Not capturing android python traffic

[x1mus]

Hello,
I'm playing a bit with android apps and decided to write one in Python. When packaging the app, the SSL library is packaged with the application and therfore the path to the lib is: /data/app/<package>/lib/<arch>/libssl1.1.so.

I've setup a small server and a small app that communicates through https and they're just exchange json message right now. However, when I launch ecapture, I have output related to the message being sent but not the content of the output.

(By the way, I made the modification to the script as mentioned in: #336 and rebuilt the binary)

Here's an example output of ecapture where there is supposedly one request and one answer:
./ecapture tls --libssl="/data/app/<package>/lib/<arch>/libssl1.1.so" -b 2

2024-07-18T07:44:45Z INF AppName="eCapture(旁观者)"
2024-07-18T07:44:45Z INF HomePage=https://ecapture.cc
2024-07-18T07:44:45Z INF Repository=https://github.com/gojue/ecapture
2024-07-18T07:44:45Z INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-07-18T07:44:45Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-07-18T07:44:45Z INF Version=linux_amd64:0.8.4-20240709-7e1ad52:5.15.0-113-generic
2024-07-18T07:44:45Z WRN ========== module starting. ==========
2024-07-18T07:44:45Z INF Kernel Info=5.15.94 Pid=3126
2024-07-18T07:44:45Z INF BTF bytecode mode: non-CORE. btfMode=2
2024-07-18T07:44:45Z INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2024-07-18T07:44:45Z INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2024-07-18T07:44:45Z INF Module.Run()
2024-07-18T07:44:45Z INF listen=localhost:28256
2024-07-18T07:44:45Z INF https server starting...You can update the configuration file via the HTTP interface.
2024-07-18T07:44:45Z INF OpenSSL/BoringSSL version found origin versionKey="OpenSSL 1.1.1w" versionKeyLower="openssl 1.1.1w"
2024-07-18T07:44:45Z INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/data/app/<package>/lib/x86_64/libssl1.1.so
2024-07-18T07:44:45Z INF target all process.
2024-07-18T07:44:45Z INF target all users.
2024-07-18T07:44:45Z INF setupManagers eBPFProgramType=Text
2024-07-18T07:44:45Z INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_1_1_1j_kern_noncore.o
2024-07-18T07:44:45Z INF perfEventReader created mapSize(MB)=4
2024-07-18T07:44:45Z INF perfEventReader created mapSize(MB)=4
2024-07-18T07:44:45Z INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL
2024-07-18T07:44:51Z INF UUID:3082_3108_SDLThread_5_1_192.168.57.1:443, Name:DefaultParser, Type:0, Length:1
G

2024-07-18T07:44:51Z INF UUID:3082_3108_SDLThread_5_0_192.168.57.1:443, Name:DefaultParser, Type:0, Length:2
H{

^C2024-07-18T07:44:52Z INF Module closed,message recived from Context
2024-07-18T07:44:52Z INF module close.
2024-07-18T07:44:52Z INF iModule module close
2024-07-18T07:44:52Z INF bye bye.

As shown above, the only information that is being parsed is "G" and "H{" ?

[x1mus]

Redirecting the output to a pcap file solved the issue :)