gojue / ecapture

Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
https://ecapture.cc
Apache License 2.0
9.26k stars 881 forks source link

runngin crashed #581

Closed ziyouchutuwenwu closed 1 month ago

ziyouchutuwenwu commented 1 month ago

Describe the bug A clear and concise description of what the bug is.

To Reproduce Steps to reproduce the behavior:

  1. check nic name
    
    sudo ifconfig                                 
    docker0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::42:deff:fe09:4f36  prefixlen 64  scopeid 0x20<link>
        ether 02:42:de:09:4f:36  txqueuelen 0  (Ethernet)
        RX packets 341  bytes 14518 (14.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 505  bytes 49493 (48.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enp2s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.0.233 netmask 255.255.254.0 broadcast 192.168.1.255 inet6 fe80::bb76:ac0:2671:c257 prefixlen 64 scopeid 0x20 ether 80:e8:2c:cf:ba:64 txqueuelen 1000 (Ethernet) RX packets 849020 bytes 1091967772 (1.0 GiB) RX errors 0 dropped 2315 overruns 0 frame 0 TX packets 466116 bytes 44234512 (42.1 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10 loop txqueuelen 1000 (Local Loopback) RX packets 215641 bytes 291594774 (278.0 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 215641 bytes 291594774 (278.0 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

veth21d7ee3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet6 fe80::a0dd:5bff:fe90:5c6 prefixlen 64 scopeid 0x20 ether a2:dd:5b:90:05:c6 txqueuelen 0 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 41 bytes 5376 (5.2 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

veth92c02ef: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet6 fe80::347f:78ff:feac:7034 prefixlen 64 scopeid 0x20 ether 36:7f:78:ac:70:34 txqueuelen 0 (Ethernet) RX packets 341 bytes 19292 (18.8 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 540 bytes 53365 (52.1 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 10.0.2.1 netmask 255.255.255.0 broadcast 10.0.2.255 ether 52:54:00:7b:02:b0 txqueuelen 1000 (Ethernet) RX packets 28850 bytes 3707412 (3.5 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 41096 bytes 228957134 (218.3 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

virbr1: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 inet 192.168.56.1 netmask 255.255.255.0 broadcast 192.168.56.255 ether 52:54:00:8b:12:ce txqueuelen 1000 (Ethernet) RX packets 497 bytes 59005 (57.6 KiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 84 bytes 14815 (14.4 KiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

wlp3s0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 ether 4e:d5:eb:4e:57:36 txqueuelen 1000 (Ethernet) RX packets 0 bytes 0 (0.0 B) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 0 bytes 0 (0.0 B) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

now we get nic name enp2s0

2. run it.

```sh
$ sudo ecapture tls -i enp2s0 -w pcapng -p 443
[sudo] mmc 的密码:
2024-07-16T13:50:43+08:00 INF AppName="eCapture(旁观者)"
2024-07-16T13:50:43+08:00 INF HomePage=https://ecapture.cc
2024-07-16T13:50:43+08:00 INF Repository=https://github.com/gojue/ecapture
2024-07-16T13:50:43+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-07-16T13:50:43+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-07-16T13:50:43+08:00 INF Version=linux_amd64:v0.8.4:6.5.0-1023-azure
2024-07-16T13:50:43+08:00 INF listen=localhost:28256
2024-07-16T13:50:43+08:00 INF https server starting...You can update the configuration file via the HTTP interface.
2024-07-16T13:50:43+08:00 WRN ========== module starting. ==========
2024-07-16T13:50:43+08:00 INF Kernel Info=6.6.34 Pid=56003
2024-07-16T13:50:43+08:00 INF BTF bytecode mode: CORE. btfMode=0
2024-07-16T13:50:43+08:00 INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2024-07-16T13:50:43+08:00 INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2024-07-16T13:50:43+08:00 INF Module.Run()
SIGSEGV: segmentation violation
PC=0x7f7c6462a186 m=5 sigcode=1
signal arrived during cgo execution

goroutine 51 [syscall]:
runtime.cgocall(0xb3aeb0, 0xc0004d0588)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/cgocall.go:157 +0x4b fp=0xc0004d0560 sp=0xc0004d0528 pc=0x40950b
net._C2func_getaddrinfo(0xc00056e380, 0x0, 0xc0005686f0, 0xc00056a0a0)
    _cgo_gotypes.go:103 +0x55 fp=0xc0004d0588 sp=0xc0004d0560 pc=0x679915
net._C_getaddrinfo.func1(0x4124e5?, 0x8?, 0xc8c320?, 0x1?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix_cgo.go:78 +0x7a fp=0xc0004d05f0 sp=0xc0004d0588 pc=0x679cda
net._C_getaddrinfo(0xdfa098?, 0x9?, 0x0?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix_cgo.go:78 +0x13 fp=0xc0004d0620 sp=0xc0004d05f0 pc=0x679c13
net.cgoLookupHostIP({0xdd95d4, 0x3}, {0xdfa098, 0x9})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:166 +0x24f fp=0xc0004d0760 sp=0xc0004d0620 pc=0x64f0ef
net.cgoLookupIP.func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:215 +0x25 fp=0xc0004d0790 sp=0xc0004d0760 pc=0x64f805
net.doBlockingWithCtx[...].func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:56 +0x35 fp=0xc0004d07e0 sp=0xc0004d0790 pc=0x679f95
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc0004d07e8 sp=0xc0004d07e0 pc=0x46dbc1
created by net.doBlockingWithCtx[...] in goroutine 50
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:54 +0xd8

goroutine 1 [syscall]:
runtime.notetsleepg(0x41f4d6?, 0x245d480?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/lock_futex.go:236 +0x29 fp=0xc000337180 sp=0xc000337148 pc=0x410c09
runtime.gcBgMarkStartWorkers()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:1221 +0x2f fp=0xc0003371a0 sp=0xc000337180 pc=0x420baf
runtime.gcStart({0x597605?, 0x100000?, 0x4fa2a8?})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:667 +0x225 fp=0xc000337238 sp=0xc0003371a0 pc=0x41f745
runtime.mallocgc(0x100000, 0xca94e0, 0x1)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/malloc.go:1246 +0x76f fp=0xc0003372a0 sp=0xc000337238 pc=0x4122cf
runtime.makeslice(0xe0b710?, 0x1c?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/slice.go:103 +0x49 fp=0xc0003372c8 sp=0xc0003372a0 pc=0x452769
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).detectOpenssl(0xc0004c8900, {0xc00033abd0, 0x12})
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl_lib.go:179 +0x3a6 fp=0xc0003373e0 sp=0xc0003372c8 pc=0x939806
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).getSslBpfFile(0x0?, {0xc00033abd0?, 0xc000337470?}, {0x0?, 0xc000122060?})
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl.go:194 +0x1a5 fp=0xc000337448 sp=0xc0003373e0 pc=0x933de5
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).setupManagersText(0xc0004c8900)
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl_text.go:25 +0xa5 fp=0xc000337608 sp=0xc000337448 pc=0x93b085
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).start(0xc0004c8900)
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl.go:211 +0x4e fp=0xc000337a10 sp=0xc000337608 pc=0x93418e
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).Start(0xc0004b6150?)
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl.go:199 +0x13 fp=0xc000337a28 sp=0xc000337a10 pc=0x934113
github.com/gojue/ecapture/user/module.(*Module).Run(0xc0004c8900)
    /home/runner/work/ecapture/ecapture/user/module/imodule.go:199 +0x58 fp=0xc000337a50 sp=0xc000337a28 pc=0x927cb8
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).Run(0xc0004b6150?)
