Skip to content

Latest commit

 

History

History
820 lines (589 loc) · 38.1 KB

CHANGELOG.md

File metadata and controls

820 lines (589 loc) · 38.1 KB

v0.8.3 (2024-06-01)

What's Changed

Full Changelog: https://github.com/gojue/ecapture/compare/v0.8.2...v0.8.3


v0.8.2 (2024-05-19)

What's Changed

  • android version compilation has failed. by @cfc4n in #548

Full Changelog: https://github.com/gojue/ecapture/compare/v0.8.1...v0.8.2


v0.8.1 (2024-05-19)

What's Changed

  • makefile: Optimized the generation mechanism of kernel header files by @cfc4n in #536
  • add dockerfile by @sancppp in #537
  • cli: Use a formatted logger rs/zerolog by @cfc4n in #539
  • utils: supported openssl 1.1.1w, 3.0.13, 3.1.5, 3.2.1 by @cfc4n in #540
  • BPF name should be appended after _core/_noncore by @darren in #545
  • user: fixed #542, masterkey being written to pcapng multiple times. by @cfc4n in #546
  • user: prepare for service-oriented architecture. by @cfc4n in #541

New Contributors

  • @darren made their first contribution in #545

Full Changelog: https://github.com/gojue/ecapture/compare/v0.8.0...v0.8.1


v0.8.0 (2024-05-04)

🚀 Breaking Changes

  • for User: No need to distinguish between CO-RE and non-CO-RE versions, automatically identified by eCapture.
    • 无需区分CO-RE和non-CO-RE版本,由eCapture自动识别。
  • for Developer: Supports cross-compilation for both amd64 and arm64 CPU architectures, building CO-RE and non-CO-RE versions respectively.
    • 支持在amd64\arm64两个CPU架构下的交叉编译,分别构建CO-RE和non-CO-RE版本

What's Changed

  • chore: rename ecapture module name. by @cfc4n in #530
  • Fix keylog mode not working correctly on certain OpenSSL versions by @AmazingPP in #534
  • feat: support CORE and non-CORE mode in one by @cfc4n in #532
  • workflows: change steps.get_tags.outputs.VERSION to github.ref_name by @sancppp in #535

New Contributors

  • @AmazingPP made their first contribution in #534

Full Changelog: https://github.com/gojue/ecapture/compare/v0.7.7...v0.8.0


v0.7.7 (2024-04-21)

What's Changed

  • [Fix] get textStart from pclnTable by @wlingze in #516
  • fix: amd64, offset read error issue for PIE executable. PR #516 by @cfc4n in #517
  • makefile: used CC=$(CROSS_COMPILE)gcc for CGO compile. by @cfc4n in #519
  • user: return error when detect openssl version failed. by @cfc4n in #521
  • user : fixed the invalid address reference of the SSL_in_before symbol OpenSSL 1.0.2k. by @cfc4n in #520
  • feat: support cross-compilation for workflows. by @cfc4n in #523
  • readme: improve English README.md translation and add TOCs by @zhoukuncheng in #525
  • build(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 by @dependabot in #528

New Contributors

  • @wlingze made their first contribution in #516
  • @zhoukuncheng made their first contribution in #525

Full Changelog: https://github.com/gojue/ecapture/compare/v0.7.6...v0.7.7


v0.7.6 (2024-03-30)

What's Changed

  • fix #500 to avoid potential hang and event loss by @ruitianzhong in #501
  • fix issue#504 by @sancppp in #506
  • tentative fix to address bash problem #490 by @ruitianzhong in #510
  • Fix cant found RET offset in gotls mode. fix #502. by @cfc4n in #512

Full Changelog: https://github.com/gojue/ecapture/compare/v0.7.5...v0.7.6


v0.7.5 (2024-03-03)

What's Changed

  • Improve makefile by @cfc4n in #488
  • Fix: init GoTLSProbe.tcPacketsChan #492 by @ruitianzhong in #493
  • fix: avoid printing confusing message when input contains special character by @ruitianzhong in #495
  • correctly update ContentLength for uncompressed response body by @ruitianzhong in #498
  • add -race flags for go test and fix data race warning by @ruitianzhong in #499
  • openssl: encode the value of fd (ssl->wbio->num) to gen uuid, rather than an unexpected random number by @wuyexkx in #494

New Contributors

  • @ruitianzhong made their first contribution in #493
  • @wuyexkx made their first contribution in #494

Full Changelog: https://github.com/gojue/ecapture/compare/v0.7.4...v0.7.5


v0.7.4 (2024-02-24)

🚀 Breaking Changes

eCapture supports [Pcap Filter Syntax] (https://www.tcpdump.org/manpages/pcap-filter.7.html), and you can use the pcap filter expression to filter network packets like tcpdump.

In the tls\gotls module, when the running mode is 'pcap', the pcap filter expression is supported, which can be set in the last parameter of the command line, for example:


eCapture支持Pcap Filter Syntax,你可以像tcpdump一样使用pcap filter表达式来过滤网络包。

在tls\gotls模块中,当运行模式为pcap时,支持pcap filter表达式,在命令行最后的参数中设定,例如:

ecapture tls -m pcap -i wlan0 -w save.pcapng host 192.168.1.1 and tcp port 443

What's Changed

  • Update probe_bash.go by @sancppp in #479
  • docs: Optimized the error message in the gotls module.(fix: #482) by @cfc4n in #484
  • feat: Support pcap-filter expression for pcap mode by @Asphaltt in #478
  • chore: Pcap filter tidy,support ubuntu arm64 to make libpcap by @cfc4n in #487

New Contributors

  • @sancppp made their first contribution in #479
  • @Asphaltt made their first contribution in #478

Full Changelog: https://github.com/gojue/ecapture/compare/v0.7.3...v0.7.4


v0.7.3 (2024-01-28)

What's Changed

  • makefile: Optimize the feature list for the Android version by @cfc4n in #457
  • user: support event processor by @cfc4n in #462
  • chore: remove refs to deprecated io/ioutil by @testwill in #465
  • user: fix concurrent map read and map write #467 by @cfc4n in #468
  • utils: support openssl 3.1.0-3.1.4 and 3.0.9-3.0.12 by @cfc4n in #469
  • user: imporve dynamic link library path loading logic on aarch64 ubuntu by @cfc4n in #470
  • user: imporve #463, impact on the performance of the tested program by @cfc4n in #471
  • kern: support openssl 3.2.x , change ssl_st to ssl_connection_st by @cfc4n in #472

New Contributors

  • @testwill made their first contribution in #465

Full Changelog: https://github.com/gojue/ecapture/compare/v0.7.2...v0.7.3


v0.7.2 (2024-01-01)

What's Changed

  • user: improve pcapng writer, flush every 2s. by @cfc4n in #455
  • builder: add debian package build script. by @cfc4n in #456

New Contributors

Full Changelog: https://github.com/gojue/ecapture/compare/v0.7.1...v0.7.2


v0.7.1 (2023-12-23)

What's Changed

  • cli: reduce mapsize to 1024 * PAGESIZE. by @cfc4n in #440
  • Add optimization in openssl detection logic to consume less memory by @h0x0er in #438
  • cli: fix nss module panic by @mannkafai in #444
  • build(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot in #448
  • pkg: support android on docker(redroid). by @cfc4n in #453

New Contributors

  • @mannkafai made their first contribution in #444

Full Changelog: https://github.com/gojue/ecapture/compare/v0.7.0...v0.7.1


v0.7.0 (2023-12-03)

🚀 Breaking Changes

  • Split nss/gnutls/openssl into three separate submodules. Corresponding to the ./ecapture nss, ./ecapture gnutls, ecapture tls commands.
  • Support keylog mode, equivalent to the functionality of the SSLKEYLOGFILE environment variable. Captures SSL/TLS communication keys directly without the need for changes in the target process.
  • Refactor the mode parameters supported by the openssl(aka tls) module using the -mparameter, with values text, pcap,keylog.
    • pcap mode: Set with -m pcap or -m pcapng parameters. When using this mode, it is necessary to specify --pcapfile and -i parameters. The default value for the --pcapfile parameter is ecapture_openssl.pcapng.
    • keylog mode: Set with -m keylog or -m key parameters. When using this mode, it is necessary to specify --keylogfile, defaulting to ecapture_masterkey.log.
    • text mode: Default mode when -m parameter is unspecified. Outputs all plaintext packets in text form. (As of v0.7.0, no longer captures communication keys, please use keylog mode instead.)
  • Refactor the mode parameters supported by the gotls module, similar to the openssl module, without further details.
  • Optimize the memory size of eBPF Map, specify with the --mapsize parameter, defaulting to 5120 KB.
  • Remove the -w parameter, use --pcapfile parameter instead.
  • Change log-addr parameter to logaddr, with unchanged functionality.

Thanks to the genius idea from @blaisewang.


  • 将nss/gnutls/openssl拆分为独立的三个子模块。分别对应./ecapture nss./ecapture gnutlsecapture tls三个子命令。
  • 支持keylog模式,等同于SSLKEYLOGFILE环境变量的功能,无需目标进程改动,直接捕获SSL/TLS通信密钥。
  • 重构openssl(aka tls)模块支持的模式参数,使用-m参数指定,分别为text,pcap,keylog三个值。
    • pcap模式:-m pcap-m pcapng参数来设定。当使用本模式时,必需指定--pcapfile-i这两个参数才能使用。 其中--pcapfile参数的默认值为ecapture_openssl.pcapng
    • keylog模式:-m keylog-m key参数来设定。当使用本模式时,必需指定--keylogfile,默认为ecapture_masterkey.log
    • text模式:-m参数不指定时,默认为本模式。将以文本形式输出所有的明文数据包。(自v0.7.0起,不再捕获通讯密钥,请使用keylog模式代替)
  • 重构gotls模块支持的模式参数,与openssl模块一样,不再赘述。
  • 优化eBPF Map的内存大小,使用--mapsize参数指定,默认为5120 KB。
  • 移除-w参数,请使用--pcapfile参数代替。
  • 更改log-addr参数为logaddr,功能含义不变。

感谢 @blaisewang 的天才思路。

Demo of keylog Mode Usage

Using eCapture to capture communication keys in real-time and combining it with tshark for real-time decryption enables the real-time plaintext output of encrypted traffic. The steps are as follows:

使用eCapture实时捕获通信密钥,并结合tshark实时解密,可以做到实时的加密流量明文输出。步骤如下:

Terminal 1

Start the keylog mode of eCapture first.

先启动eCapture的keylog模式

ecapture tls -m keylog --keylogfile=ecapture_masterkey.log

Terminal 2

Start the tshark tool by specifying tls.keylog_file as the captured key file by eCapture, named ecapture_masterkey.

再启动tshark工具,指定tls.keylog_file为eCapture捕获的密钥文件ecapture_masterkey

http 1.x

tshark -o tls.keylog_file:ecapture_masterkey.log -Y http -T fields -e http.file_data -f "port 443" -i eth0

http 2.0

tshark -o tls.keylog_file:ecapture_masterkey.log -Y http2 -T fields -e http2.data.data -f "port 443" -i eth0

Afterward, any software that uses the eCapture HOOK with OpenSSL libraries can achieve real-time decryption and display of all encrypted communication traffic without requiring any modifications to these software applications.

之后,其他使用eCapture HOOK的openssl类库的软件,所有加密通讯的流量,都可以实现实时解密并展示了,无需这些软件做任何改动。

See issue #432 for more detail.

What's Changed

  • ignore connect symbol cant found. by @cfc4n in #431
  • Add support for stripped go binaries by @h0x0er in #426
  • splitting gnutls/nss module from tls module lists. by @cfc4n in #434
  • user: custom mapSize flag. improve memory usage #433 . by @cfc4n in #435
  • add the model flag to distinguish the captured modes, support keylog captured. by @cfc4n in #436

Full Changelog: https://github.com/gojue/ecapture/compare/v0.6.6...v0.7.0


v0.6.6 (2023-11-19)

What's Changed

  • add ubunutu23.04 aarch64 clang-15 into init_env.sh by @BiteFoo in #413
  • Decode kernel time to user time by @h0x0er in #418
  • Fix : openssl event output invalid with hex mode by @cfc4n in #421
  • user : Set the connect hook as an optional parameter. by @cfc4n in #423

New Contributors

  • @BiteFoo made their first contribution in #413
  • @h0x0er made their first contribution in #418

Full Changelog: https://github.com/gojue/ecapture/compare/v0.6.5...v0.6.6


v0.6.5 (2023-11-11)

What's Changed

  • supports all ports when target_port is set to 0. by @cfc4n in #409
  • support for the boringssl library on Android 12\13\14. by @cfc4n in #410
  • update golang version to 1.21 from 1.18 by @cfc4n in #412
  • 支持所有端口的网络数据捕获(target_port为0时) by @cfc4n in #409
  • 在Android 12\13\14上,支持borlingssl类库的明文捕获 by @cfc4n in #410
  • 更新Golang类库到1.21,cilium/ebpf类库到0.12.3 by @cfc4n in #412

Full Changelog: https://github.com/gojue/ecapture/compare/v0.6.4...v0.6.5


v0.6.4 (2023-10-15)

What's Changed

  • bugfix: Hook the ssl_set_fd function to get FD. by @cfc4n in #399
  • build(deps): bump golang.org/x/net from 0.7.0 to 0.17.0 by @dependabot in #402
  • refactor : Shared Object (so) path load logic by @cfc4n in #401
  • improve: add missing eBPF maps parameters. by @cfc4n in #405

Full Changelog: https://github.com/gojue/ecapture/compare/v0.6.3...v0.6.4


v0.6.3 (2023-09-27)

What's Changed

  • fix : out of silice range. by @cfc4n in #398

Full Changelog: https://github.com/gojue/ecapture/compare/v0.6.2...v0.6.3


v0.6.2 (2023-09-24)

What's Changed

  • openssl module: add some prompts when the kernel is less than 5.2 by @cfc4n in #387
  • refactor: removal of deprecated flag support. by @cfc4n in #388
  • Revert ip address by @cfc4n in #391
  • fix : OpenSSL's file descriptor is always 0 by @cfc4n in #393

Full Changelog: https://github.com/gojue/ecapture/compare/v0.6.1...v0.6.2


v0.6.1 (2023-07-16)

What's Changed

  • fix #378 , error: use of undeclared identifier 'KBUILD_MODNAME' by @cfc4n in #379
  • feat:add openssl 1.1.1u and 3.0.9 by @cfc4n in #380

Full Changelog: https://github.com/gojue/ecapture/compare/v0.6.0...v0.6.1


v0.6.0 (2023-07-02)

🚀 Breaking Changes

Associating process information with network packets. usage: cp utils/ecapture.lua ~/.wireshark/plugins .

What's Changed

  • code refactoring by @cfc4n in #371
  • Tls response unexpected eof by @cfc4n in #372
  • modify func isCOntainerCgroup to isContainerCgroup, and where referenced by @chusyclub in #374
  • feat: Associate corresponding process information with each network packet. by @cfc4n in #376

Full Changelog: https://github.com/gojue/ecapture/compare/v0.5.3...v0.6.0


v0.5.3 (2023-05-21)

What's Changed

  • user: fixes slice out of range by @cfc4n in #366

Full Changelog: https://github.com/gojue/ecapture/compare/v0.5.2...v0.5.3


v0.5.2 (2023-05-01)

What's Changed

  • add CircleLinux rpm and mannul build support by @bella485 in #345
  • gomod: update github.com/mdlayher/netlink to v1.7.1 by @cfc4n in #348
  • use makefile to build rpm by @xjas in #344
  • fix : DumpResponse error: unexpected EOF by @cfc4n in #349
  • bugfix: Error unknown flag gobin (fixes #354 ) by @cfc4n in #355
  • GitHub actions deprecating by @cfc4n in #356
  • kern : support gotls request and response by @cfc4n in #357
  • user: fixes the network card ID cannot be found when writing to a pcapng file. (#347) by @cfc4n in #358

Full Changelog: https://github.com/gojue/ecapture/compare/v0.5.1...v0.5.2


v0.5.1 (2023-04-08)

What's Changed

  • user: add ifname's default value of gotls module. by @cfc4n in #332
  • kern: fix wrong uid by @lazybetrayer in #334
  • support rpm build by @xjas in #341
  • pkg : add proc(go version) unit testing by @cfc4n in #342

Full Changelog: https://github.com/gojue/ecapture/compare/v0.5.0...v0.5.1


v0.5.0 (2023-03-10)

What's Changed

  • fix: typo in the section name by @spacewander in #311
  • user : increase buffer size of ebpf map. (improve #291 , #314) by @cfc4n in #315
  • build(deps): bump golang.org/x/net from 0.0.0-20211112202133-69e39bad7dc2 to 0.7.0 by @dependabot in #320
  • refactor : rename Golang TLS module name to gotls from gossl . by @cfc4n in #319
  • refactor: Use camel case instead of snake case. by @cfc4n in #321
  • kern: fix typo in bpf_tracing.h by @eltociear in #323
  • Add JA readme by @eltociear in #324
  • Gotls crash : incorrect variable used. (fixes:#322) by @cfc4n in #325
  • kern: refactor golang ABI by register and stack. by @cfc4n in #326
  • feat: add Gotls master secrets module. by @cfc4n in #329

Full Changelog: https://github.com/gojue/ecapture/compare/v0.4.12...v0.5.0


v0.4.12 (2023-02-10)

What's Changed

  • pkg: get GoVersion by buildinfo package from ELF (by golang compiled) (#262) by @cfc4n in #295
  • docs: fixes supported kernel version on arm64(aarch64). (#296) by @cfc4n in #298
  • user: fixes slice bounds out of range bug (#297) by @cfc4n in #299
  • kern: fixes constant value of type uint64. (#301) by @cfc4n in #302
  • package: update gojue/ebpfmanager to v0.4.1 by @cfc4n in #305
  • docs: update README.md by @onism68 in #306

Full Changelog: https://github.com/gojue/ecapture/compare/v0.4.11...v0.4.12


v0.4.11 (2023-01-07)

What's Changed

  • builder: fix typos (#285) by @cfc4n in #286
  • Tls 13 masterkey is taken wrong (fixes #283) by @cfc4n in #284
  • fix(gossl): invalid memory address or nil pointer by @luckymrwang in #288

Full Changelog: https://github.com/gojue/ecapture/compare/v0.4.10...v0.4.11


v0.4.10 (2022-12-11)

What's Changed

  • builder: add curl shell to install develop environment. by @cfc4n in #272
  • docs : update minimal kernel version as 4.18 (#274) by @cfc4n in #275
  • kern: capture https plaintext failed with boringssl TLS 1.3 on android #271 by @cfc4n in #279

Full Changelog: https://github.com/gojue/ecapture/compare/v0.4.9...v0.4.10


v0.4.9 (2022-11-19)

What's Changed

  • constant value has to be of type uint64 (#261) by @cfc4n in #264
  • builder: rename android non-core archive file name by @cfc4n in #266
  • chore(openssl/boringssl): remove redundant calculation by @blaisewang in #267
  • makefile : support make parallel (#265) by @cfc4n in #268
  • disable gnutls/nss modules on Android. by @cfc4n in #269

Full Changelog: https://github.com/ehids/ecapture/compare/v0.4.8...v0.4.9


v0.4.8 (2022-11-05)

Breaking Changes

  1. Changed license to Apache License 2.0 from AGPL 3.0.
  2. Supported versions of openssl are 1.1.0* , 1.0.2* .
  3. Supported minimum version of Clang is 9.0.
  4. Added GitHub release action of Android X86_64 binaries(default: non-CORE version).

What's Changed

  • user : Tolower openssl version strings. by @cfc4n in #250
  • cli : remove other modules on android. by @cfc4n in #251
  • utils: add eCapture lua script for wireshark plugin. by @cfc4n in #248
  • feat: updated new openssl version by @cfc4n in #255
  • feat : support openssl 1.1.0* and 1.0.2* by @cfc4n in #257
  • fix: Build failed on clang10 (#256) by @cfc4n in #258
  • docs : Change license to Apache License 2.0 by @cfc4n in #259
  • workflows : release Android x86_64 use nocore model. by @cfc4n in #260

Full Changelog: https://github.com/ehids/ecapture/compare/v0.4.7...v0.4.8


v0.4.7 (2022-10-23)

Breaking Changes

add --ssl_version flag to set the SSL libraries version supported ssl libraries version lists:

  • openssl 1.1.1* , (1.1.1a - 1.1.1r)
  • openssl 3.0.* , (3.0.0 - 3.0.6)
  • boringssl 1.1.1
ecapture tls
ecapture tls --hex --pid=3423
ecapture tls -l save.log --pid=3423
ecapture tls --libssl=/lib/x86_64-linux-gnu/libssl.so.1.1
ecapture tls -w save_3_0_5.pcapng --ssl_version="openssl 3.0.5" --libssl=/lib/x86_64-linux-gnu/libssl.so.3 
ecapture tls -w save_android.pcapng -i wlan0 --libssl=/apex/com.android.conscrypt/lib64/libssl.so --ssl_version="boringssl 1.1.1" --port 443

What's Changed

  • feat : support openssl 3.0 @cfc4n in #244
  • feat: automate openssl offset header file generation @blaisewang in #241

v0.4.6 (2022-10-15)

What's Changed

  • user/module : compatiable Linux kernel less or more than 5.2 @cfc4n in #238

v0.4.5 (2022-10-10)

What's Changed

  • kern: capture master secrets for tls 1.3 @cfc4n in #232

v0.4.4 (2022-10-03)

What's Changed

  • feat: add support TLSv1.3 decryption by @blaisewang in #209
  • user/module : hex model output. by @cfc4n in #220
  • user/module : use const for SSL masterKey function hook. by @cfc4n in #217
  • kern: rodata map not supported on kernel 4.19 or older by @cfc4n in #223
  • kern: http2 response packet decode failed. by @cfc4n in #225

v0.4.3 (2022-09-09)

What's Changed

  • fix: use cipher id to derive secret by @blaisewang in #192
  • kern: get ssl_session in the *SSL_get_session() order . by @cfc4n in #193

v0.4.2 (2022-09-04)

What's Changed

  • refactor user package. by @cfc4n in #183
  • pkg/event_processor: DefaultParser init(). by @cfc4n in #186
  • Fix: correct ssl_st member offsets by @blaisewang in #184
  • Boringssl decrypt failed by @cfc4n in #188

v0.4.1 (2022-08-21)

What's Changed

  • kern : define variable target_port always. by @cfc4n in #157
  • workflows : build nocore version for Android default. by @cfc4n in #159
  • pkg : Ifname default value. by @cfc4n in #161
  • user : skip loopback network interface by @cfc4n in #163
  • user : tls models exit gracefully. by @cfc4n in #165
  • git: ignore .check* files by @blaisewang in #168
  • pkg : fix config file parse failed, when as gzip format. by @cfc4n in #169
  • fix gzip read err by @4ft35t in #175
  • pkg/util/ebpf : add unit testing for kernel CONFIG reader by @cfc4n in #176
  • user : fix incorrect TimeStamp by @cfc4n in #179
  • cli/cmd : print version info by @cfc4n in #177
  • kern : support boringssl offset for Android 12. by @cfc4n in #181

v0.4.0 (2022-08-07)

Breaking Changes

Support : capture plaintext packet as pcapng files for openssl TLS encryption.

Note:

Support Wireshark to open directly. Do not need to setting up Master Secrets files.

Capture raw packet by Traffic Control eBPF filter. Added Master Secrets information into pcapng with Decryption Secrets Block (DSB).

Warning

change loggerFile flag as -l from -w , because -w is reserved for Wireshark, and keep same as -w for tcpdump. use ecapture -h for help. change master secrets filename from ecapture_masterkey_[pid].log to ecapture_masterkey.log.

What's Changed

  • new feature: capture TLS 1.3 master secret by @cfc4n in #143
  • user : echo String() or StringHex() by CLI argument. by @cfc4n in #149
  • cli/cmd : clean up all probe while process exit. (#150) by @cfc4n in #151
  • save as Pcapng files #145 by @cfc4n in #148
  • user : Support writing pcapng files with Decryption Secrets Block (DSB). by @cfc4n in #153

v0.3.0 (2022-07-20)

Breaking Changes

Capture TLS master_key ,save to file. Support openssl 1.1.1.X . TLS 1.2 .

Quick Guide:

  • use ecapture to capture TLS master_key, will save master secret to ecapture_masterkey_[pid].log.
  • use tcpdump to capture and save packets to xxx.pcapng file.
  • open xxx.pcapng file with wireshark.
  • Setting : Wireshark --> Preferences --> Protocols --> TLS --> (Pre)-Master-Secret log filename, select ecapture_masterkey_[pid].log.
  • Using : right click packet item, select follow -> HTTP Stream / HTTP/2 Stream

What's Changed

  • all : refactor event_processor EventType. by @cfc4n in #134
  • fixed #138 : You have an error in your yaml syntax on line 79 by @cfc4n in #139
  • New feature: capture openssl masterkey #27 by @cfc4n in #140

Full Changelog: https://github.com/ehids/ecapture/compare/v0.2.2...v0.3.0


v0.2.2 (2022-07-09)

What's Changed

  • workflows: build failed on aarch 64 ubuntu : 'linux/kconfig.h' file not found #125 by @cfc4n in #126
  • Makefile: shell running,with a unexcepted result: lost DKERNEL_LESS_5_2 on kernel 4.15 #129 by @cfc4n in #132
  • ebpf: remove detection of BPF config when running at container #127 by @cfc4n in #128

New Contributors

Full Changelog: https://github.com/ehids/ecapture/compare/v0.2.1...v0.2.2


v0.2.1 (2022-07-05)

What's Changed

  • pkg : fix Kernel config read failed, error:Config not found #117 by @cfc4n in #123
  • user : Clean up unnecessary information. fix #122 by @cfc4n in #124

New Contributors

Full Changelog: https://github.com/ehids/ecapture/compare/v0.2.0...v0.2.1


v0.2.0 (2022-07-04)

What's Changed

  • Directly search so in search path when /usr/bin/curl is not exist by @tiann in #97
  • Add GitHub Action :Golangci lint by @cfc4n in #99
  • Add Chinese name 旁观者. by @cfc4n in #103
  • build: change tar.gz file path in checksum.txt by @cfc4n in #104
  • Support Golang HTTPS introspection by @chenhengqi in #100
  • New Feature: support Android without GKI (kernel version > 4.18) by @cfc4n in #107
  • fixed :#108 tls module cannot to capture payload on Aarch64 kernel 4.18 by @huzai9527 in #109
  • fixed #108: ip address lost on aarch64 kernel 4.18 by @cfc4n in #111
  • New feature: add payload parser. by @cfc4n in #113
  • document: message friendly by @cfc4n in #119

New Contributors

  • @tiann made their first contribution in #97
  • @chenhengqi made their first contribution in #100

Full Changelog: https://github.com/ehids/ecapture/compare/v0.1.10...v0.2.0


v0.1.10 (2022-06-20)

What's Changed

  • user : fixed bug. #76 libpthread.so not found. by @cfc4n in #77
  • Support for ARM64 architecture by @cfc4n in #75
  • fixed: outputing blank text on linux 4.18 #81 by @cfc4n in #82
  • New feature: update ebpfmanager package to 0.3.0 by @cfc4n in #83
  • New feature: #80 event filter by uid by @cfc4n in #84
  • New feature: #85 event filter by uid for module tls by @cfc4n in #86
  • New feature: #87 support Android GKI by @cfc4n in #88
  • fixed: #92 github checkout error while a PR sent. by @cfc4n in #93
  • New Feature: #79 Auto release for android gki by @cfc4n in #94

New Contributors

Full Changelog: https://github.com/ehids/ecapture/compare/v0.1.9...v0.1.10


v0.1.9 (2022-06-11)

🚀 Features

  • code refactoring: event dispatcher

    • PR: #58
  • add notes for how to use ecapture in other libs

    • PR: #60
    • : add TLS/SSL Version info (openssl).
    • PR: #62

🐛 Fixes

  • Add nosearch argument to skip auto search lib path
    • PR: #70

What's Changed

  • code refactoring: event dispatcher by @cfc4n in #58
  • add notes for how to use ecapture in other libs by @xjas in #60
  • add TLS/SSL Version info (openssl). by @cfc4n in #62
  • Update README.md by @nfsec in #63
  • fix some typos by @cuishuang in #68
  • Add nosearch argument to skip auto search lib path by @vincentmli in #70

New Contributors

  • @xjas made their first contribution in #60
  • @nfsec made their first contribution in #63
  • @cuishuang made their first contribution in #68
  • @vincentmli made their first contribution in #70

Full Changelog: https://github.com/ehids/ecapture/compare/v0.1.8...v0.1.9


v0.1.8 (2022-05-08)

What's Changed

  • ADD mysqld dispatch_command return value. by @cfc4n in #44
  • autogen vmlinux header file to compatible current OS by @cfc4n in #50
  • feat: support postgres query hook by @yihong0618 in #51
  • added return value of bash module. by @huzai9527 in #52
  • change bash line size to 256 bytes by @yindex in #55
  • add errnumber flag for command bash by @huzai9527 in #56

New Contributors

  • @huzai9527 made their first contribution in #52
  • @yindex made their first contribution in #55

Full Changelog: https://github.com/ehids/ecapture/compare/v0.1.7...v0.1.8


v0.1.7 (2022-04-22)

What's Changed

  • user: fix #29 ubuntu21.10 error :connect symbol cant found by @cfc4n in #30
  • support no co-re version on linux kernel >= 5.2 by @cfc4n in #32
  • merge two Makefile files. by @cfc4n in #33
  • images : fix #34 Inaccurate/Confusing Diagrams by @cfc4n in #36
  • Fix #37 Shared object dependence by @cfc4n in #38
  • README grammar fix by @chriskaliX in #35
  • Fix #39 .rodata: map create: read- and write-only maps not supported (requires >= v5.2) by @cfc4n in #40
  • set clang version lower to 9 from 12 by @cfc4n in #41

New Contributors

  • @cfc4n made their first contribution in #30

Full Changelog: https://github.com/ehids/ecapture/compare/v0.1.6...v0.1.7


v0.1.6 (2022-04-07)

  • 更新mysqld数据库审计模块
  • 更新tls网络捕获模块

mysqld

  • 支持mysql5.7/8.0, MariadDB 10.5+的Mysqld数据库的查询审计。
    • 自动识别mysqld版本 。
    • 自动查找hook的sql 查询函数。

tls

  • 支持openssl的IP地址关联
    • 支持网络IP地址的存储、关联到网络数据中。
    • 支持自定义libpthread.so路径指定(定位connect函数)。

v0.1.5 (2022-03-25)

  • 增加mysqld数据库审计模块

mysqld 模块

  • 支持mysql5.6的mariaDB数据库的查询审计
    • 默认path目录为/usr/sbin/mariadb 。
    • 支持function name、offset两个参数自定义。

v0.1.4 (2022-03-22)

  • 调整运行环境检测方式
    • 判断BTF支持的方法,改为优先判断/sys/kernel/btf/vmlinux文件,以及其他BTF特征的vmlinux-*目录等 。
    • 增加运行原理图。

tls(openssl) 模块

  • 支持gnutls 、 nspr 两个类库的数据捕获
  • 重命名子命令,由openssl改为tls

v0.1.3 (2022-03-20)

  • 增加运行环境检测
    • 检测linux kernel必须大于4.18 。
    • 检测kernel config中CONFIG_DEBUG_INFO_BTF必须有,且值为y。
  • 去除编译生成的文件(./bin/、./assets/、./user/bytecode/)
  • 整理go mod依赖文件

v0.1.1 (2022-03-19)

  • 模块拆分,启用子命令模式
  • 增加全局可选PID参数,针对特定PID进行数据捕获
  • 增加hexdump打印模式

openssl模块

  • 支持自定义openssl的so路径。
  • 支持hex进制的数据输出

bash模块

  • 支持自定义bash路径参数
  • 支持自定义readline.so路径参数
  • 支持hex进制的数据输出

v0.1.0 (2022-03-17)

openssl模块

  • 增加openssl的libssl.so的SSL/TLS数据抓包功能。
  • 根据wget路径,自动选择libssl.so路径。

bash模块

  • 自动根据ENV查找bash
  • 根据bash自动查找readline.so,并进行bash命令捕获