FAQ

Answers to the questions that come up most — downloading and installing, injection and proxying, filters, senders and robots. If none of these solve it, open an issue on GitHub or email wpe64@qq.com.

Does it have to run as administrator?

Yes. When WPE x64 finds it is not elevated it restarts itself via runas — there is no reduced-privilege mode. Injecting writes into another process and installs hooks; Force Proxy loads a kernel driver; installing the root certificate writes to the system certificate store. None of that works without administrator rights.

Is macOS or Linux supported?

No. WPE x64 is Windows-only: .NET Framework 4.8 plus WinForms, hooking the Windows WinSock API (wsock32.dll / ws2_32.dll / mswsock.dll), with Force Proxy relying on Windows kernel drivers. Running Windows in a VM on macOS or Linux works fine.

Can it capture from phones and emulators?

Yes, via Proxy Mode: run WPE's SOCKS5 / HTTP proxy on your PC, point the phone or emulator at that IP and port, and install WPE's root certificate to see HTTPS in the clear. Full steps, per-platform certificate installation and a troubleshooting table are in the tutorial: Proxy Mode · capturing from phones, emulators and other machines.

For Android emulators there is a shortcut: the emulator is just a local process, so Inject Mode can hook it directly and skip the whole proxy-and-certificate setup.

Does capturing affect the target program? Which mode is lighter?

It depends on the mode, and it is worth deciding up front:

• Inject Mode: WPE's assembly is loaded into the target process and the WinSock entry points are replaced. Normally the program runs as usual, but it has been modified — anything with anti-injection or anti-cheat protection may throw errors, crash or flag the session. Pressing Stop removes every hook and restores the process.
• Proxy Mode: WPE never touches the target process; it only adds a hop on the network path, so it is the least intrusive option. The trade-off is that the target must be willing to use a proxy (or be pulled in with Force Proxy), and saving the process settings drops its existing TCP connections.

Can both modes run at the same time?

Not in one instance — picking a mode on the home screen takes you straight into that window. To run both, use Database Setting to give a second instance its own database path, then start another copy of WPE in the other mode. The two configurations stay completely separate.

People say WPE only captures TCP and barely supports UDP. True?

That describes the 1.x release from twenty years ago. WPE x64 supports UDP fully:

• Inject Mode: besides send / recv, it hooks sendto / recvfrom / WSASendTo / WSARecvFrom.
• Proxy Mode: the SOCKS5 service implements a complete UDP relay, with IPv4, IPv6 and domain address types.
• Filters: SendTo / RecvFrom (inject) and UDP request / UDP response (proxy) are separate packet types you can match and rewrite on their own.

What genuinely cannot be captured is ICMP (Ping) and raw sockets — neither goes through the WinSock send / receive family, and the proxy protocols have no channel for them. Full list under Limitations.

Does WPE work at the driver layer or the application layer?

Both modes work at the application layer — something the overview articles online routinely get wrong:

• Inject Mode injects the hook assembly into the target and replaces the entry points of the send / receive functions in ws2_32.dll and friends. Those are user-mode APIs, not the network stack.
• Proxy Mode runs its own SOCKS5 / HTTP service and traffic is routed through it — an application-layer proxy.
• The only piece that uses a kernel driver is Force Proxy (NFAPI / Proxifier / WinDivert), and its job is to steer a process's connections into the proxy, not to read or write packets itself.

This has a practical consequence: traffic that bypasses WinSock is invisible to WPE — a program whose kernel driver sends packets directly, for instance. Such targets have to be pulled to the proxy side with Force Proxy, otherwise they are out of WPE's reach.

Can it capture every program on the machine at once?

No, and it is not meant to. WPE is a debugging tool aimed at one target at a time:

• Inject Mode handles one process per instance. To watch several at once, start multiple instances with Database Setting and inject each separately.
• Proxy Mode only sees traffic that actually goes through the proxy. To take over programs that ignore proxy settings, use Force Proxy and name them by PID or process name — also an allow-list, never the whole machine indiscriminately.

That is a deliberate design choice: WPE's value is that it can edit and replay, not that it captures everything. Narrowing the scope to the target process usually makes analysis faster anyway.

How do I install it? Where is the installer?

There is nothing to install. WPE x64 is a portable single-file build: the archive extracts to one WinsockPacketEditor.exe. Double-click and it runs — no registry writes, no entry in Add or Remove Programs. Put it anywhere; delete the exe when you are done with it.

Downloads live under Downloads, on Lanzou or Baidu Pan (the pan link needs the extraction code shown on the page). Full steps in the tutorial: Download and install.

How do I upgrade? What happened to auto-update?

Older releases used ClickOnce online install and auto-update. That is gone. WPE never checks for versions and never prompts you — upgrading means downloading the new build yourself:

• Check the changelog on Downloads and get the new archive.
• Unblock → extract → close the running old build (in Inject Mode, press Stop and exit the injected program first) → run the new exe.
• Keep or delete the old exe as you like; two versions side by side do not conflict.

Injection fails with STATUS_INTERNAL_ERROR (Code: 15)

Usually the downloaded file is blocked by Windows. The right order is: right-click the archive → Properties → Unblock → Apply → OK, and then extract. If you already extracted, do the same on the resulting WinsockPacketEditor.exe, or delete it and extract again.

The other cause: several different versions of WPE64 have injected the same process. Close all injected instances, restart the target, then inject again.

Blank window after injecting on Windows 7

Right-click the target's executable → Properties → Compatibility, tick "Run this program in compatibility mode for" and choose Windows Server 2008. If that does not help, try the other compatibility modes.

