[ { "path": ".github/ISSUE_TEMPLATE/bug_report.md", "content": "---\nname: Bug report\nabout: Create a report to help us improve\ntitle: ''\nlabels: ''\nassignees: ''\n\n---\n\n> [!IMPORTANT] \n> You can mention the @dosu AI robot, which can quickly answer your questions.\n\n\n**Describe the bug**\nA clear and concise description of what the bug is.\n\n**To Reproduce**\nSteps to reproduce the behavior:\n\n1.\n2.\n3.\n\n**Screenshots**\nIf applicable, add screenshots to help explain your problem.\n\n**Linux Server/Android (please complete the following information):**\n\n- Device: `Pixel 9` or `Linux Server`\n- Kernel Info: `uname -a`\n- eCapture Version: `ecapture -v`\n\n**Additional context**\nAdd any other context about the problem here.\n" }, { "path": ".github/agents/pr-agent.md", "content": "---\nname: eCapture-PR-Agent\ndisplay_name: eCapture PR Agent\ndescription: >\n 本 Agent 专门服务于 `gojue/ecapture` 仓库，用于自动创建 **小粒度、可审阅的代码改动 PR**。\n---\n\n# eCapture 自动 PR Agent Profile（草案）\n\n## 名称\neCapture 自动 PR 机器人（Auto PR Agent）\n\n## 作用描述\n本 Agent 专门服务于 `gojue/ecapture` 仓库，用于自动创建小粒度、可审阅的代码改动 PR。主要目标：\n\n- 维护与扩展对 OpenSSL / BoringSSL / GnuTLS / NSS / GoTLS 等加密库版本的 HOOK 支持；\n- 改进或增加内核 eBPF 侧 C 代码和 Go 用户态逻辑中的健壮性、小 bug 修复；\n- 强制为变更添加相应测试（单元测试 + e2e 脚本）；\n- 保持现有构建系统（`Makefile` / `variables.mk` / `functions.mk`）的约定与约束，但不负责发布或打包。\n\n重要约束（严格）：\n- **不向后兼容**\n- 不进行打包、发布、Tag 操作；\n- 不修改 `README*` / `CHANGELOG.md` 等文档（默认禁止改动，除非维护者明确要求）；\n- 不修改版本号或自动化发布流程。\n\n---\n\n## 作用范围（Scope）\n\nAgent 允许并应该做的事情：\n\n1. OpenSSL/其他加密库版本支持增强（核心任务）\n - 在 kern/ 源文件（`kern/openssl_*`、`kern/boringssl_*`、`kern/gnutls_*`、`kern/nspr` 等）与用户态版本检测逻辑中，增加对新版本加密库的支持；包括：\n - 在 `variables.mk` 的 `TARGETS` 中新增目标项；\n - 添加对应的 `kern/openssl__kern.c` 源文件或必要的偏移/结构体定义；\n - 在用户态（Go）中补充版本字符串映射、降级/回退逻辑与日志提示。\n - 保证对旧版本不回归，并提供最小验证（编译通过或单测覆盖关键路径）。\n\n2. 小范围代码修复与增强\n - C 代码：修复明显 bug、加健壮性检查（空指针/边界/长度），改进日志；\n - Go 代码：改进错误处理、增加或修补单元测试、提升解析/事件处理健壮性；\n - 避免大规模重构或改动公共 CLI 语义。\n\n3. 构建系统与工具链检查（不发布）\n - 可修改 `Makefile` / `variables.mk` / `functions.mk` 中与工具链检查、编译选项的小优化；\n - 不引入打包/发布动作，不修改 release 相关自动化。\n\n4. 自动创建 PR\n - 基于默认开发分支创建新分支并打开 PR；\n - PR 描述必须包含：问题背景、修改点、测试方法、兼容性说明。\n\nAgent 禁止的事项（严格）：\n- 不做发布（不生成 .deb/.rpm，不打 Tag 或更新 release）；\n- 不修改 README/CHANGELOG；\n- 不变更 CLI 外部行为（除非明确授权）；\n- 不直接修改生成的二进制 bytecode（如 user/bytecode/*.o）。\n\n---\n\n## 仓库关键约束与变更要求\n\n1. 工具链版本要求\n - Clang 版本：**要求升级为 clang 12 或更高**。Agent 在必要的构建检查中应把 `.checkver_$(CMD_CLANG)` 的阈值改为 12。\n - Go 版本：继续保持 Go 1.24 及以上（GO_VERSION_MAJ == 1 且 GO_VERSION_MIN >= 24）。\n - bpftool 等工具保持检查逻辑，但不自动安装这些工具。\n\n2. eBPF / 内核策略\n - 保留 CO-RE 与 non-CO-RE 两条构建路径，不破坏 `AUTOGENCMD` 与 `kern/bpf/*/vmlinux.h` 的生成逻辑；\n - 最小内核：x86_64 ≥ 4.18，aarch64 ≥ 5.5（该约束不被 Agent 更改）。\n\n3. OpenSSL 等库支持策略（Agent 的长期目标）\n - `variables.mk` 的 `TARGETS` 列表代表已支持版本，但 Agent 的目标是：持续添加对更新版本 OpenSSL/BoringSSL/GnuTLS/NSS 的 HOOK 支持。新增支持时，需：\n - 新增 target 与 kernel 源文件；\n - 添加用户态版本映射；\n - 提交 PR 并附带测试说明与验证方法。\n\n---\n\n## 软件测试要求（新增）\n为保证变更质量与可回溯性，Agent 在创建 PR 前必须满足以下测试要求：\n\n1. 单元测试（必需）\n - 对于任何修改或新增的 Go 代码，必须新增或修改对应的 Go 单元测试，位于与被修改包相同的测试包（例如 `package foo_test` 或 `package foo`）；\n - 新增/修改的测试应覆盖主要逻辑分支、异常路径与边界条件；\n - PR 必须能通过命令：`make test-race`（若有特定包，可只跑对应包的测试）；\n - 若修改影响到公共函数签名或行为，测试需明确验证向后兼容性。\n\n2. C/内核代码的测试与静态检查（必需/建议）\n - 对 C/eBPF 源文件，至少要保证能够通过静态语法检查与本地编译（`clang -fsyntax-only` 或 `make ebpf`）；\n - 若能做到，新增/修改的 C 代码应包含编译时断言或注释说明，以便在 CI 中尽早发现问题；\n - 在无法运行内核级测试（CI 限制）时，需在 PR 描述中注明“仅编译通过，未在目标内核上运行验证”的限制。\n\n3. CLI E2E 脚本（必需，尽量）\n - 每个涉及 CLI 行为或集成点的变更，应补充或更新一条 e2e 测试脚本（放在 `test/e2e/` 目录），脚本需：\n - 能够在受控环境下做基本的“构建 -> 启动 -> smoke test”流程（例如 `ecapture --help`、`ecapture tls -h` 或 keylog/pcap 模式的最小运行检查）；\n - 需要用root权限运行ecapture，根据代码需求，补充启动时的必要参数（`参见 --help的结果`）；\n - 再开一个终端，使用`curl`或`wget`等脚本，触发https的请求，以验证eBPF hook的基本功能（如TLS keylog生成、流量捕获等）；\n - 在 PR 中给出如何运行 e2e 的说明（本地直接执行 / CI 集成的命令行）。\n - 例：新增 `test/e2e/run_e2e.sh`，脚本执行：\n - `go test ./...` 并保存 coverage；\n - 构建二进制（`make build` 或 `go build` 作为回退）；\n - 运行 `bin/ecapture --help` 与一个最小子命令进行 smoke-test；\n - 提供可选的 Docker 模式（注释或开关）以便做更完整的运行时测试（需要 root/特权容器）。\n\n4. CI 要求（必需）\n - 在 CI 流程中至少运行：\n - 运行 `make test-race`进行项目的单元测试与竞态检测；\n - 语法检查、`go vet`、`golangci-lint`；\n - 轻量 e2e 脚本以验证二进制基本可用性。\n - 如涉及 eBPF 运行的严格验证，建议维护者决定是否启用带特权的 runner。\n\n---\n\n## 风格与质量要求\n（与之前描述一致，略述）\n- 使用 `make format` 格式化项目代码；\n- 小步提交、单一目的 PR、清晰的 PR 描述；\n- 所有 PR 中若有未解决的集成测试限制，必须在 PR 描述中注明并提供复现步骤或需要的维护者权限/环境。\n\n---\n\n## PR 模板建议（尽量用英文）\n- 标题：`[type] 简短描述`，例如：\n - `feat: 支持 OpenSSL 3.6.x HOOK`\n - `fix: 修复 gotls 在某条件下的 panic`\n- 描述结构：\n 1. 背景/目的\n 2. 修改内容（文件/模块列表）\n 3. 测试说明（单元测试、e2e 脚本、手工验证步骤）\n 4. 兼容性影响与风险评估\n 5. CI 运行状态/限制说明（如有）\n\n---\n\n## 安全与保守原则\n- 优先**少改**、保守变更；\n- 若无法确定兼容性或内核行为，不要直接合并，先开 PR 征询维护者；\n- 不随意修改 release/打包相关变量与文档，除非被明确授权。\n" }, { "path": ".github/workflows/android_e2e.yml", "content": "name: Android E2E Tests\n\non:\n pull_request:\n branches: [ master, v2, v1 ]\n\n push:\n branches: [ master, v2, v1 ]\n workflow_dispatch:\n\npermissions:\n contents: read\n issues: write\n pull-requests: write\n\nconcurrency:\n group: ${{ github.workflow }}-${{ github.ref }}\n cancel-in-progress: true\n\njobs:\n android-e2e-tests:\n runs-on: ubuntu-latest\n name: Android E2E Tests\n\n strategy:\n matrix:\n api-level: [35] # Android 15\n target: [google_apis]\n arch: [x86_64] # Use x86_64 for emulator (host arch matches)\n\n steps:\n - name: Checkout code\n uses: actions/checkout@v4\n with:\n submodules: 'recursive'\n fetch-depth: 0\n\n - name: Set up Go\n uses: actions/setup-go@v5\n with:\n go-version: '1.24.6'\n\n - name: Install Required Tools\n run: |\n sudo apt-get update\n sudo apt-get install --yes build-essential pkgconf libelf-dev llvm-14 clang-14 flex bison linux-tools-common linux-tools-generic gcc libssl-dev linux-source libpulse0 xvfb libxcb-cursor0 libxkbcommon-x11-0\n for tool in \"clang\" \"llc\" \"llvm-strip\"\n do\n sudo rm -f /usr/bin/$tool\n sudo ln -s /usr/bin/$tool-14 /usr/bin/$tool\n done\n cd /usr/src\n source_file=$(find . -maxdepth 1 -name \"*linux-source*.tar.bz2\")\n source_dir=$(echo \"$source_file\" | sed 's/\\.tar\\.bz2//g') \n sudo tar -xf $source_file\n cd $source_dir\n test -f .config || sudo make oldconfig\n shell: bash\n\n - uses: actions/checkout@v4\n with:\n submodules: 'recursive'\n fetch-depth: 0\n\n - name: Build ecapture for Android\n run: |\n # Build for x86_64 (for emulator testing)\n ANDROID=1 make clean\n ANDROID=1 make env\n echo \"Building ecapture for Android (x86_64)...\"\n CROSS_ARCH=amd64 ANDROID=1 make nocore -j$(nproc)\n \n # Verify binary\n if [ ! -f bin/ecapture ]; then\n echo \"❌ Failed to build ecapture binary\"\n exit 1\n fi\n \n echo \"=== Binary Info ===\"\n ls -lh bin/ecapture\n file bin/ecapture\n \n # Verify x86_64 architecture\n if ! file bin/ecapture | grep -q \"x86-64\\|x86_64\"; then\n echo \"❌ Binary is not x86_64\"\n exit 1\n fi\n \n echo \"✓ ecapture built successfully for Android x86_64\"\n\n - name: Build Go test client for Android\n run: |\n cd test/e2e\n echo \"Building Go HTTPS client for Android...\"\n CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o android/go_https_client_android go_https_client.go\n \n if [ -f android/go_https_client_android ]; then\n echo \"✓ Go client built successfully\"\n ls -lh android/go_https_client_android\n file android/go_https_client_android\n else\n echo \"⚠️ Go client build failed (tests will use curl)\"\n fi\n\n - name: Start Xvfb for headless display\n run: |\n echo \"Starting Xvfb virtual display...\"\n sudo Xvfb :99 -screen 0 1024x768x24 > /dev/null 2>&1 &\n echo \"DISPLAY=:99\" >> $GITHUB_ENV\n sleep 2\n echo \"✓ Xvfb started on display :99\"\n\n - name: Enable KVM group permissions\n run: |\n echo 'KERNEL==\"kvm\", GROUP=\"kvm\", MODE=\"0666\", OPTIONS+=\"static_node=kvm\"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules\n sudo udevadm control --reload-rules\n sudo udevadm trigger --name-match=kvm\n\n - name: AVD cache\n uses: actions/cache@v4\n id: avd-cache\n with:\n path: |\n ~/.android/avd/*\n ~/.android/adb*\n key: avd-${{ matrix.api-level }}-${{ matrix.arch }}\n\n - name: Create AVD and generate snapshot for caching\n if: steps.avd-cache.outputs.cache-hit != 'true'\n uses: reactivecircus/android-emulator-runner@v2\n with:\n api-level: ${{ matrix.api-level }}\n target: ${{ matrix.target }}\n arch: ${{ matrix.arch }}\n force-avd-creation: false\n ram-size: 4096M\n disk-size: 8192M\n emulator-options: -no-window -no-snapshot-save -noaudio -no-boot-anim -camera-back none\n disable-animations: true\n script: echo \"Generated AVD snapshot for caching.\"\n\n - name: Run Android E2E Tests\n uses: reactivecircus/android-emulator-runner@v2\n with:\n api-level: ${{ matrix.api-level }}\n target: ${{ matrix.target }}\n arch: ${{ matrix.arch }}\n force-avd-creation: false\n ram-size: 4096M\n disk-size: 8192M\n emulator-options: -no-snapshot-save -noaudio -no-boot-anim -camera-back none -writable-system\n disable-animations: true\n script: |\n echo \"=== Android Emulator Info ===\"\n adb devices\n adb shell getprop ro.build.version.release\n adb shell getprop ro.build.version.sdk\n adb shell uname -a\n\n echo \"=== Getting root access ===\"\n adb root\n sleep 5\n adb wait-for-device\n\n echo \"=== Checking root ===\"\n adb shell id\n\n echo \"=== Setting SELinux to permissive ===\"\n adb shell setenforce 0 || true\n adb shell getenforce\n\n echo \"=== Setup environment ===\"\n bash test/e2e/android/setup_android_env.sh || true\n\n echo \"=== Checking ecapture startup (diagnostic) ===\"\n adb push bin/ecapture /data/local/tmp/ecapture\n adb shell chmod 755 /data/local/tmp/ecapture\n echo \"--- Verifying eBPF / ecapture can start (3s sample) ---\"\n adb shell \"setsid nohup /data/local/tmp/ecapture tls -m text > /data/local/tmp/ecapture_startup.log 2>&1 < /dev/null &\"\n sleep 3\n adb shell \"ps -A | grep ecapture || echo '(no ecapture process found)'\"\n adb shell \"cat /data/local/tmp/ecapture_startup.log 2>/dev/null || echo '(no startup log)'\"\n adb shell \"ps -A | grep ecapture | awk '{print \\$2}' | while read p; do kill -9 \\$p; done 2>/dev/null || true\"\n echo \"--- ecapture diagnostic complete ---\"\n\n bash test/e2e/android/run_android_e2e_tests.sh\n\n - name: Upload test artifacts\n if: always()\n uses: actions/upload-artifact@v4\n with:\n name: android-e2e-test-logs\n path: /tmp/ecapture_android_*\n retention-days: 7\n" }, { "path": ".github/workflows/codeql-analysis.yml", "content": "# For most projects, this workflow file will not need changing; you simply need\n# to commit it to your repository.\n#\n# You may wish to alter this file to override the set of languages analyzed,\n# or to provide custom queries or build logic.\n#\n# ******** NOTE ********\n# We have attempted to detect the languages in your repository. Please check\n# the `language` matrix defined below to confirm you have the correct set of\n# supported CodeQL languages.\n#\nname: \"CodeQL\"\n\non:\n push:\n branches: [ master, v2, v1 ]\n pull_request:\n # The branches below must be a subset of the branches above\n branches: [ master, v2, v1 ]\n schedule:\n - cron: '42 15 * * 3'\n\njobs:\n analyze:\n name: Analyze\n runs-on: ubuntu-22.04\n permissions:\n actions: read\n contents: read\n security-events: write\n\n strategy:\n fail-fast: false\n matrix:\n language: [ 'cpp', 'go' ]\n # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]\n # Learn more about CodeQL language support at https://git.io/codeql-language-support\n\n steps:\n - uses: actions/setup-go@v3\n with:\n go-version: '1.24.6'\n - name: Checkout repository\n uses: actions/checkout@v4\n with:\n submodules: 'recursive'\n fetch-depth: 0\n\n - name: Install Compilers\n run: |\n sudo apt-get update\n sudo apt-get install --yes build-essential pkgconf libelf-dev llvm clang linux-tools-common linux-tools-generic flex bison gcc-aarch64-linux-gnu libssl-dev linux-source\n cd /usr/src\n source_file=$(find . -maxdepth 1 -name \"*linux-source*.tar.bz2\")\n source_dir=$(echo \"$source_file\" | sed 's/\\.tar\\.bz2//g') \n sudo tar -xf $source_file\n cd $source_dir\n test -f .config || sudo make oldconfig\n sudo make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- prepare V=0\n ls -al /usr/src/$source_dir\n shell: bash\n # Initializes the CodeQL tools for scanning.\n - name: Initialize CodeQL\n uses: github/codeql-action/init@v2\n with:\n languages: ${{ matrix.language }}\n # If you wish to specify custom queries, you can do so here or in a config file.\n # By default, queries listed here will override any specified in a config file.\n # Prefix the list here with \"+\" to use these queries and those in the config file.\n # queries: ./path/to/local/query, your-org/your-repo/queries@main\n\n # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).\n # If this step fails, then you should remove it and run the build manually (see below)\n - name: Autobuild\n uses: github/codeql-action/autobuild@v2\n\n # ℹ️ Command-line programs to run using the OS shell.\n # 📚 https://git.io/JvXDl\n\n # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines\n # and modify them (or add more) to build your code if your project\n # uses a compiled language\n\n - run: |\n make env\n make nocore -j4\n - name: Perform CodeQL Analysis\n uses: github/codeql-action/analyze@v2\n - name: Upload coverage reports to Codecov\n uses: codecov/codecov-action@v4\n with:\n token: ${{ secrets.CODECOV_TOKEN }}" }, { "path": ".github/workflows/e2e.yml", "content": "name: E2E Tests\n\non:\n pull_request:\n branches: [ master, v2, v1 ]\n types: [ opened, synchronize, reopened ]\n push:\n branches: [ master, v2, v1 ]\n\npermissions:\n contents: read\n issues: write\n pull-requests: write\n\nconcurrency:\n group: ${{ github.workflow }}-${{ github.ref }}\n cancel-in-progress: true\n\njobs:\n e2e-tests:\n runs-on: ubuntu-22.04\n name: E2E Tests (TLS/GnuTLS/GoTLS)\n \n steps:\n - uses: actions/setup-go@v5\n with:\n go-version: '1.24.6'\n\n - name: Install Required Tools\n run: |\n sudo apt-get update\n sudo apt-get install --yes \\\n build-essential \\\n pkgconf \\\n libelf-dev \\\n llvm-14 \\\n clang-14 \\\n linux-tools-common \\\n linux-tools-generic \\\n gcc \\\n curl \\\n wget \\\n netcat-openbsd \\\n openssl \\\n libssl-dev \\\n ca-certificates\n \n # Set up clang-14 as default\n for tool in \"clang\" \"llc\" \"llvm-strip\"\n do\n sudo rm -f /usr/bin/$tool\n sudo ln -s /usr/bin/$tool-14 /usr/bin/$tool\n done\n \n # Verify tools are installed\n echo \"=== Installed Tool Versions ===\"\n go