WPE_TUTORIAL_V2 // 04_FILTER

Filters

Tutorial Rev · 2.1.8 beta

Filters are the heart of WPE x64: match a packet by rule and rewrite it before it is really sent or received. This chapter covers the matching algorithms, the cell marks, the five actions and chained execution in one go.

00 · Before you edit: which tool should do it

Four places in WPE can change what goes over the wire, and they do not overlap. Picking the wrong one is the number-one reason a filter appears not to work — trying to edit HTTP(S) with a filter, above all, never matches:

What you want	Use	Why not a filter
Change a few bytes in a TCP / UDP packet	Filter · Replace	— this is it
Stop a kind of packet being sent or received at all	Filter · Intercept	— this is it
Reply with a fixed payload on a match	Filter · Change, or a filter triggering a Robot	— this is it
Change an HTTP / HTTPS response body	Map Settings · Map Local	filters expose 12 packet-type switches and none covers HTTP(S) or WebSocket — those packets never enter matching
Redirect a request to another host or port	Map Settings · Map Remote	filters change content, never the destination
Not capture a packet type at all	Hook Settings	filters act after the packet exists; turning it off at the source costs less
Just tidy up a noisy list	Leach Setting	filters really do change data; using one as a display filter will damage live traffic
Send packets on your own schedule	Send List	filters are reactive — with no match, nothing happens

Quick start // building a filter that actually fires

Filters are the only mechanism in WPE that changes real network data. Here is the shortest path from nothing to a working one.

Catch a sample first: find the packet in the list, right-click → Add to Filter List, and the search row is prefilled from its content.
Name the filter and tick the packet types it applies to — Send / Recv and friends in Inject Mode, TCP / UDP request and response in Proxy Mode.
Write the search row: keep only the bytes that identify the packet uniquely; empty cells are wildcards. Fewer bytes match more easily, more bytes match more precisely.
Write the modify row: put the new values at the right offsets. For values that should increment or vary, use the Progression and Random marks.
Pick an action: Replace to edit bytes, Intercept to drop the packet, Change to rebuild it whole (see section 06).
Tick Enabled, save, then press Start. Check the filter log and Statistical Data to confirm it is running; matching rows change colour in the list.

01 · The life of a filter

01A packet's journey through the filter engine · eligibility first, then content matching, then the action.

02 · The Filter List

Toolbar: Enable ALL Disable ALL Reset counts. The Menu dropdown holds four items: add filter / import filter list / export all filters / clear all filters.

Right-click a row: move to top (Ctrl+↑) / up (Alt+↑) / down (Alt+↓) / to bottom (Ctrl+↓) / export / duplicate / delete. Double-click opens the filter editor.

// Order matters

In sequential execution mode, list order is match order. When a filter does not seem to fire, try moving it to the top first.

Three ways to create a filter

Menu → add filter: creates an empty filter named Filter N.
Right-click in the packet or proxy list → Add to Filter List: prefills the search row from that packet — much the easiest start.
Select bytes in the hex editor → right-click → Add to Filter List: fills from just that selection, for when you have already found the signature.

03 · The Filter Edit window

02Filter Edit, Normal mode · parameters above, a two-row data grid below.

Filter name: free text
Mode: Normal for fixed offsets, Advanced for a sliding search — see section 04
Action: one of five, see section 05
Chained execution: on a match, additionally fire a send, a robot, another filter, or store the packet
Packet type: the two tabs follow the current mode. At least one must be ticked or the filter can never fire
Specify type: socket, length and port as preconditions — all combined with AND
Advanced and Progression: the packet head, plus continuous progression, step, carry over and digits
Search row (pale gold): the hex value in column i must equal byte i of the packet
Modify row (gold): on a match, byte i is set to this value

// Column number is not the index

Column 001 is byte index 0. Subtract one whenever you count offsets.

04 · Normal versus Advanced

03How the two match · the same 4A 5B gives completely different results.

	Normal	Advanced
Meaning	match at fixed offsets	slide a signature across the packet
How many matches	evaluated once	can match several times
Data grid	two rows (search / modify), columns `001`–`1000`	three grids: one search, two modify variants
Modify offsets	absolute	"from the packet start" is absolute; "from the matched position" is a relative offset, possibly negative
Use when	fields sit at fixed positions	fields move about, or headers vary in length

"Start from" (Advanced only)

Option	What is processed	What the modify columns mean
From the packet start	the first match only	absolute indexes, starting at 0
From the matched position	every match	offsets relative to the anchor, which is 0 — negatives allowed

Wildcards

Search cells support nibble wildcards:

Written as	Means	Mask
`4A`	exactly the byte 0x4A	`0xFF`
`4*`	high nibble must be 4, low nibble anything	`0xF0`
`*A`	low nibble must be A, high nibble anything	`0x0F`

// Limitation

In Advanced mode only two-character forms like X* and *X count as partial wildcards. A full ** is not added to the match conditions at all — it is the same as leaving the cell empty.

05 · The three cell marks

Right-click a cell in the grid to toggle them; they are told apart by background colour:

Mark	Row	Colour	Meaning
Exclude	search	purple	inverted: the byte matches when it differs from the value
Progression	modify	dark red	adds the step on every match, optionally carrying over
Random	modify	bright blue	writes a random byte each time

// Common mistake

Ticking the Continuous box without also right-clicking the modify cell and choosing Enable Progression does nothing. The checkbox picks how the value accumulates; the cell shading is what decides which byte it applies to.

How progression is calculated

For each progression cell: new = old + step × (progression count + 1)

With continuous ticked the count rises by one per match, so the value keeps climbing. Without it, the same increment is applied every time
With carry over ticked, a byte overflowing past 0xFF carries into the preceding bytes, across at most digits of them

06 · The five actions

Action	What it does	Row colour
Replace	rewrites the matched bytes from the modify row, applying progression and random cells	dark gold
Change	discards the original content and builds a new packet from the modify row, its length being the highest index plus one	bright blue
Intercept	the packet is dropped — never sent, never received	dark red
NoModify Display	content untouched, but the packet is guaranteed to reach the list and the counters	light green
NoModify NoDisplay	content untouched and kept out of the list — for silencing frequent heartbeats	—

// Change discards data

A packet built by Change is as long as the highest index in the modify row plus one, and every cell you left empty becomes 0x00. To keep the original content, use Replace.

Chained execution

Ticking Execute reveals two dropdowns:

Type	Target	What happens on a match
Send List	one send item	runs that send immediately — auto-replies, canned sequences
Robot List	one robot	starts that robot, passing the current socket in as `FilterSocket`
Filter List	another filter	runs that filter as well — chained processing
Store the packet	one warehouse	saves the matched packet there — the rewritten version if it was changed

When the corresponding list is empty the entry is greyed out — create a send, robot or warehouse first, then come back.

07 · Filter execution mode

Switched under System Settings → filter execution mode:

Mode	Behaviour	Use when
Sequential (default)	walks every filter top to bottom. `Replace` lets matching continue, so later filters see the already-edited data; `Intercept / Change / Only Display / Not Display` return immediately	several filters need to stack on one packet
Priority	the first match wins and matching stops there	the rules are mutually exclusive and speed matters

08 · Filter log and statistics

Every match outside Speed Mode writes a log line: time / filter name / action / match count / packet type / length. Read it under System Log → filter log, and export to Excel if needed.

The Statistical Data page shows progress bars for how much traffic filters touched and how the actions break down.

09 · Import, export and conversion

The native format is .fp — a filter list in XML, optionally encrypted
To convert from a legacy WPE .filt file, use the Extraction page and pick [ FILT filter file (.filt) ] → [ WPE64 filter file (.sp) ]. The converter parses 35 ￥-separated fields and maps out the filter name, the head / socket / length conditions, Normal or Advanced mode, the Replace / Intercept / invisible actions, the search and modify content, progression and the rest

10 · Five worked examples

Example 1 · pin a field to a fixed value

Goal: in every Send packet, change the fifth byte — index 4 — from 01 to 09.

Add a filter and name it "Lock field".
Mode = Normal; action = Replace.
Tick packet type Send for Inject Mode, or TCP request for Proxy Mode.
Grid: put 01 in column 005 of the search row, and 09 in column 005 of the modify row.
Save, then switch it on in the list.

Example 2 · silence flooding heartbeats

Goal: keep packets with head 01 00 03 and a length of exactly 8 out of the list.

Add a filter with action = NoModify NoDisplay.
Under Advanced, tick the packet head and enter 01 00 03.
Under Specify type, tick length and enter 8.
In the search row put 01 / 00 / 03 into columns 001 / 002 / 003.

// Do not skip that last step

Step 4 is not optional: a filter with an empty search row never matches. Setting only the packet head is not enough.

Example 3 · follow a signature (Advanced mode)

Goal: wherever 4A 5B appears, set the second byte after it to FF.

Mode = Advanced; action = Replace; start from = the matched position.
Search grid: 4A in 001, 5B in 002.
Modify grid, relative: put FF at offset +3.
The anchor 4A is offset 0, 5B is 1, the next byte is 2, and the one after that is 3.

Example 4 · an auto-incrementing counter

Goal: add one to byte 9 on every match, carrying across two bytes on overflow.

Mode = Normal; action = Replace.
In the progression group tick continuous with a step of 1, and tick carry over with 2 digits.
Right-click column 009 of the modify row → enable progression; the cell turns dark red.

Example 5 · auto-reply on a match

First create a send item and add the reply packet to its collection.
Create the filter with action NoModify Display — you only want the trigger, not an edit.
Tick Execute → choose Send List → pick the send item you just created.

11 · When a filter does not fire

// Work down this list

① Is the enable switch on in the Filter List?
② Is at least one packet type ticked, and does it match the packets you are after?
③ Did you tick socket / length / port under Specify type but enter the wrong value? These are AND conditions.
④ Is the search row empty? With nothing to search for, nothing ever matches.
⑤ In Normal mode, does an index run past the packet length? That counts as no match.
⑥ With execution mode set to Priority, an earlier filter that matched takes the packet — try moving this one to the top.
⑦ Trying to edit an HTTP / HTTPS / WebSocket packet? Filters do not apply to those types — use Map Settings instead.

// Editing the wrong bytes

Column 001 is index 0. In Advanced mode with "start from the matched position", the modify columns are offsets relative to the anchor, not absolute positions.