WINSOCK PACKET EDITOR
WPE x64 is an open-source Winsock packet interceptor and editor. It adapts to 32- and 64-bit targets and can modify and forward the network packets of any client program.
Requirements
Check your environment before you start:
| Item | Requirement |
|---|---|
| OS | Windows 10 / 11 · Server 2019 / 2022 · x64 |
| Runtime | .NET Framework 4.8 (ships with Windows 10 and 11) |
| Interface runtime | Microsoft Edge WebView2: bundled with Windows 11, normally present on Windows 10 via Edge. If it is missing WPE walks you through installing it — it is not shipped with the package |
| Privileges | Administrator (checked on launch) |
| Target program | 32-bit and 64-bit both supported; the matching hook module is selected automatically |
Download and install
No installer. What you download is WPE64 v2.2.zip (60.85 MB), which unzips to a single-file launcher, WPE64 2.2.exe: nothing appears in Add or Remove Programs.
- Go to Downloads and grab the latest build from Lanzou or Baidu Pan.
- Right-click the downloaded zip → Properties → Unblock → Apply, then unzip it. Do this before unzipping (if you forgot, do the same on the unzipped exe).
- Double-click the unzipped
WPE64 2.2.exeand accept the UAC prompt. On first run (or after a version change) it shows a progress window while it unpacks the program into%LOCALAPPDATA%\WPE64\app\<version>-<hash>\, then startsWinsockPacketEditor.exefor you. - Every later launch first checks the file sizes, repairs anything missing or damaged, starts the program and removes old version folders that are not in use.
Besides the main program the unpacked folder carries EasyHook for injection, the SunnyNet MITM engine, the IP-location database and the interface itself under wwwroot\ — injection and the interface both look these files up by path, so they have to be real files on disk. Uninstalling means deleting the launcher and %LOCALAPPDATA%\WPE64\ (the configuration database lives separately under C:\WPE64DB\).
① Unblock first, then unzip. Unzip and run it while the zip is still blocked and the Zone.Identifier mark lands on the unpacked files, so injection fails with Code 15. To recover: unblock the launcher, delete its version folder under %LOCALAPPDATA%\WPE64\app\ and run it again.
② Administrator is mandatory. Injecting, loading the driver and installing the root certificate all need elevation; the launcher asks through UAC as soon as you double-click it.
③ Blank window on first launch? That is a missing WebView2 runtime — WPE shows a three-step prompt and opens Microsoft's official installer for you. Install it and reopen WPE.
WPE never checks for or downloads updates. To upgrade, download the new zip from Downloads, unzip it and run the launcher — it unpacks into a new version folder and removes old version folders that are not in use.
Note that the config database is stored per version, so settings do not carry over automatically — export them from the old build first. See Upgrading to a new version.
Two capture modes
WPE x64 offers two ways to intercept traffic — pick by scenario:
WPE runs its own SOCKS5 and HTTP proxy servers, handling HTTP/HTTPS/WS/WSS/TCP/TLS-TCP/UDP. A built-in CA decrypts HTTPS; local / remote mappings, proxy accounts, a firewall and a web console come with it.
Hook the target process and tap WinSock from inside it; launched suspended through Pick a File, it even catches the packets sent during startup. Works with emulators, and the 32- or 64-bit module is chosen to match the target.
Capture your first packet
Four steps, using Inject Mode as the example:
- Run the launcher, choose Inject Mode on the start page, then pick a method: Pick a Process (double-click the target in the process table), Pick Window (click the target window on screen) or Pick a File (launch a program suspended and inject before it runs).
- Once attached, press Start Hook on the run bar and packets stream into the Packet List. Rows that a filter hit are coloured by action (Replace = magenta, Change = amber, Intercept = red, Display = cyan; editable under System Settings).
- Select a row and the hex panel below shows its bytes; the context menu offers Edit, View changes, Add to filters, Add to send and more.
- Set up a Filter or a Robot to make the edits and replays run by themselves.
Proxy Mode setup
There is no configuration file — every switch lives under Settings ▾ → Proxy Settings. The factory defaults are:
Proxy IP: Auto detect (TCP listens on 0.0.0.0, reachable from the LAN)SOCKS5: enabled · port 1080 · authentication on # create a proxy account firstHTTP proxy: enabled · port 1081 # the built-in CA decrypts HTTPSSystem proxy: off # this one applies immediately, no Save neededPress Start on the run bar, then point the target program at that address and port. If the program cannot be configured to use a proxy, take it over by name or PID with Force Proxy in Process Settings.
Highlights
SOCKS proxy and process injection, so Winsock packets can be reached in almost any setup.
Captured packets queue up and the interface picks them up in batches, so capturing is never held back by the display — the list keeps scrolling smoothly under heavy traffic.
Sliding signature search with several hits per packet, half-byte wildcards, exclude marks, stepping and random values; a rewrite may change the packet length.
Run a list of instructions in order: send packets, delay, loop, simulate keyboard and mouse, switch other lists on and off.
View changes shows before and after side by side, Text Comparison diffs by byte or by line, and the list can be searched as text, hex or a regular expression.
Inject emulators directly and read the traffic of the apps running inside them.
- Proxy Mode serves SOCKS5 and HTTP at the same time and decrypts HTTPS with its built-in CA; requests can be remapped by URL to a local file or another address, and the outbound side can be chained to an upstream SOCKS proxy.
- One instance injects one target. To watch several programs at once, give each instance its own database in Instance Settings and inject from each of them.
- Packets can be sent in batches with a custom order and repeat count, and imported / exported with notes.
- Settings are written to the database when you press Save; the lists are saved on exit and every 10 minutes. The system log is recorded live and can be exported.