version\n clang --version | head -1\n curl --version | head -1\n wget --version | head -1\n openssl version\n\n - name: Prepare Linux Headers\n run: |\n cd /usr/src\n source_file=$(find . -maxdepth 1 -name \"*linux-source*.tar.bz2\")\n if [ -n \"$source_file\" ]; then\n source_dir=$(echo \"$source_file\" | sed 's/\\.tar\\.bz2//g')\n sudo tar -xf $source_file\n cd $source_dir\n test -f .config || sudo make oldconfig\n fi\n\n - uses: actions/checkout@v4\n with:\n submodules: 'recursive'\n fetch-depth: 0\n\n - name: Build eCapture\n run: |\n make clean\n make env\n make -j$(nproc)\n \n # Verify binary was built\n if [ ! -f bin/ecapture ]; then\n echo \"❌ Failed to build ecapture binary\"\n exit 1\n fi\n \n ls -lh bin/ecapture\n file bin/ecapture\n\n - name: Run E2E Tests\n run: |\n echo \"=== Running E2E Tests ===\"\n echo \"Kernel: $(uname -r)\"\n echo \"Architecture: $(uname -m)\"\n \n # Run comprehensive e2e tests with sudo\n # Tests will connect to https://github.com to verify TLS capture\n sudo make e2e || {\n echo \"❌ E2E tests failed\"\n exit 1\n }\n\n - name: E2E Test Summary\n if: always()\n run: |\n echo \"=== E2E Test Execution Complete ===\"\n if [ $? -eq 0 ]; then\n echo \"✅ All E2E tests passed successfully\"\n else\n echo \"❌ Some E2E tests failed - check logs above\"\n fi\n\n e2e-tests-summary:\n runs-on: ubuntu-22.04\n name: E2E Test Results Summary\n needs: e2e-tests\n if: always()\n \n steps:\n - name: Check E2E Test Results\n run: |\n if [ \"${{ needs.e2e-tests.result }}\" == \"success\" ]; then\n echo \"✅ E2E Tests: PASSED\"\n exit 0\n else\n echo \"❌ E2E Tests: FAILED\"\n exit 1\n fi\n\n - name: Comment PR with E2E Results\n if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository\n uses: actions/github-script@v7\n with:\n github-token: ${{ secrets.GITHUB_TOKEN }}\n script: |\n const prNumber = context.payload.pull_request.number;\n const testResult = '${{ needs.e2e-tests.result }}';\n const runId = context.runId;\n \n const statusEmoji = testResult === 'success' ? '✅' : '❌';\n const statusText = testResult === 'success' ? 'PASSED' : 'FAILED';\n \n const body = `## ${statusEmoji} E2E Test Results: ${statusText}\n \n **Test Run:** [#${runId}](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId})\n \n ### Tests Executed:\n - TLS/OpenSSL Module (curl → github.com)\n - GnuTLS Module (wget/curl → github.com)\n - GoTLS Module (Go client → github.com)\n \n ${testResult === 'success' ? \n '✅ All e2e tests passed successfully! The TLS capture functionality is working correctly.' : \n '❌ Some e2e tests failed. Please check the workflow logs for details.'}\n \n ---\n *Automated e2e test results for commit ${context.sha.substring(0, 7)}*`;\n \n try {\n await github.rest.issues.createComment({\n issue_number: prNumber,\n owner: context.repo.owner,\n repo: context.repo.repo,\n body: body\n });\n console.log('E2E test results comment posted successfully');\n } catch (error) {\n console.log('Failed to post comment:', error.message);\n }\n" }, { "path": ".github/workflows/go-c-cpp.yml", "content": "name: GO/C/C++ CI\non:\n push:\n branches: [ master, v2, v1 ]\n pull_request:\n branches: [ master, v2, v1 ]\n\njobs:\n build-on-ubuntu2204:\n runs-on: ubuntu-22.04\n name: build on ubuntu-22.04 x86_64\n steps:\n - uses: actions/setup-go@v5\n with:\n go-version: '1.24.6'\n - name: Install Compilers\n run: |\n sudo apt-get update\n sudo apt-get install --yes build-essential pkgconf libelf-dev llvm-14 clang-14 flex bison linux-tools-common linux-tools-generic gcc gcc-aarch64-linux-gnu libssl-dev linux-source\n for tool in \"clang\" \"llc\" \"llvm-strip\"\n do\n sudo rm -f /usr/bin/$tool\n sudo ln -s /usr/bin/$tool-14 /usr/bin/$tool\n done\n cd /usr/src\n source_file=$(find . -maxdepth 1 -name \"*linux-source*.tar.bz2\")\n source_dir=$(echo \"$source_file\" | sed 's/\\.tar\\.bz2//g') \n sudo tar -xf $source_file\n cd $source_dir\n test -f .config || sudo make oldconfig\n sudo make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- prepare V=0\n ls -al /usr/src/$source_dir\n shell: bash\n - uses: actions/checkout@v4\n with:\n submodules: 'recursive'\n fetch-depth: 0\n - name: Build CO-RE\n run: |\n make clean\n make env\n DEBUG=1 make -j8\n cd ./lib/libpcap/ && sudo make install\n cd $GITHUB_WORKSPACE\n - name: golangci-lint\n uses: golangci/golangci-lint-action@v8\n with:\n version: v2.1\n skip-cache: true\n problem-matchers: true\n - name: Build non-CO-RE\n run: |\n make clean\n make env\n make nocore\n - name: Build CO-RE (Cross-Compilation)\n run: |\n make clean\n CROSS_ARCH=arm64 make env\n CROSS_ARCH=arm64 make -j8\n - name: Build non-CO-RE (Cross-Compilation/Android)\n run: |\n make clean\n CROSS_ARCH=arm64 make env\n ANDROID=1 CROSS_ARCH=arm64 make nocore -j8\n - name: Test\n run: go test -v -race ./...