From e41e4f18c730abdba8e095419d186dba4b6ed817 Mon Sep 17 00:00:00 2001
From: Alexander Golovanov <sasha_spb_ru@yahoo.com>
Date: Fri, 18 Sep 2026 15:58:06 +0300
Subject: [PATCH] [blockcheck2] Add a separate very quick scan level

quick is meant to be the fast option, but it only changes how repeated
attempts are handled - it still works through every variation of a
strategy regardless. For strategies built around a fake TLS handshake,
that means testing dozens of small tweaks (different TTLs, different
TCP tricks, extra padding, split positions) well past the point where
an early exit would have been possible.

The new veryquick level stops as soon as a strategy succeeds, instead
of continuing through the rest just to be thorough. It's a separate
option rather than a change to quick, so quick, standard, and force
behave exactly as they did.
---
 blockcheck2.d/standard/25-fake.sh          |  9 +++++++++
 blockcheck2.d/standard/30-faked.sh         |  6 ++++++
 blockcheck2.d/standard/35-hostfake.sh      |  8 ++++++++
 blockcheck2.d/standard/50-fake-multi.sh    | 10 ++++++++++
 blockcheck2.d/standard/55-fake-faked.sh    | 16 ++++++++++++++++
 blockcheck2.d/standard/60-fake-hostfake.sh |  8 ++++++++
 blockcheck2.sh                             | 11 ++++++-----
 docs/manual.en.md                          |  1 +
 docs/manual.md                             |  1 +
 9 files changed, 65 insertions(+), 5 deletions(-)

diff --git a/blockcheck2.d/standard/25-fake.sh b/blockcheck2.d/standard/25-fake.sh
index 121c115..cd12e0f 100644
--- a/blockcheck2.d/standard/25-fake.sh
+++ b/blockcheck2.d/standard/25-fake.sh
@@ -41,7 +41,9 @@ pktws_check_http()
 			pktws_curl_test_update $testf $domain ${FAKE_HTTP:+--blob=fake_http:@"$FAKE_HTTP" }$PAYLOAD --lua-desync=fake:blob=$ff:$fooling:repeats=$FAKE_REPEATS && ok=1
 			# duplicate SYN with MD5
 			contains "$fooling" tcp_md5 && pktws_curl_test_update $testf $domain ${FAKE_HTTP:+--blob=$fake:@"$FAKE_HTTP" }$PAYLOAD --lua-desync=fake:blob=$ff:$fooling:repeats=$FAKE_REPEATS --payload=empty "--out-range=<s1" --lua-desync=send:$TCP_MD5 && ok=1
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 	for ttl in $attls; do
 		for ff in $fake 0x00000000; do
@@ -52,6 +54,7 @@ pktws_check_http()
 				}
 			done
 		done
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 
 	[ $ok = 0 -a "$SCANLEVEL" != force ] && need_fake=1
@@ -64,9 +67,13 @@ pktws_fake_https_vary_()
 	local ok_any=0 testf=$1 domain="$2" fooling="$3" pre="$4" post="$5"
 	shift; shift; shift
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain $pre $PAYLOAD --lua-desync=fake:blob=0x00000000:$fooling:repeats=$FAKE_REPEATS $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=0x00000000:$fooling:repeats=$FAKE_REPEATS --lua-desync=fake:blob=$fake:$fooling:tls_mod=rnd,dupsid:repeats=$FAKE_REPEATS $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }$pre $PAYLOAD --lua-desync=multisplit:blob=$fake:$fooling:pos=2:nodrop:repeats=$FAKE_REPEATS $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=$fake:$fooling:tls_mod=rnd,dupsid,padencap:repeats=$FAKE_REPEATS $post && ok_any=1
 	[ "$ok_any" = 1 ] && ok=1
 }
@@ -115,11 +122,13 @@ pktws_check_https_tls()
 	done
 	for fooling in $FOOLINGS_TCP; do
 		pktws_fake_https_vary $testf $domain "$fooling" "$pre"
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 	for ttl in $attls; do
 		for f in '' "--payload=empty --out-range=s1<d1 --lua-desync=pktmod:ip${IPVV}_ttl=1"; do
 			pktws_fake_https_vary $testf $domain "ip${IPVV}_autottl=-$ttl,3-20" "$pre" "$f" && [ "$SCANLEVEL" != force ] && break
 		done
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 
 	[ $ok = 0 -a "$SCANLEVEL" != force ] && need_fake=1
diff --git a/blockcheck2.d/standard/30-faked.sh b/blockcheck2.d/standard/30-faked.sh
index 3956dfe..94923f5 100644
--- a/blockcheck2.d/standard/30-faked.sh
+++ b/blockcheck2.d/standard/30-faked.sh
@@ -35,6 +35,7 @@ pktws_check_faked()
 						[ "$SCANLEVEL" = force ] || break
 					}
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
 			[ "$ok" = 1 ] && break
 		done
@@ -43,7 +44,9 @@ pktws_check_faked()
 				pktws_curl_test_update $testf $domain ${FAKED_PATTERN:+--blob=faked_pat:@"$FAKED_PATTERN" }$pre $PAYLOAD --lua-desync=$splitf:${FAKED_PATTERN:+pattern=faked_pat:}pos=$split:$fooling && ok=1
 				# duplicate SYN with MD5
 				contains "$fooling" tcp_md5 && pktws_curl_test_update $testf $domain ${FAKED_PATTERN:+--blob=faked_pat:@"$FAKED_PATTERN" }$pre $PAYLOAD --lua-desync=$splitf:${FAKED_PATTERN:+pattern=faked_pat:}pos=$split:$fooling:repeats=$FAKE_REPEATS --payload=empty --out-range="<s1" --lua-desync=send:$TCP_MD5 && ok=1
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
 		for ttl in $attls; do
 			for split in $splits; do
@@ -53,10 +56,13 @@ pktws_check_faked()
 						[ "$SCANLEVEL" = force ] || break
 					}
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
 		[ $ok = 0 -a "$SCANLEVEL" != force ] && eval need_$splitf=1
 		[ $ok = 1 ] && ok_any=1
+		[ "$SCANLEVEL" = veryquick -a "$ok_any" = 1 ] && break
 	done
 	[ "$ok_any" = 1 ]
 }
diff --git a/blockcheck2.d/standard/35-hostfake.sh b/blockcheck2.d/standard/35-hostfake.sh
index fc635eb..cdd9b2a 100644
--- a/blockcheck2.d/standard/35-hostfake.sh
+++ b/blockcheck2.d/standard/35-hostfake.sh
@@ -7,11 +7,17 @@ pktws_hostfake_vary_()
 
