pixel7无法抓包

[rbt666]

pixel7 android15 已经root
./ecapture tls -l log.txt， 没有抓包数据，完整日志如下

{"level":"info","AppName":"eCapture(旁观者)","time":"2025-06-05T01:40:48Z"}
{"level":"info","HomePage":"https://ecapture.cc","time":"2025-06-05T01:40:48Z"}
{"level":"info","Repository":"https://github.com/gojue/ecapture","time":"2025-06-05T01:40:48Z"}
{"level":"info","Author":"CFC4N <cfc4ncs@gmail.com>","time":"2025-06-05T01:40:48Z"}
{"level":"info","Description":"Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.","time":"2025-06-05T01:40:48Z"}
{"level":"info","Version":"androidgki_arm64:v1.1.0:6.8.0-1027-azure","time":"2025-06-05T01:40:48Z"}
{"level":"info","Listen":"localhost:28256","time":"2025-06-05T01:40:48Z"}
{"level":"info","logger":"save.txt","time":"2025-06-05T01:40:48Z","message":"eCapture running logs"}
{"level":"info","eventCollector":"","time":"2025-06-05T01:40:48Z","message":"the file handler that receives the captured event"}
{"level":"info","listen":"localhost:28256","time":"2025-06-05T01:40:48Z"}
{"level":"info","time":"2025-06-05T01:40:48Z","message":"https server starting...You can upgrade the configuration file via the HTTP interface."}
{"level":"info","Pid":23058,"Kernel Info":"6.1.99","time":"2025-06-05T01:40:48Z"}
{"level":"info","TruncateSize":0,"Unit":"bytes","time":"2025-06-05T01:40:48Z"}
{"level":"warn","time":"2025-06-05T01:40:48Z","message":"Your environment is like a container. We won't be able to detect the BTF configuration.\nIf eCapture fails to run, try specifying the BTF mode. use `-b 2` to specify non-CORE mode."}
{"level":"info","btfMode":0,"time":"2025-06-05T01:40:48Z","message":"BTF bytecode mode: CORE."}
{"level":"info","keylogger":"","eBPFProgramType":"Text","time":"2025-06-05T01:40:48Z","message":"master key keylogger has been set."}
{"level":"info","moduleName":"EBPFProbeOPENSSL","isReload":false,"time":"2025-06-05T01:40:48Z","message":"module initialization."}
{"level":"info","time":"2025-06-05T01:40:48Z","message":"Module.Run()"}
{"level":"error","time":"2025-06-05T01:40:48Z","message":"OpenSSL/BoringSSL version not found, used default version.If you want to use the specific version, please set the sslVersion parameter with \"--ssl_version='boringssl_a_13'\" , \"--ssl_version='boringssl_a_14'\", or use \"ecapture tls --help\" for more help."}
{"level":"error","sslVersion":"android_default","bpfFile":"boringssl_a_15_kern.o","time":"2025-06-05T01:40:48Z"}
{"level":"info","binrayPath":"/apex/com.android.conscrypt/lib64/libssl.so","ElfType":2,"Functions":["SSL_in_init"],"time":"2025-06-05T01:40:48Z","message":"Hook masterKey function"}
{"level":"info","time":"2025-06-05T01:40:48Z","message":"target all process."}
{"level":"info","time":"2025-06-05T01:40:48Z","message":"target all users."}
{"level":"info","eBPFProgramType":"Text","time":"2025-06-05T01:40:48Z","message":"setupManagers"}
{"level":"info","bpfFileName":"user/bytecode/boringssl_a_15_kern_core.o","time":"2025-06-05T01:40:48Z","message":"BPF bytecode file is matched."}
{"level":"info","mapSize(MB)":4,"time":"2025-06-05T01:40:49Z","message":"perfEventReader created"}
{"level":"info","mapSize(MB)":4,"time":"2025-06-05T01:40:49Z","message":"perfEventReader created"}
{"level":"info","moduleName":"EBPFProbeOPENSSL","isReload":false,"time":"2025-06-05T01:40:49Z","message":"module started successfully."}
{"level":"info","time":"2025-06-05T01:42:03Z","message":"module close."}
{"level":"info","time":"2025-06-05T01:42:03Z","message":"Module closed,message Received from Context"}
{"level":"info","time":"2025-06-05T01:42:03Z","message":"iModule module close"}
{"level":"info","time":"2025-06-05T01:42:03Z","message":"bye bye."}

[dosubot]

Hi @rbt666! I'm Dosu and I’m helping the ecapture team.

你的日志显示 eCapture 没有抓到包，主要有两个常见原因：

1. OpenSSL/BoringSSL 版本未识别
   日志里有 “OpenSSL/BoringSSL version not found”，这通常是因为 eCapture 没有正确识别你系统的 SSL 库版本。你可以尝试加上参数指定版本，比如：

./ecapture tls --ssl_version='boringssl_a_15' -l log.txt

如果不行，也可以试试 'boringssl_a_14' 或 'boringssl_a_13'，具体取决于你的 Android 15 系统实际用的 BoringSSL 版本。
参考：相关讨论1 相关讨论2

2. BTF 模式兼容性问题
   日志有警告 “Your environment is like a container... try specifying the BTF mode. use -b 2 to specify non-CORE mode.”
   你可以加上 -b 2 参数试试：

./ecapture tls --ssl_version='boringssl_a_15' -b 2 -l log.txt

如果还是不行，可以尝试 -b 1 或 -b 0，有些环境下不同的 BTF 模式会影响 eBPF 程序加载。BTF 说明

3. 检查 libssl 路径
   确认你的目标 app 用的确实是 /apex/com.android.conscrypt/lib64/libssl.so，如果不是，需要用 --libssl 参数指定实际路径。参考

4. 版本问题
   建议确保你用的是最新的 eCapture 版本（v0.8.12 及以上），老版本有已知 bug，升级后很多兼容性问题会被修复。升级建议

如果以上方法都试过还是不行，可以补充下你抓包目标 app 的信息、libssl 路径、eCapture 具体版本和完整命令，方便进一步排查。

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[rbt666]

panther:/data/local/tmp # lsof -p 21993 | grep libssl
.coolapk.market 21993    u0_a286  mem       REG             254,20    455752        181 /apex/com.android.conscrypt/lib64/libssl.so

再次抓包还是没有信息

panther:/data/local/tmp # ./ecapture tls --ssl_version='boringssl_a_14' -b 2 -l log2.txt                              
2025-06-05T02:27:51Z INF AppName="eCapture(旁观者)"
2025-06-05T02:27:51Z INF HomePage=https://ecapture.cc
2025-06-05T02:27:51Z INF Repository=https://github.com/gojue/ecapture
2025-06-05T02:27:51Z INF Author="CFC4N <cfc4ncs@gmail.com>"
2025-06-05T02:27:51Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2025-06-05T02:27:51Z INF Version=androidgki_arm64:v1.1.0:6.8.0-1027-azure
2025-06-05T02:27:51Z INF Listen=localhost:28256
2025-06-05T02:27:51Z INF eCapture running logs logger=log2.txt
2025-06-05T02:27:51Z INF the file handler that receives the captured event eventCollector=
2025-06-05T02:27:51Z INF Kernel Info=6.1.99 Pid=1017
2025-06-05T02:27:51Z INF TruncateSize=0 Unit=bytes
2025-06-05T02:27:51Z INF BTF bytecode mode: non-CORE. btfMode=2
2025-06-05T02:27:51Z INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2025-06-05T02:27:51Z INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2025-06-05T02:27:51Z INF Module.Run()
2025-06-05T02:27:51Z INF OpenSSL/BoringSSL version found sslVersion=boringssl_a_14
2025-06-05T02:27:51Z INF Hook masterKey function ElfType=2 Functions=["SSL_in_init"] binrayPath=/apex/com.android.conscrypt/lib64/libssl.so
2025-06-05T02:27:51Z INF target all process.
2025-06-05T02:27:51Z INF target all users.
2025-06-05T02:27:51Z INF setupManagers eBPFProgramType=Text
2025-06-05T02:27:51Z INF BPF bytecode file is matched. bpfFileName=user/bytecode/boringssl_a_14_kern_noncore.o
2025-06-05T02:27:51Z INF listen=localhost:28256
2025-06-05T02:27:51Z INF https server starting...You can upgrade the configuration file via the HTTP interface.
2025-06-05T02:27:52Z INF perfEventReader created mapSize(MB)=4
2025-06-05T02:27:52Z INF perfEventReader created mapSize(MB)=4
2025-06-05T02:27:52Z INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL
^C2025-06-05T02:29:16Z INF module close.
2025-06-05T02:29:16Z INF Module closed,message Received from Context
2025-06-05T02:29:16Z INF iModule module close
2025-06-05T02:29:16Z INF bye bye.

[cfc4n]

PID 21993这个进程内，只有一个ssl的类库吗？ 有没有可能它使用了静态编译的SSL类库呢？

其次，能先确认在当前设备上，eCapture是正常工作的吗? 可以在android手机上多捕获一会，有一些系统服务一定会使用/apex/com.android.conscrypt/lib64/libssl.so 类库通信。