\n\n build-on-ubuntu2204-arm64:\n runs-on: ubuntu-22.04-arm\n name: build on ubuntu-22.04 arm64\n steps:\n - uses: actions/setup-go@v5\n with:\n go-version: '1.24.6'\n - name: Install Compilers\n run: |\n sudo apt-get update\n sudo apt-get install --yes build-essential pkgconf libelf-dev llvm-14 clang-14 flex bison linux-tools-common linux-tools-generic gcc gcc-x86-64-linux-gnu libssl-dev linux-source\n for tool in \"clang\" \"llc\" \"llvm-strip\"\n do\n sudo rm -f /usr/bin/$tool\n sudo ln -s /usr/bin/$tool-14 /usr/bin/$tool\n done\n cd /usr/src\n source_file=$(find . -maxdepth 1 -name \"*linux-source*.tar.bz2\")\n source_dir=$(echo \"$source_file\" | sed 's/\\.tar\\.bz2//g') \n sudo tar -xf $source_file\n cd $source_dir\n test -f .config || sudo make oldconfig\n sudo make ARCH=x86 CROSS_COMPILE=x86_64-linux-gnu- prepare V=0 > /dev/null\n ls -al /usr/src/$source_dir\n shell: bash\n - uses: actions/checkout@v4\n with:\n submodules: 'recursive'\n fetch-depth: 0\n - name: Build CO-RE\n run: |\n make clean\n make env\n DEBUG=1 make -j8\n cd ./lib/libpcap/ && sudo make install\n cd $GITHUB_WORKSPACE\n - name: golangci-lint\n uses: golangci/golangci-lint-action@v8\n with:\n version: v2.1\n skip-cache: true\n problem-matchers: true\n - name: Build non-CO-RE\n run: |\n make clean\n make env\n make nocore\n - name: Build CO-RE (Cross-Compilation)\n run: |\n make clean\n CROSS_ARCH=amd64 make env\n CROSS_ARCH=amd64 make -j8\n - name: Build non-CO-RE (Cross-Compilation/Android)\n run: |\n make clean\n CROSS_ARCH=amd64 make env\n ANDROID=1 CROSS_ARCH=amd64 make nocore -j8\n - name: Test\n run: go test -v -race ./...\n" }, { "path": ".github/workflows/pr_build_debug.yml", "content": "name: PR Build (Debug)\non:\n pull_request:\n branches: [ master, v2, v1 ]\n types: [ opened, synchronize, reopened ]\n\npermissions:\n contents: read\n actions: read\n\nconcurrency:\n group: ${{ github.workflow }}-${{ github.ref }}\n cancel-in-progress: true\n\njobs:\n build-debug-artifacts:\n runs-on: ubuntu-22.04\n name: Build Debug Artifacts\n strategy:\n matrix:\n os: [ android, linux ]\n arch: [ arm64, amd64 ]\n steps:\n - uses: actions/setup-go@v5\n with:\n go-version: '1.24.6'\n\n - name: Install Compilers\n shell: bash\n run: |\n sudo apt-get update\n sudo apt-get install --yes \\\n build-essential \\\n pkgconf \\\n libelf-dev \\\n llvm-14 \\\n clang-14 \\\n linux-tools-common \\\n linux-tools-generic \\\n gcc \\\n gcc-aarch64-linux-gnu \\\n linux-source\n for tool in \"clang\" \"llc\" \"llvm-strip\"\n do\n sudo rm -f /usr/bin/$tool\n sudo ln -s /usr/bin/$tool-14 /usr/bin/$tool\n done\n cd /usr/src\n source_file=$(find . -maxdepth 1 -name \"*linux-source*.tar.bz2\")\n source_dir=$(echo \"$source_file\" | sed 's/\\.tar\\.bz2//g')\n sudo tar -xf $source_file\n cd $source_dir\n test -f .config || sudo make oldconfig\n sudo make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- prepare V=0\n\n - uses: actions/checkout@v4\n with:\n submodules: 'recursive'\n fetch-depth: 0\n\n - name: Build Debug amd64\n if: matrix.arch == 'amd64'\n run: |\n make clean\n make env\n DEBUG=1 make -f builder/Makefile.release release SNAPSHOT_VERSION=v0.0.0-pr-${{ github.event.number || 'dev' }}-debug\n cp bin/ecapture-*.tar.gz dist/\n\n - name: Build Debug arm64\n if: matrix.arch == 'arm64'\n run: |\n make clean\n make env\n DEBUG=1 CROSS_ARCH=arm64 make -f builder/Makefile.release release SNAPSHOT_VERSION=v0.0.0-pr-${{ github.event.number || 'dev' }}-debug\n cp bin/ecapture-*.tar.gz dist/\n\n - name: Upload Debug Artifacts\n uses: actions/upload-artifact@v4\n with:\n name: ecapture-v0.0.0-pr-${{ github.event.number || 'dev' }}-debug-${{ matrix.os }}-${{ matrix.arch }}.tar.gz\n path: dist/ecapture-v0.0.0-pr-${{ github.event.number || 'dev' }}-debug-${{ matrix.os }}-${{ matrix.arch }}.tar.gz\n retention-days: 7\n\n - name: List Built Artifacts\n run: |\n echo \"Built debug artifacts:\"\n ls -la dist/\n echo \"Artifact sizes:\"\n du -h dist/*" }, { "path": ".github/workflows/pr_build_debug_comment.yml", "content": "name: PR Comment on Build\n\non:\n workflow_run:\n workflows: [\"PR Build (Debug)\"]\n types:\n - completed\n\npermissions:\n contents: read\n pull-requests: write\n\njobs:\n comment:\n runs-on: ubuntu-22.04\n if: >\n github.event.workflow_run.event == 'pull_request' &&\n github.event.workflow_run.conclusion == 'success'\n steps:\n - name: Comment PR with Download Links\n uses: actions/github-script@v7\n with:\n script: |\n const runId = context.payload.workflow_run.id;\n \n // Get the PR number from the workflow run\n const pullRequests = context.payload.workflow_run.pull_requests;\n if (!pullRequests || pullRequests.length === 0) {\n console.log('No pull request associated with this workflow run');\n return;\n }\n \n const prNumber = pullRequests[0].number;\n \n try {\n const commentBody = [\n `🔧 **Debug Build Complete (PR #${prNumber})**`,\n '',\n '📦 Download Links:',\n `- [View Build Artifacts](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId})`,\n '',\n '⏰ Files will be retained for 7 days, please download and test promptly.',\n '',\n '---',\n '*This build includes debug binaries for: android/linux (arm64/amd64)*'\n ].join('\\n');\n \n await github.rest.issues.createComment({\n issue_number: prNumber,\n owner: context.repo.owner,\n repo: context.repo.repo,\n body: commentBody\n });\n console.log('Comment created successfully');\n } catch (error) {\n console.log('Failed to create comment:', error.message);\n throw error;\n }" }, { "path": ".github/workflows/release.yml", "content": "name: Release\non:\n push:\n tags:\n - \"v*\"\n\nconcurrency:\n group: ${{ github.workflow }}-${{ github.ref }}\n cancel-in-progress: true\n\njobs:\n\n build-on-ubuntu2204:\n runs-on: ubuntu-22.04\n name: release Linux/Android Version (amd64/arm64)\n steps:\n - uses: actions/setup-go@v5\n with:\n go-version: '1.24.6'\n - name: Check Release Type\n id: release_type\n run: |\n TAG_NAME=${{ github.ref_name }}\n if [[ \"$TAG_NAME\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+$ ]]; then\n echo \"IS_PRERELEASE=false\" >> $GITHUB_OUTPUT\n echo \"RELEASE_TYPE=stable\" >> $GITHUB_OUTPUT\n echo \"📦 Stable release detected: $TAG_NAME\"\n elif [[ \"$TAG_NAME\" =~ (alpha|beta|rc) ]]; then\n echo \"IS_PRERELEASE=true\" >> $GITHUB_OUTPUT\n echo \"RELEASE_TYPE=prerelease\" >> $GITHUB_OUTPUT\n echo \"🚧 Pre-release detected: $TAG_NAME\"\n else\n echo \"IS_PRERELEASE=false\" >> $GITHUB_OUTPUT\n echo \"RELEASE_TYPE=stable\" >> $GITHUB_OUTPUT\n echo \"📦 Release: $TAG_NAME\"\n fi\n shell: bash\n - name: Install Compilers\n run: |\n sudo apt-get update\n sudo apt-get install --yes \\\n build-essential \\\n pkgconf \\\n libelf-dev \\\n llvm-14 \\\n clang-14 \\\n linux-tools-common \\\n linux-tools-generic \\\n gcc \\\n gcc-aarch64-linux-gnu \\\n linux-source\n for tool in \"clang\" \"llc\" \"llvm-strip\"\n do\n sudo rm -f /usr/bin/$tool\n sudo ln -s /usr/bin/$tool-14 /usr/bin/$tool\n done\n cd /usr/src\n source_file=$(find . -maxdepth 1 -name \"*linux-source*.tar.bz2\")\n source_dir=$(echo \"$source_file\" | sed 's/\\.tar\\.bz2//g') \n sudo tar -xf $source_file\n cd $source_dir\n test -f .config || sudo make oldconfig\n sudo make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- prepare V=0\n ls -al /usr/src/$source_dir\n shell: bash\n - uses: actions/checkout@v4\n with:\n submodules: 'recursive'\n fetch-depth: 0\n - uses: actions/cache@v4\n with:\n path: |\n ~/.cache/go-build\n ~/go/pkg/mod\n key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}\n restore-keys: |\n ${{ runner.os }}-go-\n - name: authenticate\n run: |\n gh auth login --with-token <<<'${{ secrets.GITHUB_TOKEN }}'\n - name: Get Previous Tag\n id: previoustag\n run: |\n PREVIOUS=$(git describe --tags --abbrev=0 HEAD^ 2>/dev/null || echo \"\")\n echo \"PREVIOUS_TAG=$PREVIOUS\" >> $GITHUB_OUTPUT\n - name: Generate Release Notes\n id: release_notes\n run: |\n gh api \\\n --method POST \\\n -H \"Accept: application/vnd.github+json\" \\\n /repos/${{ github.repository }}/releases/generate-notes \\\n -f tag_name=${{ github.ref_name }} \\\n -f previous_tag_name=${{ steps.previoustag.outputs.PREVIOUS_TAG }} \\\n > release_notes.json\n echo \"NOTES<> $GITHUB_OUTPUT\n jq -r .body release_notes.json >> $GITHUB_OUTPUT\n echo \"EOF\" >> $GITHUB_OUTPUT\n - name: Write File\n uses: DamianReeves/write-file-action@v1.2\n with:\n path: ./bin/release_notes.txt\n contents: |\n ${{ steps.release_notes.outputs.NOTES }}\n write-mode: append\n - name: Release amd64\n run: |\n make clean\n make env\n make -f builder/Makefile.release release SNAPSHOT_VERSION=${{ github.ref_name }}\n - name: Release arm64 (CROSS COMPILATION)\n run: |\n make clean\n make env\n CROSS_ARCH=arm64 make -f builder/Makefile.release release SNAPSHOT_VERSION=${{ github.ref_name }}\n - name: Publish\n env:\n IS_PRERELEASE: ${{ steps.release_type.outputs.IS_PRERELEASE }}\n run: |\n make -f builder/Makefile.release publish SNAPSHOT_VERSION=${{ github.ref_name }}\n build-docker-image:\n runs-on: ubuntu-22.04\n steps:\n - name: Checkout\n uses: actions/checkout@v4\n - name: Check Release Type\n id: release_type\n run: |\n TAG_NAME=${{ github.ref_name }}\n if [[ \"$TAG_NAME\" =~ (alpha|beta|rc) ]]; then\n echo \"IS_PRERELEASE=true\" >> $GITHUB_OUTPUT\n echo \"🚧 Pre-release detected for Docker: $TAG_NAME\"\n else\n echo \"IS_PRERELEASE=false\" >> $GITHUB_OUTPUT\n echo \"📦 Stable release detected for Docker: $TAG_NAME\"\n fi\n shell: bash\n - name: Set up QEMU\n uses: docker/setup-qemu-action@v3\n - name: Set up Docker Buildx\n uses: docker/setup-buildx-action@v3\n - name: Login