🚀 Xray-knife v11.5.0 (JOIN THE TELEGRAM CHANNEL)

https://t.me/lilendian0x00

Links that carry an xray finalmask (fm=) now get tested with it, and xray-core moves to 26.10.29. 🛠️

⚠️ After upgrading

• 📡 Plain type=kcp links use the original mKCP obfuscation again. That is what mKCP always did before finalmask, what older xray and v2fly servers expect, and what v2rayN sends. A server on a recent xray-core whose kcp inbound has no finalmask wants bare mKCP: add fm=%7B%7D (fm={}) to those links.
• 🔐 Links with fm stay on xray-core. sing-box would drop the masks, so -z auto no longer moves them there for insecure=1 or for plaintext to a public server. xray-core can't skip certificate checks, so a self-signed server needs pcs= / pinSHA256=. One exception: a Hysteria2 link that asks for insecure and whose fm only adds noise or quicParams stays on sing-box, because the server never sees those masks.

🎭 Finalmask in share links

xray shares finalmask as fm= (URL-encoded JSON, the same as v2rayN). xray-knife used to ignore it, so a link whose server needs a mask failed even when the server was fine.

• 🔗 Read and write fm on VLESS, VMess, Trojan, Shadowsocks, Hysteria2 and WireGuard links. Exported and regenerated links keep it.
• 🧩 Every xray-core mask works: fragment, xmc, noise, salamander (gecko too, with packetSize), mkcp-legacy, xdns, xicmp, realm, udphop, header-custom, sudoku, filter, and quicParams.
• 📥 proxy inbound --inbound-config applies fm too, so a masked link works as the local inbound.
• 🔄 fm is the whole finalmask. As in v2rayN, it replaces the salamander from obfs and anything the old mKCP params imply, so the mask order matches the server's.
• 🕰️ Old mKCP params work again. xray-core 26.x silently ignored headerType and seed on kcp links; they now map to mkcp-legacy masks, as v2rayN does.
• 📦 xray JSON subscriptions keep their finalmask when imported. A Hysteria2 salamander still goes in obfs too, so clients that don't read fm keep working.
• 🧭 Hysteria2 picks its core by fm. A link whose fm only repeats obfs stays on sing-box; anything more (gecko, another password, more masks) runs on xray-core.
• ✂️ --fragment works with masked links. Its noise goes in just before a udphop or xicmp mask, which xray-core requires to come last.

Thanks @ranthe21 for the PR (#75), tested against a live xray server across every mask type and transport. 🙏

🆙 xray-core 26.10.29

• 🌐 WebSocket links end cleanly when the server sends a normal close frame, instead of reporting an error.
• 🍎 macOS: TCP keepalive idle and interval were swapped.
• 🪟 Windows: --bind works on an interface that has only IPv4 or only IPv6.
• 🏷️ The private address list follows the IANA registries. That changes which servers may take plaintext VLESS/Trojan on xray-core: 6to4 (2002::/16), Teredo (2001::/32) and NAT64 (64:ff9b::/96) now count as private, and most of 192.0.0.0/24 no longer does.

📦 Install

Grab a prebuilt binary from the assets below (verify with sha256sum -c --ignore-missing SHA256SUMS), or install with Go. The tags match the release binaries:

go install -tags "with_gvisor,with_quic,with_wireguard,with_utls,with_clash_api,with_grpc" \
  github.com/lilendian0x00/xray-knife/v11@latest

Full Changelog: v11.4.1...v11.5.0