Pcap mode outputs strange packet

[KardRi]

Important

You can mention the @dosu AI robot, which can quickly answer your questions.

Describe the bug
./ecapture tls -m pcap, gives meaningless pcap file

But if using ecapture tls -m text, it can at least output some packets (for example from facebook), but not for chrome

Screenshots

If using text mode

Linux Server/Android (please complete the following information):

• Device: Redmi Note12T pro (pearl)
• Kernel Info: Linux localhost 5.10.136-android12-9
• eCapture Version: androidgki_arm64:v1.3.1:6.8.0-1029-azure
• MIUI version: 14
• Android version: 13

note: using older ecapture version <1 , can also capture some packet in text mode, but empty packet in pcap mode

Additional context
readelf -s /apex/com.android.conscrypt/lib64/libssl.so | grep SSL_read
723: 0000000000041a10 212 FUNC GLOBAL DEFAULT 14 SSL_read
readelf -s /apex/com.android.conscrypt/lib64/libssl.so | grep SSL_write
781: 0000000000041e10 300 FUNC GLOBAL DEFAULT 14 SSL_write

[dosubot]

Hi @KardRi! I'm Dosu and I’m helping the ecapture team.

The most likely reason pcap mode outputs meaningless packets is that ecapture can't properly detect the SSL library version on your Android device. This is a known issue—when the version isn't detected, ecapture defaults to a generic mode, which often results in empty or malformed pcap files, even though text mode can still output some plaintext data because it bypasses packet serialization complexities [1].

To fix this, explicitly specify the SSL version with the --ssl_version parameter. For Android 13, try:

./ecapture tls -m pcap --ssl_version='boringssl_a_13' -b 2 --libssl=/apex/com.android.conscrypt/lib64/libssl.so

Make sure:

• You're using the 64-bit libssl.so (not 32-bit, which isn't supported) [2].
• The output directory is writable and you have root permissions.
• The target app actually uses the specified libssl path; if not, adjust --libssl accordingly [3].

If you still see issues, check for warnings like OpenSSL/BoringSSL version not found, used default version. in your logs—this confirms the version detection problem [1].

Chrome traffic is especially tricky: Chrome uses BoringSSL and may be statically linked or have stripped symbols, making it hard for ecapture to hook into the right functions. In those cases, even with the correct parameters, capture might not work [4].

If problems persist, enabling debug logs or checking /sys/kernel/tracing/trace_pipe for eBPF output can help diagnose whether the probes are being triggered [5].

Let me know if you need more detailed troubleshooting steps!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[KardRi]

Hi @dosu

no luck with

./ecapture tls -m pcap -d --ssl_version='boringssl_a_13' -b 2 --libssl=/apex/com.android.conscrypt/lib64/libssl.so -i ccmni2

it will always say nothing captured

but you can see something with text

ecapture tls -m text -d --ssl_version='boringssl_a_13' -b 2 --libssl=/apex/com.android.conscrypt/lib64/libssl.so -i ccmni2

[dosubot]

This is a common issue on Android: text mode works because it hooks directly into SSL_read/SSL_write in process memory, while pcap mode depends on tc eBPF programs attached to the network interface. On many Android kernels (especially custom or vendor ones), tc eBPF hooks can silently fail or not trigger, so pcap mode ends up with "nothing captured" even if text mode works fine. This is not usually a problem with your command or parameters, but with kernel or interface compatibility for tc eBPF on Android devices [source].

If you want to troubleshoot further, you can: check that your kernel supports tc eBPF (CONFIG_BPF, CONFIG_NET_CLS_ACT, etc.), confirm the interface name is correct, and look for eBPF logs in /sys/kernel/tracing/trace_pipe to see if the tc hooks are firing. But in practice, text mode is the most reliable option on Android for now—pcap mode is often limited by kernel and device support [source].

Let me know if you want more details on kernel requirements or debugging tc eBPF!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[zenyanle]

Hello.Can you compile a debug version and provide some logs?

# compile
DEBUG=1 ANDROID=1 make nocore

# check ebpf log

echo 1 > /sys/kernel/tracing/tracing_on
cat  /sys/kernel/tracing/trace_pipe

[KardRi]

Hi @dosu ,

how do you cross compile arm64 with debug mode in amd64 machine? I got incaptiable libpcap.a issue

previously using

git clone --recurse-submodules git@github.com:gojue/ecapture.git
cd ecapture
DEBUG=1 ANDROID=1  CROSS_ARCH=arm64 make nocore

config.status: executing default-1 commands
make[1]: Entering directory '/root/ecapture/lib/libpcap'
bison -p pcap_ -o grammar.c -d grammar.y
aarch64-linux-gnu-gcc -fvisibility=hidden -O2 -g -gdwarf-4 -static -Wno-unused-result  -fpic -I.  -DBUILDING_PCAP -Dpcap_EXPORTS -DHAVE_CONFIG_H  -O2 -g -gdwarf-4 -static -Wno-unused-result    -c ./gencode.c
aarch64-linux-gnu-gcc -fvisibility=hidden -O2 -g -gdwarf-4 -static -Wno-unused-result  -fpic -I.  -DBUILDING_PCAP -Dpcap_EXPORTS -DHAVE_CONFIG_H  -O2 -g -gdwarf-4 -static -Wno-unused-result    -c scanner.c
aarch64-linux-gnu-gcc -fvisibility=hidden -O2 -g -gdwarf-4 -static -Wno-unused-result  -fpic -I.  -DBUILDING_PCAP -Dpcap_EXPORTS -DHAVE_CONFIG_H  -O2 -g -gdwarf-4 -static -Wno-unused-result    -c grammar.c
aarch64-linux-gnu-ar rc libpcap.a pcap-linux.o fad-getad.o  pcap-netfilter-linux.o  pcap.o gencode.o optimize.o nametoaddr.o etherent.o fmtutils.o pcap-util.o savefile.o sf-pcap.o sf-pcapng.o pcap-common.o pcap-usb-linux-common.o bpf_image.o bpf_filter.o bpf_dump.o scanner.o grammar.o strlcat.o strlcpy.o
ranlib libpcap.a
./config.status --file=libpcap.pc.tmp:./libpcap.pc.in
config.status: creating libpcap.pc.tmp
mv libpcap.pc.tmp libpcap.pc
./config.status --file=pcap-config.tmp:./pcap-config.in
config.status: creating pcap-config.tmp
mv pcap-config.tmp pcap-config
chmod a+x pcap-config
make[1]: Leaving directory '/root/ecapture/lib/libpcap'


CGO_ENABLED=1 CGO_CFLAGS='-O2 -g -gdwarf-4 -I/root/ecapture/lib/libpcap/' CGO_LDFLAGS='-O2 -g -L/root/ecapture/lib/libpcap/ -lpcap -static' GOOS=linux GOARCH=arm64 CC=aarch64-linux-gnu-gcc go build -trimpath -buildmode=pie -mod=readonly -tags 'androidgki,netgo' -ldflags "-w -s -X 'github.com/gojue/ecapture/cli/cmd.GitVersion=androidgki_arm64:v1.3.1-20250729-74d59c9:x86_64' -X 'github.com/gojue/ecapture/cli/cmd.ByteCodeFiles=noncore' -linkmode=external -extldflags -static " -o bin/ecapture
file bin/ecapture
# github.com/gojue/ecapture
/usr/local/go/pkg/tool/linux_amd64/link: running aarch64-linux-gnu-gcc failed: exit status 1
/usr/bin/aarch64-linux-gnu-gcc -s -Wl,-z,relro -pie -Wl,--build-id=0x01d00b7f7876e3df557f0463f3351bd7e0b68a41 -o $WORK/b001/exe/a.out -Wl,--export-dynamic-symbol=_cgo_panic -Wl,--export-dynamic-symbol=_cgo_topofstack -Wl,--export-dynamic-symbol=crosscall2 -Wl,--compress-debug-sections=zlib /tmp/go-link-3647288529/go.o /tmp/go-link-3647288529/000000.o /tmp/go-link-3647288529/000001.o /tmp/go-link-3647288529/000002.o /tmp/go-link-3647288529/000003.o /tmp/go-link-3647288529/000004.o /tmp/go-link-3647288529/000005.o /tmp/go-link-3647288529/000006.o /tmp/go-link-3647288529/000007.o /tmp/go-link-3647288529/000008.o /tmp/go-link-3647288529/000009.o /tmp/go-link-3647288529/000010.o /tmp/go-link-3647288529/000011.o /tmp/go-link-3647288529/000012.o /tmp/go-link-3647288529/000013.o /tmp/go-link-3647288529/000014.o /tmp/go-link-3647288529/000015.o /tmp/go-link-3647288529/000016.o -O2 -g -L/root/ecapture/lib/libpcap/ -lpcap -static -L/usr/local/lib -lpcap -L/usr/local/lib -lpcap -static -O2 -g -L/root/ecapture/lib/libpcap/ -lpcap -static -lpthread -static
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: skipping incompatible /root/ecapture/lib/libpcap//libpcap.a when searching for -lpcap
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: skipping incompatible /root/ecapture/lib/libpcap//libpcap.a when searching for -lpcap
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: cannot find -lpcap: No such file or directory
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: skipping incompatible /root/ecapture/lib/libpcap//libpcap.a when searching for -lpcap
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: skipping incompatible /root/ecapture/lib/libpcap//libpcap.a when searching for -lpcap
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: cannot find -lpcap: No such file or directory
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: skipping incompatible /root/ecapture/lib/libpcap//libpcap.a when searching for -lpcap
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: skipping incompatible /root/ecapture/lib/libpcap//libpcap.a when searching for -lpcap
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: cannot find -lpcap: No such file or directory
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: skipping incompatible /root/ecapture/lib/libpcap//libpcap.a when searching for -lpcap
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: skipping incompatible /root/ecapture/lib/libpcap//libpcap.a when searching for -lpcap
/usr/lib/gcc-cross/aarch64-linux-gnu/11/../../../../aarch64-linux-gnu/bin/ld: cannot find -lpcap: No such file or directory
collect2: error: ld returned 1 exit status

[dosubot]

The "skipping incompatible libpcap.a" error means the linker is finding a libpcap.a built for the wrong architecture (likely amd64 instead of arm64). To cross-compile ecapture for arm64 with debug mode on an amd64 machine, follow these steps:

1. Make sure you have the aarch64-linux-gnu toolchain installed (sudo apt-get install gcc-aarch64-linux-gnu) and that it's in your PATH.
2. Ensure the libpcap submodule is initialized and up to date:
   git submodule update --init --recursive
3. Clean all previous build artifacts to remove any stale or incompatible libpcap.a:
   make clean
4. Build with the correct environment variables:
   DEBUG=1 ANDROID=1 CROSS_ARCH=arm64 make nocore
   This will trigger the Makefile to use the arm64 cross-compiler for both libpcap and the Go binary, and set all necessary flags for debug and Android mode [COMPILATION.md].

To verify that libpcap.a is built for arm64, run:
file lib/libpcap/libpcap.a
It should mention "current ar archive" and "aarch64" or "ARM aarch64".

If you still get the error, double-check:

• The cross-compiler is being used (which aarch64-linux-gnu-gcc)
• The environment variables are set as expected (make env)
• The submodule is not stale or missing (ls lib/libpcap)

Common pitfalls: not cleaning after switching architectures, missing toolchain, or not initializing/updating submodules. If you follow the above steps, the build system will rebuild libpcap.a for arm64 and the linker should no longer skip it [Makefile] [variables.mk].

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[KardRi]

Hi @zenyanle ,

tracing_pipe show some logs, but pcap doesn't capture anything

if I use text mode, it show something right away

[cfc4n]

Chrome likely uses the nspr/nss library, not the mainstream libssl. You can try the ecapture nss command.

[cfc4n]

Long time no response, closed