No-Server Handshake Spoof

[r3a1d3a1]

I've noticed an interesting case recently. An endpoint, e.g. on Slack or Google, can be reached on Desktop, but not on Android. Since the only difference would lie in the handshake parameters, it'd be great to have the option of using V2Ray for such cases without a server, simply to utilize its uTLS library to spoof the handshake as if it was originated on a Desktop.

Thank you!

[mydogshitgold]

An endpoint, e.g. on Slack or Google, can be reached on Desktop, but not on Android.

What do you mean by "reachable"? What is the address/domain of "endpoints"? How do you access them? What is your client software?

This is very confusing. Could you please provide more context?

Since the only difference would lie in the handshake parameters,

This statement is unlikely to be true. More context is needed.

[r3a1d3a1]

Hahahaha.... Do you think someone who knows about RST packets would ever be that forgetful?! :)
Of course they are.

[mydogshitgold]

OK, I assume you've confirmed that the blocking is caused by the TLS fingerprints and have checked that the client hellos from the PC and phone have different fingerprints with some sort of packet inspection tool.

uTLS can indeed circumvent this kind of blocking, however, using it means patching your client software or , in case you don't have the souce code, running a TLS-capable MITM proxy.

V2Ray currently has no MITM functionality, and as far as I know, no mainstream MITM tools use uTLS. You will probably have to implement this yourself.

Thank you for your time, sir or madam, and have a good day.

[r3a1d3a1]

I haven't tried V2Ray for android yet, but I'm sure it either works as a VPN or offers a Socks proxy.
First case would be ideal, but even a Socks proxy is much easier to incorporate into a Flutter app than bringing in uTLS directly.

I see that you've only two commits to this repo, so maybe let's wait for @xiaokangwang to chip in?

[xiaokangwang]

Hi! The thing with this kind of functionality is that it would require MITM and install a trusted certificate on Android device. V2Ray already supports MITM, however, even if such thing is configured, it would require something like XPosed or root to force android applications to accept a new trusted certificate authority. So I would say it is not impossible, but the related change need to happen at Android client, not V2Ray

[r3a1d3a1]

Hey boss! I've come to realize what you meant for requiring MITM (100% necessary in the case of offering a new cipher); but would it be possible to drop certain ciphers at least from the Client Hello? (W/o deciphering anything ofc)
I'm hoping the ISP's detection mechanism is based on blacklisting certain ciphers and by removing them from the Client Hello, I bypass its restrictions.
I imagine a checksum may need to be recomputed, but no re-encryption would be needed, right?