Can't capture any requests from app in A16

[m1nhn]

1|oriole:/data/local/tmp # ./e2 tls
2026-02-05T07:05:50Z INF AppName="eCapture(旁观者)"
2026-02-05T07:05:50Z INF HomePage=https://ecapture.cc
2026-02-05T07:05:50Z INF Repository=https://github.com/gojue/ecapture
2026-02-05T07:05:50Z INF Author="CFC4N cfc4ncs@gmail.com"
2026-02-05T07:05:50Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2026-02-05T07:05:50Z INF Version=androidgki_arm64:v2.0.0-rc.1:6.8.0-1044-azure
2026-02-05T07:05:50Z INF Listen=localhost:28256
2026-02-05T07:05:50Z INF Listen for eCaptureQ=
2026-02-05T07:05:50Z INF eCapture running logs logger=
2026-02-05T07:05:50Z INF the file handler that receives the captured event eventCollector=
2026-02-05T07:05:50Z FTL config validation failed error="[101] openssl detection failed: cannot find libssl.so in common paths"
1|oriole:/data/local/tmp # ls -la /apex/com.android.conscrypt/lib64/libssl.so
-rw-r--r-- 1 system system 489400 1970-01-01 08:00 /apex/com.android.conscrypt/lib64/libssl.so
oriole:/data/local/tmp # ls -la /apex/com.android.conscrypt/lib64/libssl.so

130|oriole:/data/local/tmp # uname -a
Linux localhost 6.1.134-android14-11-Wild #1 SMP PREEMPT Thu Jan 1 00:00:00 UTC 1970 aarch64 Toybox

Model: Pixel 6

I've sent you a zip file of libssl.so

libssl.zip

[m1nhn]

1|oriole:/data/local/tmp # ./e2 tls --libssl=/data/local/tmp/libssl.so
2026-02-05T07:19:16Z INF AppName="eCapture(旁观者)"
2026-02-05T07:19:16Z INF HomePage=https://ecapture.cc
2026-02-05T07:19:16Z INF Repository=https://github.com/gojue/ecapture
2026-02-05T07:19:16Z INF Author="CFC4N cfc4ncs@gmail.com"
2026-02-05T07:19:16Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2026-02-05T07:19:16Z INF Version=androidgki_arm64:v2.0.0-rc.1:6.8.0-1044-azure
2026-02-05T07:19:16Z INF Listen=localhost:28256
2026-02-05T07:19:16Z INF Listen for eCaptureQ=
2026-02-05T07:19:16Z INF eCapture running logs logger=
2026-02-05T07:19:16Z INF the file handler that receives the captured event eventCollector=
2026-02-05T07:19:16Z INF listen=localhost:28256
2026-02-05T07:19:16Z INF https server starting...You can upgrade the configuration file via the HTTP interface.
2026-02-05T07:19:16Z INF Probe initialized pid=0 probe=OpenSSL uid=0
2026-02-05T07:19:16Z INF Text output writer created LoggerAddr= probe=OpenSSL writer=LoggerWriter
2026-02-05T07:19:16Z INF OpenSSL probe initialized capture_mode=text is_boringssl=false openssl_path=/data/local/tmp/libssl.so probe=OpenSSL ssl_version=1.1.1
2026-02-05T07:19:16Z INF probe initialization. isReload=false probeName=OpenSSL
2026-02-05T07:19:16Z INF Probe started probe=OpenSSL
2026-02-05T07:19:16Z INF Loading eBPF bytecode file=bytecode/openssl_1_1_1_kern_noncore.o probe=OpenSSL
2026-02-05T07:19:16Z FTL probe start failed. error="[401] failed to load eBPF program 'bytecode/openssl_1_1_1_kern_noncore.o': open bytecode/openssl_1_1_1_kern_noncore.o: file does not exist" isReload=false
1|oriole:/data/local/tmp #

[dosubot]

Hi @m1nhn! I'm Dosu and I’m helping the ecapture team.

