Add a reminder for failure when hooking libnss3.so. (#677)

Change NSS-related naming to NSPR. Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
gojue · Dec 1, 2024 · 3d578c8 · 3d578c8
1 parent 76c5a1a
commit 3d578c8
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 7 deletions.
diff --git a/cli/cmd/nss.go → cli/cmd/nspr.go b/cli/cmd/nss.go → cli/cmd/nspr.go
@@ -27,14 +27,14 @@ var nc = config.NewNsprConfig()
 
 // gnutlsCmd represents the openssl command
 var nssCmd = &cobra.Command{
-	Use:     "nss",
-	Aliases: []string{"nspr"},
+	Use:     "nspr",
+	Aliases: []string{"nss"},
 	Short:   "capture nss/nspr encrypted text content without CA cert for nss/nspr libraries.",
 	Long: `use eBPF uprobe/TC to capture process event data.
-ecapture nss
-ecapture nss --hex --pid=3423
-ecapture nss -l save.log --pid=3423
-ecapture nss --nspr=/lib/x86_64-linux-gnu/libnspr44.so
+ecapture nspr
+ecapture nspr --hex --pid=3423
+ecapture nspr -l save.log --pid=3423
+ecapture nspr --nspr=/lib/x86_64-linux-gnu/libnspr44.so
 `,
 	Run: nssCommandFunc,
 }

diff --git a/cli/cmd/root.go b/cli/cmd/root.go
@@ -247,7 +247,7 @@ func runModule(modName string, modConfig config.IConfig) {
 
 		err = mod.Run()
 		if err != nil {
-			logger.Fatal().Err(err).Bool("isReload", isReload).Msg("module run failed, skip it.")
+			logger.Fatal().Err(err).Bool("isReload", isReload).Msg("module run failed.")
 		}
 		logger.Info().Str("moduleName", modName).Bool("isReload", isReload).Msg("module started successfully.")
 

diff --git a/user/module/probe_nspr.go b/user/module/probe_nspr.go
@@ -30,6 +30,7 @@ import (
 	"math"
 	"os"
 	"path"
+	"strings"
 )
 
 type MNsprProbe struct {
@@ -147,6 +148,10 @@ func (n *MNsprProbe) setupManagers() error {
 	}
 
 	n.logger.Info().Str("binrayPath", binaryPath).Uint8("ElfType", n.conf.(*config.NsprConfig).ElfType).Msg("HOOK type:nspr elf")
+	if strings.Contains(binaryPath, "libnss3.so") || strings.Contains(binaryPath, "libnss.so") {
+		n.logger.Warn().Msg("In normal circumstances, the PR_Write/PR_Read functions should be in libnspr4.so. If it fails to run, please try specifying the --nspr=/xxx/libnspr4.so path. ")
+		n.logger.Warn().Msg("For more information, please refer to https://github.com/gojue/ecapture/issues/662 .")
+	}
 	n.bpfManager = &manager.Manager{
 		Probes: []*manager.Probe{
 			{