Proxy Mode

WPE turns itself into a SOCKS5 proxy server. No injection: plain HTTP lands in the list as-is, and HTTPS becomes readable once you add an HTTPS mapping rule and the WPE root certificate. Accounts, a firewall, mappings and process takeover through the built-in mihomo core come with it; phones and other PCs connect through the proxy client WPC.

01 · The main window

01Proxy mode main window · 15 navigation entries on the left, a richer statistics strip than inject mode.

1. Sidebar: Data (proxy data / client list / accounts) · Rules (filters / send / robots / warehouses / decoders / extractors) · Tools (statistics / text compare / encode-decode / extraction) · System (WPC config / system log) — 15 pages, each with a live counter
2. Status bar: lamp plus Running or Stopped, the SOCKS5 listening address, TUN (whether the built-in core has taken over the selected processes; dimmed until ready, with a tooltip), uptime; then Focus List, Start/Stop proxy, Clear and Settings ▾
3. Focus List: the toggle on the right of the status bar. It hides the statistics grid, the lower pane and the dropped-packet notice so the packet table gets more height; the status bar and common actions stay available — click again to restore
4. Statistics grid (7 × 2): proxy total, TCP and UDP connections, online/accounts, filtered, buffer, bytes; the second row holds TCP and UDP request/response, HTTP request · response, and the live rate
5. The two "HTTP request · response" cells count plain HTTP only; HTTPS is encrypted — to read it in the clear, decrypt it first with HTTPS mapping plus the root certificate
6. Packet list: two more columns than inject mode — protocol and domain (this side of the wire knows whether a connection is TCP, HTTP, HTTPS or WebSocket). Rows a filter matched are coloured whole
7. Lower half: quick panel on the left (six tabs: filters / send / robots / warehouses / decoders / extractors), hex panel on the right
8. The status bar at the very bottom always shows the SOCKS5 address and state — the one thing you want visible at all times that is not on the dashboard

The twelve menu entries

02 · Proxy Settings

02Proxy settings · read this page before starting the service.

1. Listening address: tick "auto" to listen on 0.0.0.0; untick it and you must supply a local address. ⚠️ Leaving it empty is rejected with a message
2. SOCKS5 proxy: port 1080 by default. This is the main path — filters, send lists and robots all live on it
3. Maximum connections is not an arbitrary number: the service reserves memory for "connections × per-connection buffer" up front, so the box has the per-connection memory estimate and this machine's ceiling (worked out from physical memory) written next to it. A value above the ceiling is refused on Save, with the reason spelled out
4. Allow WPC clients only: once on, a plain SOCKS5 client is refused even with the right credentials, and the refusal is written to the System Log — turn it on to keep this port for your own devices. ⚠️ It requires authentication to be on first
5. Authentication: once on, clients must supply credentials. ⚠️ If you enable it, also tick the matching option in Process Settings, or the selected process simply loses network access
6. System proxy: a sliding switch that takes effect immediately, without Save — it writes the Windows Internet settings, and its shape deliberately sets it apart from the fields that need saving
7. HTTPS mapping root certificate: to read HTTPS in the clear, create the root certificate here and press Trust to install it on this machine; then export it in the format you need and install it on the device you are capturing. Whether anything is decrypted is decided by the enabled HTTPS mapping rules in Map Settings — with no rule, HTTPS passes straight through
8. ⚠️ While the service is running the listening fields are locked: they only take effect when the service starts, so stop the proxy before changing them
9. The port must be within 1–65535

Certificate export formats

Certificate install steps (PC · emulator · Android · iOS · Firefox)

The exported certificate has to be installed as a trusted root before anything will trust it. When you are done, the status should show as trusted back under Proxy Settings → root certificate. In the commands below, WPE64.cer, WPE64.crt, WPE64.pem and 9a7ae4b0.0 are the files exported from the table above.

1 · This Windows PC

1. Create and trust it in WPE: press Create under Proxy Settings → root certificate, then Trust. That installs it as a trusted root for the current user.
2. Or install by hand: export Cer certificate (binary), double-click WPE64.cer → Install Certificate → store location Local Machine (administrator) → Place all certificates in the following store → Trusted Root Certification Authorities → Finish, then click Yes on the security warning.
3. Check where it landed: a certificate under Personal or Current User is ignored by some programs. Press Win + R and run certlm.msc; WPE64 must be listed under Trusted Root Certification Authorities → Certificates.