    <autogenerated>:1 +0x1e fp=0xc000337a68 sp=0xc000337a50 pc=0x93f79e
github.com/gojue/ecapture/cli/cmd.runModule({0xdfb9d1, 0x10}, {0xf43de0, 0xc0003a0ff0})
    /home/runner/work/ecapture/ecapture/cli/cmd/root.go:230 +0x7f1 fp=0xc000337c28 sp=0xc000337a68 pc=0xb39eb1
github.com/gojue/ecapture/cli/cmd.openSSLCommandFunc(0xc0004b8700?, {0xc0004ba360?, 0x4?, 0xdda5a3?})
    /home/runner/work/ecapture/ecapture/cli/cmd/tls.go:65 +0x99 fp=0xc000337c60 sp=0xc000337c28 pc=0xb3aad9
github.com/spf13/cobra.(*Command).execute(0x1495e00, {0xc0004ba300, 0x6, 0x6})
    /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:987 +0xaa3 fp=0xc000337e00 sp=0xc000337c60 pc=0x969963
github.com/spf13/cobra.(*Command).ExecuteC(0x14949e0)
    /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1115 +0x3ff fp=0xc000337ed8 sp=0xc000337e00 pc=0x96a23f
github.com/spf13/cobra.(*Command).Execute(...)
    /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1039
github.com/gojue/ecapture/cli/cmd.Execute()
    /home/runner/work/ecapture/ecapture/cli/cmd/root.go:106 +0x10b fp=0xc000337ef0 sp=0xc000337ed8 pc=0xb385ab
github.com/gojue/ecapture/cli.Start(...)
    /home/runner/work/ecapture/ecapture/cli/main.go:22
main.main()
    /home/runner/work/ecapture/ecapture/main.go:32 +0x93 fp=0xc000337f40 sp=0xc000337ef0 pc=0xb3ad93
runtime.main()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:267 +0x2bb fp=0xc000337fe0 sp=0xc000337f40 pc=0x43dcdb
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc000337fe8 sp=0xc000337fe0 pc=0x46dbc1

goroutine 2 [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc00005afa8 sp=0xc00005af88 pc=0x43e12e
runtime.goparkunlock(...)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:404
runtime.forcegchelper()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:322 +0xb3 fp=0xc00005afe0 sp=0xc00005afa8 pc=0x43dfb3
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00005afe8 sp=0xc00005afe0 pc=0x46dbc1
created by runtime.init.6 in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:310 +0x1a

goroutine 18 [GC sweep wait]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc000056778 sp=0xc000056758 pc=0x43e12e
runtime.goparkunlock(...)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:404
runtime.bgsweep(0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgcsweep.go:280 +0x94 fp=0xc0000567c8 sp=0xc000056778 pc=0x429fb4
runtime.gcenable.func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:200 +0x25 fp=0xc0000567e0 sp=0xc0000567c8 pc=0x41f145
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc0000567e8 sp=0xc0000567e0 pc=0x46dbc1
created by runtime.gcenable in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:200 +0x66

goroutine 19 [GC scavenge wait]:
runtime.gopark(0xc00009e000?, 0xf2c6e8?, 0x1?, 0x0?, 0xc0000924e0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc000056f70 sp=0xc000056f50 pc=0x43e12e
runtime.goparkunlock(...)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:404
runtime.(*scavengerState).park(0x1efb4a0)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgcscavenge.go:425 +0x49 fp=0xc000056fa0 sp=0xc000056f70 pc=0x427869
runtime.bgscavenge(0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgcscavenge.go:653 +0x3c fp=0xc000056fc8 sp=0xc000056fa0 pc=0x427dfc
runtime.gcenable.func2()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:201 +0x25 fp=0xc000056fe0 sp=0xc000056fc8 pc=0x41f0e5
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc000056fe8 sp=0xc000056fe0 pc=0x46dbc1
created by runtime.gcenable in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:201 +0xa5

goroutine 34 [finalizer wait]:
runtime.gopark(0x198?, 0xdd2700?, 0x1?, 0xf2?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc00005a620 sp=0xc00005a600 pc=0x43e12e
runtime.runfinq()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mfinal.go:193 +0x107 fp=0xc00005a7e0 sp=0xc00005a620 pc=0x41e0e7
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00005a7e8 sp=0xc00005a7e0 pc=0x46dbc1
created by runtime.createfing in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mfinal.go:163 +0x3d

goroutine 35 [select]:
runtime.gopark(0xc00015b970?, 0x2?, 0x18?, 0xcf?, 0xc00015b8cc?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc00015b718 sp=0xc00015b6f8 pc=0x43e12e
runtime.selectgo(0xc00015b970, 0xc00015b8c8, 0xd?, 0x0, 0x8e?, 0x1)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/select.go:327 +0x725 fp=0xc00015b838 sp=0xc00015b718 pc=0x44dc65
net.(*Resolver).lookupIPAddr(0x1efa9a0, {0xf39a38?, 0x245b020}, {0xdd95d4, 0x3}, {0xdfa098, 0x9})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/lookup.go:332 +0x3fe fp=0xc00015ba18 sp=0xc00015b838 pc=0x6686de
net.(*Resolver).internetAddrList(0xf39a38?, {0xf39a38?, 0x245b020?}, {0xdd95d4, 0x3}, {0xdfa098?, 0x100000000?})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/ipsock.go:288 +0x4e5 fp=0xc00015bb40 sp=0xc00015ba18 pc=0x6666c5
net.(*Resolver).resolveAddrList(0x41b673?, {0xf39a38, 0x245b020}, {0xde14ed, 0x6}, {0xdd95d4?, 0xc00015bcd0?}, {0xdfa098, 0xf}, {0x0, ...})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/dial.go:282 +0x405 fp=0xc00015bc40 sp=0xc00015bb40 pc=0x651a05
net.(*ListenConfig).Listen(0xc00015bd70, {0xf39a38, 0x245b020}, {0xdd95d4, 0x3}, {0xdfa098, 0xf})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/dial.go:716 +0x7e fp=0xc00015bd38 sp=0xc00015bc40 pc=0x6546be
net.Listen({0xdd95d4?, 0xe8?}, {0xdfa098?, 0x1486101?})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/dial.go:806 +0x47 fp=0xc00015bd98 sp=0xc00015bd38 pc=0x6551e7
net/http.(*Server).ListenAndServe(0xc00058c000)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/http/server.go:2981 +0x50 fp=0xc00015bdc8 sp=0xc00015bd98 pc=0x7b15f0
net/http.ListenAndServe(...)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/http/server.go:3239
github.com/gin-gonic/gin.(*Engine).Run(0xc000586000, {0xc00015bf00, 0x1, 0x1})
    /home/runner/go/pkg/mod/github.com/gin-gonic/gin@v1.10.0/gin.go:399 +0x225 fp=0xc00015be60 sp=0xc00015bdc8 pc=0xb28265
github.com/gojue/ecapture/cli/http.HttpServer.Run(...)
