WPE_TUTORIAL_V2 // 03_PROXY

Proxy Mode

Tutorial Rev · 2.1.8 beta

WPE turns itself into a SOCKS5 proxy server plus an HTTP/HTTPS man-in-the-middle proxy. No injection, HTTPS in the clear, and it comes with accounts, a firewall, port mapping and driver-level takeover.

Quick start // Proxy Mode in six steps

Proxy Mode picks no process and injects nothing. Get the service running first, then decide how to route traffic into it.

Click Proxy Mode on the home screen to go straight to the main window.
Menu → Proxy Settings: tick Enable SOCKS5 proxy (port 1080 by default). For HTTPS in the clear also tick Enable HTTP proxy (1081 by default — it cannot share the SOCKS5 port), then save.
Menu → Hook Settings, proxy tab: tick the TCP and UDP request and response boxes.
Press Start to bring the service up, then check the System Log for the SOCKS5 proxy : TCP [ … ] and WPE64 certificate installed lines.
Route traffic in: let the local program point at the proxy itself, or take it over by PID or name with Process Settings → Force Proxy. For phones, emulators and other machines see section 10.
Once data appears in the Proxy List: HTTP(S) types are shown as plain text and are edited with Map Settings; TCP / UDP types are edited byte-wise with Filters.

01 · The main window

01Proxy Mode main window · fourteen navigation items, with a richer status bar than Inject Mode.

Sidebar (14 items): Proxy List / Client List / Account List / Filter List / Send List / Robot List / WareHouse List / WPC Config / Statistical Data / Text Comparison / XOR / Transcoding / Extraction / System Log
Toolbar and menu: the menu holds twelve settings panels — five more than Inject Mode: Proxy, Process, Map, EXTProxy and FireWall
Proxy List: the address columns become Client address / Server address, and the types are TCP / UDP / HTTP(S) / WebSocket
Two-row status bar: connection counts, accounts online, per-type counters and live up / down throughput
Quick list: same as Inject Mode
Data panel: HTTP and HTTPS types are shown as plain text; everything else is hex

The twelve menu entries

#	Menu entry	Where in this chapter
1	Proxy Settings	section 02
2	Process Settings	section 03
3	Leach Setting	same as Inject Mode (see there)
4	Hook Settings	section 04
5	List Settings	same as Inject Mode
6	Map Settings	section 06
7	EXTProxy Settings	section 05
8	HotKey Settings	Tools chapter
9	BackUp Settings	Tools chapter
10	Remote MGT	Tools chapter
11	FireWall Settings	section 07
12	System Settings	Tools chapter

02 · Proxy Settings

02Proxy Settings · the page to read before starting the service.

Auto detect: when ticked, TCP listens on 0.0.0.0 — every interface — and UDP uses the machine's first IP. Untick it to bind one specific local address
Enable SOCKS5 proxy plus its port, 1080 by default. This must be ticked, or saving fails with "proxy type not set"
Enable authentication: clients must then supply a username and password (see section 08). Username / password is currently the only method
Enable HTTP proxy plus its port, 1081 by default. It runs on SunnyNet and can decrypt HTTPS. It cannot share the SOCKS5 port. The dropdown on the right picks the certificate format to export
The system proxy switch
Max connections

Certificate export formats

Dropdown option	File	Typical use
Cer certificate (binary)	`WPE64.cer`	double-click to install on Windows
Cer certificate (text)	`WPE64.cer`	where Base64 is required
Crt certificate (binary / text)	`WPE64.crt`	Linux / Nginx
Pem certificate (text)	`WPE64.pem`	SDKs, curl
Android system certificate	`9a7ae4b0.0`	push into the Android system certificate store

What happens when the service starts

Decide the listen address: the auto-detect setting determines which IP TCP and UDP bind to.
Start the SOCKS5 service (SuperSocket): a 65535-byte receive buffer, a 10 MB per-request cap, idle sessions cleared after three minutes, and an IP connection filter attached — this is where the firewall acts.
Start the HTTP proxy, if enabled: SunnyNet binds the port, loads the built-in CA and tries to install the WPE64 root certificate into the system store, logging a success line when it works.

// The log tells you everything

After starting, look in the System Log for these lines: SOCKS5 proxy : TCP [ … ] UDP [ … ], HTTP proxy : …, SOCKS5 proxy authentication enabled and upstream proxy enabled [ ip:port ].

