gojue/ecaptureCapture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation. Supports Linux and Android on x86_64\arm64 and loong64.
eCapture (旁观者)
Capture SSL/TLS plaintext with eBPF—no MITM proxy or custom CA installation.
English · 汉字
[!IMPORTANT] Supports Linux on x86_64 (kernel 4.18+), aarch64 (kernel 5.5+), and LoongArch64
loong64(kernel 6.6+). Android supports x86_64 and aarch64 with the existing kernel minimums. Requires root privileges or specific Linux capabilities. Does not support Windows or macOS.
Run ecapture --help for the commands and flags available in your installed version.
[!TIP] Supports Linux on x86_64, aarch64, and LoongArch64; Android supports x86_64 and aarch64.
Download the ELF binary package from the releases page, extract it, and run:
sudo ecapture --help
[!TIP] Linux only.
# Pull the Docker image
docker pull gojue/ecapture:latest
# Run it
docker run --rm --privileged=true --net=host -v ${HOST_PATH}:${CONTAINER_PATH} gojue/ecapture ARGS
⚠️ Security note:
--privileged=truegrants full host access. For production use, prefer specific capabilities instead. See the Minimum Privileges Guide.
See Docker Hub for more information.
sudo ecapture tls
eCapture automatically detects the system's OpenSSL library and selects a capture interface: it prefers an up Ethernet interface on the lowest-metric IPv4/IPv6 default route, then falls back to interface traffic counters or an up interface. A startup warning names the selected interface and explains how to override it with -i eth0 or --ifname eth0. Only that interface is captured; use -i lo for loopback traffic. Generate an HTTPS request with an OpenSSL-linked client to see the reconstructed request and response. This synthetic HTTP/1.1 example illustrates the text format:
[2026-01-01T12:00:00.000000000Z] http/1.1 request 192.0.2.1:43210 -> 192.0.2.2:443 host="example.com" domain_source="Host" connection="17-4-client/192.0.2.1:43210--192.0.2.2:443/tcp#2"
GET / HTTP/1.1
Host: example.com
📄 For output formats and verification examples, see docs/example-outputs.md.
The eCapture tool includes 8 modules that can capture plaintext data from TLS/SSL libraries such as OpenSSL, GnuTLS, NSS/NSPR, BoringSSL, and GoTLS. It also supports auditing commands and queries from Bash, MySQL, and PostgreSQL applications.
You can use ecapture -h to view the full list of subcommands.
eCapture searches the default library paths from /etc/ld.so.conf to locate shared libraries and detect the OpenSSL library location. You can also set the library path explicitly with the --libssl flag.
If the target program is statically linked, you can set the program path directly as the value of the --libssl flag.
The OpenSSL module supports three output modes:
pcap/pcapng mode stores encrypted network packets and TLS secrets in pcap-NG format.keylog/key mode saves TLS handshake keys to a file.text mode defaults to --text-source=pcapng, reconstructing complete HTTP/1.1 and HTTP/2 messages from live pcapng and DSB data. The capture interface is selected automatically; use -i eth0 to override it. Use --text-source=hook to capture plaintext through function hooks instead (no interface required).For OpenSSL, GoTLS, and GnuTLS, --eventaddr is the uniform primary event
destination. It accepts stdout, a plain path or file:// URI,
tcp://host:port, and ws:///wss:// (ordered binary frames). The mode
selects text, NSS Key Log, or pcapng representation; the address selects only
the transport. --keylogfile and --pcapfile remain compatible primary-file
aliases in their respective modes. Setting --eventaddr together with the
corresponding alias is an error. In pcapng mode, --keylogfile is a separate
optional keylog artifact.
tls, gotls, and gnutls default to the pcapng text source and automatically
select a capture interface when -i is omitted. All three accept --text-source hook
for function-hook capture. GoTLS still requires --elfpath to identify the target binary.