Inject Mode

Inject WPEHook.dll into the target process and hook the WinSock send / receive functions from inside it. This is the capture method closest to the program's own logic; the chapter walks the whole path from picking a target to editing packets.

01 · Picking a target

Clicking Inject Mode on the home screen opens the Process List dialog.

01Choose an injection method · three method cards plus the "last injection" record below.

1. Method 01 · Process: pick one of the running processes. It opens a searchable process table (name / PID / path — search matches the path as well as the name, which is the only way to tell several svchost instances apart). The PROCS readout is how many processes were enumerated
2. Method 02 · Window: WPE minimises itself and you click the target window on screen; Esc cancels. Use it when you do not know the process name but recognise the window (multi-instance games, emulator child windows)
3. Method 03 · File: pick an executable that is not running yet. It is launched suspended and resumed once the hooks are in place — the only way to capture the start-up traffic. You also get to type command-line arguments
4. Last injection (the terminal block): time, method, target and full path. Quick inject at the bottom right repeats that exact injection
5. The process table never lists WPE itself

Which way to pick

02 · The main window

02Inject mode main window · 12 navigation entries on the left with live counters, workspace on the right.

1. Sidebar: four groups — Data / Rules / Tools / System — with 12 pages in total. The number on the right of each entry is a live count. the same layout as Proxy Mode
2. Collapsing the sidebar: the button at the top right of the sidebar folds it into an icon rail (icons and counters only); press it again to expand. Useful on a narrow window or when you only want the data
3. Status bar: the lamp and the state word (Disconnected / Attached / Hooking), the target process and its bitness, the WinSock version; then Focus List, Start / Stop Hook, Clear and Settings ▾
4. Focus List: the toggle on the right of the status bar. It hides the statistics grid, the lower pane and the dropped-packet notice so the packet table gets more height; the status bar and common actions stay available — click again to restore
5. ⚠️ There is no Disconnect button: the hooks are removed from the target automatically when WPE exits, so switching to another target means restarting WPE. If the target exits on its own, this screen keeps its data and shows a notice at the top; the captured packets can still be viewed and exported
6. Statistics grid (7 × 2): column 1 is the total and the filter execution count; columns 2–5 are vertical pairs (send ↔ receive: Send↔Recv, SendTo↔RecvFrom, WSASend↔WSARecv, WSASendTo↔WSARecvFrom); column 6 is the queue and the filtered count; column 7 is bytes and live rate
7. Toolbar: four colour chips on the left are the filter-action legend (Replace / Swap / Intercept / Display only), the search box in the middle, and Hex/Text, auto-scroll and auto-clear on the right
8. Packet list: columns can be dragged and double-clicking a divider restores the default width. Rows a filter matched are coloured whole, matching the legend chips
9. Lower half: the quick panel on the left (six tabs: Filter / Send / Robot / WareHouse / Decoder / Extractor, each row can be toggled straight from here) and the hex panel on the right — click a packet row to see all of its bytes
10. Settings ▾ holds the 7 dialogs inject mode has: Leach, Hook, List, Hotkey, Backup, Remote management and System
11. Title bar: the leftmost button is Back to start page (Inject Mode only) — you can go back to pick another mode or change settings without closing the program; then come the gear (Preferences), the pin (keep on top) and the window buttons

The lower half: quick panel and hex panel

03Quick panel · six tabs, so rules can be switched without leaving this screen.

1. Six tabs — Filter / Send / Robot / WareHouse / Decoder / Extractor — each row with a green checkbox on the left that toggles that entry and saves it immediately, without switching to the matching sidebar page; double-clicking a row opens its editor
2. The number on the right is its execution count; disabled rows are dimmed as a whole
3. The cyan keyboard icon beside the "Send" tab shows which list the global hotkeys currently act on. Hotkeys 1–10 fire the matching entry and 11 / 12 run the whole list, but that either/or setting lives inside HotKey Settings — until now there was no way to tell before pressing a key
4. The context menu carries the rest: add / enable all / disable all for the whole list (Filter, Send and Robot also get reset counts, and Send and Robot get execute / stop), plus move to top, up, down, bottom, duplicate and delete for that row. The panel offers no export — export lives on each list page

04Hex panel · click a packet row and its full bytes appear here.

