Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ubuntu 18.04 运行报错 #274

Closed
idlefire opened this issue Nov 24, 2022 · 1 comment · Fixed by #275
Closed

ubuntu 18.04 运行报错 #274

idlefire opened this issue Nov 24, 2022 · 1 comment · Fixed by #275
Labels
documentation Improvements or additions to documentation invalid This doesn't seem right

Comments

@idlefire
Copy link

Describe the bug
A clear and concise description of what the bug is.

tls_2022/11/24 18:23:30 ECAPTURE :: ecapture Version : linux_x86_64:--:4.15.0-176-generic
tls_2022/11/24 18:23:30 ECAPTURE :: Pid Info : 32514
tls_2022/11/24 18:23:30 ECAPTURE :: Kernel Info : 4.15.18
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        module initialization
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        master key keylogger: ecapture_masterkey.log
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        Module.Run()
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        UPROBE MODEL
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        origin version:OpenSSL 1.1.1, as key:openssl 1.1.1
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        OpenSSL/BoringSSL version not found from shared library file, used default version:linux_default_1_1_1
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        HOOK type:2, binrayPath:/usr/lib/x86_64-linux-gnu/libssl.so.1.1
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        libPthread so Path:/lib/x86_64-linux-gnu/libpthread.so.0
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        BPF bytecode filename:user/bytecode/openssl_1_1_1j_kern_less52.o
tls_2022/11/24 18:23:30 EBPFProbeOPENSSL        module run failed, [skip it]. error:couldn't init manager error:program probe_ssl_master_key: load program without BTF: permission denied: 0: (bf) r6 = r1
1: (85) call bpf_get_current_pid_tgid#14
2: (85) call bpf_get_current_uid_gid#15
3: (b7) r1 = 0
4: (63) *(u32 *)(r10 -16) = r1
5: (bf) r2 = r10
6: (07) r2 += -16
7: (18) r1 = 0xffff910bd1c13800
9: (85) call bpf_map_lookup_elem#1
10: (bf) r7 = r0
11: (15) if r7 == 0x0 goto pc+157
 R0=map_value(id=0,off=0,ks=4,vs=408,imm=0) R6=ctx(id=0,off=0,imm=0) R7=map_value(id=0,off=0,ks=4,vs=408,imm=0) R10=fp0
12: (85) call bpf_get_current_pid_tgid#14
13: (7b) *(u64 *)(r10 -232) = r0
14: (bf) r8 = r10
15: (07) r8 += -232
16: (18) r1 = 0xffff910dee784800
18: (bf) r2 = r8
19: (bf) r3 = r7
20: (b7) r4 = 0
21: (85) call bpf_map_update_elem#2
R3 type=map_value expected=fp , couldn't load eBPF programs, cs:&{map[active_ssl_read_args_map:Hash(keySize=8, valueSize=16, maxEntries=1024, flags=0) active_ssl_write_args_map:Hash(keySize=8, valueSize=16, maxEntries=1024, flags=0) bpf_context:LRUHash(keySize=8, valueSize=408, maxEntries=2048, flags=0) bpf_context_gen:Array(keySize=4, valueSize=408, maxEntries=1, flags=0) connect_events:PerfEventArray(keySize=0, valueSize=0, maxEntries=0, flags=0) data_buffer_heap:PerCPUArray(keySize=4, valueSize=4152, maxEntries=1, flags=0) mastersecret_events:PerfEventArray(keySize=0, valueSize=0, maxEntries=0, flags=0) skb_data_buffer_heap:PerCPUArray(keySize=4, valueSize=40, maxEntries=1, flags=0) skb_events:PerfEventArray(keySize=0, valueSize=0, maxEntries=4, flags=0) tls_events:PerfEventArray(keySize=0, valueSize=0, maxEntries=0, flags=0)] map[egress_cls_func:0xc0005221e0 ingress_cls_func:0xc000522460 probe_connect:0xc0005225a0 probe_entry_SSL_read:0xc000522320 probe_entry_SSL_write:0xc000522280 probe_ret_SSL_read:0xc0005223c0 probe_ret_SSL_write:0xc000522500 probe_ssl_master_key:0xc0005220a0] 0xc0003fad80 LittleEndian}
tls_2022/11/24 18:23:30 EBPFProbeGNUTLS module initialization failed. [skip it]. error:stat /lib/x86_64-linux-gnu/libgnutls.so.30: no such file or directory
tls_2022/11/24 18:23:30 EBPFProbeNSPR   module initialization failed. [skip it]. error:stat /lib/x86_64-linux-gnu/libnspr4.so: no such file or directory
tls_2022/11/24 18:23:30 EBPFProbeGoSSL  module [disabled].
tls_2022/11/24 18:23:30 ECAPTURE ::     No runnable modules, Exit(1)

To Reproduce
Steps to reproduce the behavior:
./ecapture tls

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
If applicable, add screenshots to help explain your problem.
image

Linux Server/Android (please complete the following information):

  • Env: [run make env to get the environment variables]
  • OS: Ubuntu 18.04
  • Arch: amd64
  • Kernel Version: 4.15.0-176
root@k8s-node1:/home/k8s-node/ecapture-master# make env
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
fatal: not a git repository (or any of the parent directories): .git
---------------------------------------
eCapture Makefile Environment:
---------------------------------------
PARALLEL                 4
---------------------------------------
CLANG_VERSION            9
GO_VERSION               1.19
---------------------------------------
CMD_CLANG                clang
CMD_GIT                  git
CMD_GO                   go
CMD_INSTALL              install
CMD_LLC                  llc
CMD_MD5                  md5sum
CMD_PKGCONFIG            pkg-config
CMD_STRIP                llvm-strip
VERSION                  --
LAST_GIT_TAG             --
BPF_NOCORE_TAG           4_15_0-176-generic.--
---------------------------------------
UNAME_M                  x86_64
UNAME_R                  4.15.0-176-generic
ARCH                     x86_64
LINUX_ARCH               x86
---------------------------------------
KERN_RELEASE             4.15.0-176-generic
KERN_BUILD_PATH          /lib/modules/4.15.0-176-generic/build
KERN_SRC_PATH            /lib/modules/4.15.0-176-generic/build
---------------------------------------
GO_ARCH                  amd64
ANDROID
AUTOGENCMD               bpftool btf dump file /sys/kernel/btf/vmlinux format c > kern/bpf/x86/vmlinux.h

Additional context
Add any other context about the problem here.

@cfc4n
Copy link
Member

cfc4n commented Nov 24, 2022

不支持4.15内核,最小支持内核是4.18 。之前文档描述有误,抱歉,已更新文档。

@cfc4n cfc4n added documentation Improvements or additions to documentation invalid This doesn't seem right labels Nov 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
documentation Improvements or additions to documentation invalid This doesn't seem right
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants