README
¶
asslcapture
Capture system-wide Conscrypt/BoringSSL TLS traffic on Android using eBPF.
Like ecapture or peetch, but more simple, stable, and focused on Android.
This is a non-intrusive alternative to injecting root certs and generally works more reliably, but requires root and a modern kernel.
See here for a comparison to ecapture.
Features
- Readable, non-vibecoded, and simple code.
- Focus on ARM64. ARMv7 support might be added later.
- Explicit focus on Android with boringssl and a non-ancient kernel version.
- Partial support for older kernels using ptrace or a more limited version of the probe.
- Wide boringssl version compatibility with automated offset analysis.
- Other native TLS libraries which apps may embed are out-of-scope (for now at least) (this is pretty rare, though).
- Only basic output formats, no application protocol parsing for simplicity (use Wireshark or something like pcapng_to_har if you want to look at HTTP traffic):
- SSLKEYLOGFILE.
- PCAPNG with dsb.
- Support for multiple copies of BoringSSL, including ones statically linked into apps.
- Carefully designed buffering to avoid dropped packets/secrets.
Documentation
Documentation
¶
Overview ¶
Command asslcapture captures system-wide Conscrypt/BoringSSL TLS traffic on Android using eBPF.
This is a non-intrusive alternative to injecting root certs and generally works more reliably, but requires root and a modern kernel.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
analyze
Package analyze statically analyzes the ARM64 BoringSSL libssl.so (or binaries linking it statically) to find offsets for logging TLS secrets.
|
Package analyze statically analyzes the ARM64 BoringSSL libssl.so (or binaries linking it statically) to find offsets for logging TLS secrets. |
|
kvlines
Package kvlines implements a simple line-based key-value format.
|
Package kvlines implements a simple line-based key-value format. |
|
pflagx
Package pflagx extends github.com/spf13/pflag with extra functionality.
|
Package pflagx extends github.com/spf13/pflag with extra functionality. |
|
probe/bpfprobe
Package bpfprobe manages the uprobe for reading boringssl secrets.
|
Package bpfprobe manages the uprobe for reading boringssl secrets. |
|
probe/bpfprobe/internal
Package uprobe wraps uprobe functionality via the perf subsystem for non-BTF eBPF programs.
|
Package uprobe wraps uprobe functionality via the perf subsystem for non-BTF eBPF programs. |
|
probe/pprobe
Package pprobe implements an alternative probe mechanism using ptrace which supports per-process tracing on kernels which do not support eBPF.
|
Package pprobe implements an alternative probe mechanism using ptrace which supports per-process tracing on kernels which do not support eBPF. |
|
probe/pprobe/internal
Package phook implements a ptrace-based hooking mechanism.
|
Package phook implements a ptrace-based hooking mechanism. |
Click to show internal directories.
Click to hide internal directories.