1. Title bar: index · byte count · RTT (time from requesting the bytes to receiving them, excluding local rendering) · the after / before segment · the Hex / Text segment
2. After / Before: for a packet a filter modified, these two compare directly — the differing bytes are marked amber
3. How many bytes fit on a line is computed from the panel width, not fixed at 16 — widen the panel and you get more columns (rounded to whole 2-byte groups). The column header above scrolls horizontally with the body, so they never drift apart
4. The right-hand column is "characters", not "text": a per-byte Latin-1 rendering, one cell per byte, aligned with the hex on the left. 0x00–0x1F and 0x7F–0x9F show as dots; everything else is drawn from its byte value
5. Select a range and right-click: copy text / copy hex / select all, plus "add to filters" and "add to send ▸" — with nothing selected it takes the whole packet
6. When a search matches, the matching bytes are outlined here

05The Text tab · the whole payload decoded as UTF-8, wrapped rather than scrolled sideways.

1. This and the "characters" column are two different things: this decodes the whole payload as UTF-8, that one is per-byte Latin-1
2. The four HTTP / HTTPS packet types land on this tab by default (they are text protocols to begin with); everything else defaults to hex. After you switch by hand, selecting another packet re-decides by type
3. It wraps and never scrolls sideways: this panel is only half a screen tall and is there to be read — dragging sideways pushes away the half-sentence you were reading. Long runs without spaces break too
4. ⚠️ Search hits are only highlighted on the Hex tab: the Text tab is one block of text with no byte-level selection
5. ⚠️ Packets from Chinese games are usually GBK, and this tab only decodes UTF-8, so those come out as mojibake. Read them from the "characters" column against the hex, or copy them into the encode/decode workbench

03 · Starting a capture

1. First open Settings ▾ on the right of the status bar → Hook Settings and tick the functions you need (next section). This must be done before pressing Start Hook.
2. If needed, narrow the display with Leach Setting.
3. Press Start Hook on the status bar: the hooks go live, and a target created suspended (the "File" route) is woken at the same moment.
4. Make the target do something on the network; packets stream into the list.
5. Stop Hook removes every hook and restores the target; Clear empties the queue, the list, the data panel and the matching group of counters.

04 · Hook Settings

This decides which hooks get installed, and therefore what can be captured at all.

06Hook settings (inject mode) · 12 function switches, all on by default.

1. Winsock 1.1 (wsock32.dll): send / sendto / recv / recvfrom
2. Winsock 2.0 (ws2_32.dll): the same four entry points — most modern programs use this group
3. Winsock 2.0 · WSA: WSASend / WSASendTo / WSARecv / WSARecvFrom — the asynchronous family, very common in games. The WSARecv switch also covers WSARecvEx in mswsock.dll
4. ⚠️ WSARecvEx is not hooked on 64-bit targets: to keep the target from crashing, that one entry point is skipped on 64-bit targets and a line is written to the system log; the other 12 entry points work as usual
5. Turn an entry point off and its packets neither reach the list nor the filters. All 12 switches are persisted and pushed to the target process immediately
6. The amber line at the bottom only appears when something really is switched off — nine times out of ten "I capture nothing" is this

05 · Leach Setting (display only)

07Leach settings · pick the direction first, then fill in conditions; conditions are ANDed.

1. Direction: "show only matches" or "hide matches" — one set of conditions, usable both ways
2. Six conditions: socket, IP address, port, packet head, content, length. Only ticked ones count, and several ticked conditions are ANDed
3. Categories: inject mode offers the eight WinSock categories that line up with the 12 hook entry points; proxy mode offers TCP/UDP request and response instead. Before 2.2 this dialog wrongly offered proxy mode's four in inject mode, so ticking them matched nothing
4. ⚠️ Ticking a condition and leaving its value empty is now rejected: letting it through would filter out every packet, which is far harder to diagnose than an error
5. It only decides what reaches the list; it never alters packet content — that is what filters are for

08The same screen in Proxy Mode · only the "categories" group differs.

1. The direction and the six conditions are identical; the only difference is the categories group at the bottom — Proxy Mode offers TCP request / TCP response / UDP request / UDP response, Inject Mode the eight WinSock categories
2. ⚠️ Before 2.2 these two were crossed: Inject Mode showed the four proxy categories, which could never match no matter what you ticked. The two sets are stored separately, so changing one mode never touches the other
3. With the "filter by category" master switch off, all four are dimmed — categories take no part in the decision then

06 · List Settings

It does exactly one thing: which columns the list shows, stored per mode (inject and proxy keep separate sets that do not affect each other).

09List Settings · seven columns you can hide; three are always shown.

1. The seven you can hide: Socket · Type · Client · Client location · Server · Server location · Length
2. No., Time, Domain and Data are always shown, and the grey line in the dialog says why — No. is the key used to fetch the bytes, and the other three are the point of the table

07 · Search Packet

10Finding a packet · as of 2.2 this is no longer a drawer — it is the search box on the packet toolbar (middle of the figure).

1. Search box: what you type is a regular expression, not plain text
2. The Hex / Text segmented button to its right decides what is matched: Text is the packet decoded as UTF-8; Hex is one continuous uppercase hex run
3. Find next: the list scrolls to the hit and selects it, and the hex panel below outlines the matching bytes. At the end of the list it wraps around; only after a full lap does it report "no matching packet"
4. To start over, change the query or clear it with Esc / the × — the cursor goes back to the beginning. (2.2 removed the separate "search from start" button; it could do nothing that Find next cannot)
5. The rest of the toolbar: the four colour chips on the left are the filter-action legend; auto-scroll and auto-clear are on the right

Example: to find TLS records starting with 0x16 0x03, choose Hex and enter ^1603.

08 · Editing and replaying packets

Double-click a row, or right-click → Edit. This is where hand-editing and replaying actually happens.

11Packet editor · an info bar on top, the hex editor in the middle, Send and Progression on either side.

1. Info bar: socket in use, type, local address, remote address and length. Without an available socket, the packet cannot be sent back on its original connection.
2. Send (left): "send N times" or "send continuously" until you press Stop; an interval of 0 means no sleep. Totals, successes and failures update live
3. Progression (right): every send adds step to the byte at position. With "carry" ticked an overflow carries into the preceding bytes, up to the number of digits given — this is how you deal with a sequence field
4. Hex editor: type over the bytes directly. Insert switches between overwrite and insert, and the outlined pill on the title bar shows which you are in (green = overwrite, amber = insert) — inserting grows the packet, so it gets the more cautious colour
5. The right-hand column is "characters", not "text": it is a per-byte Latin-1 rendering, one cell per byte, aligned with the hex on the left. For decoded text use the Text tab of the hex panel, which decodes UTF-8
6. Context menu: add to filter list, add to send ▸, copy text, copy hex, select all
7. Save writes the edit back into that row of the list; Cancel changes nothing

Which channel a send goes through

09 · The packet list right-click menu

10 · Comparing original and modified

Right-click → View Packet Modification puts before and after side by side, so you can confirm exactly which bytes a filter touched.

12View Packet Modification · side by side on top, listed change by change below.

1. The line at the top gives the index, the original length and the modified length — different lengths mean the filter changed the packet size
2. Side-by-side view: before on the left, after on the right, differing bytes in amber. It compares the same way as the Text Comparison page: when a filter's Replace changes the length, the two columns still line up and only the part that really changed is marked
3. A length change still lines up: the side with the insertion or deletion is held open with filler cells, so the offsets on the right run a few bytes behind the left while the two columns stay aligned
4. Difference table: no. / position / bytes / change type / old value / new value. Click a row to scroll to it above; the change type is modified, added or deleted
5. ⚠️ The "bytes" column may read 4 → 3: meaning that spot has a different length before and after
6. Old and new values are capped at 24 bytes, with "… +N" beyond that — a whole-packet replacement is thousands of bytes and unreadable spelled out

11 · Troubleshooting