>
EN
v2.1.7
WPE_TUTORIAL_V2 // 02_INJECT

Inject Mode

Tutorial Rev · 2.1.8 beta

Inject WPEHook.dll into the target process and hook the WinSock send / receive functions from inside it. This is the capture method closest to the program's own logic; the chapter walks the whole path from picking a target to editing packets.

// The mechanism in one line

EasyHook injects the managed assembly into the target → Application.Run(InjectModeForm) runs inside that process → the WPE window appears within the injected program, with LocalHook hooking the send / receive functions of wsock32.dll, ws2_32.dll and mswsock.dll.

Quick start // Inject Mode in six steps

When the target is already running and you do not need its start-up traffic, these six steps are the whole procedure.

  1. Click Inject Mode on the home screen and filter for the target by name in the Process List dialog.
  2. Click the row to select it — the readout below turns green — then click Inject. The WPE window then appears inside the target program.
  3. Open Menu → Hook Settings and tick the functions to hook. Everything is on by default; do not trim it down yet.
  4. When there are too many packets to follow, use Menu → Leach Setting to narrow what is shown by port, length or content.
  5. Press Start on the toolbar, make the target do something on the network, and packets stream into the list.
  6. Double-click a row to open Packet Edit, change bytes and press Send to replay. Once the pattern is confirmed, turn it into a Filter.

01 · Picking a target

Clicking Inject Mode on the home screen opens the Process List dialog.

01Process List · four ways to pick a target, five buttons in the bottom-right.
Process List Filter processes 1 ICO Process name ⇅ PID ⇅ Path chrome7284C:\Program Files\Google\...\chrome.exe Ld9BoxHeadless16980D:\leidian\LDPlayer9\...\dnplayer.exe notepad3312C:\Windows\System32\notepad.exe game9021D:\Games\game.exe …(all running processes) 2 Ld9BoxHeadless [16980] 3 Pick Window Pick Program Refresh Inject Exit 4 5 6 7
  1. Filter box: filters by process name as you type — case-insensitive, substring match
  2. Process table: icon / name / PID / path. Name and PID are sortable by clicking the header, and a single click selects a row
  3. Selection readout: red border while empty, green once a target is chosen, showing name [PID]
  4. Pick Window: enters picker mode — hovering any window shows its process, PID, title and path; left-clicking the target selects it and injects immediately; Esc cancels
  5. Pick Program: choose an .exe that is not running yet. Injection goes through CreateAndInject — the process is created suspended, then injected — so you can capture from the very first packet
  6. Refresh: clears both boxes and re-enumerates the process list
  7. Inject: performs the injection. On success the dialog closes and the WPE window appears inside the target
// Small convenience

WPE remembers the last process it injected successfully. If that process is running the next time you open the list, it is preselected for you.

Which way to pick

MethodWhen to use itCaptures start-up?
Click in the listthe target is running and you know its nameNo
Pick Windowyou only know which window it is — multiple instances, emulator child windowsNo
Pick Programyou need login or handshake packets from start-upYes
// Important

After injecting via Pick Program the target sits suspended and looks frozen. It only wakes up when you press Start on the toolbar, which calls WakeUpProcess().

02 · The main window

02Inject Mode main window · eleven navigation items on the left with live counters, the work area on the right.
WPE x64 - Inject Mode2.1.8 ☰ ◐ ⚙ ZH — □ ✕ 8 Packet List248 Filter List3 Send List2 Robot List1 WareHouse List4 Statistical Data Text Comparison XOR Transcoding Extraction System Log37 1 Ld9BoxHeadless [16980] | Main window title Handle: 0x0034F1 | WinSock 1.1 2.0 Microsoft | Sent : 12.3 KB Received : 45.6 KB 2 Start Stop Clear 🔍 Auto scroll Auto clear 5000 Always on top Menu ▾ No.TimeTypeSocket Local addressRemote addressLengthData 110:22:31:0114820Send5164192.168.88.85:61821106.75.109.179:44318416 03 01 00 B3… 210:22:31:0231907Recv5164106.75.109.179:443192.168.88.85:61821607216 03 03 00 54… 310:22:31:5510033WSARecvFrom5148192.168.1.1:530.0.0.0:61176289F9 C3 81 80 00… 410:22:32:1002119Send5164192.168.88.85:61821106.75.109.179:4439317 03 03 00 58… 510:22:32:4471028WSASend5252192.168.88.85:61822106.14.127.178:8072150 4F 53 54 20… 610:22:33:0018844Recv5252106.14.127.178:80192.168.88.85:6182241348 54 54 50 2F… … 3 Packets : 248 | Filtered : 31 | Buffer : 0 | Leached : 12 | Send : 88 | Recv : 92 | SendTo : 14 | RecvFrom : 10 | WSASend : 24 | WSARecv : 8 4 FilterSendRobotWareHouse OnFilter nameCount Lock a field18 Drop heartbeats9 Increment counter4 Enable ALL Disable ALL Reset counts 5 Packet data (hex) 00000000F9 C3 81 80 00 01 00 02 00 00 00 04 74 61 67 73ù.....tags 0000001072 6F 77 69 6E 67 69 6F 03 63 6F 6D 00 00 01 00rowingio.com 0000002001 C0 0C 00 05 00 01 00 00 02 58 00 0A 4B 6D C0.À........Km 0000003011 C0 0C 00 01 00 01 00 00 00 3C 00 04 76 69 70.À........vip 0000004033 06 61 6C 69 64 6E 73 00 00 01 00 01 C0 0C 003.alidns Row 3 Col 1 289 Bytes Bits of Byte 0: 11111001 6 7
  1. Sidebar (11 items): Packet List / Filter List / Send List / Robot List / WareHouse List / Statistical Data / Text Comparison / XOR / Transcoding / Extraction / System Log. The green badges are live counts
  2. Info bar: process name [PID] · main window title and handle · the detected WinSock version · bytes sent and received
  3. Packet List: the row colour is the filter action — gold for Replace, red for Intercept, blue for Change (see the colour table). Double-click any row to open Packet Edit
  4. Status bar: total packets / filter executions / Buffer / leached / per-function counters
  5. Quick list: four tabs — Filter / Send / Robot / WareHouse — so filters can be toggled mid-capture without leaving the list. Double-click a row to open its editor
  6. Packet data panel: a hex editor for the selected row (Be.Windows.Forms.HexBox), with row, column and bit information along the bottom
  7. Menu: seven settings drawers that slide in from the right
  8. Collapse sidebar / theme / display settings / language
// WinSock version detection

If the third segment of the info bar shows only WinSock, without 1.1 / 2.0 / Microsoft after it, the target has not loaded any WinSock module yet — the hooks cannot attach and nothing will be captured. Make the program do something on the network, then inject again.

03 · Starting a capture

  1. First open Menu → Hook Settings and tick the functions you need (next section). This must be done before pressing Start.
  2. If needed, narrow the display with Leach Setting.
  3. Press Start: the hooks go live, and a suspended target is woken at the same moment.
  4. Make the target do something on the network; packets stream into the list.
  5. Stop removes every hook and restores the target; Clear empties the queue, the list, the data panel and all counters.

04 · Hook Settings

This decides which hooks get installed, and therefore what can be captured at all.

03Hook Settings, Inject Mode tab · twelve function switches, all on by default.
Hook Settings Winsock 1.1 Send 1.1 SendTo 1.1 Recv 1.1 RecvFrom 1.1 Winsock 2.0 Send SendTo Recv RecvFrom WSASend WSASendTo WSARecv WSARecvFrom ※ WSARecvEx in mswsock follows the WSARecv switch Save Exit
  • Winsock 1.1 (wsock32.dll): send / sendto / recv / recvfrom
  • Winsock 2.0 (ws2_32.dll): send / sendto / recv / recvfrom + WSASend / WSASendTo / WSARecv / WSARecvFrom
  • Microsoft extension (mswsock.dll): WSARecvEx, which follows the WSARecv switch
  • Only the hooks matching the WinSock version that was detected are actually installed
// Read this one

Hooks are created one by one at the moment you press Start. Changing Hook Settings afterwards has no effect — you must Stop, change, then Start again.

05 · Leach Setting (display only)

04Leach Setting · choose the method first, then fill in the conditions — they are combined with AND.
Leach Setting Leach method : Not Display Only Display 1 Socket : 5164;5252 Length : 0-99;100 IP address : use ; to separate Port : 443;80 Packet head : hex with spaces, use ; to separate Content : hex with spaces, use ; to separate 2 Packet type : Send Recv SendTo RecvFrom WSASend 3 Save Exit
  1. Leach method: Not Display hides whatever matches; Only Display shows only what matches
  2. Six conditions, formats in the table below. Ticking one but leaving the box empty is rejected on save
  3. Packet type: ticking it reveals the type checkboxes — eight on the inject tab, four on the proxy tab
ConditionFormatMatching
Socket5164;5252exact match, ; separated
Length0-99;100ranges and single values
IP address1.1.1.1;8.8.8.8exact match; a hit on either the local or the remote address counts
Port443;80exact match, same rule as above
Packet head01 00 0A;02 FFmatches the start of the packet
Content4A 5B;FF FFsubstring match anywhere in the packet's hex string

06 · List Settings

Two tabs — inject and proxy — with ten checkboxes each, controlling which columns the list shows:

No. · Time · Type · Socket · Local address · Local location · Remote address · Remote location · Length · Data

// Performance tip

Turning off the two Location columns cuts a lot of overhead during heavy capture — behind them sit a QQWry offline lookup and flag-icon rendering.

