about eCapture supports kernel version.

[cfc4n]

Overview

Linux Kernel

Type	Arch	Kernel Version	ref	other
Globa Params	X86_64	5.2	cilium ebpf	.rodata cilium/ebpf#628
BTF	X86_64	4.18	cilium ebpf
ALL	ARM64	5.5	Kernel Bugs	bpf_probe_read_user returns error (-14) on Android 11, Kernel 4.14, ARM64 bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers iovisor/bcc#3783 iovisor/bcc#2253

Android Device

型号	代号	版本	说明	推荐度
Pixel 6	oriole	5.10	官方出品	**
Redmi Note 11T Pro	xaga	5.10	略过时	**
Redmi Note 12R	sky	5.10	性价比	***
Redmi Note 12	topaz	5.15	4G海外版	*
Redmi Note 12 Turbo	marble	5.10	略贵	*
Redmi Note 13	gold	5.10	新出不贵	**

---

load ebpf bytecode failed on kernel version 4.15

bash_2022/07/08 20:50:29 couldn't init manager error:program uretprobe_bash_retval: load program without BTF: permission denied: 0: (bf) r6 = r1
1: (85) call bpf_get_current_pid_tgid#14
2: (77) r0 >>= 32
3: (63) *(u32 *)(r10 -4) = r0
4: (85) call bpf_get_current_uid_gid#15
5: (79) r8 = *(u64 *)(r6 +80)
6: (bf) r2 = r10
7: (07) r2 += -4
8: (18) r1 = 0xffff9de0786f1a00
10: (85) call bpf_map_lookup_elem#1
11: (bf) r7 = r0
12: (15) if r7 == 0x0 goto pc+16
 R0=map_value(id=0,off=0,ks=4,vs=284,imm=0) R6=ctx(id=0,off=0,imm=0) R7=map_value(id=0,off=0,ks=4,vs=284,imm=0) R8=inv(id=0) R10=fp0
13: (63) *(u32 *)(r7 +264) = r8
 R0=map_value(id=0,off=0,ks=4,vs=284,imm=0) R6=ctx(id=0,off=0,imm=0) R7=map_value(id=0,off=0,ks=4,vs=284,imm=0) R8=inv(id=0) R10=fp0
14: (bf) r2 = r10
15: (07) r2 += -4
16: (18) r1 = 0xffff9de0786f1a00
18: (bf) r3 = r7
19: (b7) r4 = 0
20: (85) call bpf_map_update_elem#2
R3 type=map_value expected=fp , couldn't load eBPF programs, cs:&{map[events:PerfEventArray(keySize=0, valueSize=0, maxEntries=0, flags=0) events_t:Hash(keySize=4, valueSize=284, maxEntries=1024, flags=0)] map[uretprobe_bash_readline:0xc000138000 uretprobe_bash_retval:0xc000138140] 0xc000409320 LittleEndian}

ref : iovisor/bcc#3118

As the error message mentioned,

R3 type=map_value expected=fp

for 4.15, you cannot lookup a map, get a map_value and use it as input to another map_value for map update. The map_value used for map update needs to be on stack. This restriction has been lifted in later kernels.

unsupported Kernel Version 4.19 ARM64 ARCH

[root@VM-0-5-centos ssldump]# bin/ecapture tls
2022/06/22 23:31:13 pid info :4428
2022/06/22 23:31:13 start to run EBPFProbeOPENSSL module
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 start to run EBPFProbeGNUTLS module
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 HOOK type:2, binrayPath:/usr/lib64/libssl.so.1.1
2022/06/22 23:31:13 libPthread so Path:/usr/lib64/libpthread.so.0
2022/06/22 23:31:13 start to run EBPFProbeNSPR module
2022/06/22 23:31:13 stat /usr/lib/libnspr4.so: no such file or directory
2022/06/22 23:31:13 start to run EBPFProbeGoSSL module
2022/06/22 23:31:13 go binary not found
2022/06/22 23:31:13 HOOK type:2, binrayPath:/usr/lib64/libgnutls.so.30
2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Send 77 bytes to [ADDR_NOT_FOUND], Payload:

2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Recived 1179 bytes from [ADDR_NOT_FOUND], Payload:

2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Recived 1664 bytes from [ADDR_NOT_FOUND], Payload:

Screenshots

#108

fixed at https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5

commit ae8a76fb8b5d03fa2adc7249dc6131ba6a0c6119
Merge: d31e95585ca6 358fdb456288
Author: David S. Miller [email protected]
Date: Sat Nov 2 15:27:42 2019 -0700

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Alexei Starovoitov says:

====================
pull-request: bpf-next 2019-11-02

The following pull-request contains BPF updates for your *net-next* tree.

We've added 30 non-merge commits during the last 7 day(s) which contain
a total of 41 files changed, 1864 insertions(+), 474 deletions(-).

The main changes are:

1) Fix long standing user vs kernel access issue by introducing
   bpf_probe_read_user() and bpf_probe_read_kernel() helpers, from Daniel.

2) Accelerated xskmap lookup, from Bj枚rn and Maciej.

3) Support for automatic map pinning in libbpf, from Toke.

4) Cleanup of BTF-enabled raw tracepoints, from Alexei.

5) Various fixes to libbpf and selftests.
====================

Signed-off-by: David S. Miller <[email protected]>

[cfc4n]

in https://kernelnewbies.org/Linux_5.5

Add probe_read_user, probe_read_kernel and probe_read_user_str, probe_read_kernel_str helpers commit

[sJJdGG]

@cfc4n @gojue What about android 14 kernel 6.1? Currently getting "Permission Denied" on rooted android device

[cfc4n]

It should be supported. If you encounter problems, please send an issue.