How to Capture Browser Traffic

[xiewayne]

Why is ecapture unable to capture HTTPS traffic from the Chrome browser? Checking Chrome's dependencies reveals that it has NSS.

# ./ecapture nss --nspr=/lib/x86_64-linux-gnu/libnspr4.so
2024-12-31T17:40:42+08:00 INF AppName="eCapture(旁观者)"
2024-12-31T17:40:42+08:00 INF HomePage=https://ecapture.cc
2024-12-31T17:40:42+08:00 INF Repository=https://github.com/gojue/ecapture
2024-12-31T17:40:42+08:00 INF Author="CFC4N <[email protected]>"
2024-12-31T17:40:42+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-12-31T17:40:42+08:00 INF Version=linux_amd64:v0.8.10:6.5.0-1025-azure
2024-12-31T17:40:42+08:00 INF Listen=localhost:28256
2024-12-31T17:40:42+08:00 INF eCapture running logs logger=
2024-12-31T17:40:42+08:00 INF the file handler that receives the captured event eventCollector=
2024-12-31T17:40:42+08:00 WRN ========== module starting. ==========
2024-12-31T17:40:42+08:00 INF Kernel Info=6.6.28 Pid=12022
2024-12-31T17:40:42+08:00 INF listen=localhost:28256
2024-12-31T17:40:42+08:00 INF BTF bytecode mode: CORE. btfMode=0
2024-12-31T17:40:42+08:00 INF https server starting...You can update the configuration file via the HTTP interface.
2024-12-31T17:40:42+08:00 INF module initialization. isReload=false moduleName=EBPFProbeNSPR
2024-12-31T17:40:42+08:00 INF Module.Run()
2024-12-31T17:40:42+08:00 INF BPF bytecode file is matched. bpfFileName=user/bytecode/nspr_kern_core.o
2024-12-31T17:40:42+08:00 INF HOOK type:nspr elf ElfType=2 binrayPath=/lib/x86_64-linux-gnu/libnspr4.so
2024-12-31T17:40:42+08:00 INF target all process.
2024-12-31T17:40:42+08:00 INF target all users.
2024-12-31T17:40:42+08:00 INF perfEventReader created mapSize(MB)=4
2024-12-31T17:40:42+08:00 INF module started successfully. isReload=false moduleName=EBPFProbeNSPR

# ldd /opt/apps/cn.google.chrome/files/google/chrome/chrome
	linux-vdso.so.1 (0x00007ffffef7d000)
	libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f724d84c000)
	libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f724d82b000)
	libgobject-2.0.so.0 => /lib/x86_64-linux-gnu/libgobject-2.0.so.0 (0x00007f724d7d5000)
	libglib-2.0.so.0 => /lib/x86_64-linux-gnu/libglib-2.0.so.0 (0x00007f724d6b5000)
	libnss3.so => /lib/x86_64-linux-gnu/libnss3.so (0x00007f723feb2000)
	libnssutil3.so => /lib/x86_64-linux-gnu/libnssutil3.so (0x00007f723fe80000)
	libsmime3.so => /lib/x86_64-linux-gnu/libsmime3.so (0x00007f723fe51000)
	libnspr4.so => /lib/x86_64-linux-gnu/libnspr4.so (0x00007f723fe10000)
        .....

But my own test program(https_test) that relies on NSS works.

"module started successfully. isReload=false moduleName=EBPFProbeNSPR
2024-12-31T17:14:51+08:00 ??? UUID:10609_10609_https_test_1, Name:HTTPRequest, Type:1, Length:58
GET / HTTP/1.1
Host: www.baidu.com
Connection: close
"
# ldd https_test 
	linux-vdso.so.1 (0x00007ffc2371c000)
	libssl3.so => /lib/x86_64-linux-gnu/libssl3.so (0x00007fa4dbfc1000)
	libnss3.so => /lib/x86_64-linux-gnu/libnss3.so (0x00007fa4dbe73000)
	libnssutil3.so => /lib/x86_64-linux-gnu/libnssutil3.so (0x00007fa4dbe41000)
	libnspr4.so => /lib/x86_64-linux-gnu/libnspr4.so (0x00007fa4dbe00000)

[cfc4n]

I will turn this topic into an issue. See #712