diff --git a/README.md b/README.md index 12997efc1..f24fcfe24 100644 --- a/README.md +++ b/README.md @@ -112,41 +112,26 @@ cfc4n@vm-server:~$# cat /boot/config-`uname -r` | grep CONFIG_DEBUG_INFO_BTF CONFIG_DEBUG_INFO_BTF=y ``` -### tls command +### gotls command capture tls text context. + Step 1: ```shell -./ecapture tls --hex +./ecapture gotls --elfpath=/home/cfc4n/go_https_client --hex ``` Step 2: ```shell -curl https://github.com +/home/cfc4n/go_https_client ``` - -### libressl&boringssl +### more help ```shell -# for installed libressl, libssl.so.52 is the dynamic ssl lib -vm@vm-server:~$ ldd /usr/local/bin/openssl - linux-vdso.so.1 (0x00007ffc82985000) - libssl.so.52 => /usr/local/lib/libssl.so.52 (0x00007f1730f9f000) - libcrypto.so.49 => /usr/local/lib/libcrypto.so.49 (0x00007f1730d8a000) - libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1730b62000) - /lib64/ld-linux-x86-64.so.2 (0x00007f17310b2000) - -# use the libssl to config the libssl.so path -vm@vm-server:~$ sudo ./ecapture tls --libssl="/usr/local/lib/libssl.so.52" --hex - -# in another terminal, use the command, then type some string, watch the output of ecapture -vm@vm-server:~$ /usr/local/bin/openssl s_client -connect github.com:443 - -# for installed boringssl, usage is the same -/path/to/bin/bssl s_client -connect github.com:443 +./ecapture gotls -h ``` -### bash command -capture bash command. +## bash Module +capture bash command : `ecapture bash` ```shell ps -ef | grep foo ``` diff --git a/README_CN.md b/README_CN.md index 5d3b1f80f..b45979b23 100644 --- a/README_CN.md +++ b/README_CN.md @@ -121,33 +121,24 @@ cfc4n@vm-server:~$# cat /boot/config-`uname -r` | grep CONFIG_DEBUG_INFO_BTF CONFIG_DEBUG_INFO_BTF=y ``` -### openssl的无证书抓包 openssl -执行任意https网络请求即可使用。 +### 启动eCapture ```shell -curl https://www.qq.com +./ecapture gotls --elfpath=/home/cfc4n/go_https_client --hex ``` -### libressl&boringssl的测试验证 +### 启动该程序: +确保该程序会触发https请求。 ```shell -# 由于curl等工具依赖于原生openssl的安装,用以下方式测试,也可以重新编译安装相关的工具来测试 -vm@vm-server:~$ ldd /usr/local/bin/openssl - linux-vdso.so.1 (0x00007ffc82985000) - libssl.so.52 => /usr/local/lib/libssl.so.52 (0x00007f1730f9f000) - libcrypto.so.49 => /usr/local/lib/libcrypto.so.49 (0x00007f1730d8a000) - libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1730b62000) - /lib64/ld-linux-x86-64.so.2 (0x00007f17310b2000) - -# 使用libssl配置libssl.so的路径 -vm@vm-server:~$ sudo ./ecapture tls --libssl="/usr/local/lib/libssl.so.52" --hex - -# 另一个终端使用如下命令开启测试,可输入一些字符串,然后回车,观察ecapture的抓包输出 -vm@vm-server:~$ /usr/local/bin/openssl s_client -connect www.qq.com:443 - -# boringssl的测试,同理 -/path/to/bin/bssl s_client -connect www.qq.com:443 +/home/cfc4n/go_https_client ``` +### 更多帮助 +```shell +./ecapture gotls -h +``` + ### bash的shell捕获 +capture bash command : `ecapture bash` ```shell ps -ef | grep foo ``` diff --git a/README_JA.md b/README_JA.md index 69eee7f5f..11b9a3bd0 100644 --- a/README_JA.md +++ b/README_JA.md @@ -104,37 +104,18 @@ cfc4n@vm-server:~$# cat /boot/config-`uname -r` | grep CONFIG_DEBUG_INFO_BTF CONFIG_DEBUG_INFO_BTF=y ``` -### tls コマンド - -TLS テキストコンテキストをキャプチャします。 -ステップ 1: +Step 1: ```shell -./ecapture tls --hex +./ecapture gotls --elfpath=/home/cfc4n/go_https_client --hex ``` -ステップ 2: +Step 2: ```shell -curl https://github.com +/home/cfc4n/go_https_client ``` - -### libssl & boringssl +### more help ```shell -# インストールされた libssl に対して、libssl.so.52 は動的な ssl lib です -vm@vm-server:~$ ldd /usr/local/bin/openssl - linux-vdso.so.1 (0x00007ffc82985000) - libssl.so.52 => /usr/local/lib/libssl.so.52 (0x00007f1730f9f000) - libcrypto.so.49 => /usr/local/lib/libcrypto.so.49 (0x00007f1730d8a000) - libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1730b62000) - /lib64/ld-linux-x86-64.so.2 (0x00007f17310b2000) - -# libssl を使って libssl.so のパスを設定 -vm@vm-server:~$ sudo ./ecapture tls --libssl="/usr/local/lib/libssl.so.52" --hex - -# 別の端末で実行し、何らかの文字列を入力し、ecapture の出力を確認 -vm@vm-server:~$ /usr/local/bin/openssl s_client -connect github.com:443 - -# インストールされた boringssl の場合、使い方は同じです -/path/to/bin/bssl s_client -connect github.com:443 +./ecapture gotls -h ``` ### bash コマンド diff --git a/cli/cmd/gotls.go b/cli/cmd/gotls.go index c4d345c39..a7f156ea8 100644 --- a/cli/cmd/gotls.go +++ b/cli/cmd/gotls.go @@ -97,6 +97,7 @@ func goTLSCommandFunc(command *cobra.Command, args []string) { if err != nil { // ErrorGoBINNotFound is a special error, we should not print it. if errors.Is(err, config.ErrorGoBINNotFound) { + logger.Printf("%s\t%s, exec \"ecapture gotls --help\" for more detail.", mod.Name(), config.ErrorGoBINNotFound.Error()) logger.Printf("%s\tmodule [disabled].", mod.Name()) return } diff --git a/user/config/config_gotls.go b/user/config/config_gotls.go index fe50aa58c..901cfc228 100644 --- a/user/config/config_gotls.go +++ b/user/config/config_gotls.go @@ -30,7 +30,7 @@ const Arm64armInstSize = 4 const GoTlsReadFunc = "crypto/tls.(*Conn).Read" var ( - ErrorGoBINNotFound = errors.New("GO application not found") + ErrorGoBINNotFound = errors.New("The executable program (compiled by Golang) was not found") ErrorSymbolNotFound = errors.New("symbol not found") ErrorNoRetFound = errors.New("no RET instructions found") )