zapret-win-bundle refuses to be one-click, which is why blockcheck ships with it

A bundle, not a product, and the README admits it

The repository description is short: zapret and blockcheck binary bundle for windows. What is inside is two upstream projects, zapret1 and zapret2, merged for Windows with a minimal Cygwin and the blockcheck analyser. There is no homepage, no license is declared, and the repository has no GitHub releases at all, so there is no version to pin.

The framing in the readme is unusual enough to quote in spirit rather than paraphrase: this is not a one-button solution for opening sites, there are no ready-made strategies and no open-sites button, and you need to understand how zapret works or the bundle is useless. That is a blunt statement of scope from the author, and it decides who should install this. Someone looking for a toggle will uninstall it within an hour.

The Windows target list is specific, and it is where most of the friction lives. Windows 7 x64 and Windows Server 2008 R2 need ESU updates or a replacement of the windivert files. Windows 8+ x64 and Server 2012+ may need secure boot disabled. Windows 11+ ARM64 and Server 2025+ require testsigning mode. And Windows Server of any supported vintage requires installing the wireless networking feature, which is odd enough that it is worth checking before you plan an installation.

The last push was on 2026-09-18 and the repository is not archived, so work is happening on master even without tagged artifacts.

Two engines, winws.exe and winws2.exe, and why both are here

The bundle carries both generations of the tool. winws.exe is the main zapret component, the nfqws build for Windows, and winws2.exe is the zapret2 equivalent built as nfqws2. Both are described in the file list as DPI bypass tools, and having both in one directory is the point of the bundle: you can compare behaviour of the older and newer engines on the same machine rather than switching installs.

Around them sit the entry scripts. preset1_example.cmd and preset2_example.cmd run an example strategy interactively against winws and winws2 respectively, and the readme notes in the Russian section that an example strategy is not a ready-made cure. preset2_wireguard.cmd runs a WireGuard protocol bypass on any ports, which is the one script tied to a specific protocol.

Two support binaries come from the Cygwin set. killall.exe sends signals to winws and is used by reload_lists.cmd, and elevator.exe simply runs a program as administrator. cygwin\cygwin.cmd opens a Cygwin prompt with the current user's privileges, while cygwin\cygwin-admin.cmd does the same as administrator, and _CMD_ADMIN.cmd is the plain route to an elevated command prompt.

For anything persistent there is the service*.cmd family, which handles Windows service installation and control for non-interactive autostart. The Russian section of the readme carries a warning in capitals: do not run these without editing them first.

blockcheck only works when zapret is stopped

blockcheck is the diagnostic half of the bundle and the reason to prefer this repository over downloading zapret alone. Four scripts ship it: blockcheck\blockcheck.cmd and blockcheck\blockcheck2.cmd are the two analysers, the second based on winws2, and blockcheck-kyber.cmd plus blockcheck2-kyber.cmd are the same analysers running CURL with a multi-segment TLS Client Hello.

The constraint is repeated in every one of those descriptions and it is a real operational rule: run blockcheck only with zapret and other DPI bypass software stopped. Running an analyser while a bypass tool is already altering traffic measures the bypass, not the network, and the results will mislead you into picking a strategy for a problem you do not have.

The kyber variants exist because the TLS Client Hello shape matters to the measurement. If a strategy depends on how the first packet is fragmented, then the tool issuing the request has to be able to do multi-segment Client Hello, which is what the CURL-based variants add.

What the readme does not document is the output format of blockcheck, how long a run takes, or how to map its recommendation back onto a specific winws invocation. The repository also has a windivert-hide/ directory at the top level, whose purpose is not explained in the documentation, so treat it as something to read before running rather than something to run.

Platform preparation scripts are the actual installation steps

There is no package manager entry and no install command in the documentation. Installation is: get the bundle, then run the preparation script your platform needs.

For ARM64 the readme gives two steps. Run arm64\install_arm64.cmd, then reboot if testsigning mode was not already enabled. You should see a test mode watermark in the bottom right corner of the screen afterwards, which is the only confirmation the readme gives.

For Windows 7, if windivert does not work as it ships, run win7\install_win7.cmd, or apply the ESU updates instead. That is a fork in the road rather than an additive step, so pick one.

One more script matters before you experiment with strategies: enable_timestamps.cmd turns on TCP timestamps. They are disabled by default and the readme states they are required for ts fooling, so a ts strategy will silently do nothing useful without that script having been run.

To undo the driver installation there is windivert_delete.cmd, which stops and removes the windivert driver. Keeping that script is the reason the bundle is reversible, and rolling back cleanly matters more here than in most tools because the driver sits in the packet path.

The antivirus problem, and how to check the driver yourself

The readme has a section on antiviruses and it is blunt: windivert may cause antivirus reaction, and antivirus software can treat it as a potential risk or a hacker instrument. The offered remedies are an exclusion or turning the product off.

Before you do either, there is a verification step in the documentation that deserves to be the first thing you do. The driver windivert64.sys is signed for loading into the 64-bit Windows kernel, and the readme suggests comparing the files in the bundle against the originals published by the author at reqrypt.org/download. That comparison is what turns the antivirus warning from an assertion into something you checked.

The readme describes WinDivert as a tool that intercepts and filters traffic and as a replacement for iptables and NFQUEUE under Windows. It notes that both good and bad programs can use it.

If you decide to exclude the file, keep the exclusion as narrow as the one path rather than the whole application directory, and remember that on Server you are also changing the security posture of a machine that is probably not the one hosting your workload.

How this compares with running zapret upstream

The two zapret repositories it draws from are zapret1 and zapret2, and this bundle is packaging rather than a fork of behaviour. Upstream, you would assemble a Windows toolchain, a Cygwin environment, the blockcheck scripts and the per-platform preparation yourself. Here they arrive in one directory with names that describe what each file does, which is a real saving on the first run and a liability later.

The liability is versioning. The repository has no GitHub releases, so there is no tag, no changelog reference and nothing to roll back to. The top-level tree has tools/ and zapret-winws/ alongside the documented directories, and without a tag there is no way to tell which upstream commit a given copy corresponds to. If you depend on this for ongoing access rather than a single evening of troubleshooting, that gap is the first thing to solve.

The alternative approach for someone with technical depth is to use the blockcheck analyser to find which transport strategy works on your network and then implement that strategy against upstream zapret directly, keeping the diagnostic tooling and the runtime under separate version control. You give up the one-folder convenience and gain reproducibility.

Editorial conclusion

This bundle is for a Windows user who already understands how zapret strategies work and needs the blockcheck analyser in the same folder as winws.exe and winws2.exe, since the diagnostics and the fix belong together. It is not for someone who wants a button that makes blocked sites open, and the README says so. Verify two things before running anything: whether your Windows edition is on the supported list, because Server needs the wireless networking feature and ARM64 needs testsigning mode, and whether blockcheck\blockcheck.cmd is run with zapret stopped, as the README requires. If antivirus is deleting windivert64.sys, compare the file against the author's originals at reqrypt.org/download before excluding anything.

Frequently asked questions

Official sources

1. bol-van/zapret-win-bundle on GitHub
2. Issues
3. README