CaptureSSL/TLS plaintextwithout a CA certificate

Observe plaintext at TLS library boundaries without changing applications or installing a CA certificate.
Linux x86_64Linux ARM64Linux LoongArch64Android x86_64 / ARM64LoongArch64 requires Linux kernel 6.6+; Android/loong64 is not supported.

User Manual Get Started Download

⚡No custom CA

🛡️Kernel-Level

🔍Real-Time

UPSTREAM v2.8 · OCTOBER 2026

LoongArch64 joins the Linux builds

The v2.8 codebase also adds text, keylog and pcapng modes for GnuTLS and separates captured events from operational logs.

Read the upstream changelog

CAPABILITIES

Three probes for TLS plaintext

TLS

Capture plaintext from OpenSSL, LibreSSL and BoringSSL at library boundaries. Point the probe at a shared library or a statically linked binary.

OpenSSL · LibreSSL · BoringSSL

GoTLS

Inspect TLS traffic from Go programs. Use --elfpath to select the target executable so eCapture can resolve its Go TLS symbols.

Go TLS · executable path

GnuTLS

Capture GnuTLS plaintext and session keys with version-aware probes. The current module supports text, keylog and pcapng capture modes.

GnuTLS · text · keylog · pcapng

All three modules support text, keylog and pcapng modes. --eventaddr routes captured events to stdout, files, TCP or WebSocket; operational logs use --logaddr.

GET STARTED

Start with a TLS capture

Use a published build for your system, or build from source. Run eCapture with root privileges or the required Linux capabilities, then make a TLS request in another terminal.

Download releases →Read the getting started guide →

terminal

$ sudo ecapture tls

# In another terminal
$ curl https://example.com

The default text mode writes captured events to stdout. Operational logs use stderr; --logaddr configures their separate destination.

PLATFORMS

Choose the right build and kernel

System	Architecture	Minimum kernel
Linux	x86_64 / amd64	4.18+
Linux	AArch64 / arm64	5.5+
Linux	LoongArch64 / loong64	6.6+
Android	x86_64 / amd64	4.18+
Android	AArch64 / arm64	5.5+

Android/loong64, Windows and macOS are not supported. Check published assets for a LoongArch64 package; its build path has cross-build and user-mode smoke checks, so verify eBPF capture on target hardware.

Minimum privileges ↗ LoongArch64 build guide ↗

Feature Showcase

Examples of TLS plaintext, keylog and pcapng capture across supported libraries and protocols.