 	for disorder in '' 'disorder_after:'; do
 		pktws_curl_test_update $testf $domain $pre $PAYLOAD --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}$fooling:repeats=$FAKE_REPEATS $post && ok_any=1
+		[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 		pktws_curl_test_update $testf $domain $pre $PAYLOAD --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}nofake1:$fooling:repeats=$FAKE_REPEATS $post && ok_any=1
+		[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 		pktws_curl_test_update $testf $domain $pre $PAYLOAD --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}nofake2:$fooling:repeats=$FAKE_REPEATS $post && ok_any=1
+		[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 		pktws_curl_test_update $testf $domain $pre $PAYLOAD --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}midhost=midsld:$fooling:repeats=$FAKE_REPEATS $post && ok_any=1
+		[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 		pktws_curl_test_update $testf $domain $pre $PAYLOAD --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}nofake1:midhost=midsld:$fooling:repeats=$FAKE_REPEATS $post && ok_any=1
+		[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 		pktws_curl_test_update $testf $domain $pre $PAYLOAD --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}nofake2:midhost=midsld:$fooling:repeats=$FAKE_REPEATS $post && ok_any=1
+		[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	done
 	[ "$ok_any" = 1 ] && ok=1
 }
@@ -51,11 +57,13 @@ pktws_check_hostfake()
 	done
 	for fooling in $FOOLINGS_TCP; do
 		pktws_hostfake_vary $testf $domain "$fooling" "$pre"
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 	for ttl in $attls; do
 		for f in '' "--payload=empty --out-range=s1<d1 --lua-desync=pktmod:ip${IPVV}_ttl=1"; do
 			pktws_hostfake_vary $testf $domain "ip${IPVV}_autottl=-$ttl,3-20" "$pre" "$f" && [ "$SCANLEVEL" != force ] && break
 		done
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 	[ $ok = 0 -a "$SCANLEVEL" != force ] && need_hostfakesplit=1
 	[ $ok = 1 ]
diff --git a/blockcheck2.d/standard/50-fake-multi.sh b/blockcheck2.d/standard/50-fake-multi.sh
index d2b2d96..d56425d 100644
--- a/blockcheck2.d/standard/50-fake-multi.sh
+++ b/blockcheck2.d/standard/50-fake-multi.sh
@@ -70,9 +70,13 @@ pktws_fake_https_vary_()
 	local ok_any=0 testf=$1 domain="$2" fooling="$3" pre="$4" post="$5"
 	shift; shift; shift
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS --lua-desync=$splitf:pos=$split $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain $pre $PAYLOAD --lua-desync=fake:blob=0x00000000:$fooling:repeats=$FAKE_REPEATS --lua-desync=$splitf:pos=$split $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=0x00000000:$fooling:repeats=$FAKE_REPEATS --lua-desync=fake:blob=$fake:$fooling:tls_mod=rnd,dupsid:repeats=$FAKE_REPEATS --lua-desync=$splitf:pos=$split $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }$pre $PAYLOAD --lua-desync=multisplit:blob=$fake:$fooling:pos=2:nodrop:repeats=$FAKE_REPEATS --lua-desync=$splitf:pos=$split $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=$fake:$fooling:tls_mod=rnd,dupsid,padencap:repeats=$FAKE_REPEATS --lua-desync=$splitf:pos=$split $post && ok_any=1
 	[ "$ok_any" = 1 ] && ok=1
 }
@@ -122,22 +126,28 @@ pktws_check_https_tls()
 				for f in '' "--payload=empty --out-range=s1<d1 --lua-desync=pktmod:ip${IPVV}_ttl=1"; do
 					pktws_fake_https_vary $testf $domain "ip${IPVV}_ttl=$ttl" "$pre" "$f" && [ "$SCANLEVEL" != force ] && break
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
 			[ "$ok" = 1 ] && break
 		done
 		for fooling in $FOOLINGS_TCP; do
 			for split in $splits; do
 				pktws_fake_https_vary $testf $domain "$fooling" "$pre"
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
 		for ttl in $attls; do
 			for split in $splits; do
 				for f in '' "--payload=empty --out-range=s1<d1 --lua-desync=pktmod:ip${IPVV}_ttl=1"; do
 					pktws_fake_https_vary $testf $domain "ip${IPVV}_autottl=-$ttl,3-20" "$pre" "$f" && [ "$SCANLEVEL" != force ] && break
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
 		[ "$ok" = 1 ] && ok_any=1
+		[ "$SCANLEVEL" = veryquick -a "$ok_any" = 1 ] && break
 	done
 	[ "$ok_any" = 1 ]
 }
diff --git a/blockcheck2.d/standard/55-fake-faked.sh b/blockcheck2.d/standard/55-fake-faked.sh
index aeb9ac2..8faad3a 100644
--- a/blockcheck2.d/standard/55-fake-faked.sh
+++ b/blockcheck2.d/standard/55-fake-faked.sh
@@ -38,6 +38,7 @@ pktws_check_http()
 						}
 					done
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
 			[ "$ok" = 1 ] && break
 		done
@@ -48,7 +49,9 @@ pktws_check_http()
 					# duplicate SYN with MD5
 					contains "$fooling" tcp_md5 && pktws_curl_test_update $testf $domain ${FAKE_HTTP:+--blob=$fake:@"$FAKE_HTTP" }${FAKED_PATTERN_HTTP:+--blob=faked_pat:@"$FAKED_PATTERN_HTTP" }$PAYLOAD --lua-desync=fake:blob=$ff:$fooling:repeats=$FAKE_REPEATS --lua-desync=$splitf:${FAKED_PATTERN_HTTP:+pattern=faked_pat:}pos=$split:$fooling:repeats=$FAKE_REPEATS --payload=empty "--out-range=<s1" --lua-desync=send:$TCP_MD5 && ok=1
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
 		for ttl in $attls; do
 			for split in $splits; do
@@ -60,8 +63,11 @@ pktws_check_http()
 						}
 					done
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 }
 
