Core TLS Modules
Relevant source files
The following files were used as context for generating this wiki page:
This page provides a high-level user-facing overview of the core TLS interception capabilities in eCapture: tls (OpenSSL/BoringSSL), gotls (Go native TLS), and gnutls (GnuTLS). These three core modules enable the extraction of TLS plaintext, cryptographic key logs, and pcapng packet captures without requiring a custom CA certificate or modifying target applications cli/cmd/tls.go:29-32, cli/cmd/gotls.go:29-32, cli/cmd/gnutls.go:33-36.
Shared Workflow and Architecture
Despite targeting different cryptographic libraries and runtime environments, all core TLS modules share a unified lifecycle managed by the eBPF probe framework. Configuration parsing, eBPF bytecode loading, map polling, event decoding, and output routing are coordinated through shared components such as base.BaseProbe and events.NewDispatcher internal/probe/base/base_probe.go:46-68, internal/probe/base/base_probe.go:128-161.
*Sources: cli/cmd/tls.go:29-48, cli/cmd/gotls.go:29-43, cli/cmd/gnutls.go:33-49, internal/probe/openssl/openssl_probe.go:44-69, internal/probe/gotls/gotls_probe.go:52-78, internal/probe/base/base_probe.go:46-68 *
Module Comparison
While the output modes (text, keylog, pcapng) remain consistent across modules, their targeting mechanisms and runtime prerequisites differ significantly:
| Module | Command | Target Discovery | Supported Runtimes / Libraries | Platform Support |
|---|---|---|---|---|
| tls | ecapture tls | --libssl or automatic search cli/cmd/tls.go:51 | OpenSSL 1.0.x / 1.1.x / 3.x, BoringSSL cli/cmd/tls.go:32 | Linux (amd64/arm64/loong64), Android (BoringSSL) cli/cmd/root.go:46 |
| gotls | ecapture gotls | --elfpath (ELF binary) cli/cmd/gotls.go:46 | Go standard library (crypto/tls) compiled binaries | Linux, Android |
| gnutls | ecapture gnutls | --gnutls or automatic search cli/cmd/gnutls.go:52 | GnuTLS library (libgnutls.so) cli/cmd/gnutls.go:52 | Linux, Android (Termux) cli/cmd/gnutls.go:32-46 |
Sources: cli/cmd/tls.go:32-51, cli/cmd/gotls.go:46, cli/cmd/gnutls.go:32-52, cli/cmd/root.go:46
2.1. TLS Capture (OpenSSL and BoringSSL)
The tls module attaches uprobes to OpenSSL and BoringSSL functions (such as SSL_read, SSL_write, and master key extraction functions) to capture encrypted payloads and session secrets. It supports automatic library path discovery or manual specification via --libssl cli/cmd/tls.go:33-51.
For detailed configuration flags, version mappings, Android BoringSSL setups, and verified text, keylog, and pcapng examples, see TLS Capture (OpenSSL and BoringSSL).
Sources: cli/cmd/tls.go:29-61, internal/probe/openssl/openssl_probe.go:44-69
2.2. GoTLS Capture
The gotls module targets Go binaries built with standard crypto/tls. Because Go compiles TLS routines statically into ELF binaries rather than relying on shared system libraries, the module requires the path to the target executable via --elfpath cli/cmd/gotls.go:46 and resolves function offsets or symbols (crypto/tls.(*Conn).Read, crypto/tls.(*Conn).writeRecordLocked) internal/probe/gotls/gotls_probe.go:47-49.
For detailed instruction on Go version compatibility, symbol considerations, Register ABI handling, and runnable workflows across all output modes, see GoTLS Capture.
Sources: cli/cmd/gotls.go:28-55, internal/probe/gotls/gotls_probe.go:46-78
2.3. GnuTLS Capture
The gnutls module instruments GnuTLS (libgnutls.so) function calls to intercept plaintext and handshake secrets cli/cmd/gnutls.go:33-52. It accommodates applications and package managers such as Termux on Android cli/cmd/gnutls.go:32-46.
For library path discovery, version-specific patch mappings, platform limitations, and verified command examples, see GnuTLS Capture.
Sources: cli/cmd/gnutls.go:31-60