- No installer: everything the program needs sits in the unpacked folder. On exit WPE turns the system proxy back off, removes the hooks it installed, releases the processes it handed to the driver and writes the configuration back to the database.
Typical use cases
The same capture-and-edit toolkit takes different routes depending on the job. These four are what WPE x64 gets used for most; each notes which mode to use and where to start reading:
When your own client and server disagree, or a third-party SDK behaves differently from its docs, reading the real bytes on the wire beats adding logs at both ends.
- Mode: either; use Proxy Mode if you need HTTPS in the clear
- Start at: Packet Analysis · Editing and replaying packets
With authorization in place, craft odd lengths, out-of-range values and malformed fields to see how the target handles bad input — or check whether sensitive data leaves in the clear.
- Mode: Proxy Mode (decrypts HTTPS, isolates traffic per account)
- Start at: Proxy Mode · Which tool should do the editing
Given an undocumented private protocol, work out its structure one field at a time through controlled experiments — the classic WPE workflow.
- Mode: Inject Mode (closest to the program's own logic)
- Start at: Locating a field in four steps · Text Comparison
An Android emulator is just a local process, so inject it directly. For a real device, make WPE the proxy server on your LAN.
- Mode: inject the emulator; proxy the phone
- Start at: Capturing from phones and emulators
Limitations · what it cannot do
Knowing what it cannot do saves more time than the feature list. None of the following is a misconfiguration — the mechanism simply does not reach that far:
| Cannot | Why | What to do instead |
|---|---|---|
| Traffic that bypasses Winsock | Inject Mode hooks the user-mode send / receive functions in ws2_32.dll and friends. A kernel driver sending packets itself, or a program with its own network stack, never passes through that layer | Use Proxy Mode, or pull it in with Force Proxy at the driver level |
| ICMP · Ping · raw sockets | None of it goes through the WinSock send / recv family, and the proxy protocols have no channel for it either | Out of scope for WPE; use a link-layer capture method |
| HTTPS in the clear under Inject Mode | The hooks sit on send / recv, where the data is already TLS-encrypted | Switch to Proxy Mode and let the built-in CA decrypt it |
| Editing HTTP(S) or WebSocket with a Filter | Filters expose 12 packet-type switches, and those three are not among them — such packets never enter matching | Use Map Settings to rewrite the response body or the target |
| Breaking HTTPS when the app pins its certificate | SSL Pinning only trusts the certificate baked into the app, regardless of what the system trusts | Observe it as TCP traffic, or find a way in from inside the process |
| QUIC / HTTP3 in the clear | It rides on UDP, so WPE sees the bytes — but QUIC encrypts the payload itself | Make the target fall back to TCP + TLS, then decrypt in Proxy Mode |
| Running on macOS or Linux | The whole implementation depends on the Windows WinSock API, .NET Framework 4.8 and Windows kernel drivers | Run it inside a Windows VM |
| Working without administrator rights | Injecting other processes, loading drivers and writing to the system certificate store all require elevation | No workaround; WPE requests elevation itself |
What the internet says, and what is actually true
Search for "what is WPE" and you will find plenty of overviews — many describing the 1.x release from twenty years ago, or simply repeating each other. For the record:
| Common claim | For WPE x64 |
|---|---|
| "TCP only, weak UDP support" | False. Inject Mode hooks sendto / recvfrom / WSASendTo / WSARecvFrom; Proxy Mode implements a full SOCKS5 UDP relay, and UDP request / response are separate packet types in the filter |
| "Intercepts at the network or driver layer" | Inaccurate. Both modes work at the application layer — injection hooks WinSock functions, the proxy runs its own SOCKS5 / HTTP service. Only Force Proxy uses a kernel driver, and its job is to steer traffic into the proxy, not to read packets directly |
| "IPv4 only" | False. The SOCKS5 address types cover IPv4, IPv6 and domain names, for both TCP and UDP |
| "Capturing slows down or crashes the target" | Depends on the mode. Proxy Mode never touches the target process. Inject Mode does load a capture module into it and hook its send / receive functions, so programs with anti-injection protection may misbehave — pressing Stop Hook removes every hook. See the FAQ |
| "WPE is a cheat tool" | That is a use, not a property of the tool. The same capability is protocol debugging on your own software and a violation — possibly a crime — on someone else's server without authorization. See below |
Responsible use
This is an open-source tool intended for personal study and research in network programming. It is not for commercial use, and must not be used for anything unlawful.
Capturing and editing packets is a neutral engineering technique; whether it is legitimate depends on whether you are authorized to touch the target. Run through this list first:
- Scope of authorization: use it only on software you wrote, servers you own, test environments, or targets you hold written permission for. Capturing or editing a third party's live service — even "just looking" — may already cross the line.
- Games and anti-cheat: using any capture or packet-editing tool in an online game can be flagged and get the account banned, whether or not the tool is open source. This project does not support that use.
- Data handling: captured traffic may contain accounts, tokens, identity data and payment details. Do not retain, share or repurpose it beyond the debugging task at hand, and clear samples when you are done.
- Not an attack tool: tampering with other people's communications, forging transactions or bypassing authentication is well past debugging, and the legal responsibility is yours.
- License: released under MIT. The author accepts no liability for how it is used; keep the license notice when redistributing.
About and credits
Winsock Packet Editor has been published and maintained by X-NAS since 2021, moved from the 52pojie forum to GitHub and Gitee in 2022, and is released under the MIT license.
Thanks to EasyHook and SunnyNet. The project is listed in DotNet Guide and is part of the dotNET China organisation.
Next steps
- Read the full 2.2 tutorial — installation, injection capture, the proxy server, filters, robots and the warehouse, step by step. All eight chapters are available in English; the legacy 1.0.0.36 PDF is archived as well.
- Browse Downloads for past releases and the changelog.
- Open an issue or contribute on GitHub.