the driver.

To uninstall the modified driver version, run the following command/script:

monkey_delete.cmd

If windivert fails to start on Windows 7, you must either:

1. Run win7/install_win7.cmd.
2. Install ESU (Extended Security Updates).

To use the modified driver to hide WinDivert, follow these steps:

1. Stop existing services: Stop all programs using WinDivert and stop the original windivert service. You can do this via an administrator command prompt:

   sc stop windivert

   Or by using the provided script: zapret-winws/windivert_delete.cmd.

2. Copy files: Copy WinDivert.dll and Monkey64.sys into the same folder where winws.exe is located.

To use the bundle on ARM64 architecture (e.g., Windows 11 ARM), follow these steps:

1. Run arm64/install_arm64.cmd.
2. Reboot the system if testsigning mode was not previously enabled.

Verification: You should see a "Test Mode" watermark in the bottom right corner of your desktop after rebooting.

The blockcheck tools are analyzers used to find effective DPI bypass strategies.

CRITICAL: You must stop zapret and any other DPI bypass software before running these tools.

Available tools:

• blockcheck\blockcheck.cmd: Standard analyzer.
• blockcheck\blockcheck-kyber.cmd: Uses CURL with multi-segment TLS Client Hello.
• blockcheck\blockcheck2.cmd: Analyzer based on winws2.
• blockcheck\blockcheck2-kyber.cmd: winws2 analyzer using CURL with multi-segment TLS Client Hello.

Before using the bundle, ensure your system meets the following requirements:

• Windows 7 x64, Windows Server 2008 R2: Requires ESU updates or replacement of windivert files.
• Windows 8+ x64, Windows Server 2012+: May require disabling Secure Boot.
• Windows 11+ ARM64, Windows Server 2025+: Requires testsigning mode to be enabled.
• Windows Server: Requires the installation of the 'Wireless Networking' feature.

The windivert driver (used by zapret to intercept and filter traffic, similar to iptables and NFQUEUE on Linux) may trigger antivirus software.

windivert64.sys is signed for 64-bit Windows kernels, but antivirus engines often flag it as a high-risk or hacker tool. If you encounter issues, add an exception for windivert or disable your antivirus temporarily.

If you need to point blockcheck2 to strategy files located in a different directory, you can override the default paths using the following environment variables:

• LIST_HTTP
• LIST_HTTPS_TLS12
• LIST_HTTPS_TLS13
• LIST_QUIC