The error means eCapture can't find the required eBPF bytecode file (bytecode/openssl_1_1_1_kern_noncore.o) in the expected location. This file is needed to instrument your OpenSSL library at runtime. As of early 2026, all eBPF bytecode files must be in the top-level bytecode/ directory, not user/bytecode/—this was changed recently and all probe code and Makefile rules were updated accordingly [PR 914].

To fix this, you need to generate or obtain the correct bytecode file for your OpenSSL version and place it in the bytecode/ directory next to your eCapture binary or in your working directory. If you build from source, run the Makefile targets that generate eBPF bytecode (look for ebpf and ebpf_noncore), and make sure the resulting .o files are in bytecode/. If you’re using a prebuilt binary, you’ll need the matching bytecode files for your OpenSSL version and architecture [details].

If you’re targeting Android, make sure the bytecode matches both your OpenSSL/BoringSSL version and Android version, as the probe may use a variant like boringssl_a_ [source].

Once the correct file is in bytecode/, rerun your command and the error should be resolved.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[m1nhn]

@dosu So what should I do right now.

[dosubot]

You need to provide the correct eBPF bytecode file for your device’s OpenSSL/BoringSSL version and Android version. For Pixel 6 on Android 14, eCapture expects a file like bytecode/boringssl_a_14_kern_noncore.o (or _core.o, depending on your kernel’s BTF support) in the bytecode/ directory next to your binary. If that file is missing, eCapture can’t hook the library and will fail to capture traffic reference.

First, check if you have the required bytecode file in bytecode/. If not, try running with --ssl_version=boringssl_a_14 (or boringssl_a_13, boringssl_a_15, etc.) to see if any compatible bytecode is present reference. If you still get a missing file error, you’ll need to generate the correct bytecode: extract your device’s /apex/com.android.conscrypt/lib64/libssl.so, update the offset generator, regenerate offsets, and rebuild the eBPF bytecode reference.

If you’re not set up to build the bytecode yourself, you’ll need to wait for a prebuilt file for your device/OS version or contribute your libssl.so to help generate one. If you want to try workarounds, you can also force non-CORE mode with -b 2 or switch capture modes, but these won’t fix version mismatches reference.

Let me know if you want step-by-step instructions for generating the bytecode or if you have a build environment ready.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[cfc4n]

try v2.0.0-rc.2

[m1nhn]

Hi @cfc4n again. I've tried your latest version: https://github.com/gojue/ecapture/releases/tag/v2.0.0-rc.2. Btw, it has some errors:

oriole:/data/local/tmp/ecapture-v2.0.0-rc.2-android-arm64 # ./ecapture tls
2026-02-10T04:06:16Z INF AppName="eCapture(旁观者)"
2026-02-10T04:06:16Z INF HomePage=https://ecapture.cc
2026-02-10T04:06:16Z INF Repository=https://github.com/gojue/ecapture
2026-02-10T04:06:16Z INF Author="CFC4N <cfc4ncs@gmail.com>"
2026-02-10T04:06:16Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."
2026-02-10T04:06:16Z INF Version=ecap_android_arm64:v2.0.0-rc.2:6.8.0-1044-azure
2026-02-10T04:06:16Z INF Listen=localhost:28256
2026-02-10T04:06:16Z INF Listen for eCaptureQ=
2026-02-10T04:06:16Z INF eCapture running logs logger=
2026-02-10T04:06:16Z INF the file handler that receives the captured event eventCollector=
2026-02-10T04:06:16Z INF listen=localhost:28256
2026-02-10T04:06:16Z INF https server starting...You can upgrade the configuration file via the HTTP interface.
2026-02-10T04:06:16Z INF Probe initialized pid=0 probe=OpenSSL uid=0
2026-02-10T04:06:16Z INF Text output writer created LoggerAddr= probe=OpenSSL writer=LoggerWriter
2026-02-10T04:06:16Z FTL probe initialization failed error="[101] unsupported OpenSSL version: boringssl_android_16" isReload=false
1|oriole:/data/local/tmp/ecapture-v2.0.0-rc.2-android-arm64 #