We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Describe the bug On Ubuntu 24.04, the encrypted communication of nss3 cannot be successfully captured, and the PR_Write symbol cannot be found.
PR_Write
To Reproduce Steps to reproduce the behavior: cmd: sudo bin/ecapture nss --nspr=/lib/x86_64-linux-gnu/libnss3.so
sudo bin/ecapture nss --nspr=/lib/x86_64-linux-gnu/libnss3.so
ecapture@gojue:~/project/ecapture$ sudo bin/ecapture nss --nspr=/lib/x86_64-linux-gnu/libnss3.so 2024-11-07T23:47:58-08:00 INF AppName="eCapture(旁观者)" 2024-11-07T23:47:58-08:00 INF HomePage=https://ecapture.cc 2024-11-07T23:47:58-08:00 INF Repository=https://github.com/gojue/ecapture 2024-11-07T23:47:58-08:00 INF Author="CFC4N <[email protected]>" 2024-11-07T23:47:58-08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64." 2024-11-07T23:47:58-08:00 INF Version=linux_amd64:0.8.6-20240916-d50ee78:6.8.0-45-generic 2024-11-07T23:47:58-08:00 INF Listen=localhost:28256 2024-11-07T23:47:58-08:00 INF eCapture running logs logger= 2024-11-07T23:47:58-08:00 INF the file handler that receives the captured event eventCollector= 2024-11-07T23:47:58-08:00 WRN ========== module starting. ========== 2024-11-07T23:47:58-08:00 INF Kernel Info=6.8.12 Pid=23125 2024-11-07T23:47:58-08:00 INF BTF bytecode mode: CORE. btfMode=0 2024-11-07T23:47:58-08:00 INF module initialization. isReload=false moduleName=EBPFProbeNSPR 2024-11-07T23:47:58-08:00 INF listen=localhost:28256 2024-11-07T23:47:58-08:00 INF https server starting...You can update the configuration file via the HTTP interface. 2024-11-07T23:47:58-08:00 INF Module.Run() 2024-11-07T23:47:58-08:00 INF BPF bytecode file is matched. bpfFileName=user/bytecode/nspr_kern_core.o 2024-11-07T23:47:58-08:00 INF HOOK type:nspr elf ElfType=2 binrayPath=/lib/x86_64-linux-gnu/libnss3.so 2024-11-07T23:47:58-08:00 INF target all process. 2024-11-07T23:47:58-08:00 INF target all users. 2024-11-07T23:47:58-08:00 FTL module run failed, skip it. error="couldn't start bootstrap manager error:8 errors occurred:\n\t* error:opening uprobe: cannot resolve /lib/x86_64-linux-gnu/libnss3.so library call 'PR_Write': not supported (consider providing UprobeOptions.Address) , isRet:false, opts:&{0 0 0 0 0 }, {UID:, EbpfFuncName:probe_entry_SSL_write}\n\t* error:opening uprobe: cannot resolve /lib/x86_64-linux-gnu/libnss3.so library call 'PR_Write': not supported (consider providing UprobeOptions.Address) , isRet:true, opts:&{0 0 0 0 0 }, {UID:, EbpfFuncName:probe_ret_SSL_write}\n\t* error:opening uprobe: cannot resolve /lib/x86_64-linux-gnu/libnss3.so library call 'PR_Send': not supported (consider providing UprobeOptions.Address) , isRet:false, opts:&{0 0 0 0 0 }, {UID:PR_Write-PR_Send, EbpfFuncName:probe_entry_SSL_write}\n\t* error:opening uprobe: cannot resolve /lib/x86_64-linux-gnu/libnss3.so library call 'PR_Send': not supported (consider providing UprobeOptions.Address) , isRet:true, opts:&{0 0 0 0 0 }, {UID:PR_Write-PR_Send, EbpfFuncName:probe_ret_SSL_write}\n\t* error:opening uprobe: symbol PR_Read: not found , isRet:false, opts:&{0 0 0 0 0 }, {UID:, EbpfFuncName:probe_entry_SSL_read}\n\t* error:opening uprobe: symbol PR_Read: not found , isRet:true, opts:&{0 0 0 0 0 }, {UID:, EbpfFuncName:probe_ret_SSL_read}\n\t* error:opening uprobe: cannot resolve /lib/x86_64-linux-gnu/libnss3.so library call 'PR_Recv': not supported (consider providing UprobeOptions.Address) , isRet:false, opts:&{0 0 0 0 0 }, {UID:PR_Read-PR_Recv, EbpfFuncName:probe_entry_SSL_read}\n\t* error:opening uprobe: cannot resolve /lib/x86_64-linux-gnu/libnss3.so library call 'PR_Recv': not supported (consider providing UprobeOptions.Address) , isRet:true, opts:&{0 0 0 0 0 }, {UID:PR_Read-PR_Recv, EbpfFuncName:probe_ret_SSL_read}\n\n, probes activation validation failed " isReload=false
Expected behavior A clear and concise description of what you expected to happen.
Screenshots If applicable, add screenshots to help explain your problem.
Linux Server/Android (please complete the following information):
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Describe the bug
On Ubuntu 24.04, the encrypted communication of nss3 cannot be successfully captured, and the
PR_Write
symbol cannot be found.To Reproduce
Steps to reproduce the behavior:
cmd:
sudo bin/ecapture nss --nspr=/lib/x86_64-linux-gnu/libnss3.so
Expected behavior
A clear and concise description of what you expected to happen.
Screenshots
If applicable, add screenshots to help explain your problem.
Linux Server/Android (please complete the following information):
The text was updated successfully, but these errors were encountered: