Skip to content

fix: couldn't find bpf bytecode file error#650

Merged
cfc4n merged 1 commit into
gojue:masterfrom
yuweizzz:openssl-version
Oct 24, 2024
Merged

fix: couldn't find bpf bytecode file error#650
cfc4n merged 1 commit into
gojue:masterfrom
yuweizzz:openssl-version

Conversation

@yuweizzz
Copy link
Copy Markdown
Contributor

Issue:

openssl 3.3.x bpf bytecode file not found.

bin/ecapture tls --ssl_version="openssl 3.3.0"
2024-10-14T11:33:53+08:00 INF AppName="eCapture(旁观者)"
2024-10-14T11:33:53+08:00 INF HomePage=https://ecapture.cc
2024-10-14T11:33:53+08:00 INF Repository=https://github.com/gojue/ecapture
2024-10-14T11:33:53+08:00 INF Author="CFC4N <cfc4ncs@gmail.com>"
2024-10-14T11:33:53+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2024-10-14T11:33:53+08:00 INF Version=linux_amd64:-20241013-93cfff4:6.1.0-22-amd64
2024-10-14T11:33:53+08:00 INF Listen=localhost:28256
2024-10-14T11:33:53+08:00 INF eCapture running logs logger=
2024-10-14T11:33:53+08:00 INF the file handler that receives the captured event eventCollector=
2024-10-14T11:33:53+08:00 INF listen=localhost:28256
2024-10-14T11:33:53+08:00 INF https server starting...You can update the configuration file via the HTTP interface.
2024-10-14T11:33:53+08:00 WRN ========== module starting. ==========
2024-10-14T11:33:53+08:00 INF Kernel Info=6.1.0 Pid=21260
2024-10-14T11:33:53+08:00 INF BTF bytecode mode: CORE. btfMode=0
2024-10-14T11:33:53+08:00 INF master key keylogger has been set. eBPFProgramType=Text keylogger=
2024-10-14T11:33:53+08:00 INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL
2024-10-14T11:33:53+08:00 INF Module.Run()
2024-10-14T11:33:53+08:00 INF OpenSSL/BoringSSL version found sslVersion="openssl 3.3.0"
2024-10-14T11:33:53+08:00 INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/usr/lib/x86_64-linux-gnu/libssl.so.3
2024-10-14T11:33:53+08:00 INF target all process.
2024-10-14T11:33:53+08:00 INF target all users.
2024-10-14T11:33:53+08:00 INF setupManagers eBPFProgramType=Text
2024-10-14T11:33:53+08:00 INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_3_3_0_kern_core.o
2024-10-14T11:33:53+08:00 ERR couldn't find bpf bytecode file error="open user/bytecode/openssl_3_3_0_kern_core.o: file does not exist" bytecode files=["user/bytecode/boringssl_a_13_kern_core.o","user/bytecode/openssl_3_2_0_kern_noncore.o","user/bytecode/openssl_3_2_0_kern_core.o","user/bytecode/bash_kern_core_less52.o","user/bytecode/bash_kern_noncore_less52.o","user/bytecode/mysqld_kern_noncore.o","user/bytecode/openssl_1_1_1a_kern_core_less52.o","user/bytecode/openssl_1_1_1d_kern_core_less52.o","user/bytecode/openssl_1_1_1a_kern_core.o","user/bytecode/openssl_1_1_1b_kern_core_less52.o","user/bytecode/openssl_1_1_1d_kern_noncore.o","user/bytecode/bash_kern_core.o","user/bytecode/boringssl_a_13_kern_noncore.o","user/bytecode/mysqld_kern_noncore_less52.o","user/bytecode/openssl_1_0_2a_kern_core.o","user/bytecode/openssl_1_0_2a_kern_noncore.o","user/bytecode/openssl_1_1_1d_kern_noncore_less52.o","user/bytecode/openssl_1_1_1j_kern_core_less52.o","user/bytecode/openssl_3_0_0_kern_noncore.o","user/bytecode/boringssl_a_14_kern_noncore_less52.o","user/bytecode/boringssl_na_kern_noncore_less52.o","user/bytecode/gotls_kern_core.o","user/bytecode/openssl_1_0_2a_kern_core_less52.o","user/bytecode/openssl_1_1_0a_kern_core.o","user/bytecode/openssl_1_1_0a_kern_noncore.o","user/bytecode/openssl_1_1_0a_kern_noncore_less52.o","user/bytecode/openssl_1_1_1b_kern_core.o","user/bytecode/openssl_1_1_1b_kern_noncore.o","user/bytecode/boringssl_a_13_kern_core_less52.o","user/bytecode/boringssl_na_kern_noncore.o","user/bytecode/nspr_kern_noncore_less52.o","user/bytecode/gotls_kern_noncore_less52.o","user/bytecode/nspr_kern_core.o","user/bytecode/openssl_1_1_1j_kern_noncore_less52.o","user/bytecode/openssl_3_2_0_kern_noncore_less52.o","user/bytecode/postgres_kern_noncore_less52.o","user/bytecode/boringssl_a_14_kern_core_less52.o","user/bytecode/boringssl_a_14_kern_noncore.o","user/bytecode/gnutls_kern_noncore_less52.o","user/bytecode/nspr_kern_core_less52.o","user/bytecode/openssl_1_1_1j_kern_noncore.o","user/bytecode/nspr_kern_noncore.o","user/bytecode/openssl_3_2_0_kern_core_less52.o","user/bytecode/postgres_kern_noncore.o","user/bytecode/gnutls_kern_core.o","user/bytecode/mysqld_kern_core_less52.o","user/bytecode/openssl_1_1_1a_kern_noncore.o","user/bytecode/openssl_1_1_1b_kern_noncore_less52.o","user/bytecode/openssl_3_0_0_kern_core_less52.o","user/bytecode/gotls_kern_core_less52.o","user/bytecode/boringssl_a_13_kern_noncore_less52.o","user/bytecode/boringssl_na_kern_core.o","user/bytecode/openssl_1_1_0a_kern_core_less52.o","user/bytecode/openssl_1_1_1d_kern_core.o","user/bytecode/openssl_3_0_0_kern_core.o","user/bytecode/gnutls_kern_noncore.o","user/bytecode/openssl_1_0_2a_kern_noncore_less52.o","user/bytecode/openssl_3_0_0_kern_noncore_less52.o","user/bytecode/postgres_kern_core_less52.o","user/bytecode/boringssl_na_kern_core_less52.o","user/bytecode/gotls_kern_noncore.o","user/bytecode/bash_kern_noncore.o","user/bytecode/boringssl_a_14_kern_core.o","user/bytecode/gnutls_kern_core_less52.o","user/bytecode/openssl_1_1_1a_kern_noncore_less52.o","user/bytecode/postgres_kern_core.o","user/bytecode/mysqld_kern_core.o","user/bytecode/openssl_1_1_1j_kern_core.o"]
2024-10-14T11:33:53+08:00 FTL module run failed, skip it. error="EBPFProbeOPENSSL\tcouldn't find asset open user/bytecode/openssl_3_3_0_kern_core.o: file does not exist ." isReload=false

@cfc4n cfc4n added the fix bug fix PR label Oct 22, 2024
Copy link
Copy Markdown
Member

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM,thanks.

@cfc4n cfc4n merged commit 03a9409 into gojue:master Oct 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fix bug fix PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants