{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/README.md#L34-L37",
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/README.md#L120-L198",
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/docs/compilation.md",
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/docs/minimum-privileges.md",
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/docs/defense-detection.md#L151-L166",
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/docs/e2e-tests.md",
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/CHANGELOG.md",
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/.gitmodules",
    "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/LICENSE",
    "https://github.com/gojue/ecapture/releases/tag/v2.9.0"
  ],
  "category": "protocol-analysis",
  "description_en": "eBPF-based Linux and Android tool that attaches uprobes to TLS libraries such as OpenSSL, BoringSSL, GnuTLS and NSS, and to Go's TLS stack, recording the plaintext a process sends and receives without a proxy or an installed CA certificate, so analysts can inspect an application's encrypted traffic on a host they control. Output modes write plaintext text, NSS key logs, or pcapng files with embedded TLS secrets for Wireshark and tshark, and a text mode can rebuild complete HTTP/1.1 and HTTP/2 messages from the captured stream. Separate modules audit bash and zsh commands and MySQL and PostgreSQL queries.",
  "description_zh": "基于 eBPF 的 Linux 与 Android 工具，在 OpenSSL、BoringSSL、GnuTLS、NSS 等 TLS 库以及 Go 的 TLS 实现上挂载 uprobe，记录进程收发的明文，无需代理或安装 CA 证书，便于分析者在自己掌控的主机上检查应用的加密流量。输出模式包括明文文本、NSS 密钥日志，以及内嵌 TLS 密钥、可交给 Wireshark 和 tshark 解读的 pcapng 文件；文本模式还能从捕获的数据流中重建完整的 HTTP/1.1 和 HTTP/2 报文。另有独立模块审计 bash、zsh 命令以及 MySQL、PostgreSQL 查询。",
  "entry_url": "https://awesomerea.org/resources/ecapture/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/ecapture/",
  "evidence_url": "https://github.com/gojue/ecapture/blob/e834aa060d9308e0462837f29779753f9059d9ff/README.md",
  "group": "tools",
  "id": "ecapture",
  "json_url": "https://awesomerea.org/resources/ecapture/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/ecapture/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/ecapture/index.md",
  "name": "eCapture",
  "name_zh": "eCapture eBPF TLS 明文捕获工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v2.9.0, published 2026-10-24; the reviewed master commit is identical to that tag. Release assets are Linux amd64, arm64 and loong64 archives and .deb packages plus Android amd64 and arm64 archives; the Docker image is Linux only. The README states that Windows and macOS are not supported; the separate eCaptureQ GUI can connect from them to a remote eCapture service.",
    "Needs Linux kernel 4.18+ on x86_64, 5.5+ on aarch64 or 6.6+ on LoongArch64, or Android on x86_64 or aarch64. Loading the eBPF programs requires root or, per the minimum-privileges guide, CAP_BPF, CAP_PERFMON and CAP_SYS_PTRACE on kernel 5.8+ (CAP_SYS_ADMIN on older kernels), plus CAP_NET_ADMIN for pcapng mode. Source builds need Go 1.26+, clang and LLVM 9+, cmake 3.18.4+, libelf and the pinned libpcap submodule; make nocore builds for kernels without BTF.",
    "Analysts choose the library or program to observe: the tls module locates the system OpenSSL through ld.so.conf paths or takes --libssl, which can also name a statically linked program, and gotls takes the Go program's ELF path; pcapng mode also needs a network interface and capture filter. Pcap mode records TLS-protected HTTP/1.x and HTTP/2 over TCP and HTTP/3 over QUIC, while the pcapng text source rebuilds only HTTP/1.1 and HTTP/2 over TCP. The project documents root-only end-to-end tests per module (make e2e).",
    "Apache-2.0; libpcap is a git submodule and the bin, dist, deps and bytecode directories hold only placeholders. Captured plaintext and keys can contain passwords, tokens and personal data: the project's defense-and-detection guide asks for written authorization before production use, scoping capture to chosen processes with --pid and handling the data under organizational policy, and describes how to detect eBPF capture tools."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v2.9.0，发布于 2026-10-24；所审阅的 master 提交与该标签完全一致。发布文件包括 Linux amd64、arm64、loong64 压缩包和 .deb 安装包，以及 Android amd64、arm64 压缩包；Docker 镜像仅支持 Linux。README 声明不支持 Windows 和 macOS；独立的 eCaptureQ 图形客户端可从这些系统连接远程 eCapture 服务。",
    "需要 x86_64 上 4.18+、aarch64 上 5.5+ 或 LoongArch64 上 6.6+ 的 Linux 内核，或 x86_64、aarch64 架构的 Android。加载 eBPF 程序需要 root；按最小权限指南，也可在 5.8+ 内核上改授 CAP_BPF、CAP_PERFMON 和 CAP_SYS_PTRACE（旧内核为 CAP_SYS_ADMIN），pcapng 模式另需 CAP_NET_ADMIN。从源码构建需要 Go 1.26+、clang 与 LLVM 9+、cmake 3.18.4+、libelf 以及固定版本的 libpcap 子模块；make nocore 可为不支持 BTF 的内核构建。",
    "分析者需选定要观察的库或程序：tls 模块通过 ld.so.conf 路径查找系统 OpenSSL，或由 --libssl 指定（也可指向静态链接的程序）；gotls 需要 Go 程序的 ELF 路径；pcapng 模式还需指定网卡和抓包过滤条件。pcap 模式可记录 TCP 上受 TLS 保护的 HTTP/1.x、HTTP/2 以及 QUIC 上的 HTTP/3，而 pcapng 文本数据源只能重建 TCP 上的 HTTP/1.1 和 HTTP/2。项目文档列出了各模块须以 root 运行的端到端测试（make e2e）。",
    "采用 Apache-2.0；libpcap 以 git 子模块引入，bin、dist、deps 和 bytecode 目录只有占位文件。捕获的明文和密钥可能包含密码、令牌和个人数据：项目的防御与检测指南要求在生产环境使用前取得书面授权，用 --pid 将捕获限定于选定进程，并按组织政策处理数据，同时说明了如何检测 eBPF 捕获工具。"
  ],
  "targets": [
    "app",
    "protocol"
  ],
  "url": "https://github.com/gojue/ecapture",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}