Crash on launch or on injection

Restart WPE and the machine first. If it persists, delete the config folders and try again:

• WPE64 config: C:\Users\<you>\AppData\Local\X-NAS
• Injected program's config: C:\Users\<you>\AppData\Local\<program name>

"Injection failed" after clicking Inject

Check in this order: ① is WPE running as administrator; ② does the target have anti-cheat or anti-injection protection (if so, switch to Proxy Mode); ③ are WPEHook.dll, EasyHook32/64.dll and EasyLoad32/64.dll all present in the program folder; ④ was the archive unblocked; ⑤ read the full exception in the System Log.

Injection succeeded, but Start captures nothing

① Is the WinSock version in the top info bar empty? If it shows only WinSock without 1.1 / 2.0 / Microsoft, the target has not loaded any WinSock module yet — make the program do something on the network, then inject again. ② Are the functions ticked in Hook Settings? Changes require Stop then Start — hooks are created at the moment you press Start. ③ Is the "Leach:" counter at the bottom rising? Then Leach Setting is filtering them out. ④ Is Speed Mode on in System Settings? ⑤ Does a filter use the NoModify NoDisplay action?

After "Select Program", the target looks frozen

That is expected. This path uses CreateAndInject, which creates the process suspended. Pressing Start on the toolbar wakes it up.

"Failed to start SOCKS5 proxy" when pressing Start

The port is taken, or the bind IP you chose does not exist. Change the port, or tick "auto detect" in Proxy Settings.

Proxy settings refuse to save

"Proxy type not set" → you must tick Enable SOCKS5 proxy. "SOCKS and HTTP ports cannot be the same" → give them different values (1080 / 1081 by default).

The target connected to the proxy, but nothing is captured

① Are the TCP / UDP request and response boxes ticked on the Proxy Mode tab of Hook Settings; ② is Leach Setting filtering them out (watch the "Leach:" counter); ③ is Speed Mode on.

I selected a process, but the filter does nothing

Force Proxy must be enabled before filters work, and the HTTP proxy must be enabled before a process's data can be intercepted at all. Both are spelled out in the red notice at the top of the Process Settings screen.

HTTPS comes through as garbage

The WPE64 root certificate is not installed. When the proxy starts, the System Log should show "WPE64 certificate installed successfully". Other devices — a phone, another machine — need the certificate exported from Proxy Settings → Export Cert and installed manually as a trusted root.

The driver-type radio buttons are greyed out

Once a driver is loaded it is locked. Click "Uninstall driver" first, then change it.

How do I get a WPC subscription ID? Can I create one?

You cannot create one; it has to be requested from the subscription server. The ID registry lives on the subscription server — neither the WPC client nor WPE x64 can issue IDs.

An ID maps to the public address of your WPE x64 proxy server: WPC exchanges the ID for that address at the subscription server, then pulls the node list, forwarding rules and notices from your WPE. So before anyone can reach your server with one-click subscribe, its public IP and port have to be registered.

• How to ask: GitHub Issue, or QQ group 1121552990.
• Validity: IDs carry an expiry date. Once expired the client cannot resolve the address any more and the ID needs renewing.

The filter never matches

Work down this list:

• Is the filter's enable switch on in the Filter List?
• Is at least one packet type ticked, and does it match the packets you are after (Send for Inject Mode, TCP request for Proxy Mode)?
• Did you tick socket / length / port under "specify type" but enter the wrong value? These are AND conditions — all must hold.
• Is the search row of the data grid empty? With nothing to search for, nothing ever matches.
• In Normal mode, does the offset run past the packet length? That counts as no match.
• With "filter execution = priority", an earlier filter that already matched takes the packet — try moving this one to the top.
• Trying to edit an HTTP / HTTPS / WebSocket packet? Filters do not apply to those types. Use Map Settings instead.

The filter works, but edits the wrong bytes

Column heading 001 is byte index 0 — subtract one when counting offsets. In Advanced mode with "start from the matched position", the column numbers in the modify grid are offsets relative to the anchor (the anchor itself is 0, negatives allowed), not absolute positions.

The send ran, but the success count stays at 0

① Is the packet's socket valid (> 0 and still alive)? ② Did you tick "use system socket" without ever setting one — the System Log will say the system socket is not set; right-click a packet in the list and choose Set System Socket first. ③ In Proxy Mode, the HTTP_* / HTTPS_* packet types cannot be sent.

Pressing Execute on a robot does nothing

Check the System Log. A line like Robot instruction N error! [robot name] means validation failed and the robot refuses to start — most often an unpaired loop start / end, or a send item that has since been deleted.

Hotkeys do nothing

① Is "Apply To" set correctly in HotKey Settings (Send List or Robot List)? ② Is the combination already claimed globally by another program? ③ Does the list item with that index exist (hotkey 1 = first item in the list)?

It stutters under load and the buffer count climbs

Best return first:

• Turn off the two Location columns in List Settings — this drops the IP geolocation lookup and flag rendering, and is by far the biggest win.
• Enable auto-clear and lower the threshold (5000 by default).
• Turn off auto-scroll.
• In the display settings on the title bar, turn off animation, shadows and high-quality text rendering.
• Use Leach Setting to show only the packets you care about.
• Last resort: turn on Speed Mode — nothing is displayed at all, but filters keep working.

Importing a backup says "Import failed: wrong password"

That .sb file was exported with a password, and the same one is required to import. If the file has no password, just press Cancel when the password box appears.