05The Search Packet drawer · slides down from the top. Note that the input is a regular expression, not plain text.
^16 03 0[13] 1 Find text Find hex 2 From start Search down 3 Find next Exit 4
  1. The regular expression box
  2. What is matched: Find text searches the packet decoded as UTF-8; Find hex searches its formatted hex string — like 16 03 01, with spaces
  3. Starting point: from index 0, or continuing from the currently selected row
  4. Find next: on a hit the list scrolls to that row and the hex editor below highlights the matching bytes. If the offset cannot be located in that row, the search moves on to the next one

Example: to find TLS records starting with 0x16 0x03, choose Find hex and enter ^16 03. When the search finishes with nothing found, WPE reports that no packet matched.

08 · Editing and replaying packets

Double-click a row, or right-click → Edit. This is where hand-editing and replaying actually happens.

06The Packet Edit window · four blocks: socket, hex editor, send, progression.
Packet Edit Socket Use socket :5164 Remote address :106.75.109.179:443 Length :184 1 0000000016 03 01 00 B3 01 00 00 AF 03 03 F7 47 D1 EE 94......¯..÷GÑî. 0000001016 1B 76 2E 3A 41 2C 9A 5E 33 0C 4D 6E 6E 1F 5C..v.:A,.^3.Mnn.\ 0000002000 00 20 C0 2B C0 2F C0 2C C0 30 CC A9 CC A8 C0.. À+À/À,À0̨̩À 0000003013 C0 14 00 9C 00 9D 00 2F 00 35 01 00 00 66 00.À....../.5...f. 0000004000 00 12 00 10 00 00 0D 77 77 77 2E 65 78 61 6D........www.exam 0000005070 6C 65 2E 63 6F 6D 00 17 00 00 FF 01 00 01 00ple.com....ÿ.... …(edit in place; inserting or deleting updates Length live, and the right-click menu has the rest) 2 Send Send N times 1 Send continuously Interval (ms)100 3 Progression Enable progression Offset8 Step1 Carry over Digits2 4 Sent : 120 | OK : 118 | Failed : 2 5 Send Stop Save Exit 6 7
  1. Use socket: defaults to the packet's own socket, and that is what sending uses. Enter 0 to go through the SunnyNet channel of Proxy Mode instead (see below)
  2. Hex editor: edit bytes directly. The right-click menu offers Add to Send ▸ / Add to Filter List / Cut / Copy ▸ (text, hex) / Paste ▸ (text, hex) / Select All. Moving the caret updates the progression offset
  3. Send mode: a fixed number of times, or continuously until you press Stop. An interval of 0 means no pause between sends
  4. Progression: adds the step to the chosen byte on every send. The offset must be smaller than the packet length or WPE reports an invalid progression offset. With carry over ticked, an overflow carries into the preceding bytes, up to digits of them
  5. Live counters: total sent / succeeded / failed
  6. Send / Stop
  7. Save: writes the edited content back into that packet in the list — data, length and socket — and refreshes the data panel

Which channel a send goes through

ConditionHow it is sent
socket > 0calls the native send / sendto / WSASend API matching the packet type
= 0 with type TCP_Req / TCP_Respsent to the server or client through the SunnyNet channel
= 0 with type UDP_* / WebSocket_*same as above
= 0 with type HTTP_* / HTTPS_*cannot be sent — always reports failure
ItemShortcutWhat it does
Edit—opens the Packet Edit window
CopyCtrl+Ccopies the selected rows to the clipboard as hex text, one per line
Add to Send ▸—the submenu lists every send item; the selected packets are appended to it
Add to Filter List—creates a filter from the selected packet, prefilled with its content
Add to WareHouse ▸—stores it in the chosen warehouse
Set System Socket—makes that row's socket the global System Socket
View Packet Modification—shows the original and the filtered packet side by side
Export to Excel—exports the selected rows — or all of them — to .xls
Add to Text A / Text B—sends it to Text Comparison for diffing
Select all / deselectCtrl+A—
// The combination you will use most

Catch the packet → right-click Add to Filter List, which fills the search row for you → double-click the filter to set its action and modify row → switch it on. That is the shortest path from seeing something to changing it.

10 · Comparing original and modified

Right-click → View Packet Modification opens two hex views: the original packet data (length N) on the left and the modified packet data (length M) on the right. Use it to confirm exactly which bytes a filter touched.

11 · Troubleshooting

// Injection failed

In order: ① is WPE elevated; ② does the target have anti-cheat or anti-injection protection (if so use Proxy Mode); ③ are WPEHook.dll, EasyHook32/64.dll and EasyLoad32/64.dll all present; ④ was the archive unblocked; ⑤ read the full exception in the System Log.

// Injected, but nothing is captured

① Is the WinSock version in the info bar empty; ② are the right functions ticked in Hook Settings (Stop and Start after changing them); ③ a rising Leach counter at the bottom means the display filter is hiding them; ④ is Speed Mode on in System Settings; ⑤ does any filter use the NoModify NoDisplay action.

// The target freezes after Pick Program

Expected. CreateAndInject creates the process suspended; pressing Start wakes it up.

← Previous
Getting Started