WPE_TUTORIAL_V2 // 08_APPENDIX
Appendix · Reference
Tutorial Rev · 2.1.8 beta
Four look-it-up-and-go tables: file types by extension, packet types side by side, the directory and dependencies for troubleshooting, and a glossary that settles the naming. Nothing here needs reading front to back — come back when something does not add up.
Appendix A · Data file types
| Extension | Contents | Exported from | Encrypted |
|---|
.sb | system backup — the whole configuration | Backup Settings | ✓ |
.fp | the filter list | Filter List → Menu | ✓ |
.sp | the send list | Send List → Menu | ✓ |
.sc | a send set — the packets of one send | Send Edit | ✓ |
.rp | the robot list | Robot List → Menu | ✓ |
.whp | the warehouse list | WareHouse List → Menu | ✓ |
.whs | stored items | right-click in the stored items | ✓ |
.pas | auto-store rules | Auto Store | ✓ |
.pa | the proxy account list | Account List → Menu | ✓ |
.pml / .pmr | local / remote mappings | Map Settings | ✓ |
.wl / .bl | allow list / block list | FireWall Settings | ✓ |
.xls | Excel — tab-separated text | Export to Excel, from any list's context menu | ✗ |
.cer .crt .pem .0 | the HTTPS root certificate | Proxy Settings → Export Cert | ✗ |
.filt | import: an old-WPE filter | Extraction | — |
.chlsx | import: a Charles session | Extraction | — |
.ini | import and export: CCProxy accounts | Account List / Extraction | — |
Appendix B · Packet types
| Value | Enum | Name on screen | Mode | Filter category |
|---|
| 0 / 1 | WS1_Send / WS2_Send | Send 1.1 / Send | Inject | Send |
| 2 / 3 | WS1_SendTo / WS2_SendTo | SendTo 1.1 / SendTo | Inject | SendTo |
| 4 / 5 | WS1_Recv / WS2_Recv | Recv 1.1 / Recv | Inject | Recv |
| 6 / 7 | WS1_RecvFrom / WS2_RecvFrom | RecvFrom 1.1 / RecvFrom | Inject | RecvFrom |
| 8 | WSASend | WSASend | Inject | WSASend |
| 9 | WSASendTo | WSASendTo | Inject | WSASendTo |
| 10 / 11 | WSARecv / WSARecvEx | WSARecv | Inject | WSARecv |
| 12 | WSARecvFrom | WSARecvFrom | Inject | WSARecvFrom |
| 13 / 15 | TCP_Req / TCP_Resp | TCP request / response | Proxy | TCP request / response |
| 14 / 16 | UDP_Req / UDP_Resp | UDP request / response | Proxy | UDP request / response |
| 17—20 | HTTP(S)_Req / Resp | HTTP(S) request / response | Proxy | never filtered |
| 21 / 22 | WebSocket_Req / Resp | WebSocket request / response | Proxy | never filtered |
Appendix C · Files and dependencies
| Path | What it is |
|---|
WinsockPacketEditor.exe | the main program |
WPEHook.dll | the hook assembly injected into the target process |
EasyHook32/64.dll, EasyLoad32/64.dll | the EasyHook bootstrap libraries, picked automatically from the target's bitness |
x86\SunnyNet.dll | the MITM engine written in Go, with HTTP, HTTPS, WebSocket, TCP and UDP callbacks |
IPLocation\qqwry.dat | the offline QQWry IP-location database |
Config\log4net.config | logging configuration |
Web\ | the static pages of the remote management console |
C:\WPE64DB\<version>.db | the default SQLite database; the path is changeable in Database Setting |
| Component | Version | Used for |
|---|
| AntdUI | 2.1.12 | every control, the themes and the localisation |
| EasyHook | 2.7 | process injection and API hooking |
| SuperSocket | 1.6.6.1 | the SOCKS5 server framework |
| SunnyNet | — | the HTTPS man-in-the-middle and driver-level Force Proxy |
| Be.Windows.Forms.HexBox | 1.6.1 | the hex editor |
| DiffPlex | 1.9 | text differencing |
| QQWry | — | IP location lookup |
| log4net | 3.3.1 | logging to disk |
| EntityFramework + System.Data.SQLite | 6.0 / 1.0.119 | persistence |
| Microsoft.Owin.* | 4.2.2 | self-hosting the remote management web service |
| InputSimulator | — | the Robot's keyboard and mouse simulation |
Appendix D · Glossary
| Term | Meaning |
|---|
| Inject Mode | injects WPE's hook assembly into the target process and hooks the WinSock API from inside it |
| Proxy Mode | WPE runs its own SOCKS5 and HTTP proxy services and the target's traffic detours through it |
| Socket | a connection handle; sending a packet needs a valid one |
| System socket | a global socket variable the Send List and Robot can use |
| Filter | a rule that matches and rewrites real network data. Not to be confused with Leach Setting, which only affects what is displayed |
| Normal mode | matching at absolute positions — it compares and rewrites at fixed indexes only |
| Advanced mode | a sliding search for a signature; it can match in several places and rewrite at relative offsets |
| Progression | increments the marked byte by the step on every match or send, with optional carry-over |
| Random | fills the marked position with a random byte on every send |
| Exclude | inverts a search cell: it matches only when the byte is not the value you entered |
| Change | discards the original packet and builds a new one from the modify row |
| UnPack | splits a coalesced TCP stream into whole packets using the head and the length field |
| Force Proxy | uses a driver — NFAPI, Proxifier or WinDivert — to push a named process's traffic through the proxy at system level |
| Upstream proxy | chains WPE's outbound traffic on to a further SOCKS proxy |
| Map Local | replaces the response body of a remote URL with a local file |
| Map Remote | redirects a request from one URL to another |
| WareHouse | where packet samples are archived |
| Auto Store | files matching proxy packets into a warehouse by packet-head rules; Proxy Mode only |
| Speed Mode | a high-throughput mode that displays nothing and only counts packets and runs the filters |
| Multiple instances | running independent configurations side by side by switching the SQLite database path |
| WPC Config | the nodes, rules and notices published to the WPEProxyCap accelerator client |