# eCapture

> eBPF-based Linux and Android tool that attaches uprobes to TLS libraries such as OpenSSL, BoringSSL, GnuTLS and NSS, and to Go's TLS stack, recording the plaintext a process sends and receives without a proxy or an installed CA certificate, so analysts can inspect an application's encrypted traffic on a host they control. Output modes write plaintext text, NSS key logs, or pcapng files with embedded TLS secrets for Wireshark and tshark, and a text mode can rebuild complete HTTP/1.1 and HTTP/2 messages from the captured stream. Separate modules audit bash and zsh commands and MySQL and PostgreSQL queries.

- Type: Tool
- Targets: App · Protocol
- Category: Protocol analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/gojue/ecapture>
- Primary source: <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/README.md>
- Catalog page: <https://awesomerea.org/resources/ecapture/>
- Record JSON: <https://awesomerea.org/resources/ecapture/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ecapture/index.md)

## Requirements & limits

- Latest release at review: v2.9.0, published 2026-10-24; the reviewed master commit is identical to that tag. Release assets are Linux amd64, arm64 and loong64 archives and .deb packages plus Android amd64 and arm64 archives; the Docker image is Linux only. The README states that Windows and macOS are not supported; the separate eCaptureQ GUI can connect from them to a remote eCapture service.
- Needs Linux kernel 4.18+ on x86_64, 5.5+ on aarch64 or 6.6+ on LoongArch64, or Android on x86_64 or aarch64. Loading the eBPF programs requires root or, per the minimum-privileges guide, CAP_BPF, CAP_PERFMON and CAP_SYS_PTRACE on kernel 5.8+ (CAP_SYS_ADMIN on older kernels), plus CAP_NET_ADMIN for pcapng mode. Source builds need Go 1.26+, clang and LLVM 9+, cmake 3.18.4+, libelf and the pinned libpcap submodule; make nocore builds for kernels without BTF.
- Analysts choose the library or program to observe: the tls module locates the system OpenSSL through ld.so.conf paths or takes --libssl, which can also name a statically linked program, and gotls takes the Go program's ELF path; pcapng mode also needs a network interface and capture filter. Pcap mode records TLS-protected HTTP/1.x and HTTP/2 over TCP and HTTP/3 over QUIC, while the pcapng text source rebuilds only HTTP/1.1 and HTTP/2 over TCP. The project documents root-only end-to-end tests per module (make e2e).
- Apache-2.0; libpcap is a git submodule and the bin, dist, deps and bytecode directories hold only placeholders. Captured plaintext and keys can contain passwords, tokens and personal data: the project's defense-and-detection guide asks for written authorization before production use, scoping capture to chosen processes with --pid and handling the data under organizational policy, and describes how to detect eBPF capture tools.

## Primary sources

1. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/README.md>
2. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/README.md#L34-L37>
3. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/README.md#L120-L198>
4. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/docs/compilation.md>
5. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/docs/minimum-privileges.md>
6. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/docs/defense-detection.md#L151-L166>
7. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/docs/e2e-tests.md>
8. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/CHANGELOG.md>
9. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/.gitmodules>
10. <https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/LICENSE>
11. <https://github.com/gojue/ecapture/releases/tag/v2.9.0>

## More in Protocols

- [USBPcap](https://awesomerea.org/resources/usbpcap/index.md) · Tool
- [cantools](https://awesomerea.org/resources/cantools/index.md) · Tool
- [inspectrum](https://awesomerea.org/resources/inspectrum/index.md) · Tool
- [PULSAR](https://awesomerea.org/resources/pulsar/index.md) · Tool
- [CanLab](https://awesomerea.org/resources/canlab/index.md) · Tool
- [Facedancer](https://awesomerea.org/resources/facedancer/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.