Getting Started ​

Purpose and Scope ​

eCapture (旁观者) is an eBPF-based tool designed to capture SSL/TLS plaintext communication, perform command-line auditing, and monitor database queries without requiring a Man-in-the-Middle (MITM) proxy or custom CA certificate installation README.md:5-8, README.md:59-67. This entry point guides users through system prerequisites, selecting the appropriate TLS capture module (tls, gotls, or gnutls), and executing your first plaintext, keylog, or pcapng capture workflow.

Sources: README.md:5-8, README.md:59-67

Title: Core TLS Command Routing to Probe Factory ​

Sources: cli/cmd/tls.go:29-48, cli/cmd/gotls.go:28-43, cli/cmd/gnutls.go:33-49

1.1 Requirements and Installation ​

eCapture supports Linux on x86_64 (kernel 4.18+), aarch64 (kernel 5.5+), and LoongArch64 (kernel 6.6+), as well as Android on x86_64 and aarch64 README.md:34-38. Execution requires root privileges or specific Linux capabilities to load eBPF programs and attach uprobes/TC classifiers README.md:34-38. For complete details on kernel BTF requirements, capability configuration, and environment setup, see Requirements and Installation.

Sources: README.md:34-38, README.md:70-98

1.2 Choosing a TLS Probe ​

Depending on your target application stack, eCapture provides three core TLS capture modules:

• tls: Targets OpenSSL, LibreSSL, and BoringSSL shared libraries or statically linked binaries README.md:131, cli/cmd/tls.go:29-32.
• gotls: Targets Go binaries built with Go's native crypto/tls package README.md:127, cli/cmd/gotls.go:28-32.
• gnutls: Targets applications linked against the GnuTLS cryptographic library README.md:126, cli/cmd/gnutls.go:33-36.

For a comprehensive decision matrix comparing targets, library paths, and output capabilities, see Choosing a TLS Probe.

Sources: README.md:126-131, cli/cmd/tls.go:29-32, cli/cmd/gotls.go:28-32, cli/cmd/gnutls.go:33-36

Title: Output Pipeline Mode Selection ​

Sources: cli/cmd/tls.go:53-55, cli/cmd/gotls.go:49-51, cli/cmd/gnutls.go:53-55

1.3 First OpenSSL and BoringSSL Capture ​

The tls command automatically discovers system OpenSSL libraries or accepts explicit paths via --libssl README.md:136-139, cli/cmd/tls.go:51. Running in text mode prints decrypted HTTPS requests and responses directly to the console README.md:106-116. For verified end-to-end command examples, traffic generators, and transitions to keylog and pcapng workflows, see First OpenSSL and BoringSSL Capture.

Sources: README.md:100-116, cli/cmd/tls.go:29-51

1.4 First GoTLS Capture ​

The gotls command targets Go binaries by specifying the compiled binary path via --elfpath cli/cmd/gotls.go:46. It hooks Go's internal TLS connection functions to extract plaintext traffic README.md:127. For verified text-mode commands, required flags, expected events, and advanced output bindings, see First GoTLS Capture.

Sources: README.md:127, cli/cmd/gotls.go:28-46

1.5 First GnuTLS Capture ​

The gnutls command captures plaintext from applications linked with GnuTLS README.md:126, cli/cmd/gnutls.go:33-36. It supports explicit library paths (--gnutls) and version specifiers (--ssl_version) across Linux and Termux/Android environments cli/cmd/gnutls.go:52-57. For complete instructions, version checks, and output examples, see First GnuTLS Capture.

Sources: README.md:126, cli/cmd/gnutls.go:33-57