// the find
gojue/ecapture
Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
eCapture hooks into SSL/TLS library functions at the userspace level using eBPF uprobes, capturing plaintext before it gets encrypted — no MITM proxy, no CA cert needed. It works across OpenSSL, BoringSSL, GnuTLS, NSS, and Go's crypto/tls, plus bonus modules for bash auditing and MySQL/Postgres query capture. The target audience is security engineers doing traffic analysis, pentesters, and sysadmins who need visibility into encrypted traffic on machines they control.
The coverage of TLS library variants is unusually thorough — there are per-version eBPF programs for OpenSSL going back to 1.0.2 and forward to 3.5.0, which means it actually works rather than just claiming to. The Go TLS module is genuinely tricky to get right (no stable ABI, goroutine stack walking) and they've done it with architecture-specific instruction scanning in go_instructions_amd64.go and go_instructions_arm64.go. Output flexibility is solid: pcapng for Wireshark, keylog file for tshark, raw text, or forwarding to Burp Suite via the event forwarding API — you pick based on your workflow. The companion eCaptureQ GUI (Rust/Tauri) with remote mode means you can run captures headless and analyze from a Windows or macOS machine, which matters for anyone doing Android work.
The kernel version floor is a real constraint that the docs undersell: arm64 requires 5.5+ which excludes a lot of Android devices still running 4.19 or 5.4 kernels. The uprobe approach breaks whenever a library is statically compiled or when address space layout changes between builds — you have to manually pass --libssl with the right path, and if the offset calculation is wrong you get silence rather than an error. The codebase has grown the eBPF C programs by copy-paste per OpenSSL version rather than using CO-RE properly (kern/ has 20+ openssl_*_kern.c files), which will become a maintenance problem as new versions ship. Root or a fistful of capabilities is required with no credential-narrowing story for the most common ops use case.