2 · Android emulator (MuMu / LDPlayer / Nox / BlueStacks / AVD)

1. Turn on root first: MuMu, LDPlayer, Nox and friends have a root switch in their settings; for a plain AVD run adb root.
2. Android 7 and above: export Android system certificate (9a7ae4b0.0), then run adb push 9a7ae4b0.0 /sdcard/ → adb shell → su → mount -o rw,remount /system → cp /sdcard/9a7ae4b0.0 /system/etc/security/cacerts/ → chmod 644 /system/etc/security/cacerts/9a7ae4b0.0 → reboot.
3. When the store is on a read-only partition: newer builds keep it at /apex/com.android.conscrypt/cacerts/; run mount -o rw,remount /apex first, or mount the certificate with a Magisk module. Reboot either way.
4. Android 6 and below, or browser only: export Crt certificate or Cer certificate, adb push it to /sdcard/, then Settings → Security → Encryption & credentials → Install from storage → CA certificate to install it as a user certificate.
5. Check: Settings → Security → Encryption & credentials → Trusted credentials; WPE64 should appear under the System tab. Reboot the emulator before capturing HTTPS.

3 · Android phone

1. Get the file onto the phone: a USB cable, WeChat file transfer, a cloud drive or email all work; save it to local storage.
2. Android 6 and below: Settings → Security → Encryption & credentials → Install from storage → CA certificate, pick the file and install it as a user certificate. Browsers and apps that opt in trust it immediately; no root needed.
3. Android 7 and above: apps no longer trust user certificates, so reading an app's HTTPS needs root and a system certificate: push Android system certificate (9a7ae4b0.0) into /system/etc/security/cacerts/ (same commands as the emulator section above), permissions 644, then reboot.
4. Without root: you can only install a user certificate, and only the few apps that opt in will trust it; other apps and browsers still reject it. For those targets use Inject Mode instead.

4 · iPhone / iPad (iOS)

1. Send the certificate: export Cer certificate (binary) and AirDrop it or attach it to an email; you can also host WPE64.cer on a reachable page and open it in Safari.
2. Install the profile: tap WPE64.cer → "Profile Downloaded" → Settings → General → VPN & Device Management → Downloaded Profile → tap WPE64 → Install, enter your passcode, and tap Install again on the unsigned warning.
3. Enable full trust (the step people miss): Settings → General → About → Certificate Trust Settings → turn on the switch for WPE64 → Continue. Since iOS 10.3 installing the profile alone does nothing; this step is required.
4. Check: HTTPS pages in Safari stop warning about an untrusted certificate. You can remove the profile any time under VPN & Device Management.

5 · Firefox

1. Firefox has its own store: it does not read the Windows certificate store by default, so even on a machine where the certificate is already installed you must import it again here.
2. Export a text format: choose Crt certificate or Pem certificate; Firefox accepts either.
3. Import: Firefox menu → Settings → Privacy & Security → scroll to Certificates → View Certificates → Authorities → Import → pick WPE64.crt or WPE64.pem.
4. Trust it: in the import dialog tick "Trust this CA to identify websites" and confirm.
5. Check: WPE64 appears in the Authorities list. If it still fails, make sure you imported the file exported from WPE and not another CA.
6. Optional: to make Firefox follow the system store, set security.enterprise_roots.enabled to true in about:config. Outside managed environments importing directly is cleaner.

What happens when the service starts

1. Decide the listen address: the auto-detect setting determines which IP TCP and UDP bind to.
2. Start the SOCKS5 service: it starts listening, clears idle sessions automatically and turns on IP connection filtering — this is where the firewall acts.

03 · Process Settings · mihomo core

Steers a given process's traffic into the proxy at the system level, so the target does not need proxy support of its own.

03Process Settings · mihomo core · choose TUN stack, DNS mode and intercepted processes.

1. Data path: target process → mihomo TUN → WPE SOCKS5 → capture and filters. The status bar shows core and TUN readiness.
2. 01 Mihomo core: enable it, then choose the system, gvisor or mixed TUN stack and DNS mode.
3. 02 Intercepted processes: select running applications by name; names are saved with the settings. Use semicolon-separated manual process names when an app is not listed.
4. ⚠️ With the core disabled or no process selected, that traffic never enters WPE SOCKS5, so filters are not on its path.

Choosing a TUN stack

What each Test proxy error means

04 · Hook Settings and UnPack

Two groups: which directions to capture, and whether to cut the TCP byte stream apart by packet header.

04Hook Settings · four direction switches on top, UnPack below.

1. 01 Capture direction: TCP request / response and UDP request / response. Only the ticked directions are captured; the rest are forwarded straight through — they reach neither the list nor the filters
2. ⚠️ Read the grey line carefully: the capture direction applies to this run only and goes back to all-on after a restart; the UnPack settings below are persisted
3. 02 UnPack: TCP is a byte stream, so one recv may hold several application-level packets (or half of one). Turn on the master switch and maintain an ordered rule list; only complete frames independently reach filters, capture and forwarding
4. Each rule has a name, enabled state, direction (both / request / response), header and length field. Rule order is first-match priority. The header is hex, for example 01 00 00; length positions are counted from 1
5. It is for Proxy-Mode TCP only: not UDP and not Inject Mode. Requests and responses retain their own partial frames; after the first successful frame, that direction stays with its selected rule until the connection ends

05 · EXTProxy (upstream chaining)

Has WPE's SOCKS5 service hand traffic on to an upstream SOCKS proxy — to change the exit IP, or to chain other tools behind it.

06EXTProxy settings · one switch, one address, plus picking traffic by port.

1. EXTProxy: the master switch. With it on, WPE's SOCKS5 exit goes out through this upstream SOCKS proxy — capturing still happens inside WPE; only the last hop changes hands
2. Proxy address and port, with Test proxy beside it — it really connects and completes the handshake, not just a ping
3. Specified ports: only these destination ports go through the upstream proxy, comma separated; leave it unticked and everything does. Handy for "send the game ports out through another exit and let the rest go direct"
4. Requires authentication: tick it when the upstream proxy wants credentials
5. ⚠️ This and Process Settings are different things: that one governs how traffic gets into WPE, this one how it leaves

06 · Map Settings

Two independent features, each with its own switch. This is the right place to change HTTP content — filters cannot reach those packet types.

08Map Settings · local mapping above, remote mapping below, a rule table each.

1. Mapping supports HTTP and HTTPS. HTTP is matched after its complete request header arrives; HTTPS needs an enabled mapping and a trusted root certificate, and currently supports HTTP/1.1 only.
2. 01 Local mapping: replaces the response from a remote address with a local file. A rule is "remote address → local file"; on a match the file contents are returned as the response
3. 02 Remote mapping: rewrites a request address to another address. A rule is "request address → mapped address"
4. Each group has its own add / import / export / clear and a count; disabled rows are dimmed as a whole
5. ⚠️ Long addresses are truncated from the left (…example.com:80/config.json) — cutting from the right would keep the http:// every row shares and throw away the path tail you actually need to read
6. ⚠️ The line at the bottom says it: Save only covers the two master switches; adding, editing and deleting rules is already written to the database
7. The protocol is fixed at http://: mapping applies to HTTP requests only

Map Local · serve a local file instead

Map Remote · redirect to another address

Both lists support right-click move to top / up / down / to bottom / export / duplicate / delete, and import and export as .pml for Map Local and .pmr for Map Remote.

07 · FireWall

Implemented as a SuperSocket connection filter, so a client is allowed or refused while the TCP connection is still being established — which costs almost nothing.

09Firewall settings · one of two modes, plus automatic rules and two lists.

1. Enable firewall: the master switch. While it is off, the mode and the automatic rules below are dimmed — they describe how the firewall behaves, which is meaningless when it is off
2. Mode: allow-list = deny by default, permit only what is listed; block-list = permit by default, deny only what is listed. ⚠️ In allow-list mode an empty list means nobody can connect — that is by design
3. Automatic rules: IPs that authenticate successfully are added to the allow list; failed authentications and non-SOCKS protocols go to the block list; both share one block duration; and "auto-clear expired IPs"
4. The lists: allow and block tabs; each entry is a single IP or a range, with its location, hit count and expiry
5. ⚠️ The lists stay editable while the firewall is off (prepare the addresses first, enable later), with an amber line saying they are not in effect yet

08 · Proxy accounts

With authentication enabled, clients must use the credentials defined here.

10Proxy accounts · toolbar, expiry range, the account table and in-row actions.

1. Toolbar: new account / bulk create / expiry range (two date boxes) / search / import / export / clear. On a narrow window the toolbar wraps and the search box gives way first
2. The "enabled" column is the only checkbox on screen and it is always green — clicking it toggles that account and saves immediately. Selection does not use checkboxes: click to select, Ctrl to add, Shift to extend, exactly like Explorer
3. A disabled row is dimmed as a whole, except the checkbox cell — that is the control you need in order to light the row back up
4. Sortable headers: ascending → descending → back to the original order. IPs and dates sort numerically; "unlimited" and "never expires" sort last
5. Context menu: Bulk adjust ▸ (Expiry / Links / Devices) · Bulk export · Bulk delete · Select all / Deselect, the first three showing how many rows are selected. Enabling is done in the On column, and Login history is a button in the Actions column. ⚠️ Right-clicking opens the menu without changing the selection; with nothing selected the items are still clickable and tell you to select something first — dimming would say "you cannot" without saying why
6. The table stays smooth to scroll and search even with tens of thousands of accounts
7. ⚠️ Connection and device limits cannot be 0: the minimum is 1, and 0 is treated as 1 — whether set in the program, the remote console or through the CCProxy-compatible API

Editing an account

Batch create and batch adjust

Batch create (toolbar button): under Rules, choose how Username is generated — Time + No. or Prefix + No. (enter the prefix for the latter) — then set Count (10 by default) and Password length (6 by default). Under Limits, tick Links / Devices and Set expiry as needed (unticked means Unlimited / Never). Then under Preview press Generate: the table lists No. / Username / Password, usernames that already exist are flagged and skipped on save, and unwanted rows can be removed one by one. Export saves the preview to a file; when it looks right, press Save.

Bulk adjust: select several accounts, then right-click:

• Bulk adjust ▸ Expiry: under Add time enter N and pick Hours or Days; under Starting from pick Current expiry or Now
• Bulk adjust ▸ Links / Devices: set one value for all, or lift the limit entirely
• Bulk export / Bulk delete, the latter behind a confirmation showing how many accounts will go

09 · Client List

Two stacked tables: the authenticated clients on top, and the connections the selected client currently has open below.

11Client List · clients above, connection detail below.

1. Upper table: auth time / username / IP / client location / links / devices / traffic / online (min) / device ID. The location carries a flag icon, resolved from the QQWry offline database
2. Device ID (the last column): only WPC connections have one — it shows a truncated device fingerprint in green, and hovering reveals the full value plus the client version (such as WPC 1.2); a plain SOCKS5 client shows a dash. This is exactly what an account's device limit counts, so the cell is either a dash or WPC
3. Lower table, "connection detail": select a row above to fill it — it lists every connection that client has open right now
4. WPC control connection: WPC's persistent control connection is labelled WPC control connection · WPC · — in green (its target is empty). It never connects to a target by design, so it is not a broken connection
5. Headers are sortable (ascending → descending → back to the original order). IPs sort numerically, not as strings — otherwise 10.10.10.9 would land after 10.10.10.10
6. The context menu can drop an IP straight into the firewall block list, see section 07
7. ⚠️ There is no "result" column: an authentication that fails never reaches this table, so the column would read "passed" forever and carry no information at all
8. Connections brought in through local process interception show a local client address; manage the process list in Process Settings.

10 · Bringing in phones, emulators and other PCs with WPC

Inject Mode reaches one local process and no further. To capture from an Android phone or another PC on the LAN or across the internet, install the proxy client WPE Proxy Cap (WPC) on the device. It takes over the device's traffic with a virtual adapter (Windows) or the system VPN (Android) and, following the node's forwarding rules, hands the traffic that should be proxied to WPE over SOCKS5 — no need to set a proxy program by program. WPC comes as WPC for Windows 1.2 and WPC for Android 1.1; the Android download link is pending and will be placed on the Downloads page.

How each kind of device connects

HTTPS in the clear: HTTPS mapping plus certificate

Connections from WPC arrive over SOCKS5: their data lands in the TCP / UDP types of the Proxy List and Filters can edit it as usual; HTTP requests to destination port 80 / 8080 can also be changed with Map Settings. The SOCKS5 path does not decrypt HTTPS, though — on 443 / 8443 you see encrypted bytes.

Reading HTTPS in the clear takes three things: ① an enabled HTTPS mapping rule for the host you want, in Map Settings (with no rule, HTTPS passes straight through undecrypted); ② the root certificate created and trusted on this machine under Proxy Settings → root certificate; ③ the certificate exported in the format you need and installed, per the table below, on the device that makes the requests. The device's traffic just has to reach WPE over SOCKS5 (through WPC or a SOCKS5 client) — there is no separate proxy port to point it at.

Connecting through WPC · troubleshooting

11 · Troubleshooting