Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: couldn't find bpf bytecode file error #650

Merged
merged 1 commit into from
Oct 24, 2024

Conversation

yuweizzz
Copy link
Contributor

Issue:

openssl 3.3.x bpf bytecode file not found.

bin/ecapture tls --ssl_version="openssl 3.3.0"
2024-10-14T11:33:53+08:00 INF AppName="eCapture(旁观者)"
2024-10-14T11:33:53+08:00 INF HomePage=https://ecapture.cc
2024-10-14T11:33:53+08:00 INF Repository=https://github.com/gojue/ecapture
2024-10-14T11:33:53+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-10-14T11:33:53+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-10-14T11:33:53+08:00 INF Version=linux_amd64:-20241013-93cfff4:6.1.0-22-amd64
2024-10-14T11:33:53+08:00 INF Listen=localhost:28256
2024-10-14T11:33:53+08:00 INF eCapture running logs logger=
2024-10-14T11:33:53+08:00 INF the file handler that receives the captured event eventCollector=
2024-10-14T11:33:53+08:00 INF listen=localhost:28256
2024-10-14T11:33:53+08:00 INF https server starting...You can update the configuration file via the HTTP interface.
2024-10-14T11:33:53+08:00 WRN ========== module starting. ==========
2024-10-14T11:33:53+08:00 INF Kernel Info=6.1.0 Pid=21260
2024-10-14T11:33:53+08:00 INF BTF bytecode mode: CORE. btfMode=0
2024-10-14T11:33:53+08:00 INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2024-10-14T11:33:53+08:00 INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2024-10-14T11:33:53+08:00 INF Module.Run()
2024-10-14T11:33:53+08:00 INF OpenSSL/BoringSSL version found sslVersion="openssl 3.3.0"
2024-10-14T11:33:53+08:00 INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/usr/lib/x86_64-linux-gnu/libssl.so.3
2024-10-14T11:33:53+08:00 INF target all process.
2024-10-14T11:33:53+08:00 INF target all users.
2024-10-14T11:33:53+08:00 INF setupManagers eBPFProgramType=Text
2024-10-14T11:33:53+08:00 INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_3_3_0_kern_core.o
2024-10-14T11:33:53+08:00 ERR couldn't find bpf bytecode file error="open user/bytecode/openssl_3_3_0_kern_core.o: file does not exist" bytecode files=["user/bytecode/boringssl_a_13_kern_core.o","user/bytecode/openssl_3_2_0_kern_noncore.o","user/bytecode/openssl_3_2_0_kern_core.o","user/bytecode/bash_kern_core_less52.o","user/bytecode/bash_kern_noncore_less52.o","user/bytecode/mysqld_kern_noncore.o","user/bytecode/openssl_1_1_1a_kern_core_less52.o","user/bytecode/openssl_1_1_1d_kern_core_less52.o","user/bytecode/openssl_1_1_1a_kern_core.o","user/bytecode/openssl_1_1_1b_kern_core_less52.o","user/bytecode/openssl_1_1_1d_kern_noncore.o","user/bytecode/bash_kern_core.o","user/bytecode/boringssl_a_13_kern_noncore.o","user/bytecode/mysqld_kern_noncore_less52.o","user/bytecode/openssl_1_0_2a_kern_core.o","user/bytecode/openssl_1_0_2a_kern_noncore.o","user/bytecode/openssl_1_1_1d_kern_noncore_less52.o","user/bytecode/openssl_1_1_1j_kern_core_less52.o","user/bytecode/openssl_3_0_0_kern_noncore.o","user/bytecode/boringssl_a_14_kern_noncore_less52.o","user/bytecode/boringssl_na_kern_noncore_less52.o","user/bytecode/gotls_kern_core.o","user/bytecode/openssl_1_0_2a_kern_core_less52.o","user/bytecode/openssl_1_1_0a_kern_core.o","user/bytecode/openssl_1_1_0a_kern_noncore.o","user/bytecode/openssl_1_1_0a_kern_noncore_less52.o","user/bytecode/openssl_1_1_1b_kern_core.o","user/bytecode/openssl_1_1_1b_kern_noncore.o","user/bytecode/boringssl_a_13_kern_core_less52.o","user/bytecode/boringssl_na_kern_noncore.o","user/bytecode/nspr_kern_noncore_less52.o","user/bytecode/gotls_kern_noncore_less52.o","user/bytecode/nspr_kern_core.o","user/bytecode/openssl_1_1_1j_kern_noncore_less52.o","user/bytecode/openssl_3_2_0_kern_noncore_less52.o","user/bytecode/postgres_kern_noncore_less52.o","user/bytecode/boringssl_a_14_kern_core_less52.o","user/bytecode/boringssl_a_14_kern_noncore.o","user/bytecode/gnutls_kern_noncore_less52.o","user/bytecode/nspr_kern_core_less52.o","user/bytecode/openssl_1_1_1j_kern_noncore.o","user/bytecode/nspr_kern_noncore.o","user/bytecode/openssl_3_2_0_kern_core_less52.o","user/bytecode/postgres_kern_noncore.o","user/bytecode/gnutls_kern_core.o","user/bytecode/mysqld_kern_core_less52.o","user/bytecode/openssl_1_1_1a_kern_noncore.o","user/bytecode/openssl_1_1_1b_kern_noncore_less52.o","user/bytecode/openssl_3_0_0_kern_core_less52.o","user/bytecode/gotls_kern_core_less52.o","user/bytecode/boringssl_a_13_kern_noncore_less52.o","user/bytecode/boringssl_na_kern_core.o","user/bytecode/openssl_1_1_0a_kern_core_less52.o","user/bytecode/openssl_1_1_1d_kern_core.o","user/bytecode/openssl_3_0_0_kern_core.o","user/bytecode/gnutls_kern_noncore.o","user/bytecode/openssl_1_0_2a_kern_noncore_less52.o","user/bytecode/openssl_3_0_0_kern_noncore_less52.o","user/bytecode/postgres_kern_core_less52.o","user/bytecode/boringssl_na_kern_core_less52.o","user/bytecode/gotls_kern_noncore.o","user/bytecode/bash_kern_noncore.o","user/bytecode/boringssl_a_14_kern_core.o","user/bytecode/gnutls_kern_core_less52.o","user/bytecode/openssl_1_1_1a_kern_noncore_less52.o","user/bytecode/postgres_kern_core.o","user/bytecode/mysqld_kern_core.o","user/bytecode/openssl_1_1_1j_kern_core.o"]
2024-10-14T11:33:53+08:00 FTL module run failed, skip it. error="EBPFProbeOPENSSL\tcouldn't find asset open user/bytecode/openssl_3_3_0_kern_core.o: file does not exist ." isReload=false

@cfc4n cfc4n added the fix bug fix PR label Oct 22, 2024
Copy link
Member

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM,thanks.

@cfc4n cfc4n merged commit 03a9409 into gojue:master Oct 24, 2024
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
fix bug fix PR
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants