AwesomeREA.org

Tool

eCapture

eBPF-based Linux and Android tool that attaches uprobes to TLS libraries such as OpenSSL, BoringSSL, GnuTLS and NSS, and to Go's TLS stack, recording the plaintext a process sends and receives without a proxy or an installed CA certificate, so analysts can inspect an application's encrypted traffic on a host they control. Output modes write plaintext text, NSS key logs, or pcapng files with embedded TLS secrets for Wireshark and tshark, and a text mode can rebuild complete HTTP/1.1 and HTTP/2 messages from the captured stream. Separate modules audit bash and zsh commands and MySQL and PostgreSQL queries.

Targets
App · Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v2.9.0, published 2026-10-24; the reviewed master commit is identical to that tag. Release assets are Linux amd64, arm64 and loong64 archives and .deb packages plus Android amd64 and arm64 archives; the Docker image is Linux only. The README states that Windows and macOS are not supported; the separate eCaptureQ GUI can connect from them to a remote eCapture service.
  • Needs Linux kernel 4.18+ on x86_64, 5.5+ on aarch64 or 6.6+ on LoongArch64, or Android on x86_64 or aarch64. Loading the eBPF programs requires root or, per the minimum-privileges guide, CAP_BPF, CAP_PERFMON and CAP_SYS_PTRACE on kernel 5.8+ (CAP_SYS_ADMIN on older kernels), plus CAP_NET_ADMIN for pcapng mode. Source builds need Go 1.26+, clang and LLVM 9+, cmake 3.18.4+, libelf and the pinned libpcap submodule; make nocore builds for kernels without BTF.
  • Analysts choose the library or program to observe: the tls module locates the system OpenSSL through ld.so.conf paths or takes --libssl, which can also name a statically linked program, and gotls takes the Go program's ELF path; pcapng mode also needs a network interface and capture filter. Pcap mode records TLS-protected HTTP/1.x and HTTP/2 over TCP and HTTP/3 over QUIC, while the pcapng text source rebuilds only HTTP/1.1 and HTTP/2 over TCP. The project documents root-only end-to-end tests per module (make e2e).
  • Apache-2.0; libpcap is a git submodule and the bin, dist, deps and bytecode directories hold only placeholders. Captured plaintext and keys can contain passwords, tokens and personal data: the project's defense-and-detection guide asks for written authorization before production use, scoping capture to chosen processes with --pid and handling the data under organizational policy, and describes how to detect eBPF capture tools. No process was traced and no traffic was captured.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · gojue/ecapture · Revision e834aa0
  2. README.md#L34-L37 GitHub · gojue/ecapture · Revision e834aa0
  3. README.md#L120-L198 GitHub · gojue/ecapture · Revision e834aa0
  4. docs/compilation.md GitHub · gojue/ecapture · Revision e834aa0
  5. docs/minimum-privileges.md GitHub · gojue/ecapture · Revision e834aa0
  6. docs/defense-detection.md#L151-L166 GitHub · gojue/ecapture · Revision e834aa0
  7. docs/e2e-tests.md GitHub · gojue/ecapture · Revision e834aa0
  8. CHANGELOG.md GitHub · gojue/ecapture · Revision e834aa0
  9. .gitmodules GitHub · gojue/ecapture · Revision e834aa0
  10. LICENSE GitHub · gojue/ecapture · Revision e834aa0
  11. https://github.com/gojue/ecapture/releases/tag/v2.9.0

More in Protocols

All 66 entries in Protocols