Getting Started
This chapter covers installing and launching, the three entry points on the home screen, multi-instance databases, and the core concepts used throughout the tutorial. By the end you will know whether Inject Mode or Proxy Mode is the right route for you.
Written against 2.1.8 beta, whose interface is the new AntdUI build — sidebar navigation plus light and dark themes.
The 2.1.x UI figures are structural diagrams drawn to match the real layout in the same colour scheme; the numbered red circles map one-to-one onto the legend beneath each figure.
Still on 1.0.0.36? Download the legacy tutorial PDF (Chinese).
Walk through it once and get to the point where packets appear on screen. The reasoning behind each step is unpacked in this chapter and the ones after it.
- Run
WinsockPacketEditor.exeas administrator to reach the three cards on the home screen. - Pick a route: ordinary desktop programs and emulators go through Inject Mode; HTTPS in the clear, phones and other machines go through Proxy Mode.
- Inject Mode: pick the target in the process list that pops up and click Inject — the WPE window then appears inside the target program.
Proxy Mode: go to Menu → Proxy Settings, tickEnable SOCKS5 proxy(port 1080 by default) and save. - Set the capture scope: under Menu → Hook Settings, tick the send / receive functions (Inject Mode) or the TCP / UDP request and response boxes (Proxy Mode). This has to be done before you press Start — changes made afterwards have no effect.
- Press Start on the toolbar, make the target program do something on the network, and packets stream into the list.
- Double-click any row to open the packet editor, change a few bytes and press Send — that is the full capture → edit → replay loop in miniature.
Requirements
| Item | Requirement |
|---|---|
| OS | Windows 10 / 11 · Server 2019 / 2022 (x64 recommended) |
| Runtime | .NET Framework 4.8 |
| Privileges | Administrator required. Launched without it, WPE restarts itself via runas |
| Target program | 32-bit and 64-bit both supported; the hook module matching the process is selected automatically |
| Data storage | SQLite, C:\WPE64DB\<version>.db by default |
| Distribution | Portable single-file build: the archive extracts to one exe. Double-click to run — no installer, no auto-update |
Download and install
WPE x64 is a portable single-file build: one exe in the archive, nothing to install, no registry writes, no entry in Add or Remove Programs. Move it by dragging the exe; uninstall it by deleting the exe and the database folder.
- Download the archive: pick the latest build on Downloads, from either Lanzou or Baidu Pan (the pan link needs the extraction code shown on the page).
- Unblock it first: right-click the downloaded archive → Properties → tick Unblock at the bottom → Apply. Do this before extracting — see the warning below.
- Extract anywhere: you get a single
WinsockPacketEditor.exe. Desktop, another drive, a USB stick — all fine, though it is best to avoid spaces and non-ASCII characters in the path. - Double-click to run: accept the UAC prompt if you are not already elevated (see First launch). If SmartScreen shows "Windows protected your PC", click More info → Run anyway.
Windows tags archives downloaded from the internet with Zone.Identifier. Extract first and the tag lands on the exe, which usually means STATUS_INTERNAL_ERROR (Code: 15) when you inject. If you forgot, it is recoverable: right-click the extracted exe → Properties → Unblock, or delete it and start over.
.NET Framework 4.8 is required. Windows 10 1903 and later ship with it, so normally there is nothing to do. If launching complains about a missing runtime, install the .NET Framework 4.8 runtime from Microsoft and try again.
Upgrading to a new version
There is no auto-update — WPE never checks for versions and never prompts. Upgrading means repeating the steps above:
- Read the changelog on Downloads and check the new build has what you want.
- Download the new archive → unblock → extract the new exe.
- Close the running old build — in Inject Mode press Stop and exit the injected program first — then run the new exe.
- Delete the old exe or keep it; two versions side by side do not conflict.
Settings live in C:\WPE64DB\<assembly version>.db and the filename follows the version. So the first time a new build opens, filters, send lists, robots and proxy accounts all look empty — nothing is lost, it is simply still in the old version's .db.
To carry it across: export a .sb file from the old build via BackUp Settings, then import it into the new one. Worth doing before every upgrade.
First launch
- Double-click to start. Without elevation a UAC prompt appears — choose Yes and WPE exits and restarts as administrator.
- This is a beta build, so a notice saying this is a test version appears — click OK to continue.
- You land on the home screen, where you choose the working mode.
Home screen · three entry points
- Inject Mode: opens the process list dialog — pick a target and inject → chapter 2
- Proxy Mode: closes the home screen and goes straight to the Proxy Mode window → chapter 3
- Database Setting: switch the SQLite database path to keep several independent config sets (next section)
- Each card is clickable in its entirety — title, subtitle or icon, anywhere works
- Language (Chinese / English) and the light-dark theme toggle, both applied instantly
- Links area: official site / tutorial / GitHub / Gitee / issue feedback
If the official domain is unreachable, WPE falls back to the backup IP http://101.132.222.195. On a machine with no internet, the external links simply doing nothing is expected.
Database Setting (multiple instances)
Every setting in WPE — system settings, filters, send lists, robots, the warehouse, proxy accounts, mappings, allow and block lists, WPC servers and notices — lives in one SQLite file. Which means:
A different database path is a different config set, and that is how you run multiple instances.
- Database path:
C:\WPE64DBby default. Use the path picker to choose a folder - Database name: read-only, always
<assembly version>.db—2.1.8.0.db, for example. A new version means a new database - The on-screen hints
- Saving creates the database and its tables at that path straight away, and confirms that the setting was saved
Running a second instance
- Home screen → Database Setting, change the path to
D:\WPE_A, save. - Go back and choose a mode; from then on every setting is read from and written to the new database.
- For a second one: start another copy of WPE, set the path to
D:\WPE_B, save, then choose a mode.
In Inject Mode the database path is passed into the target process as an injection parameter (InjectionParameters.DataBasePath), so the injected side and the host always read and write the same database — they never cross over.
Concept · choosing a mode
| Capability | Inject Mode | Proxy Mode |
|---|---|---|
| Mechanism | EasyHook injection + WinSock API hooks | Built-in SOCKS5 server + SunnyNet MITM |
| Where the UI lives | Inside the target process | WPE's own process |
| Packet types | Send / Recv / SendTo / RecvFrom / WSA* | TCP, UDP, HTTP(S) and WebSocket requests and responses |
| HTTPS in the clear | ✗ you get the encrypted bytes | ✓ decrypted by the built-in CA |
| Cooperation from the target | None needed, but anti-cheat may block it | Must use the proxy, or be taken over with the driver |
| Port / host mapping | ✗ | ✓ Map Local / Map Remote |
| Accounts / firewall | ✗ | ✓ Proxy accounts + allow and block lists |
| Edit / replay | ✓ / ✓ | ✓ / ✓ (HTTP(S) types cannot be replayed) |
An ordinary desktop program or emulator → prefer Inject Mode; the data is closest to the program's own logic.
A target with anti-injection protection, a need for HTTPS in the clear, or traffic from a phone or another machine → Proxy Mode.
Concept · how a packet reaches the screen
Captured packets are not pushed straight to the UI — a message queue sits in between, and that is what lets WPE take millions of packets without freezing.
- The Buffer figure on screen is how many packets are queued up. A number that keeps climbing means rendering cannot keep up with capture — see performance tuning
- Speed Mode (System Settings) skips the queue entirely: nothing is displayed, but filters keep working — for high-volume work where you only need the edits, not the view
Concept · Leach Setting is not a Filter
The single most common beginner mix-up. The names look alike; the jobs are nothing alike:
| Leach Setting | Filter | |
|---|---|---|
| Acts on | the display only | the real network data |
| Modifies packets | No | Yes — Replace / Change / Intercept |
| Applied | on dequeue, as rows enter the list | at hook / forwarding time |
| Typical use | show only one port or one packet length | change values, drop heartbeats, auto-reply |
| Where | Menu → Leach Setting | Sidebar → Filter List |
Concept · the four gates a packet passes
Four things in WPE sound like filtering, but they sit at different points along the path. When nothing is captured or edits do not take, walking this table top to bottom beats guessing:
| # | Gate | Where | What it controls | If it is off |
|---|---|---|---|---|
| 1 | Hook Settings | the source of hooking / forwarding | which hooks are installed and which packet types exist at all — 12 function switches for injection, TCP · UDP request / response for the proxy | those packets are never produced, and nothing downstream can help |
| 2 | Filter | before the packet is queued | the only layer that changes real data: Replace / Change / Intercept / Only Display / Not Display | data passes through untouched |
| 3 | Leach Setting | on dequeue, as rows enter the list | only what you can see; the network data is never touched | everything is displayed and the list floods |
| 4 | Map Settings | the HTTP(S) path in Proxy Mode | rewrites HTTP / HTTPS response bodies and targets — filters cannot reach these | HTTP(S) content is returned unchanged |
"Nothing captured at all" → check gate 1. "Counters rising but nothing in the list" → check gate 3, watching the Leach counter on the status bar. "The filter reports a match but nothing changed" → check whether it is an HTTP(S) type, which belongs to gate 4.
Concept · sockets and the System Socket
- Socket: the number column in the list — the socket handle of that connection inside the target process. Sending requires a valid socket; without one nothing goes out
- System Socket: a global variable, for cases like the Send List and Robots where the socket is not known in advance
- To set it: right-click in the packet list or proxy list → Set System Socket
- To use it: tick "use system socket" in the send editor, or use the robot instruction that sets it
- If it is ≤ 0, the log records that the system socket is not set and the send is abandoned
Concept · filter actions and row colours
The background colour of each row in the packet list tells you what a filter did to it:
| Action | Meaning | Default colour |
|---|---|---|
| Replace | rewrites some bytes of the packet per the rule | dark gold / black text |
| Intercept | drops the packet — never sent, never received | dark red / white text |
| Change | builds a brand-new packet from the filter's modify row | bright blue / black text |
| NoModify Display | leaves the content alone but guarantees the row is shown | light green / black text |
| NoModify NoDisplay | leaves the content alone and keeps it out of the list entirely | — (nothing to see) |
The colours can be changed under System Settings → filter actions, each with its own reset button.
Concept · packet types
WPE defines 23 packet types internally — the first 13 come from Inject Mode, the last 10 from Proxy Mode. The filter's packet-type switches group them into 12:
| Mode | Internal type | Filter packet type |
|---|---|---|
| Inject | WS1_Send / WS2_Send | Send |
WS1_SendTo / WS2_SendTo | SendTo | |
WS1_Recv / WS2_Recv, WSARecvEx | Recv / WSA Recv | |
WSASend / WSASendTo / WSARecv / WSARecvFrom | the four matching WSA switches | |
| Proxy | TCP_Req / TCP_Resp | TCP request / TCP response |
UDP_Req / UDP_Resp | UDP request / UDP response | |
HTTP(S)_* / WebSocket_* | never matched by filters |
HTTP, HTTPS and WebSocket packets are never matched by a filter — there are only 12 packet-type switches and none of them covers these. Use Map Settings to change that content instead.