@@ -70,9 +76,13 @@ pktws_fake_https_vary_()
 	local ok_any=0 testf=$1 domain="$2" fooling="$3" pre="$4" post="$5"
 	shift; shift; shift
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }${FAKED_PATTERN_HTTPS:+--blob=faked_pat:@"$FAKED_PATTERN_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS --lua-desync=$splitf:${FAKED_PATTERN_HTTPS:+pattern=faked_pat:}pos=$split:$fooling $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKED_PATTERN_HTTPS:+--blob=faked_pat:@"$FAKED_PATTERN_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=0x00000000:$fooling:repeats=$FAKE_REPEATS --lua-desync=$splitf:${FAKED_PATTERN_HTTPS:+pattern=faked_pat:}pos=$split:$fooling $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }${FAKED_PATTERN_HTTPS:+--blob=faked_pat:@"$FAKED_PATTERN_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=0x00000000:$fooling:repeats=$FAKE_REPEATS --lua-desync=fake:blob=$fake:$fooling:tls_mod=rnd,dupsid:repeats=$FAKE_REPEATS --lua-desync=$splitf:${FAKED_PATTERN_HTTPS:+pattern=faked_pat:}pos=$split:$fooling $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }${FAKED_PATTERN_HTTPS:+--blob=faked_pat:@"$FAKED_PATTERN_HTTPS" }$pre $PAYLOAD --lua-desync=multisplit:blob=$fake:$fooling:pos=2:nodrop:repeats=$FAKE_REPEATS --lua-desync=$splitf:${FAKED_PATTERN_HTTPS:+pattern=faked_pat:}pos=$split:$fooling $post && ok_any=1
+	[ "$ok_any" = 1 -a "$SCANLEVEL" = veryquick ] && { ok=1; return 0; }
 	pktws_curl_test_update $testf $domain ${FAKE_HTTPS:+--blob=$fake:@"$FAKE_HTTPS" }${FAKED_PATTERN_HTTPS:+--blob=faked_pat:@"$FAKED_PATTERN_HTTPS" }$pre $PAYLOAD --lua-desync=fake:blob=$fake:$fooling:tls_mod=rnd,dupsid,padencap:repeats=$FAKE_REPEATS --lua-desync=$splitf:${FAKED_PATTERN_HTTPS:+pattern=faked_pat:}pos=$split:$fooling $post && ok_any=1
 	[ "$ok_any" = 1 ] && ok=1
 
@@ -123,22 +133,28 @@ pktws_check_https_tls()
 				for f in '' "--payload=empty --out-range=s1<d1 --lua-desync=pktmod:ip${IPVV}_ttl=1"; do
 					pktws_fake_https_vary $testf $domain "ip${IPVV}_ttl=$ttl" "$pre" "$f" && [ "$SCANLEVEL" != force ] && break
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
 			[ "$ok" = 1 ] && break
 		done
 		for fooling in $FOOLINGS_TCP; do
 			for split in $splits; do
 				pktws_fake_https_vary $testf $domain "$fooling" "$pre"
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
 		for ttl in $attls; do
 			for split in $splits; do
 				for f in '' "--payload=empty --out-range=s1<d1 --lua-desync=pktmod:ip${IPVV}_ttl=1"; do
 					pktws_fake_https_vary $testf $domain "ip${IPVV}_autottl=-$ttl,3-20" "$pre" "$f" && [ "$SCANLEVEL" != force ] && break
 				done
+				[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 			done
+			[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 		done
 		[ "$ok" = 1 ] && ok_any=1
+		[ "$SCANLEVEL" = veryquick -a "$ok_any" = 1 ] && break
 	done
 	[ "$ok_any" = 1 ]
 }
diff --git a/blockcheck2.d/standard/60-fake-hostfake.sh b/blockcheck2.d/standard/60-fake-hostfake.sh
index 9551434..d195ba4 100644
--- a/blockcheck2.d/standard/60-fake-hostfake.sh
+++ b/blockcheck2.d/standard/60-fake-hostfake.sh
@@ -7,11 +7,17 @@ pktws_hostfake_vary_()
 
