0.6.5 libc.so: no such file or directory

[heidan123]

`./ecapture tls --libssl=/system/lib64/libssl.so
tls_2023/11/17 22:23:08 ECAPTURE :: ecapture Version : androidgki_x86_64:0.6.5-20231111-256a2b5:5.15.0-1050-azure
tls_2023/11/17 22:23:08 ECAPTURE :: Pid Info : 10711
tls_2023/11/17 22:23:08 ECAPTURE :: Kernel Info : 4.19.110
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL module initialization
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL master key keylogger: ecapture_masterkey.log
tls_2023/11/17 22:23:08 ECAPTURE :: Module.Run()
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL UPROBE MODEL
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL OpenSSL/BoringSSL version not found, used default version :android_default
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL HOOK type:2, binrayPath:/system/lib64/libssl.so
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL libPthread:/apex/com.android.runtime/lib64/bionic/libc.so
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL Hook masterKey function:SSL_in_init
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL Your kernel version is less than 5.2, the following parameters will be ignored:[target_pid, target_uid, target_port]
tls_2023/11/17 22:23:08 EBPFProbeOPENSSL BPF bytecode filename:user/bytecode/boringssl_a_13_kern_less52.o
tls_2023/11/17 22:23:09 EBPFProbeOPENSSL module run failed, [skip it]. error:couldn't start bootstrap manager error:1 error occurred:
* error:error:parse ELF file: open /apex/com.android.runtime/lib64/bionic/libc.so: no such file or directory , couldn't enable uprobe probe_connect, {UID:, EbpfFuncName:probe_connect}

, probes activation validation failed .
tls_2023/11/17 22:23:09 ECAPTURE :: No runnable modules, Exit(1)`

使用0.6 版本之后的错误，使用0.5版本可以正常使用，但是没有办法保存

`./ecapture tls --libssl=/system/lib64/libssl.so -w asd.log
tls_2023/11/17 22:27:05 ECAPTURE :: ecapture Version : androidgki_x86_64:0.5.3-20230521-fba6930:5.15.0-1037-azure
tls_2023/11/17 22:27:05 ECAPTURE :: Pid Info : 10971
tls_2023/11/17 22:27:05 ECAPTURE :: Kernel Info : 4.19.110
tls_2023/11/17 22:27:05 EBPFProbeOPENSSL module initialization
tls_2023/11/17 22:27:05 ECAPTURE :: Module.Run()
tls_2023/11/17 22:27:05 EBPFProbeOPENSSL TC MODEL
tls_2023/11/17 22:27:05 EBPFProbeOPENSSL OpenSSL/BoringSSL version not found, used default version :android_default
tls_2023/11/17 22:27:05 EBPFProbeOPENSSL HOOK type:2, binrayPath:/system/lib64/libssl.so
tls_2023/11/17 22:27:05 EBPFProbeOPENSSL Ifname:wlan0, Ifindex:4, Port:443, Pcapng filepath:/data/asd.log
tls_2023/11/17 22:27:05 EBPFProbeOPENSSL Hook masterKey function:SSL_in_init
tls_2023/11/17 22:27:05 EBPFProbeOPENSSL BPF bytecode filename:user/bytecode/boringssl_1_1_1_kern_less52.o
tls_2023/11/17 22:27:05 EBPFProbeOPENSSL module run failed, [skip it]. error:couldn't start bootstrap manager error:2 errors occurred:
* error:error:netlink receive: no such file or directory , couldn't add a ", err clsact" qdisc to interface 4, {UID:, EbpfFuncName:egress_cls_func}
* error:error:netlink receive: no such file or directory , couldn't add a ", err clsact" qdisc to interface 4, {UID:, EbpfFuncName:ingress_cls_func}

, probes activation validation failed .
tls_2023/11/17 22:27:05 ECAPTURE :: No runnable modules, Exit(1)`

使用环境是夜神安卓模拟器 安卓9 x64 版本
uname -a
Linux localhost 4.19.110 #106 SMP PREEMPT Tue Sep 26 02:29:27 CST 2023 x86_64

[heidan123]

0.5 版本
./ecapture tls --libssl=/system/lib64/libssl.so 正常，可以获取到数据

./ecapture tls --libssl=/system/lib64/libssl.so -w asd.log 就报错了

[cfc4n]

你是windows上的模拟器吧？ 暂时不支持win上的模拟android环境。

[cfc4n]

• error:error:parse ELF file: open /apex/com.android.runtime/lib64/bionic/libc.so: no such file or directory , couldn't enable uprobe probe_connect, {UID:, EbpfFuncName:probe_connect}

不过，这里确实有问题，libc.so 不存在，不应该直接退出。

[heidan123]

好的，感谢