    /home/runner/work/ecapture/ecapture/cli/http/server.go:56
github.com/gojue/ecapture/cli/cmd.runModule.func1()
    /home/runner/work/ecapture/ecapture/cli/cmd/root.go:200 +0x159 fp=0xc00015bfe0 sp=0xc00015be60 pc=0xb3a679
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00015bfe8 sp=0xc00015bfe0 pc=0x46dbc1
created by github.com/gojue/ecapture/cli/cmd.runModule in goroutine 1
    /home/runner/work/ecapture/ecapture/cli/cmd/root.go:196 +0x410

goroutine 50 [select]:
runtime.gopark(0xc00015db50?, 0x2?, 0x78?, 0xdb?, 0xc00015db34?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc00015d9e0 sp=0xc00015d9c0 pc=0x43e12e
runtime.selectgo(0xc00015db50, 0xc00015db30, 0x0?, 0x0, 0x4c76c0?, 0x1)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/select.go:327 +0x725 fp=0xc00015db00 sp=0xc00015d9e0 pc=0x44dc65
net.doBlockingWithCtx[...]({0xf39aa8, 0xc00058e000}, 0xc000568690)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:60 +0x14f fp=0xc00015dbd0 sp=0xc00015db00 pc=0x67b76f
net.cgoLookupIP({0xf39aa8, 0xc00058e000}, {0xdd95d4, 0x3}, {0xdfa098, 0x9})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:214 +0xb4 fp=0xc00015dc00 sp=0xc00015dbd0 pc=0x64f774
net.(*Resolver).lookupIP(0x1efa9a0, {0xf39aa8, 0xc00058e000}, {0xdd95d4, 0x3}, {0xdfa098, 0x9})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/lookup_unix.go:70 +0x11a fp=0xc00015de58 sp=0xc00015dc00 pc=0x669b1a
net.(*Resolver).lookupIP-fm({0xf39aa8?, 0xc00058e000?}, {0xdd95d4?, 0x0?}, {0xdfa098?, 0x0?})
    <autogenerated>:1 +0x49 fp=0xc00015dea0 sp=0xc00015de58 pc=0x67e929
net.glob..func1({0xf39aa8?, 0xc00058e000?}, 0xc0004b60e0?, {0xdd95d4?, 0x0?}, {0xdfa098?, 0x0?})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/hook.go:23 +0x37 fp=0xc00015dee0 sp=0xc00015dea0 pc=0x65ec37
net.(*Resolver).lookupIPAddr.func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/lookup.go:324 +0x3a fp=0xc00015df38 sp=0xc00015dee0 pc=0x6690fa
internal/singleflight.(*Group).doCall(0x1efa9b0, 0xc00058e050, {0xc00056e290, 0xd}, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/internal/singleflight/singleflight.go:93 +0x35 fp=0xc00015dfa8 sp=0xc00015df38 pc=0x64cc55
internal/singleflight.(*Group).DoChan.func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/internal/singleflight/singleflight.go:86 +0x30 fp=0xc00015dfe0 sp=0xc00015dfa8 pc=0x64cbf0
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00015dfe8 sp=0xc00015dfe0 pc=0x46dbc1
created by internal/singleflight.(*Group).DoChan in goroutine 35
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/internal/singleflight/singleflight.go:86 +0x2e9

goroutine 36 [runnable]:
runtime.gcBgMarkWorker()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:1261 fp=0xc0004d0fe0 sp=0xc0004d0fd8 pc=0x420be0
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc0004d0fe8 sp=0xc0004d0fe0 pc=0x46dbc1
created by runtime.gcBgMarkStartWorkers in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:1219 +0x1c

rax    0x1e33c0
rbx    0x0
rcx    0xffffffffffffff18
rdx    0x7f7c64759500
rdi    0x0
rsi    0xfcd9a5
rbp    0x7f7c6595c110
rsp    0x7f7c6595c0d8
r8     0x963cf85
r9     0x0
r10    0x7f7c54000100
r11    0x7f7c54000090
r12    0x7f7c54003b70
r13    0x1
r14    0x7f7c54001160
r15    0x7f7c54003b70
rip    0x7f7c6462a186
rflags 0x10202
cs     0x33
fs     0x0
gs     0x0

Linux Server/Android (please complete the following information):

mmc at manjaro in ~ (dev_env) $ uname -a Linux manjaro 6.6.34-1-MANJARO #1 SMP PREEMPT_DYNAMIC Wed Jun 19 19:00:06 UTC 2024 x86_64 GNU/Linux

cfc4n commented 1 month ago

It looks like a bug in the libpcap class library.I will debug it in the near future.

cfc4n commented 1 month ago

It seems that there is an issue with the libpcap library during runtime. Can tcpdump run normally?

ziyouchutuwenwu commented 1 month ago
sudo tcpdump -i enp2s0 -A 'tcp && port 443' > tcpdump.log

tcpdump.log

13:47:15.733863 IP manjaro.55892 > ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https: Flags [P.], seq 48859300:48859371, ack 473925695, win 501, options [nop,nop,TS val 612095844 ecr 2648352531], length 71
E..{.`@.@.<.....4%3..T.......?.?....)......
${.d........B........l...H7...[)...........................9...c...)uok..U.!t..
13:47:15.733896 IP manjaro.55892 > ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https: Flags [P.], seq 71:117, ack 1, win 501, options [nop,nop,TS val 612095844 ecr 2648352531], length 46
E..b.a@.@.<.....4%3..T.......?.?....)......
${.d........)...........8Y..;%g!.7..:.Arg..)..@
..P~2#
13:47:15.733943 IP manjaro.55892 > ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https: Flags [P.], seq 117:341, ack 1, win 501, options [nop,nop,TS val 612095844 ecr 2648352531], length 224
E....b@.@.<.....4%3..T.......?.?....*......
${.d..................._..b.+.E...[i..N......vV...r
.m.uc...3|.Y.....x...B  ..m?.1...=.`[..L.....%....i....^D.O%../0.;..P..
W......`K.....3s.....K.oI5*N...K%....~..
........B..t\=.*...z........p...M....../..:V...$...:...>......O.IBw.
13:47:15.735090 IP manjaro.55892 > ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https: Flags [P.], seq 341:412, ack 1, win 501, options [nop,nop,TS val 612095846 ecr 2648352531], length 71
E..{.c@.@.<.....4%3..T.......?.?....)......
${.f........B........+..........44.\<z.y..L.....<B.
..Z..im.;..........]O......
13:47:15.735117 IP manjaro.55892 > ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https: Flags [P.], seq 412:635, ack 1, win 501, options [nop,nop,TS val 612095846 ecr 2648352531], length 223
E....d@.@.<.....4%3..T.....@.?.?....*......
${.f.....................A4aS.,]S..C....W..
,....;<P#...L(..=.. .j.+..l~.B....p.).J...CS..==.....E..J...P}.m...g|~:.7l..pQA_    ..{=r.I..V.. <.5.....J.6.B.Qu....?B.y(+.F....i+...w...H9...{....&1....z..j.p.....Si{..0.    4.Ev.Z..r...N.iT.
13:47:15.735142 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [P.], seq 1880545106:1880545257, ack 4010650714, win 501, options [nop,nop,TS val 332386628 ecr 2611805343], length 151
E....(@.@......."x......p..R...Z...........
...D..........f....j..q.:...*.@...Y..Bw........u    .$.x...b....TSl..st.gR.i.!...x.....H...
.;..zq..|...Rc..y......|Q.B.3..R:......8.6f.C.k.[..F..5...~...5<If#.d.
13:47:15.735159 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [P.], seq 151:190, ack 1, win 501, options [nop,nop,TS val 332386628 ecr 2611805343], length 39
E..[.)@.@..p...."x......p......Z.....P.....
...D........"$]0a4...+Q[_..0
.r...3...B.9......
13:47:15.735168 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [P.], seq 190:361, ack 1, win 501, options [nop,nop,TS val 332386628 ecr 2611805343], length 171
E....*@.@......."x......p......Z...........
...D.........Fq.'.r.    ..@.b[.m\.....4.....S'.#.*..hy.*d.Ia..T.9o.%F..o y..._..I.h.. ..%C......x......\L$...
..G&e|4..H.?."..K.n.'2.......}U.{....v.&LR.RCH.....u.....D.w ..Xj.`/-n..
13:47:15.879930 IP 249.195.120.34.bc.googleusercontent.com.https > manjaro.57510: Flags [.], ack 190, win 355, options [nop,nop,TS val 2611837611 ecr 332386628], length 0
E..4....s..7"x.............Zp......c.......
..z....D
13:47:15.879931 IP 249.195.120.34.bc.googleusercontent.com.https > manjaro.57510: Flags [P.], seq 1:40, ack 361, win 366, options [nop,nop,TS val 2611837611 ecr 332386628], length 39
E..[....s..."x.............Zp......n.......
..z....D...."......J..xJ.u..........v.....$s..Q
13:47:15.883542 IP ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https > manjaro.55892: Flags [.], ack 117, win 254, options [nop,nop,TS val 2648384449 ecr 612095844], length 0
Eh.4..@...l.4%3........T.?.?.........3.....
..#.${.d
13:47:15.883703 IP ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https > manjaro.55892: Flags [P.], seq 1:47, ack 117, win 254, options [nop,nop,TS val 2648384449 ecr 612095844], length 46
Eh.b..@...k.4%3........T.?.?.........X.....
..#.${.d....)........r...b.......QY....a.*..}x?\......
13:47:15.884468 IP ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https > manjaro.55892: Flags [.], ack 412, win 266, options [nop,nop,TS val 2648384450 ecr 612095844], length 0
Eh.4..@...k.4%3........T.?.m...@...
.......
..#.${.d
13:47:15.887411 IP ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https > manjaro.55892: Flags [P.], seq 47:232, ack 635, win 277, options [nop,nop,TS val 2648384452 ecr 612095846], length 185
Eh....@...kE4%3........T.?.m........z......
..#.${.f.............h......a...a...gG.K....us....c}.......',Da(..\..5.......S...3..
Z].
.......E....'6MG'M.......Y..@...6..i.*..d|2.%w...7}..x.^\U.b../2
.f.. tTw.).TA.....UL.6~Y.w.vz)...o...Sx
13:47:15.887412 IP ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https > manjaro.55892: Flags [P.], seq 232:270, ack 635, win 277, options [nop,nop,TS val 2648384452 ecr 612095846], length 38
Eh.Z..@...k.4%3........T.?.&...............
..#.${.f....!............p8.^.@....
p   '.N_l..j
13:47:15.887701 IP manjaro.55892 > ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https: Flags [.], ack 270, win 501, options [nop,nop,TS val 612095998 ecr 2648384449], length 0
E..4.e@.@.<.....4%3..T.......?.L....)......
${....#.
13:47:15.889341 IP manjaro.55892 > ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https: Flags [P.], seq 635:677, ack 270, win 501, options [nop,nop,TS val 612096000 ecr 2648384449], length 42
E..^.f@.@.<.....4%3..T.......?.L....)......
${....#.....%........7.0E4Qx......S./0..:..\....sj
13:47:15.890345 IP ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https > manjaro.55892: Flags [P.], seq 270:455, ack 635, win 277, options [nop,nop,TS val 2648384456 ecr 612095846], length 185
Eh....@...kC4%3........T.?.L.........h.....
..#.${.f.............|..|Q.L...._A..!.56.....s......<OM..a.uS..P....BL...9b...9.>.wK@.".<.o....3..X^N.....7(xa`..~a..[./..`...!..$.CZ.z.Eu..R...M..s+{.Y...v.....^..\........9  Z.6...-.N..H..De..
13:47:15.890379 IP ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https > manjaro.55892: Flags [P.], seq 455:493, ack 635, win 277, options [nop,nop,TS val 2648384456 ecr 612095846], length 38
Eh.Z..@...k.4%3........T.?..........n".....
..#.${.f....!........%.3?05...e....}40e....e.t
13:47:15.890548 IP manjaro.55892 > ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https: Flags [.], ack 493, win 501, options [nop,nop,TS val 612096001 ecr 2648384456], length 0
E..4.g@.@.<.....4%3..T.....I.?.+....)......
${....#.
13:47:15.926083 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [.], ack 40, win 501, options [nop,nop,TS val 332386818 ecr 2611837611], length 0
E..4.+@.@......."x......p............).....
......z.
13:47:15.934408 IP 249.195.120.34.bc.googleusercontent.com.https > manjaro.57510: Flags [P.], seq 40:107, ack 361, win 366, options [nop,nop,TS val 2611837666 ecr 332386628], length 67
E..w....s..."x..............p......n.......
..z....D....>
...I.-z.#~hw.rq.&h......\.....b.-tA~.........5X.2.i....../.`.
13:47:15.934409 IP 249.195.120.34.bc.googleusercontent.com.https > manjaro.57510: Flags [P.], seq 140:179, ack 361, win 366, options [nop,nop,TS val 2611837666 ecr 332386628], length 39
E..[....s..."x..............p......ndx.....
..z....D....".[14..y!.?....)................X.=
13:47:15.934429 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [.], ack 107, win 501, options [nop,nop,TS val 332386827 ecr 2611837666], length 0
E..4.,@.@......."x......p............).....
......z.
13:47:15.934432 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [.], ack 107, win 501, options [nop,nop,TS val 332386827 ecr 2611837666,nop,nop,sack 1 {140:179}], length 0
E..@.-@.@......."x......p............5.....
......z....
........
13:47:15.936451 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [P.], seq 361:396, ack 107, win 501, options [nop,nop,TS val 332386829 ecr 2611837666,nop,nop,sack 1 {140:179}], length 35
E..c..@.@..c...."x......p............X.....
......z....
..............H.rA$O?7.j.XQH...8i......W.sb
13:47:16.083547 IP ec2-52-37-51-200.us-west-2.compute.amazonaws.com.https > manjaro.55892: Flags [.], ack 677, win 277, options [nop,nop,TS val 2648384648 ecr 612096000], length 0
Eh.4..@...k.4%3........T.?.+...I....|......
..$.${..
13:47:16.115462 IP 249.195.120.34.bc.googleusercontent.com.https > manjaro.57510: Flags [P.], seq 107:140, ack 396, win 366, options [nop,nop,TS val 2611837847 ecr 332386829], length 33
E..U....s..."x..............p......n.......
..{...........yO.d...H^V.k"..C.=..n...2..
13:47:16.115483 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [.], ack 179, win 501, options [nop,nop,TS val 332387008 ecr 2611837847], length 0
E..4./@.@......."x......p............).....
......{.
13:47:16.115565 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [P.], seq 396:431, ack 179, win 501, options [nop,nop,TS val 332387008 ecr 2611837847], length 35
E..W.0@.@..m...."x......p............L.....
......{......r.}....7.3....|..$..bZ`...-...
13:47:16.115574 IP manjaro.57510 > 249.195.120.34.bc.googleusercontent.com.https: Flags [P.], seq 431:470, ack 179, win 501, options [nop,nop,TS val 332387008 ecr 2611837847], length 39
E..[.1@.@..h...."x......p............P.....
......{....."..R."{...
....A...*z.rK.tt.?..+...
13:47:16.254484 IP 249.195.120.34.bc.googleusercontent.com.https > manjaro.57510: Flags [.], ack 470, win 366, options [nop,nop,TS val 2611837989 ecr 332387008], length 0
E..4....s..0"x..............p..(...n.......
..|%....
13:47:19.059535 IP manjaro.47896 > 104.18.21.157.https: Flags [S], seq 705545575, win 64240, options [mss 1460,sackOK,TS val 2698855007 ecr 0,nop,wscale 7], length 0
E..<O.@.@.......h.......*..g........?o.........
..B_........
13:47:19.059577 IP manjaro.55930 > 13.107.246.74.https: Flags [.], ack 4076310972, win 501, options [nop,nop,TS val 2988313471 ecr 1200874010], length 0
E..4..@.@..b.....k.J.z..{\.p.........m.....
....G...
13:47:19.062954 IP manjaro.47894 > 104.18.21.157.https: Flags [S], seq 1631682334, win 64240, options [mss 1460,sackOK,TS val 2698855010 ecr 0,nop,wscale 7], length 0
E..<..@.@.V\....h.......aA..........?o.........
..Bb........
13:47:19.096252 IP 13.107.246.74.https > manjaro.55930: Flags [.], ack 1, win 83, options [nop,nop,TS val 1200919842 ecr 2988267668], length 0
Eh.4..@......k.J.......z....{\.q...SC......
G.."..X.
13:47:19.285921 IP 104.18.21.157.https > manjaro.47894: Flags [S.], seq 2391066564, ack 1631682335, win 65535, options [mss 1400,sackOK,TS val 751466508 ecr 2698855010,nop,wscale 13], length 0
Eh.<..@./...h...............aA.......S.....x...
,.x...Bb...
13:47:19.286001 IP manjaro.47894 > 104.18.21.157.https: Flags [.], ack 1, win 502, options [nop,nop,TS val 2698855233 ecr 751466508], length 0
E..4. @.@.Vc....h.......aA..........?g.....
..CA,.x.
13:47:19.287289 IP manjaro.47894 > 104.18.21.157.https: Flags [.], seq 1:1389, ack 1, win 502, options [nop,nop,TS val 2698855235 ecr 751466508], length 1388
E....!@.@.P.....h.......aA..........D......
..CC,.x............t..u..j.9.+.. .n.....{u!........ ..p...a1;...3i@^w.6?<..B......J.. .........+./.,.0............./.5................................................... 7..N.Ai.sk.,T.-.==#_..y.m....xHv..T.3@.....~......
.J....i5..8...Zwu.p.].<}......Q,.n........r[D.&....r..#......5n..J.I..e`..\i...\W...BwF.....+.o.7"~.%\....;.....:.,.D^...ur...S.l...N\....`..(.9a....h./.R.ov..fr..l.B..#.fm..tO.........rox.>3Di.....h2.#.........h2.http/1.1.+...zz.....3....jj...c......Fx6....xn..d-.Z..zU.(?4.....i..8....$X-." t......H.........Y.g..0F5.a..^.E......0!UsC!QP.{....u."...a..#....\}...5....t...........,...4..(..?...j.o..`.. .7.w    ..0.z..Y7.j+.........r......:l2[:.....P].E..QH&G.q~........T..T......&..Df.57.?.....&...ZMM.sds.Wex.%&.8.-....p{i...H.I;eY..jE..d.Sy.,........R'..`u....z..f<.q(xh....r...v9x...l.2f.....v.SN|....!s.PU.L....z*...A{K..j.....9....&/.wH>.......O..<m...2
..c...v:..,+.W...>...D.v..6.....W..qE..d7z..M.@"XT5$    Z.JB.,Fp.   zkt.....Xd:...h.:o..p.D......u.......{1.e{.[...sI.D.j.  I...|.5.............ns....#.^w.l..[.T5.....Q.hJ.....$'.fv.`..).X..1u.u..iY.....o...1"P{.    U....B.....M.I.(.c..M..0.s...g.....a~UIX(..u...yG3...M.........E...rB..Hj7..(.${......nLD..t.."<;.BvI....q...v..&......`l....K..L.............E...T..4...
...qXBKKa*.TG.E.n7..e.V....C7.3......D....t.h...#..SAwKJ/...JF....x.W.K....9...i..s.F...~?....x..] L....oF.w!z..;W.....m.!3*.3K.}7......P%.....:.....-.0...V
$ sudo ecapture tls -i enp2s0 -w pcapng -p 443
2024-07-19T13:48:36+08:00 INF AppName="eCapture(旁观者)"
2024-07-19T13:48:36+08:00 INF HomePage=https://ecapture.cc
2024-07-19T13:48:36+08:00 INF Repository=https://github.com/gojue/ecapture
2024-07-19T13:48:36+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-07-19T13:48:36+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-07-19T13:48:36+08:00 INF Version=linux_amd64:v0.8.4:6.5.0-1023-azure
2024-07-19T13:48:36+08:00 WRN ========== module starting. ==========
2024-07-19T13:48:36+08:00 INF listen=localhost:28256
2024-07-19T13:48:36+08:00 INF https server starting...You can update the configuration file via the HTTP interface.
2024-07-19T13:48:36+08:00 INF Kernel Info=6.6.40 Pid=3496
2024-07-19T13:48:36+08:00 INF BTF bytecode mode: CORE. btfMode=0
2024-07-19T13:48:36+08:00 INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2024-07-19T13:48:36+08:00 INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2024-07-19T13:48:36+08:00 INF Module.Run()
SIGSEGV: segmentation violation
PC=0x7f98193a4186 m=4 sigcode=1
signal arrived during cgo execution

goroutine 6 [syscall]:
runtime.cgocall(0xb3aeb0, 0xc000056588)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/cgocall.go:157 +0x4b fp=0xc000056560 sp=0xc000056528 pc=0x40950b
net._C2func_getaddrinfo(0xc000014420, 0x0, 0xc000046720, 0xc00005e0a8)
    _cgo_gotypes.go:103 +0x55 fp=0xc000056588 sp=0xc000056560 pc=0x679915
net._C_getaddrinfo.func1(0x4124e5?, 0x8?, 0xc8c320?, 0x1?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix_cgo.go:78 +0x7a fp=0xc0000565f0 sp=0xc000056588 pc=0x679cda
net._C_getaddrinfo(0xdfa098?, 0x9?, 0x0?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix_cgo.go:78 +0x13 fp=0xc000056620 sp=0xc0000565f0 pc=0x679c13
net.cgoLookupHostIP({0xdd95d4, 0x3}, {0xdfa098, 0x9})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:166 +0x24f fp=0xc000056760 sp=0xc000056620 pc=0x64f0ef
net.cgoLookupIP.func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:215 +0x25 fp=0xc000056790 sp=0xc000056760 pc=0x64f805
net.doBlockingWithCtx[...].func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:56 +0x35 fp=0xc0000567e0 sp=0xc000056790 pc=0x679f95
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc0000567e8 sp=0xc0000567e0 pc=0x46dbc1
created by net.doBlockingWithCtx[...] in goroutine 5
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:54 +0xd8

goroutine 1 [syscall]:
runtime.notetsleepg(0x41f4d6?, 0x245d480?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/lock_futex.go:236 +0x29 fp=0xc00039f180 sp=0xc00039f148 pc=0x410c09
runtime.gcBgMarkStartWorkers()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:1221 +0x2f fp=0xc00039f1a0 sp=0xc00039f180 pc=0x420baf
runtime.gcStart({0x597605?, 0x100000?, 0x4fa2d8?})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:667 +0x225 fp=0xc00039f238 sp=0xc00039f1a0 pc=0x41f745
runtime.mallocgc(0x100000, 0xca94e0, 0x1)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/malloc.go:1246 +0x76f fp=0xc00039f2a0 sp=0xc00039f238 pc=0x4122cf
runtime.makeslice(0xe0b710?, 0x1c?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/slice.go:103 +0x49 fp=0xc00039f2c8 sp=0xc00039f2a0 pc=0x452769
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).detectOpenssl(0xc0004d0900, {0xc00033abd0, 0x12})
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl_lib.go:179 +0x3a6 fp=0xc00039f3e0 sp=0xc00039f2c8 pc=0x939806
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).getSslBpfFile(0x0?, {0xc00033abd0?, 0xc00039f470?}, {0x0?, 0xc00012a060?})
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl.go:194 +0x1a5 fp=0xc00039f448 sp=0xc00039f3e0 pc=0x933de5
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).setupManagersText(0xc0004d0900)
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl_text.go:25 +0xa5 fp=0xc00039f608 sp=0xc00039f448 pc=0x93b085
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).start(0xc0004d0900)
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl.go:211 +0x4e fp=0xc00039fa10 sp=0xc00039f608 pc=0x93418e
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).Start(0xc0004be150?)
    /home/runner/work/ecapture/ecapture/user/module/probe_openssl.go:199 +0x13 fp=0xc00039fa28 sp=0xc00039fa10 pc=0x934113
github.com/gojue/ecapture/user/module.(*Module).Run(0xc0004d0900)
    /home/runner/work/ecapture/ecapture/user/module/imodule.go:199 +0x58 fp=0xc00039fa50 sp=0xc00039fa28 pc=0x927cb8
github.com/gojue/ecapture/user/module.(*MOpenSSLProbe).Run(0xc0004be150?)
    <autogenerated>:1 +0x1e fp=0xc00039fa68 sp=0xc00039fa50 pc=0x93f79e
github.com/gojue/ecapture/cli/cmd.runModule({0xdfb9d1, 0x10}, {0xf43de0, 0xc0003a8ff0})
    /home/runner/work/ecapture/ecapture/cli/cmd/root.go:230 +0x7f1 fp=0xc00039fc28 sp=0xc00039fa68 pc=0xb39eb1
github.com/gojue/ecapture/cli/cmd.openSSLCommandFunc(0xc0004c2700?, {0xc0004c4360?, 0x4?, 0xdda5a3?})
    /home/runner/work/ecapture/ecapture/cli/cmd/tls.go:65 +0x99 fp=0xc00039fc60 sp=0xc00039fc28 pc=0xb3aad9
github.com/spf13/cobra.(*Command).execute(0x1495e00, {0xc0004c4300, 0x6, 0x6})
    /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:987 +0xaa3 fp=0xc00039fe00 sp=0xc00039fc60 pc=0x969963
github.com/spf13/cobra.(*Command).ExecuteC(0x14949e0)
    /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1115 +0x3ff fp=0xc00039fed8 sp=0xc00039fe00 pc=0x96a23f
github.com/spf13/cobra.(*Command).Execute(...)
    /home/runner/go/pkg/mod/github.com/spf13/cobra@v1.8.0/command.go:1039
github.com/gojue/ecapture/cli/cmd.Execute()
    /home/runner/work/ecapture/ecapture/cli/cmd/root.go:106 +0x10b fp=0xc00039fef0 sp=0xc00039fed8 pc=0xb385ab
github.com/gojue/ecapture/cli.Start(...)
    /home/runner/work/ecapture/ecapture/cli/main.go:22
main.main()
    /home/runner/work/ecapture/ecapture/main.go:32 +0x93 fp=0xc00039ff40 sp=0xc00039fef0 pc=0xb3ad93
runtime.main()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:267 +0x2bb fp=0xc00039ffe0 sp=0xc00039ff40 pc=0x43dcdb
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00039ffe8 sp=0xc00039ffe0 pc=0x46dbc1

goroutine 2 [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc00005afa8 sp=0xc00005af88 pc=0x43e12e
runtime.goparkunlock(...)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:404
runtime.forcegchelper()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:322 +0xb3 fp=0xc00005afe0 sp=0xc00005afa8 pc=0x43dfb3
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00005afe8 sp=0xc00005afe0 pc=0x46dbc1
created by runtime.init.6 in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:310 +0x1a

goroutine 3 [GC sweep wait]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc00005b778 sp=0xc00005b758 pc=0x43e12e
runtime.goparkunlock(...)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:404
runtime.bgsweep(0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgcsweep.go:280 +0x94 fp=0xc00005b7c8 sp=0xc00005b778 pc=0x429fb4
runtime.gcenable.func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:200 +0x25 fp=0xc00005b7e0 sp=0xc00005b7c8 pc=0x41f145
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00005b7e8 sp=0xc00005b7e0 pc=0x46dbc1
created by runtime.gcenable in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:200 +0x66

goroutine 4 [GC scavenge wait]:
runtime.gopark(0xc00007c000?, 0xf2c6e8?, 0x1?, 0x0?, 0xc0000071e0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc00005bf70 sp=0xc00005bf50 pc=0x43e12e
runtime.goparkunlock(...)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:404
runtime.(*scavengerState).park(0x1efb4a0)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgcscavenge.go:425 +0x49 fp=0xc00005bfa0 sp=0xc00005bf70 pc=0x427869
runtime.bgscavenge(0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgcscavenge.go:653 +0x3c fp=0xc00005bfc8 sp=0xc00005bfa0 pc=0x427dfc
runtime.gcenable.func2()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:201 +0x25 fp=0xc00005bfe0 sp=0xc00005bfc8 pc=0x41f0e5
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00005bfe8 sp=0xc00005bfe0 pc=0x46dbc1
created by runtime.gcenable in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:201 +0xa5

goroutine 18 [finalizer wait]:
runtime.gopark(0x198?, 0xdd2700?, 0x1?, 0xf2?, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc00005a620 sp=0xc00005a600 pc=0x43e12e
runtime.runfinq()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mfinal.go:193 +0x107 fp=0xc00005a7e0 sp=0xc00005a620 pc=0x41e0e7
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc00005a7e8 sp=0xc00005a7e0 pc=0x46dbc1
created by runtime.createfing in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mfinal.go:163 +0x3d

goroutine 19 [select]:
runtime.gopark(0xc000163970?, 0x2?, 0x8?, 0x61?, 0xc0001638cc?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc000163718 sp=0xc0001636f8 pc=0x43e12e
runtime.selectgo(0xc000163970, 0xc0001638c8, 0xd?, 0x0, 0x8e?, 0x1)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/select.go:327 +0x725 fp=0xc000163838 sp=0xc000163718 pc=0x44dc65
net.(*Resolver).lookupIPAddr(0x1efa9a0, {0xf39a38?, 0x245b020}, {0xdd95d4, 0x3}, {0xdfa098, 0x9})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/lookup.go:332 +0x3fe fp=0xc000163a18 sp=0xc000163838 pc=0x6686de
net.(*Resolver).internetAddrList(0xf39a38?, {0xf39a38?, 0x245b020?}, {0xdd95d4, 0x3}, {0xdfa098?, 0x100000000?})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/ipsock.go:288 +0x4e5 fp=0xc000163b40 sp=0xc000163a18 pc=0x6666c5
net.(*Resolver).resolveAddrList(0x41b673?, {0xf39a38, 0x245b020}, {0xde14ed, 0x6}, {0xdd95d4?, 0xc000163cd0?}, {0xdfa098, 0xf}, {0x0, ...})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/dial.go:282 +0x405 fp=0xc000163c40 sp=0xc000163b40 pc=0x651a05
net.(*ListenConfig).Listen(0xc000163d70, {0xf39a38, 0x245b020}, {0xdd95d4, 0x3}, {0xdfa098, 0xf})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/dial.go:716 +0x7e fp=0xc000163d38 sp=0xc000163c40 pc=0x6546be
net.Listen({0xdd95d4?, 0xe8?}, {0xdfa098?, 0x1486101?})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/dial.go:806 +0x47 fp=0xc000163d98 sp=0xc000163d38 pc=0x6551e7
net/http.(*Server).ListenAndServe(0xc0000a8000)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/http/server.go:2981 +0x50 fp=0xc000163dc8 sp=0xc000163d98 pc=0x7b15f0
net/http.ListenAndServe(...)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/http/server.go:3239
github.com/gin-gonic/gin.(*Engine).Run(0xc0000076c0, {0xc000163f00, 0x1, 0x1})
    /home/runner/go/pkg/mod/github.com/gin-gonic/gin@v1.10.0/gin.go:399 +0x225 fp=0xc000163e60 sp=0xc000163dc8 pc=0xb28265
github.com/gojue/ecapture/cli/http.HttpServer.Run(...)
    /home/runner/work/ecapture/ecapture/cli/http/server.go:56
github.com/gojue/ecapture/cli/cmd.runModule.func1()
    /home/runner/work/ecapture/ecapture/cli/cmd/root.go:200 +0x159 fp=0xc000163fe0 sp=0xc000163e60 pc=0xb3a679
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc000163fe8 sp=0xc000163fe0 pc=0x46dbc1
created by github.com/gojue/ecapture/cli/cmd.runModule in goroutine 1
    /home/runner/work/ecapture/ecapture/cli/cmd/root.go:196 +0x410

goroutine 5 [select]:
runtime.gopark(0xc000165b50?, 0x2?, 0x78?, 0x5b?, 0xc000165b34?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/proc.go:398 +0xce fp=0xc0001659e0 sp=0xc0001659c0 pc=0x43e12e
runtime.selectgo(0xc000165b50, 0xc000165b30, 0x0?, 0x0, 0x4c76c0?, 0x1)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/select.go:327 +0x725 fp=0xc000165b00 sp=0xc0001659e0 pc=0x44dc65
net.doBlockingWithCtx[...]({0xf39aa8, 0xc000092050}, 0xc0000466c0)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:60 +0x14f fp=0xc000165bd0 sp=0xc000165b00 pc=0x67b76f
net.cgoLookupIP({0xf39aa8, 0xc000092050}, {0xdd95d4, 0x3}, {0xdfa098, 0x9})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/cgo_unix.go:214 +0xb4 fp=0xc000165c00 sp=0xc000165bd0 pc=0x64f774
net.(*Resolver).lookupIP(0x1efa9a0, {0xf39aa8, 0xc000092050}, {0xdd95d4, 0x3}, {0xdfa098, 0x9})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/lookup_unix.go:70 +0x11a fp=0xc000165e58 sp=0xc000165c00 pc=0x669b1a
net.(*Resolver).lookupIP-fm({0xf39aa8?, 0xc000092050?}, {0xdd95d4?, 0x0?}, {0xdfa098?, 0x0?})
    <autogenerated>:1 +0x49 fp=0xc000165ea0 sp=0xc000165e58 pc=0x67e929
net.glob..func1({0xf39aa8?, 0xc000092050?}, 0xc0004be0e0?, {0xdd95d4?, 0x0?}, {0xdfa098?, 0x0?})
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/hook.go:23 +0x37 fp=0xc000165ee0 sp=0xc000165ea0 pc=0x65ec37
net.(*Resolver).lookupIPAddr.func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/net/lookup.go:324 +0x3a fp=0xc000165f38 sp=0xc000165ee0 pc=0x6690fa
internal/singleflight.(*Group).doCall(0x1efa9b0, 0xc0000920a0, {0xc000014330, 0xd}, 0x0?)