03 · Process Settings · Force Proxy

Steers a given process's traffic into the proxy at the system level, so the target does not need proxy support of its own.

// The on-screen warning, and it matters

The HTTP proxy must be enabled before a process's data can be captured. Force Proxy must be enabled before filters can be used.
Saving drops the TCP connections the target has already established.

03Process Settings · processes on the left, driver on the right, forwarding target below.

Capture by PID: tick the processes to take over. Double-clicking a row adds it to the by-name list on the right
Capture by process name: matches by name, so it survives a restart of the process. Double-click a row to remove it
Driver type: one of three, see the table below. Once a driver is loaded the choice is locked and all three radio buttons grey out
Uninstall driver: available only while one is loaded. It reboots the machine immediately, after a confirmation prompt
Force Proxy: the master switch plus the forwarding target IP:port — usually WPE's own SOCKS5 service. Test proxy verifies the handshake on the spot
Specify port / Requires auth: forward only certain ports, and supply credentials when the upstream asks for them

Choosing between the three drivers

Driver	What WPE says about it	Suggestion
NFAPI (default)	limited to 1,000,000 TCP connections and UDP sockets; past that a restart is needed to keep capturing	the general-purpose choice
Proxifier	no UDP, no 32-bit Windows	TCP-only scenarios
WinDivert	cannot capture 127.0.0.1 traffic	fine when loopback is not involved

What each Test proxy error means

Message	Meaning
Proxy server settings are invalid	bad parameters
Proxy server connection timed out	unreachable
Proxy server refused the connection	nothing listening, or actively refused
Proxy server requires authentication	the upstream wants credentials but Requires auth is unticked
Proxy server authentication failed	wrong username or password
Unsupported authentication method	the upstream only offers GSSAPI or similar
Unsupported SOCKS protocol	version mismatch
Failed to reach the target server	the handshake succeeded but the destination did not

04 · Hook Settings and UnPack

The proxy tab has just four switches — TCP and UDP, request and response — plus the UnPack settings.

04UnPack · splits a coalesced TCP stream into whole packets using the protocol header.

Field	Default	Meaning
Packet head	`01 00 00`	every packet must begin with this hex string; spaces, commas or semicolons all work as separators
Length	`4-5`	the byte range (1-based) holding the length field — bytes 4 to 5 here — read big-endian as the total packet length

// Validation

Ticking UnPack but leaving either box empty makes saving fail with an invalid-UnPack-settings error.

05 · EXTProxy (upstream chaining)

Has WPE's SOCKS5 service hand traffic on to an upstream SOCKS proxy — to change the exit IP, or to chain other tools behind it.

05Chained proxy topology · ports decide which traffic takes the upstream route.

Field	Default	Notes
`Enable EXTProxy`	off	the master switch
IP or domain / port	`127.0.0.1` / `8889`	the upstream SOCKS server
`Specify port`	off (prefilled `80,8080,443,8443`)	only destinations on this list go upstream
`Requires auth`	off	tick it when the upstream wants credentials
`Test proxy`	—	error messages are listed in section 03

06 · Map Settings

Two independent features, each with its own switch. This is the right place to change HTTP(S) content — filters cannot reach those packet types.

Map Local · serve a local file instead

Field	Notes
Protocol	`Http` / `Https`
Host	e.g. `cdn.example.com`
Port	80 by default
Remote path	e.g. `/static/app.js`
Local file	drag it in or browse for it; matching requests get this file as their response body

Map Remote · redirect to another address

Section	Fields
Request address (what to match)	protocol / host / port / path
Mapped address (what to rewrite it to)	protocol / host / port / path

Both lists support right-click move to top / up / down / to bottom / export / duplicate / delete, and import and export as .pml for Map Local and .pmr for Map Remote.

07 · FireWall

Implemented as a SuperSocket connection filter, so a client is allowed or refused while the TCP connection is still being established — which costs almost nothing.

06FireWall Settings · one of two modes, two lists, and a set of automatic rules.

Enable FireWall: the master switch
Mode: WhiteList Mode lets only listed IPs connect; BlackList Mode blocks the listed ones
Two lists: each entry is either a single IP or a range (a start and end IPv4), optionally with an expiry
FireWall rules: automatic blocking and allowing, see the table below

Rule	Default	Notes
Auto-allow → IPs that authenticate successfully	off	an IP is allowed once a proxy account authenticates from it
Auto-block → unsupported SOCKS protocol, for N minutes	off / 30	an IP sending a malformed handshake is banned for N minutes
Auto-block → IPs that fail authentication	off	a wrong username or password gets the IP blocked
Auto-clean → expired entries	off	removes expired entries periodically

// Blocking someone quickly

Right-click an auth record in the Client List → add to WhiteList or add to BlackList ▸ (1 hour / 1 day / 30 days / permanent).
Import and export: .wl for the allow list, .bl for the block list.

08 · Proxy accounts

With authentication enabled, clients must use the credentials defined here.

07Account List · search, an expiry calendar, a paged table and per-row actions.

Search area: fuzzy search by username, or by expiry through the calendar, which badges each day with how many accounts expire on it
Menu: add account / batch create / import list / export all / clear all
Table: checkbox / no. / username / status / links / devices / expiry / actions. Unrestricted values show a green Unlimited tag
Row actions: ✎ edit · 📍 login history (past IPs and their locations) · ✕ delete
Paging: 20 / 30 / 50 / 100 / 200 rows per page

Editing an account

Field	Notes
`Enabled`	a disabled account cannot authenticate
`Username`	must be unique; duplicates are rejected
`Password`	case-sensitive at authentication
`Link limit`	how many simultaneous connections one account may hold
`Device limit`	how many distinct source IPs one account may use
`Expiry`	unticked means never — stored internally as `8888/12/31`

Batch create and batch adjust

Batch create: naming rule / custom prefix / how many (10 by default) / password length (6 by default) / link limit / device limit / expiry. Press Preview to see the result, then Save to write them. The preview table can be right-clicked to export to Excel with username, password and expiry columns.

Batch adjust: tick several accounts, then right-click:

Batch adjust ▸ expiry: add N days or hours, counted either from now or from each account's existing expiry
Batch adjust ▸ links / devices: set one value for all, or lift the limit entirely
Batch export / batch delete, the latter behind a confirmation showing how many accounts will go

// Import and export

The native format is .pa — XML, with optional password encryption. Import also accepts CCProxy .ini account files. Both directions prompt for a password; press Cancel if you do not want one.

09 · Client List

A tree of client connections on the left, the authentication records on the right:

Column	Notes
Auth time	`HH:mm:ss`
Account	the username resolved from the account ID
IP / location	with a flag icon, resolved from the QQWry offline database
Links / devices	current connections from that IP, and devices on that account
Traffic	units scale automatically
Online (min)	minutes since authentication
Result	`Passed` in green, `Failed` in red

10 · Capturing from phones, emulators and other machines

Inject Mode reaches one local process and no further. To capture from an Android or iOS device, an emulator or another machine on the LAN, make WPE their proxy server: point the device at this PC's IP and port, and its traffic passes through WPE on the way out.

08How external devices connect · the device treats WPE as its proxy, and HTTPS is decrypted by the built-in CA.

// Three prerequisites

① The device and the PC are on the same LAN, and the device can ping the PC. ② Auto detect is ticked in Proxy Settings so TCP listens on 0.0.0.0 — otherwise only one address is bound and nothing outside can reach it. ③ Windows Firewall allows inbound traffic on 1080 / 1081 — by far the most common reason a device cannot connect.

Quick start // routing a phone through WPE

Find the PC's IP: run ipconfig and note the IPv4 on the same subnet as the phone, e.g. 192.168.1.20.
Set up the proxy: in Proxy Settings tick Auto detect, Enable SOCKS5 proxy and Enable HTTP proxy, give them different ports, and save.
Export the certificate: pick the format for your platform in the dropdown and press Export Cert (formats are listed below).
Press Start; once the log shows the SOCKS5 proxy : TCP [ … ] line, the service is ready.
Configure the device: in the phone's Wi-Fi manual proxy settings, enter the PC's IP and the HTTP proxy port. For non-HTTP TCP or UDP, use a SOCKS5 client pointed at 1080 instead.
Install the certificate, then verify: install the exported root certificate on the device and open any HTTPS page. Plain-text HTTP(S) entries appearing in the Proxy List mean it works.

What to enter on each device

Device	Where	Which port	Notes
Android device	Wi-Fi → long-press the network → Modify → Advanced → Proxy: Manual	HTTP 1081	the built-in manual proxy only handles HTTP(S); raw TCP and UDP will not appear
Android · all traffic	install a SOCKS5 client app such as Postern or SocksDroid	SOCKS5 1080	routes the device's whole TCP traffic; enter the credentials in the app if authentication is on
iPhone / iPad	Settings → Wi-Fi → ⓘ → Configure Proxy → Manual	HTTP 1081	iOS has no system-level SOCKS5 either, so a third-party client is needed
Android emulator	the emulator's own network / proxy settings, or the Android steps above from inside it	1081 / 1080	an emulator is a local process, so Inject Mode can skip this whole setup
Another Windows PC	Settings → Network & Internet → Proxy → Manual proxy setup	HTTP 1081	to capture every process's TCP on that machine, pair SOCKS5 with a tool like Proxifier

// Turn the safety valves on while you are here

Opening the proxy to the network exposes those ports on the LAN. Enable authentication so clients must supply credentials, put the firewall in WhiteList Mode with only that device's IP allowed, and check the auth records in the Client List.

Where the certificate goes

Without the root certificate installed, HTTPS shows nothing but failed handshakes and garbage. Export the right format from Proxy Settings first, then follow the table:

Target	Format	How to install
This Windows PC	—	installed into the system store automatically when the proxy starts, with a success line in the log. If that fails, export `Cer certificate (binary)`, double-click it and install into Trusted Root Certification Authorities
Android 6 and below	`Crt` or `Cer`	copy the file to the phone, then Settings → Security → Install from storage. A user certificate is enough here
Android 7 and above	`Android system certificate (9a7ae4b0.0)`	apps no longer trust user certificates by default, so the device must be rooted: push `9a7ae4b0.0` into `/system/etc/security/cacerts/` — under `/apex` on some builds — set permissions to 644 and reboot
iPhone / iPad	`Cer certificate (binary)`	open it via Safari or AirDrop → install it under Downloaded Profile in Settings → then enable full trust for it under General → About → Certificate Trust Settings, the step people forget
Firefox	`Crt` / `Pem`	Firefox does not use the system store: Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import, and tick trust for identifying websites
Linux / Nginx / curl / SDKs	`Crt` · `Pem`	drop it into the distribution's CA directory and refresh, or point the tool at the file with something like `--cacert`

// Certificate installed, still no plain text

Almost certainly SSL Pinning: the app trusts only the certificate baked into it, regardless of what the system trusts. No certificate will fix that. Either switch to Inject Mode and read the buffers on either side of encryption, or give up on decrypting and watch it as TCP traffic.

External devices · troubleshooting

Symptom	Check this first
No connectivity at all on the device, or timeouts	① does Windows Firewall allow inbound; ② is Auto detect ticked in Proxy Settings; ③ are both really on the same subnet — is the phone on 4G or a guest network
The device works but the list stays empty	are the TCP / UDP boxes ticked in Hook Settings; is Leach Setting hiding them (watch the Leach counter); is Speed Mode on
The device asks for a username and password	authentication is enabled — create an account under proxy accounts and enter it on the device
Connects, then drops immediately	the firewall is in WhiteList Mode and the device is not on the list, or the IP was auto-blocked after failed authentication
HTTPS pages report an untrusted certificate	it was never installed, installed as a user certificate on Android 7+, or full trust was not enabled on iOS
Only some apps show up	a system manual proxy only affects apps that honour it; games and push services usually run over raw TCP or UDP, so use a full-traffic SOCKS5 client

11 · Troubleshooting

// Failed to start the SOCKS5 proxy

The port is taken, or the bind IP you chose does not exist. Change the port, or tick Auto detect.

// Settings refuse to save

"Proxy type not set" → tick Enable SOCKS5 proxy. "SOCKS and HTTP ports cannot be the same" → give them different values.

// Connected to the proxy but nothing is captured

① Are the TCP / UDP boxes ticked on the proxy tab of Hook Settings; ② is Leach Setting hiding them (watch the Leach counter); ③ is Speed Mode on.

// A process is selected but filters do nothing

Force Proxy must be on before filters work, and the HTTP proxy must be on before a process's data is captured at all — both are stated in the red notice at the top of the panel.

// HTTPS is all garbage

The WPE64 root certificate is not installed. Starting the proxy should log that it was installed successfully; other devices need it exported via Export Cert and installed manually as a trusted root.

// The driver radio buttons are greyed out

A loaded driver locks the choice. Uninstall it first — which reboots the machine immediately — then change it.