to Docker Hub\n uses: docker/login-action@v3\n with:\n username: ${{ secrets.DOCKERHUB_USERNAME }}\n password: ${{ secrets.DOCKERHUB_TOKEN }}\n - name: Update submodule\n run: git submodule update --init\n - name: Prepare Docker Tags\n id: docker_tags\n run: |\n TAGS=\"${{ secrets.DOCKERHUB_USERNAME }}/ecapture:${{ github.ref_name }}\"\n if [[ \"${{ steps.release_type.outputs.IS_PRERELEASE }}\" == \"false\" ]]; then\n TAGS=\"${TAGS}\n ${{ secrets.DOCKERHUB_USERNAME }}/ecapture:latest\"\n echo \"📦 Adding 'latest' tag for stable release\"\n else\n echo \"🚧 Skipping 'latest' tag for pre-release\"\n fi\n echo \"TAGS<> $GITHUB_OUTPUT\n echo \"$TAGS\" >> $GITHUB_OUTPUT\n echo \"EOF\" >> $GITHUB_OUTPUT\n - name: Build and push\n uses: docker/build-push-action@v5\n with:\n context: .\n build-args: VERSION=${{ github.ref_name }}\n file: ./builder/Dockerfile\n platforms: linux/amd64,linux/arm64\n push: true\n cache-from: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/ecapture:buildcache\n cache-to: type=registry,ref=${{ secrets.DOCKERHUB_USERNAME }}/ecapture:buildcache,mode=max\n tags: ${{ steps.docker_tags.outputs.TAGS }}\n" }, { "path": ".gitignore", "content": "# Binaries for programs and plugins\n*.exe\n*.exe~\n*.dll\n*.so\n*.dylib\n*.d\n*.o\n\n# Test binary, built with `go test -c`\n*.test\n\n# Output of the go coverage tool, specifically when used with LiteIDE\n*.out\n\n# Log files\n*.log\n\n# Dependency directories (remove the comment below to include it)\n# vendor/\n/assets/ebpf_probe.go\n/assets/ebpf_probe_core.go\n/assets/ebpf_probe_noncore.go\n\n# VSCode\n.vscode/settings.json\n\n#idea\n.idea/*\n\nbin/*\n/.check*\n/deps/*\n/assets/probe.go\ndocs/blog/*\n\n# Example binaries\n/examples/ecaptureq_client/ecaptureq_client\npkg/proc/go_elf/go_elf\n" }, { "path": ".gitmodules", "content": "[submodule \"lib/libpcap\"]\n\tpath = lib/libpcap\n\turl = https://github.com/the-tcpdump-group/libpcap.git\n" }, { "path": ".golangci.yml", "content": "# This configuration file is not a recommendation.\n#\n# We intentionally use a limited set of linters.\n# This configuration file is used with different version of golangci-lint to avoid regressions:\n# the linters can change between version,\n# their configuration may be not compatible or their reports can be different,\n# and this can break some of our tests.\n# Also, some linters are not relevant for the project (e.g. linters related to SQL).\n#\n# We have specific constraints, so we use a specific configuration.\n#\n# See the file `.golangci.reference.yml` to have a list of all available configuration options.\n\nversion: \"2\"\n\nlinters:\n default: none\n # This list of linters is not a recommendation (same thing for all this configuration file).\n # We intentionally use a limited set of linters.\n # See the comment on top of this file.\n enable:\n - errcheck\n - staticcheck\n - errorlint\n\n settings:\n errorlint:\n asserts: false\n staticcheck:\n checks:\n # Invalid regular expression.\n # https://staticcheck.dev/docs/checks/#SA1000\n - all\n - \"-ST1000\"\n - \"-ST1005\"\n - \"-ST1003\"\n - \"-ST1021\"\n - \"-ST1023\"\n - \"-QF1012\"\n - \"-QF1008\"\n - \"-S1005\"\n - \"-S1021\"\n - \"-S1025\"\n - \"-ST1020\"\n - \"-ST1016\"\n - \"-ST1022\"\n - \"-QF1011\"\n - \"-S1034\"\n - \"-S1023\"\n - \"-SA4031\"\n - \"-S1000\"\n - \"-SA4006\"\n\n exclusions:\n paths:\n - test/\n - tests/\n - bin/\n - utils/\n\nformatters:\n enable:\n - gofmt\n - goimports\n settings:\n gofmt:\n rewrite-rules:\n - pattern: 'interface{}'\n replacement: 'any'\n goimports:\n local-prefixes:\n - github.com/gojue/ecapture\n exclusions:\n paths:\n - test/\n - tests/\n - bin/\n - utils/\n" }, { "path": "CHANGELOG.md", "content": "# v2.0.0 (2026-03-14)\n\n## What's Changed\n\n### ⚠️ Breaking Changes\n* **Architecture refactoring**: Completely migrated from the legacy `user/` directory to the new `internal/probe` standardized architecture. The old `user/` directory has been deleted. (#911, #912, #913, #914)\n* **Build tag rename**: Build tag `androidgki` has been renamed to `ecap_android`. (#930)\n* **eBPF bytecode directory**: eBPF bytecode assets have been relocated to `ebpfassets/` directory structure.