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/internal/singleflight/singleflight.go:93 +0x35 fp=0xc000165fa8 sp=0xc000165f38 pc=0x64cc55
internal/singleflight.(*Group).DoChan.func1()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/internal/singleflight/singleflight.go:86 +0x30 fp=0xc000165fe0 sp=0xc000165fa8 pc=0x64cbf0
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc000165fe8 sp=0xc000165fe0 pc=0x46dbc1
created by internal/singleflight.(*Group).DoChan in goroutine 19
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/internal/singleflight/singleflight.go:86 +0x2e9

goroutine 20 [runnable]:
runtime.gcBgMarkWorker()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:1261 fp=0xc000056fe0 sp=0xc000056fd8 pc=0x420be0
runtime.goexit()
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/asm_amd64.s:1650 +0x1 fp=0xc000056fe8 sp=0xc000056fe0 pc=0x46dbc1
created by runtime.gcBgMarkStartWorkers in goroutine 1
    /home/runner/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.21.5.linux-amd64/src/runtime/mgc.go:1219 +0x1c

rax    0x1e33c0
rbx    0x0
rcx    0xffffffffffffff18
rdx    0x7f98194d3500
rdi    0x0
rsi    0xfcd9a5
rbp    0x7f981af17110
rsp    0x7f981af170d8
r8     0x963cf85
r9     0x0
r10    0x7f9804000100
r11    0x7f9804000090
r12    0x7f9804003b70
r13    0x1
r14    0x7f9804001160
r15    0x7f9804003b70
rip    0x7f98193a4186
rflags 0x10202
cs     0x33
fs     0x0
gs     0x0
ziyouchutuwenwu commented 1 month ago

version

$ sudo ecapture --version
eCapture version:   linux_amd64:v0.8.4:6.5.0-1023-azure
cfc4n commented 1 month ago

I cannot reproduce your issue; my assessment is that there was a problem during the compilation process. Could you try compiling a version yourself to verify? Use the make command.

refer release.yml to install the compilation environment

ziyouchutuwenwu commented 1 month ago

according the release.yaml, i install these for build essential

yay -S bpftool-bin
pacman -S linux-headers clang pkgconf libelf llvm

compile

git clone https://github.com/gojue/ecapture -b v0.8.4
cd ecapture
make

after building, i run it

cd bin
sudo ./ecapture tls -i enp2s0 -w pcapng -p 443

output works fine

mmc at kvm-manjaro in ~/downloads/ecapture/bin (tags/v0.8.4) 
$ sudo ./ecapture tls -i enp2s0 -w pcapng -p 443
2024-07-20T19:44:56+08:00 INF AppName="eCapture(旁观者)"
2024-07-20T19:44:56+08:00 INF HomePage=https://ecapture.cc
2024-07-20T19:44:56+08:00 INF Repository=https://github.com/gojue/ecapture
2024-07-20T19:44:56+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-07-20T19:44:56+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-07-20T19:44:56+08:00 INF Version=linux_amd64:0.8.4-20240709-7e1ad52:6.9.9-1-MANJARO
2024-07-20T19:44:56+08:00 WRN ========== module starting. ==========
2024-07-20T19:44:56+08:00 INF listen=localhost:28256
2024-07-20T19:44:56+08:00 INF https server starting...You can update the configuration file via the HTTP interface.
2024-07-20T19:44:56+08:00 INF Kernel Info=6.9.9 Pid=15092
2024-07-20T19:44:56+08:00 INF BTF bytecode mode: CORE. btfMode=0
2024-07-20T19:44:56+08:00 INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2024-07-20T19:44:56+08:00 INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2024-07-20T19:44:56+08:00 INF Module.Run()
2024-07-20T19:44:56+08:00 INF OpenSSL/BoringSSL version not found from shared library file, used default version OpenSSL Version=linux_default_3_0
2024-07-20T19:44:56+08:00 INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/lib64/libssl.so.3
2024-07-20T19:44:56+08:00 INF target process. target PID=443
2024-07-20T19:44:56+08:00 INF target all users.
2024-07-20T19:44:56+08:00 INF setupManagers eBPFProgramType=Text
2024-07-20T19:44:56+08:00 INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_3_0_0_kern_core.o
2024-07-20T19:44:57+08:00 INF perfEventReader created mapSize(MB)=4
2024-07-20T19:44:57+08:00 INF perfEventReader created mapSize(MB)=4
2024-07-20T19:44:57+08:00 INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL
^C2024-07-20T19:45:01+08:00 INF Module closed,message recived from Context
2024-07-20T19:45:01+08:00 INF module close.
2024-07-20T19:45:01+08:00 INF iModule module close
2024-07-20T19:45:01+08:00 INF bye bye.

i redownload the release bin version from https://github.com/gojue/ecapture/releases/download/v0.8.4/ecapture-v0.8.4-linux-amd64.tar.gz

run it

sudo ./ecapture tls -i enp2s0 -w pcapng -p 443

but it crashed yet.

Here is the build binary on my machine, i'm not sure if it is useful. ecapture_0.8.4_build_on_manjaro.tar.gz

cfc4n commented 1 month ago

The issue seems to be with the compilation process, which is likely related to the local build environment. The pre-compiled binary files cannot be used for debugging, and moreover, I am unable to reproduce it on my local 6.x kernel.

Could you provide me with an SSH account so that I can troubleshoot it on your server?

ziyouchutuwenwu commented 1 month ago

sorry, i don't have manjaro server on any cloud, this is my pc.

here is all the steps after installing manjaro

# using mirror
sudo pacman-mirrors -i --geoip -m rank

# remove something, or else system upgrading will fail
sudo pacman -Rcns libdvdcss spice-vdagent xcape
# do system upgrading
sudo pacman -Syyu

sudo pacman -S fakeroot make clang pkgconf libelf llvm flex bison
sudo pacman -S linux-headers

# it needs proxy, such as proxychains
sudo pacman -S yay nvim proxychains
yay -S bpftool-bin

# manually install golang and do the configuration
...

git clone https://github.com/gojue/ecapture -b v0.8.4
cd ecapture
make

this build output bin file works fine.

cfc4n commented 1 month ago

sorry, I am unable to reproduce it.

xxxxxliil commented 1 week ago

@ziyouchutuwenwu Would you like to go ahead and try to see if ecapture in vm continues to crash?

ziyouchutuwenwu commented 1 week ago

i have installed manjaro on local pc, and also install it in virt-manager vm, i did the test in the virt-manager manjaro vm.

xxxxxliil commented 5 days ago

i have installed manjaro on local pc, and also install it in virt-manager vm, i did the test in the virt-manager manjaro vm.

如果虚拟机里的 manjaro 还是有同样问题,可以把虚拟机的镜像上传然后供大伙试一试。但是在这之前要不要先发一下你的硬件配置?也许有的时候是 CPU 指令集不够新导致的

xxxxxliil commented 5 days ago

@cfc4n 我试了之后发现 arch 也会崩溃,是有什么东西硬编码导致在 arch 系发行版跑不起来吗?

cfc4n commented 5 days ago

新提一个issue吧。把详细崩溃的信息贴一下

ziyouchutuwenwu commented 4 days ago

@xxxxxliil 有没有上传的地址,百度网盘实在是太慢了

$ lscpu
架构:                    x86_64
  CPU 运行模式:          32-bit, 64-bit
  Address sizes:          39 bits physical, 48 bits virtual
  字节序:                Little Endian
CPU:                      12
  在线 CPU 列表:         0-11
厂商 ID:                 GenuineIntel
  型号名称:              Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
    CPU 系列:            6
    型号:                158
    每个核的线程数:      2
    每个座的核数:        6
    座:                  1
    步进:                10
    CPU(s) scaling MHz:   18%
    CPU 最大 MHz:        4500.0000
    CPU 最小 MHz:        800.0000
    BogoMIPS:            5202.65
    标记:                fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmo
                          v pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe 
                          syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon p
                          ebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf
                           pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg 
                          fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt ts
                          c_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnow
                          prefetch cpuid_fault epb pti ssbd ibrs ibpb stibp tpr_shadow
                           flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 
                          smep bmi2 erms invpcid mpx rdseed adx smap clflushopt intel_
                          pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hw
                          p hwp_notify hwp_act_window hwp_epp vnmi md_clear flush_l1d 
                          arch_capabilities
Virtualization features:  
  虚拟化:                VT-x
Caches (sum of all):      
  L1d:                    192 KiB (6 instances)
  L1i:                    192 KiB (6 instances)
  L2:                     1.5 MiB (6 instances)
  L3:                     12 MiB (1 instance)
NUMA:                     
  NUMA 节点:             1
  NUMA 节点0 CPU:        0-11
Vulnerabilities:          
  Gather data sampling:   Mitigation; Microcode
  Itlb multihit:          KVM: Mitigation: VMX disabled
  L1tf:                   Mitigation; PTE Inversion; VMX conditional cache flushes, SM
                          T vulnerable
  Mds:                    Mitigation; Clear CPU buffers; SMT vulnerable
  Meltdown:               Mitigation; PTI
  Mmio stale data:        Mitigation; Clear CPU buffers; SMT vulnerable
  Reg file data sampling: Not affected
  Retbleed:               Mitigation; IBRS
  Spec rstack overflow:   Not affected
  Spec store bypass:      Mitigation; Speculative Store Bypass disabled via prctl
  Spectre v1:             Mitigation; usercopy/swapgs barriers and __user pointer sani
                          tization
  Spectre v2:             Mitigation; IBRS; IBPB conditional; STIBP conditional; RSB f
                          illing; PBRSB-eIBRS Not affected; BHI Not affected
  Srbds:                  Mitigation; Microcode
  Tsx async abort:        Not affected
$ screenfetch

 ██████████████████  ████████     mmc@p53
 ██████████████████  ████████     OS: Manjaro 24.0.7 Wynsdey
 ██████████████████  ████████     Kernel: x86_64 Linux 6.6.46-1-MANJARO
 ██████████████████  ████████     Uptime: 3h 16m
 ████████            ████████     Packages: 1315
 ████████  ████████  ████████     Shell: zsh 5.9
 ████████  ████████  ████████     Resolution: No X Server
 ████████  ████████  ████████     DE: Xfce4
 ████████  ████████  ████████     WM: Xfwm4
 ████████  ████████  ████████     WM Theme: JacWin10
 ████████  ████████  ████████     GTK Theme: Windows10 [GTK2]
 ████████  ████████  ████████     Icon Theme: Faenza
 ████████  ████████  ████████     Font: 文泉驿等宽微米黑 10
 ████████  ████████  ████████     Disk: 442G / 1.5T (33%)
                                  CPU: Intel Core i7-9750H @ 12x 4.5GHz [52.0°C]
                                  GPU: Quadro T1000
                                  RAM: 2495MiB / 64073MiB
xxxxxliil commented 4 days ago

@xxxxxliil 有没有上传的地址,百度网盘实在是太慢了

$ lscpu
架构:                    x86_64
  CPU 运行模式:          32-bit, 64-bit
  Address sizes:          39 bits physical, 48 bits virtual
  字节序:                Little Endian
CPU:                      12
  在线 CPU 列表:         0-11
厂商 ID:                 GenuineIntel
  型号名称:              Intel(R) Core(TM) i7-9750H CPU @ 2.60GHz
    CPU 系列:            6
    型号:                158
    每个核的线程数:      2
    每个座的核数:        6
    座:                  1
    步进:                10
    CPU(s) scaling MHz:   18%
    CPU 最大 MHz:        4500.0000
    CPU 最小 MHz:        800.0000
    BogoMIPS:            5202.65
    标记:                fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmo
                          v pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe 
                          syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon p
                          ebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf
                           pni pclmulqdq dtes64 monitor ds_cpl vmx est tm2 ssse3 sdbg 
                          fma cx16 xtpr pdcm pcid sse4_1 sse4_2 x2apic movbe popcnt ts
                          c_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnow
                          prefetch cpuid_fault epb pti ssbd ibrs ibpb stibp tpr_shadow
                           flexpriority ept vpid ept_ad fsgsbase tsc_adjust bmi1 avx2 
                          smep bmi2 erms invpcid mpx rdseed adx smap clflushopt intel_
                          pt xsaveopt xsavec xgetbv1 xsaves dtherm ida arat pln pts hw
                          p hwp_notify hwp_act_window hwp_epp vnmi md_clear flush_l1d 
                          arch_capabilities
Virtualization features:  
  虚拟化:                VT-x
Caches (sum of all):      
  L1d:                    192 KiB (6 instances)
  L1i:                    192 KiB (6 instances)
  L2:                     1.5 MiB (6 instances)
  L3:                     12 MiB (1 instance)
NUMA:                     
  NUMA 节点:             1
  NUMA 节点0 CPU:        0-11
Vulnerabilities:          
  Gather data sampling:   Mitigation; Microcode
  Itlb multihit:          KVM: Mitigation: VMX disabled
  L1tf:                   Mitigation; PTE Inversion; VMX conditional cache flushes, SM
                          T vulnerable
  Mds:                    Mitigation; Clear CPU buffers; SMT vulnerable
  Meltdown:               Mitigation; PTI
  Mmio stale data:        Mitigation; Clear CPU buffers; SMT vulnerable
  Reg file data sampling: Not affected
  Retbleed:               Mitigation; IBRS
  Spec rstack overflow:   Not affected
  Spec store bypass:      Mitigation; Speculative Store Bypass disabled via prctl
  Spectre v1:             Mitigation; usercopy/swapgs barriers and __user pointer sani
                          tization
  Spectre v2:             Mitigation; IBRS; IBPB conditional; STIBP conditional; RSB f
                          illing; PBRSB-eIBRS Not affected; BHI Not affected
  Srbds:                  Mitigation; Microcode
  Tsx async abort:        Not affected
$ screenfetch

 ██████████████████  ████████     mmc@p53
 ██████████████████  ████████     OS: Manjaro 24.0.7 Wynsdey
 ██████████████████  ████████     Kernel: x86_64 Linux 6.6.46-1-MANJARO
 ██████████████████  ████████     Uptime: 3h 16m
 ████████            ████████     Packages: 1315
 ████████  ████████  ████████     Shell: zsh 5.9
 ████████  ████████  ████████     Resolution: No X Server
 ████████  ████████  ████████     DE: Xfce4
 ████████  ████████  ████████     WM: Xfwm4
 ████████  ████████  ████████     WM Theme: JacWin10
 ████████  ████████  ████████     GTK Theme: Windows10 [GTK2]
 ████████  ████████  ████████     Icon Theme: Faenza
 ████████  ████████  ████████     Font: 文泉驿等宽微米黑 10
 ████████  ████████  ████████     Disk: 442G / 1.5T (33%)
                                  CPU: Intel Core i7-9750H @ 12x 4.5GHz [52.0°C]
                                  GPU: Quadro T1000
                                  RAM: 2495MiB / 64073MiB

先不用上传了,我这 arch 也出一样的问题