 	for disorder in '' 'disorder_after:'; do
 		pktws_curl_test_update $testf $domain $pre ${FAKE:+--blob=$fake:@"$FAKE" }$PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}$fooling:repeats=$FAKE_REPEATS $post && ok=1
+		[ "$ok" = 1 -a "$SCANLEVEL" = veryquick ] && return 0
 		pktws_curl_test_update $testf $domain $pre ${FAKE:+--blob=$fake:@"$FAKE" }$PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}nofake1:$fooling:repeats=$FAKE_REPEATS $post && ok=1
+		[ "$ok" = 1 -a "$SCANLEVEL" = veryquick ] && return 0
 		pktws_curl_test_update $testf $domain $pre ${FAKE:+--blob=$fake:@"$FAKE" }$PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}nofake2:$fooling:repeats=$FAKE_REPEATS $post && ok=1
+		[ "$ok" = 1 -a "$SCANLEVEL" = veryquick ] && return 0
 		pktws_curl_test_update $testf $domain $pre ${FAKE:+--blob=$fake:@"$FAKE" }$PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}midhost=midsld:$fooling:repeats=$FAKE_REPEATS $post && ok=1
+		[ "$ok" = 1 -a "$SCANLEVEL" = veryquick ] && return 0
 		pktws_curl_test_update $testf $domain $pre ${FAKE:+--blob=$fake:@"$FAKE" }$PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}nofake1:midhost=midsld:$fooling:repeats=$FAKE_REPEATS $post && ok=1
+		[ "$ok" = 1 -a "$SCANLEVEL" = veryquick ] && return 0
 		pktws_curl_test_update $testf $domain $pre ${FAKE:+--blob=$fake:@"$FAKE" }$PAYLOAD --lua-desync=fake:blob=$fake:$fooling:repeats=$FAKE_REPEATS --lua-desync=hostfakesplit:${HOSTFAKE:+host=${HOSTFAKE}:}${disorder}nofake2:midhost=midsld:$fooling:repeats=$FAKE_REPEATS $post && ok=1
+		[ "$ok" = 1 -a "$SCANLEVEL" = veryquick ] && return 0
 	done
 }
 pktws_hostfake_vary()
@@ -48,6 +54,7 @@ pktws_check_hostfake()
 	done
 	for fooling in $FOOLINGS_TCP; do
 		pktws_hostfake_vary $testf $domain "$fooling" "$pre" && ok=1
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 	for ttl in $attls; do
 		for f in '' "--payload=empty --out-range=s1<d1 --lua-desync=pktmod:ip${IPVV}_ttl=1"; do
@@ -56,6 +63,7 @@ pktws_check_hostfake()
 				[ "$SCANLEVEL" = force ] || break
 			}
 		done
+		[ "$SCANLEVEL" = veryquick -a "$ok" = 1 ] && break
 	done
 	[ "$ok" = 1 ]
 }
diff --git a/blockcheck2.sh b/blockcheck2.sh
index 6ddc21a..869c4c9 100755
--- a/blockcheck2.sh
+++ b/blockcheck2.sh
@@ -1083,7 +1083,7 @@ curl_test()
 				[ $REPEATS -gt 1 ] && echo 'AVAILABLE'
 			else
 				code=$?
-				[ "$SCANLEVEL" = quick ] && break
+				[ "$SCANLEVEL" = quick -o "$SCANLEVEL" = veryquick ] && break
 			fi
 		done
 	fi
@@ -1708,10 +1708,11 @@ ask_params()
 		SCANLEVEL=standard
 		[ "$BATCH" = 1 ] || {
 			echo
-			echo quick    - in multi-attempt mode skip further attempts after first failure
-			echo standard - do investigation what works on your DPI
-			echo force    - scan maximum despite of result
-			ask_list SCANLEVEL "quick standard force" "$SCANLEVEL"
+			echo veryquick - same as quick, and also stop testing more variations of a strategy family once one already succeeds
+			echo quick     - in multi-attempt mode skip further attempts after first failure
+			echo standard  - do investigation what works on your DPI
+			echo force     - scan maximum despite of result
+			ask_list SCANLEVEL "veryquick quick standard force" "$SCANLEVEL"
 		}
 	}
 
