From 3d578c88bdab11a11749df546b9a4cbfa340da13 Mon Sep 17 00:00:00 2001
From: CFC4N <cfc4n.cs@gmail.com>
Date: Sun, 1 Dec 2024 20:37:19 +0800
Subject: [PATCH] Add a reminder for failure when hooking libnss3.so. (#677)

Change NSS-related naming to NSPR.

Signed-off-by: CFC4N <cfc4n.cs@gmail.com>
---
 cli/cmd/{nss.go => nspr.go} | 12 ++++++------
 cli/cmd/root.go             |  2 +-
 user/module/probe_nspr.go   |  5 +++++
 3 files changed, 12 insertions(+), 7 deletions(-)
 rename cli/cmd/{nss.go => nspr.go} (88%)

diff --git a/cli/cmd/nss.go b/cli/cmd/nspr.go
similarity index 88%
rename from cli/cmd/nss.go
rename to cli/cmd/nspr.go
index 104d1e569..421fd8184 100644
--- a/cli/cmd/nss.go
+++ b/cli/cmd/nspr.go
@@ -27,14 +27,14 @@ var nc = config.NewNsprConfig()
 
 // gnutlsCmd represents the openssl command
 var nssCmd = &cobra.Command{
-	Use:     "nss",
-	Aliases: []string{"nspr"},
+	Use:     "nspr",
+	Aliases: []string{"nss"},
 	Short:   "capture nss/nspr encrypted text content without CA cert for nss/nspr libraries.",
 	Long: `use eBPF uprobe/TC to capture process event data.
-ecapture nss
-ecapture nss --hex --pid=3423
-ecapture nss -l save.log --pid=3423
-ecapture nss --nspr=/lib/x86_64-linux-gnu/libnspr44.so
+ecapture nspr
+ecapture nspr --hex --pid=3423
+ecapture nspr -l save.log --pid=3423
+ecapture nspr --nspr=/lib/x86_64-linux-gnu/libnspr44.so
 `,
 	Run: nssCommandFunc,
 }
diff --git a/cli/cmd/root.go b/cli/cmd/root.go
index 3f861a08d..f0ddf5a16 100644
--- a/cli/cmd/root.go
+++ b/cli/cmd/root.go
@@ -247,7 +247,7 @@ func runModule(modName string, modConfig config.IConfig) {
 
 		err = mod.Run()
 		if err != nil {
-			logger.Fatal().Err(err).Bool("isReload", isReload).Msg("module run failed, skip it.")
+			logger.Fatal().Err(err).Bool("isReload", isReload).Msg("module run failed.")
 		}
 		logger.Info().Str("moduleName", modName).Bool("isReload", isReload).Msg("module started successfully.")
 
diff --git a/user/module/probe_nspr.go b/user/module/probe_nspr.go
index 4ac87af25..c4655a78d 100644
--- a/user/module/probe_nspr.go
+++ b/user/module/probe_nspr.go
@@ -30,6 +30,7 @@ import (
 	"math"
 	"os"
 	"path"
+	"strings"
 )
 
 type MNsprProbe struct {
@@ -147,6 +148,10 @@ func (n *MNsprProbe) setupManagers() error {
 	}
 
 	n.logger.Info().Str("binrayPath", binaryPath).Uint8("ElfType", n.conf.(*config.NsprConfig).ElfType).Msg("HOOK type:nspr elf")
+	if strings.Contains(binaryPath, "libnss3.so") || strings.Contains(binaryPath, "libnss.so") {
+		n.logger.Warn().Msg("In normal circumstances, the PR_Write/PR_Read functions should be in libnspr4.so. If it fails to run, please try specifying the --nspr=/xxx/libnspr4.so path. ")
+		n.logger.Warn().Msg("For more information, please refer to https://github.com/gojue/ecapture/issues/662 .")
+	}
 	n.bpfManager = &manager.Manager{
 		Probes: []*manager.Probe{
 			{