Tutorial
Eight chapters covering every screen, every field and every action in WPE x64. Chapters 1–7 read as one path from install to advanced use; chapter 8 is a reference you come back to. You can also jump straight to whatever you are trying to solve.
All eight chapters are available in English, as is the FAQ. Terminology follows the software's own English UI, so every name below matches what you see in WPE. The download centre is still Chinese only.
Contents
Install and launch, the three entry points on the home screen, multi-instance databases, and the core concepts used throughout. Start here on your first run.
- Requirements · portable build · upgrading
- Database Setting: a different database is a different config set
- Choosing a mode · how packets reach the list
- Four filtering stages · Leach Setting ≠ Filter · System Socket
Inject the hook into the target process and tap the WinSock send / receive functions from inside — the view closest to the program's own logic.
- Picking a target: list, window picker, or an unstarted exe
- Hook Settings · Leach Setting · List Settings
- Search Packet (regex) · editing and replaying
- The full right-click menu · injection troubleshooting
WPE becomes a SOCKS5 + HTTP/HTTPS man-in-the-middle proxy. No injection, and HTTPS in the clear.
- Proxy Settings · Export Cert · system proxy
- Force Proxy (NFAPI / Proxifier / WinDivert)
- UnPack · upstream chaining · Map Local / Map Remote
- FireWall lists · proxy accounts · capturing from phones and emulators
The heart of the software: match a packet and rewrite it before it is really sent or received.
- Which tool should do the editing · Normal vs Advanced
- Nibble wildcards · Exclude / Progression / Random
- Five actions · chained execution · execution order
- Five worked examples · why it is not matching
From reading a packet's structure to pinning down the one byte you need. Earlier chapters explain the software; this one explains how to approach an unknown protocol.
- Anatomy of a packet · locating a field in four steps
- Spotting counters, timestamps and checksums
- Detecting encryption · the full edit workflow
- Protocol signatures · legacy-tutorial terminology
The automation trio. They can call each other, and filters or hotkeys can trigger them.
- Which of the three you actually need
- Send List: batch replay with repeat count and interval
- Robot: packet / control / keyboard / mouse instructions
- WareHouse and Auto Stores: archiving samples by packet head
Everything outside the main window: five helper tools, WPC Config for the accelerator, five groups of global settings and the remote management web console.
- Statistical Data · Text Comparison · XOR · Transcoding · Extraction
- WPC Config: servers / rules / notices
- System Log · System Settings · HotKeys · BackUp
- Display Settings · Remote MGT · performance tuning
Four look-it-up-and-leave tables. Not meant to be read through — come back when something does not add up.
- A · file types: what
.sp .sc .rb .sb .paare - B · packet types: 23 types ↔ the filter's 12 switches
- C · folders and dependencies
- D · glossary: one name per concept, site-wide
Find it by what you are trying to do
| Your goal | Where to start |
|---|---|
| First time — capture something quickly | Getting Started · quick start → Inject Mode |
| Unsure which mode to use | Getting Started · choosing a mode |
| Edit packets, manually or automatically | Filters (the core feature) |
| Replay packets or send them in a loop | Send List + packet editing |
| No idea where to start on an unknown protocol | Packet Analysis (locating a field in four steps) |
| Following an old tutorial that does not match | Legacy WPE terminology |
| Build an automation script | Robot |
| See HTTPS in the clear | Proxy Settings + Export Cert |
| Capture from a phone, emulator or another machine | Proxy · external devices (with per-platform certificate steps) |
| Not sure whether to use a Filter or Map Settings | Filters · which tool should do the editing |
| Run WPE as a proxy server for others | Proxy accounts + Remote MGT |
| Use it with the WPEProxyCap accelerator | WPC Config |
| Stutter under load / buffer climbing | Performance tuning |
| Something is broken | System Log + FAQ |
Reading conventions
[ Button ]marks a button in the UI; a small key cap like Start is also a button or a key- "right-click menu" means the menu that appears when you right-click the list or grid in question
- Hex input boxes take hexadecimal with spaces between bytes unless stated otherwise, e.g.
01 00 0A FF - The UI diagrams in each chapter are drawn to match the real layout; the numbered red circles correspond one-to-one with the legend beneath
Legacy tutorial (1.0.0.36)
1.0.0.36 had a completely different interface — a single WinForms window plus a separate process injector — which does not map onto the AntdUI interface of 2.1.8. That tutorial is no longer maintained as web pages; only the PDF is archived, in Chinese: