ecapture

There's a similiar tool https://github.com/gojue/ecapture

Not today, maybe one day! Edit: Another user posted a link to https://github.com/gojue/ecapture which looks like it supports android and has some overlapping functionality.

here is one example: https://github.com/gojue/ecapture in short, you can hook calls within SSL libraries (like OpenSSL)

I believe that's how https://github.com/gojue/ecapture works. I don't know the details, but it seems to work!

It is quite simple to use eBPF with uprobes to hook library calls, for example: https://github.com/iovisor/bcc/blob/master/tools/sslsniff.py The downside is this doesn't work with anything not using OpenSSL, there are projects like https://github.com/gojue/ecapture which have interceptors for many common libraries, but the downside is that needs different code for each library. I think providing a TLS certificate is fine for the use cases of the tool; most tools won't be doing certificate pinning, but ecapture does support Android where this is more likely.

Latest release: 2024-07-09 changelog: https://github.com/gojue/ecapture/blob/master/CHANGELOG.md

https://github.com/gojue/ecapture/releases/expanded_assets/v... Anyone know why there is an aarch64 nocore but not an x86_64 nocore.

There are ways to bypass any of these restrictions imposed by the Android system, even if they were real. Android ships with eBPF, so you just need root. https://github.com/gojue/ecapture

One option is to use ebpf uprobes to dump the key material or plaintext (https://github.com/ehids/ecapture ). Should be easy for c-like TLS libraries probably less useful for JIT languages.