關於vless-cracker-v1的檢測

[FuckCCP8964]

先說結論，這玩具目前我發現只能對reality的target為aws的網站有效，這與aws（包括cloudfront.net）所使用的TLS庫s2n-tls有關。
下面是在中轉機測試的結果（已對IP、Port等做匿名化處理）：

aws.amazon.com:
[2026-05-12 09:26:05.036852] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 3/3 confirmations. client=2a0x::xxxx:40128 server=260x::xxxx:1234 sni=aws.amazon.com probes=7 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,TO,TO,ALERT,ALERT,TO,ALERT}
[2026-05-12 09:26:05.037660] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 3/3 confirmations. client=240x::xxxx:56117 server=2a0x::xxxx:443 sni=aws.amazon.com probes=7 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,TO,TO,ALERT,ALERT,TO,ALERT}
images-na.ssl-images-amazon.com:
[2026-05-12 11:00:39.650184] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 3/3 confirmations. client=240x::xxxx:34662 server=2a0x::xxxx:443 sni=images-na.ssl-images-amazon.com probes=7 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,TO,TO,ALERT,ALERT,TO,ALERT}
[2026-05-12 11:00:39.653810] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 3/3 confirmations. client=2a0x::xxxx:55436 server=260x::xxxx:1234 sni=images-na.ssl-images-amazon.com probes=7 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,TO,TO,ALERT,ALERT,TO,ALERT}

可以發現s2n-tls對於這7次異常封包的行為確實與gotls不同，在第2次、第3次、第6次時都是Timeout，而gotls這邊除了第1次以外都是Alert。
建議大家在xray沒有加入模仿target對異常封包的行為前暫時不要使用aws網站（包括cdn）的sni了。

target為nginx (built with OpenSSL 3.6.2)時，一開始就被排除了，因為行為上與gotls無異。

TLS ServerHello 240x::xxxx:1234 -> 2a0x::xxxx:42618 selected_version=0xbbbb bytes=1428
TLS ServerHello 2a0x::xxxx:443 -> 2001::xxxx:50016 selected_version=0xbbbb bytes=5583
TLS replay attempt=1 probe=1 server=2a0x::xxxx:443 complete probe_status=TO bytes=5583
TLS replay B randomized ClientHello legacy_session_id len=32 before=aaaaaaaa after=bbbbbbb
TLS replay waiting 1s before attempt=B randomized session_id recheck
TLS replay attempt=1 probe=1 server=240x::xxxx:1234 complete probe_status=TO bytes=5583
TLS replay B randomized ClientHello legacy_session_id len=32 before=aaaaaaaa after=cccccccc
TLS replay waiting 1s before attempt=B randomized session_id recheck
TLS replay attempt=2 server=2a0x::xxxx:443
TLS replay attempt=2 server=2a0x::xxxx:443
TLS replay attempt=2 server=2a0x::xxxx:443
TLS replay attempt=2 server=2a0x::xxxx:443
TLS replay attempt=2 server=2a0x::xxxx:443
TLS replay attempt=2 server=2a0x::xxxx:443
TLS replay attempt=2 server=2a0x::xxxx:443
TLS replay attempt=2 probe=3 server=2a0x::xxxx:443 sent probe bytes=5
TLS replay attempt=2 probe=3 server=2a0x::xxxx:443 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=1 server=2a0x::xxxx:443 sent probe bytes=18
TLS replay attempt=2 server=240x::xxxx:1234
TLS replay attempt=2 server=240x::xxxx:1234
TLS replay attempt=2 server=240x::xxxx:1234
TLS replay attempt=2 server=240x::xxxx:1234
TLS replay attempt=2 server=240x::xxxx:1234
TLS replay attempt=2 server=240x::xxxx:1234
TLS replay attempt=2 server=240x::xxxx:1234
TLS replay attempt=2 probe=2 server=2a0x::xxxx:443 sent probe bytes=5
TLS replay attempt=2 probe=2 server=2a0x::xxxx:443 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=7 server=2a0x::xxxx:443 sent probe bytes=10
TLS replay attempt=2 probe=7 server=2a0x::xxxx:443 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=4 server=2a0x::xxxx:443 sent probe bytes=7
TLS replay attempt=2 probe=4 server=2a0x::xxxx:443 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=5 server=2a0x::xxxx:443 sent probe bytes=6
TLS replay attempt=2 probe=5 server=2a0x::xxxx:443 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=6 server=2a0x::xxxx:443 sent probe bytes=6
TLS replay attempt=2 probe=6 server=2a0x::xxxx:443 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=6 server=240x::xxxx:1234 sent probe bytes=6
TLS replay attempt=2 probe=6 server=240x::xxxx:1234 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=1 server=240x::xxxx:1234 sent probe bytes=18
TLS replay attempt=2 probe=2 server=240x::xxxx:1234 sent probe bytes=5
TLS replay attempt=2 probe=2 server=240x::xxxx:1234 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=3 server=240x::xxxx:1234 sent probe bytes=5
TLS replay attempt=2 probe=3 server=240x::xxxx:1234 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=4 server=240x::xxxx:1234 sent probe bytes=7
TLS replay attempt=2 probe=4 server=240x::xxxx:1234 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=5 server=240x::xxxx:1234 sent probe bytes=6
TLS replay attempt=2 probe=5 server=240x::xxxx:1234 complete probe_status=ALERT bytes=5607
TLS replay attempt=2 probe=7 server=240x::xxxx:1234 sent probe bytes=10
TLS replay attempt=2 probe=7 server=240x::xxxx:1234 complete probe_status=ALERT bytes=5607
[2026-05-11 22:20:06.108249] TLS ClientHello 2a0x::xxxx:42632 -> 240x::xxxx:1234 sni=www.domain.com versions=0xaaaa,0xbbbb,0xcccc
[2026-05-11 22:20:06.108489] TLS ClientHello 2a0x::xxxx:42636 -> 240x::xxxx:1234 sni=www.domain.com versions=0xaaaa,0xbbbb,0xcccc
[2026-05-11 22:20:06.108525] TLS ClientHello 2a0x::xxxx:42642 -> 240x::xxxx:1234 sni=www.domain.com versions=0xaaaa,0xbbbb,0xcccc
[2026-05-11 22:20:06.108859] TLS ClientHello 2a0x::xxxx:42650 -> 240x::xxxx:1234 sni=www.domain.com versions=0xaaaa,0xbbbb,0xcccc
[2026-05-11 22:20:06.109096] TLS ClientHello 2a0x::xxxx:42662 -> 240x::xxxx:1234 sni=www.domain.com versions=0xaaaa,0xbbbb,0xcccc
[2026-05-11 22:20:06.109349] TLS ClientHello 2a0x::xxxx:42664 -> 240x::xxxx:1234 sni=www.domain.com versions=0xaaaa,0xbbbb,0xcccc
[2026-05-11 22:20:06.109643] TLS ClientHello 2a0x::xxxx:42678 -> 240x::xxxx:1234 sni=www.domain.com versions=0xaaaa,0xbbbb,0xcccc
TLS ServerHello 240x::xxxx:1234 -> 2a0x::xxxx:42642 selected_version=0xbbbb bytes=1428
TLS ServerHello 240x::xxxx:1234 -> 2a0x::xxxx:42632 selected_version=0xbbbb bytes=4096
TLS ServerHello 240x::xxxx:1234 -> 2a0x::xxxx:42636 selected_version=0xbbbb bytes=4096
TLS ServerHello 240x::xxxx:1234 -> 2a0x::xxxx:42678 selected_version=0xbbbb bytes=1428
TLS ServerHello 240x::xxxx:1234 -> 2a0x::xxxx:42650 selected_version=0xbbbb bytes=4096
TLS ServerHello 240x::xxxx:1234 -> 2a0x::xxxx:42662 selected_version=0xbbbb bytes=1428
TLS ServerHello 240x::xxxx:1234 -> 2a0x::xxxx:42664 selected_version=0xbbbb bytes=1428
TLS replay attempt=2 probe=1 server=2a0x::xxxx:443 complete probe_status=TO bytes=5583
TLS replay confirmation failed; excluding server=2a0x::xxxx:443 round=1
TLS replay attempt=2 probe=1 server=240x::xxxx:1234 complete probe_status=TO bytes=5583
TLS replay confirmation failed; excluding server=240x::xxxx:1234 round=1

我沒有測試caddy(gotls)類的網站，我想也沒有必要了。。。

[FuckCCP8964]

另外我想吐槽一下，這明明是reality-cracker，不知道與vless有何關係😂

[JarmoHu]

昨晚上用ai改了好久的代码。https://github.com/JarmoHu/VLESS-cracker/tree/main 已经通过细微的差别识别出了akamai的cdn了，www.apple.com已经成功识别

[JarmoHu]

[2026-05-12 13:30:49.955329] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 1/1 confirmations. client=xxx server=xxxx sni=xxxxx probes=20 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT,TO,FIN,ALERT,ALERT,ALERT,ALERT,FIN,ALERT,ALERT}
刚刚的事情，基于nginx的也识别出区别了

[FuckCCP8964]

將characteristic.txt中的第6行和第7行替換為：
15 03 03 00 02 03 00
15 03 03 00 02 01 FF

這種情況下會出現行為差異

target為nginx:

[2026-05-12 15:17:52.830039] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 3/3 confirmations. client=240x::xxxx:60012 server=2a0x::xxxx:443 sni=www.domain.com probes=7 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,ALERT,ALERT,ALERT,ALERT,FIN,FIN}
[2026-05-12 15:17:52.898037] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 3/3 confirmations. client=2a0x::xxxx:40051 server=260x::xxxx:1234 sni=www.domain.com probes=7 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,ALERT,ALERT,ALERT,ALERT,FIN,FIN}

gotls的第6次和第7次都是ALERT，而nginx(openssl)是FIN
client向server發送alert時gotls表現與openssl不同。

[FuckCCP8964]

@RPRX
要不要考慮把openssl加入reality或者模仿target的行為？

[RPRX]

直到读到正确的 client finished 之前都交给 target 来响应不就行了，虽然弄个 OpenSSL 版 REALITY 也有其它好处

[ysyl-re]

將characteristic.txt中的第6行和第7行替換為： 15 03 03 00 02 03 00 15 03 03 00 02 01 FF

這種情況下會出現行為差異

target為nginx:

[2026-05-12 15:17:52.830039] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 3/3 confirmations. client=240x::xxxx:60012 server=2a0x::xxxx:443 sni=www.domain.com probes=7 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,ALERT,ALERT,ALERT,ALERT,FIN,FIN}
[2026-05-12 15:17:52.898037] TLS ReplayProbe MISMATCH, VLESS/REALITY connection detected after 3/3 confirmations. client=2a0x::xxxx:40051 server=260x::xxxx:1234 sni=www.domain.com probes=7 cmp=X[D] result=A{X=TO,ALERT,ALERT,ALERT,ALERT,ALERT,ALERT}|B{X=TO,ALERT,ALERT,ALERT,ALERT,FIN,FIN}

gotls的第6次和第7次都是ALERT，而nginx(openssl)是FIN client向server發送alert時gotls表現與openssl不同。

不好意思我有个疑问，我将characteristic.txt替换后再次进行测试，但为什么我的还是无法被测出？
这是我curl -v -x socks5h://127.0.0.1:1080 https://www.google.com的日志，隐私信息已替换

root@debian-test:~/VLESS-cracker# ./vless-cracker-v1 -i wlp2s0 -l info
[2026-05-12 17:46:18.081035] TLS ClientHello 192.168.5.14:50462 -> <reality节点v4>:<reality节点端口> sni=<reality节点域名> alpn=h2,http/1.1 versions=0x0a0a,0x0304,0x0303
TLS ServerHello <reality节点v4>:<reality节点端口> -> 192.168.5.14:50462 selected_version=0x0304 bytes=2880
TLS replay attempt=1 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=1 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=1 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=1 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=1 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=1 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=1 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=1 probe=5 server=<reality节点v4>:<reality节点端口> sent probe bytes=6
TLS replay attempt=1 probe=6 server=<reality节点v4>:<reality节点端口> sent probe bytes=7
TLS replay attempt=1 probe=4 server=<reality节点v4>:<reality节点端口> sent probe bytes=7
TLS replay attempt=1 probe=4 server=<reality节点v4>:<reality节点端口> complete probe_status=ALERT bytes=3523
TLS replay attempt=1 probe=2 server=<reality节点v4>:<reality节点端口> sent probe bytes=5
TLS replay attempt=1 probe=2 server=<reality节点v4>:<reality节点端口> complete probe_status=ALERT bytes=3523
TLS replay attempt=1 probe=1 server=<reality节点v4>:<reality节点端口> sent probe bytes=18
TLS replay attempt=1 probe=3 server=<reality节点v4>:<reality节点端口> sent probe bytes=5
TLS replay attempt=1 probe=6 server=<reality节点v4>:<reality节点端口> complete probe_status=ALERT bytes=3522
TLS replay attempt=1 probe=5 server=<reality节点v4>:<reality节点端口> complete probe_status=ALERT bytes=3522
TLS replay attempt=1 probe=3 server=<reality节点v4>:<reality节点端口> complete probe_status=ALERT bytes=3524
TLS replay attempt=1 server=<reality节点v4>:<reality节点端口> failed=timeout bytes=0
TLS replay attempt=1 probe=1 server=<reality节点v4>:<reality节点端口> complete probe_status=TO bytes=3499
TLS replay B randomized ClientHello legacy_session_id len=32 before=216ecd1c after=2ee08b81
TLS replay waiting 1s before attempt=B randomized session_id recheck
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口>
TLS replay attempt=2 probe=3 server=<reality节点v4>:<reality节点端口> sent probe bytes=5
TLS replay attempt=2 probe=6 server=<reality节点v4>:<reality节点端口> sent probe bytes=7
TLS replay attempt=2 probe=3 server=<reality节点v4>:<reality节点端口> complete probe_status=ALERT bytes=3523
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口> failed=timeout bytes=0
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口> failed=timeout bytes=0
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口> failed=timeout bytes=0
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口> failed=timeout bytes=0
TLS replay attempt=2 server=<reality节点v4>:<reality节点端口> failed=timeout bytes=0
TLS replay attempt=2 probe=6 server=<reality节点v4>:<reality节点端口> complete probe_status=ALERT bytes=3522
TLS replay confirmation failed; excluding server=<reality节点v4>:<reality节点端口> round=1

我的是nginx

[FuckCCP8964]

替換以後有重新執行嗎？
我替換以後無論target到nginx還是 www.apple.com 都能檢測出來，結果都是最後兩次的FIN與xray的Alert不同。

[ysyl-re]

替換以後有重新執行嗎？ 我替換以後無論target到nginx還是 www.apple.com 都能檢測出來，結果都是最後兩次的FIN與xray的Alert不同。

有的，替换后我删除了然后重新make

[FuckCCP8964]

昨晚上用ai改了好久的代码。https://github.com/JarmoHu/VLESS-cracker/tree/main 已经通过细微的差别识别出了akamai的cdn了，www.apple.com已经成功识别

或者可以直接編譯這個repo測試，我替換的值也是從這個repo裡面複製的

[ysyl-re]

昨晚上用ai改了好久的代码。https://github.com/JarmoHu/VLESS-cracker/tree/main 已经通过细微的差别识别出了akamai的cdn了，www.apple.com已经成功识别

或者可以直接編譯這個repo測試，我替換的值也是從這個repo裡面複製的

他的仓库我也有用过，也是一切正常，和原仓库一样什么都不输出表示一切正常，除非加上-l info能看到详情

[FuckCCP8964]

我不清楚你那邊的情況，反正他測試的結果與我替換數值測試的結果是一樣的，nginx也沒有倖免。

[ysyl-re]

我不清楚你那邊的情況，反正他測試的結果與我替換數值測試的結果是一樣的，nginx也沒有倖免。

那就很怪了，不管怎么说感谢回复，这个问题我再观望看看

[FuckCCP8964]

另外我的nginx版本：
nginx version: nginx/1.30.0
built by gcc 15.2.0 (Debian 15.2.0-16)
built with OpenSSL 3.6.2 7 Apr 2026
不清楚是否因為不同的nginx/openssl版本導致的行為差異，還有我並不是用curl測試的，是直接使用shadowrocket測試的，但是這個應該不影響結果。