Cuttlefish

Force any Windows process to use a specific network interface — no VPN, no routing table edits, no admin firewall rules.

Cuttlefish hooks directly into Winsock (bind, connect, WSAConnect, WSASendTo) using Frida to redirect all socket calls of a target process to the interface of your choice. IPv6 is blocked at hook level to guarantee zero leaks.

Features

Bindings

• Select any running windowed process
• Bind it to any active network interface (Wi-Fi, Ethernet, 4G dongle, Bluetooth PAN…)
• Bind + Inject — inject into an already-running process
• Launch + Inject — launch an executable and inject immediately
• Force IPv4 only — disables IPv6 on home adapters while bound (required for Chromium/Electron apps like Claude, Edge)
• Live interface monitor: automatically cuts traffic if the bound interface goes down (fail-close)
• Leak detector: alerts if traffic escapes outside the bound interface

Stealth

• Transparent overlay over any target window (adjustable opacity)
• Always On Top toggle
• Hide from Taskbar
• Panic Hide — instantly hide the target window
• Configurable global hotkeys (defaults: Ctrl+Alt+C/H/A/F/Z)

Ghost Traffic

• Generates background HTTP traffic through the bound interface to simulate normal browsing activity
• Modes: Off, Heartbeat (connectivity checks), Browsing (random realistic requests)

Requirements

• Windows 10/11 (64-bit)
• Python 3.12+
• Administrator privileges (required for Frida injection and IPv6 control)

Installation

git clone https://github.com/arnaudleroy20/cuttlefish.git
cd cuttlefish
pip install -r requirements.txt

pyinstaller and pytest/pytest-qt are dev dependencies — you can skip them if you just want to run from source.

Usage

# Run from source (as administrator)
python -m cuttlefish

Or build a standalone .exe:

build.bat

The compiled binary is output to dist/Cuttlefish/Cuttlefish.exe.

How It Works

Cuttlefish uses Frida to inject a JavaScript hook (cuttlefish/hooks/winsock_hook.js) into the target process at runtime. The hook intercepts every Winsock socket call:

• bind() — rewrites INADDR_ANY (and any other IPv4 address) to the chosen interface IP
• connect() / WSAConnect() — forces a pre-bind to the chosen interface before each connection
• WSASendTo() — blocks IPv6 UDP (used by Chromium for QUIC/HTTP3)
• Any IPv6 socket call → blocked with WSAENETDOWN, forcing the app to fall back to IPv4

This works on any process without modifying it, without touching the system routing table, and without setting up a VPN tunnel.

Configuration

Persistent settings are saved to ~/.cuttlefish/config.json (created automatically on first run). This includes hotkey mappings and last-used interface.

Tests

pytest

Disclaimer

Cuttlefish is intended for privacy, network testing, and research purposes on systems you own or have explicit permission to test. Do not use it to bypass network controls you are not authorized to bypass. The author is not responsible for misuse.

License

MIT — © 2026 Arnaud Leroy