diff --git a/docs/manual.en.md b/docs/manual.en.md
index 5343a28..511eca2 100644
--- a/docs/manual.en.md
+++ b/docs/manual.en.md
@@ -4795,6 +4795,7 @@ Parallel mode is [supported](#shell-variables). In this mode, each attempt is ex
 
 - **standard** - uses a test algorithm that excludes strategies deemed irrelevant based on previous successes or other criteria. In the case of multiple attempts, testing does not stop upon failure. The success rate and curl errors can also provide useful information for situational analysis.
 - **quick** - same as standard, but when using multiple attempts, testing stops after the first failure.
+- **veryquick** - same as quick, and also stops testing further variations of a strategy family (extra TCP foolings, autottl deltas, TTL values, and, where applicable, multisplit/fakedsplit positions and split-mechanisms) as soon as any combination has already succeeded for the current target, instead of continuing through the rest for completeness. Only affects the fake-based strategy families (25-fake.sh, 30-faked.sh, 35-hostfake.sh, 50-fake-multi.sh, 55-fake-faked.sh, 60-fake-hostfake.sh); can make those noticeably faster to test when an early candidate already succeeds, at the cost of not necessarily finding every strategy that would also have succeeded (success here means curl got through - it says nothing about how that strategy will actually do in a real browser).
 - **force** - tests as extensively as possible, regardless of previous test results.
 
 ### Supported protocols
diff --git a/docs/manual.md b/docs/manual.md
index 783942a..13c81c2 100644
--- a/docs/manual.md
+++ b/docs/manual.md
@@ -4983,6 +4983,7 @@ blockcheck2 способен определить подменяется ли DN
 
 - standard - использовать алгоритм теста, позволяющий исключить тестирование неактуальных по его мнению стратегий в зависимости от успешности предыдущих или по каким-то другим критериям. В случае множественных попыток тестирование не прекращается при неудаче. Процент успеха и ошибки curl тоже могут служить полезной информации при анализе ситуации.
 - quick - то же самое, что и standard, но при использовании множественных попыток прекращение тестирования после первой неудачи
+- veryquick - то же самое, что и quick, а также прекращение перебора оставшихся вариантов внутри семейства стратегий (доп. TCP foolings, autottl-дельты, TTL, а где применимо - позиции multisplit/fakedsplit и сами split-механизмы), как только для текущей цели уже нашлась хоть одна успешная комбинация, вместо перебора всех вариантов до конца. Затрагивает только семейства на основе fake (25-fake.sh, 30-faked.sh, 35-hostfake.sh, 50-fake-multi.sh, 55-fake-faked.sh, 60-fake-hostfake.sh); может заметно ускорить тестирование этих семейств, если успешная комбинация находится рано, ценой того, что не все стратегии, которые тоже могли бы оказаться успешными, будут найдены (успех здесь значит, что curl прошел - это ничего не говорит о том, как эта стратегия поведет себя в реальном браузере)
 - force - тестировать максимально много без учета результата предыдущих тестов
 
 ### Поддерживаемые протоколы