\n\n### 🏗️ Architecture Refactoring (v2 Foundation)\n* Implement clean architecture foundation — Phase 3 complete + Phase 4 Plan B: All simple probes migrated (Bash, Zsh, MySQL, Postgres) by @Copilot in https://github.com/gojue/ecapture/pull/911\n* feat: Phase 4 TLS probe refactoring — Complete all libraries (OpenSSL, GnuTLS, NSPR, GoTLS) with multi-mode support and factory registration by @Copilot in https://github.com/gojue/ecapture/pull/912\n* Complete eCapture v2 Architecture Refactoring (Phases 5-7): E2E Tests, Deprecation, Migration Guide, Complete eBPF Code Migration, and CLI Integration Plan by @Copilot in https://github.com/gojue/ecapture/pull/913\n* Complete migration to `internal/probe` architecture: CLI commands, eCaptureQ HTTP server, eBPF bytecode directory, and `user/` directory deletion (8/8 probes) by @Copilot in https://github.com/gojue/ecapture/pull/914\n* Refactor `pkg/event_processor` to remove user/event dependency and fix CLI compilation by @Copilot in https://github.com/gojue/ecapture/pull/915\n* Refactor gotls probe to follow standardized architecture pattern by @Copilot in https://github.com/gojue/ecapture/pull/916\n* Refactor OpenSSL probe to follow standardized architecture pattern by @Copilot in https://github.com/gojue/ecapture/pull/917\n* refactor(nspr): Complete probe refactoring to standardized architecture by @Copilot in https://github.com/gojue/ecapture/pull/918\n* refactor: Refactor the event dispatcher setup and probe initialization process by @cfc4n in https://github.com/gojue/ecapture/pull/924\n* refactor: migrate build tag from `androidgki` to `ecap_android` by @cfc4n in https://github.com/gojue/ecapture/pull/930\n\n### ✨ New Features\n* feat: add ELF path configuration and refactor eBPF filename handling in GoTLS probe by @cfc4n\n* feat: implement logger writer and enhance output handling in various components by @cfc4n in https://github.com/gojue/ecapture/pull/925\n* feat: implement buffered pcapng packet writing with interface metadata and improved closure handling by @cfc4n in https://github.com/gojue/ecapture/pull/928\n* feat: Optimize GoTLS event handling, enhance OpenSSL configuration (including Android support), and add configuration validation by @cfc4n in https://github.com/gojue/ecapture/pull/936\n* feat: add connection event handling and enhance TLS event structure with additional fields by @cfc4n in https://github.com/gojue/ecapture/pull/938\n\n### 🐛 Bug Fixes & Improvements\n* refactor: rename documentation files and update capture mode handling in configuration by @cfc4n in https://github.com/gojue/ecapture/pull/923\n* refactor: rename Chinese documentation files and update links in README by @cfc4n in https://github.com/gojue/ecapture/pull/927\n* Fix E2E test failures: Android arch detection, missing curl fallback, keylog test tolerance by @Copilot in https://github.com/gojue/ecapture/pull/944\n* Revert non-tag changes, keep ebpfassets/dynamic, minimally fix unit tests by @cfc4n in https://github.com/gojue/ecapture/pull/945\n\n### 🧪 Testing\n* Add comprehensive E2E test suite with 72+ scenarios covering all modules by @Copilot in https://github.com/gojue/ecapture/pull/919\n\n### 🔧 CI/CD & Tooling\n* feat: enhance release workflow with pre-release detection and Docker tagging by @cfc4n\n* docs: add comprehensive documentation for eCapture project and update compilation references by @cfc4n\n\n## New Contributors\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.5.2...v2.0.0\n
\n\n# v1.5.2 (2025-12-27)\n\n## What's Changed\n* add entry for android 16 by @jeromekleinen in https://github.com/gojue/ecapture/pull/899\n* comment out early returns in SSL_write by @jeromekleinen in https://github.com/gojue/ecapture/pull/903\n* Optimized the FD fetch logic of openssl by @cfc4n in https://github.com/gojue/ecapture/pull/905\n* feat(gotls): support Go binaries built with -ldflags=\"-s -w\" by @wocaolideTwistzz in https://github.com/gojue/ecapture/pull/907\n* refactor: remove kernel version detect for less than 5.2 by @cfc4n in https://github.com/gojue/ecapture/pull/906\n\n## New Contributors\n* @jeromekleinen made their first contribution in https://github.com/gojue/ecapture/pull/899\n* @wocaolideTwistzz made their first contribution in https://github.com/gojue/ecapture/pull/907\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.5.1...v1.5.2\n
\n\n# v1.5.1 (2025-12-07)\n\n## What's Changed\n* fix (iworker): handle empty payload and ignore EOF error in parser write. by @cfc4n in https://github.com/gojue/ecapture/pull/897\n\n## New Contributors\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.5.0...v1.5.1\n
\n\n# v1.5.0 (2025-12-07)\n\n## What's Changed\n* feat: support OpenSSL 3.5.4 by @namoen0301 in https://github.com/gojue/ecapture/pull/857\n* build(deps): bump golang.org/x/crypto from 0.38.0 to 0.45.0 by @dependabot[bot] in https://github.com/gojue/ecapture/pull/864\n* Add protobuf-based WebSocket client example and fix ecaptureq documentation by @Copilot in https://github.com/gojue/ecapture/pull/868\n* docs: update READMEs with protobuf protocol links and refactor visualizer docs by @zenyanle in https://github.com/gojue/ecapture/pull/869\n* feat: add eCapture Issue Responder template for Copilot Agent. by @cfc4n in https://github.com/gojue/ecapture/pull/873\n* feat: add eCapture PR Agent Profile. by @cfc4n in https://github.com/gojue/ecapture/pull/878\n* fix: prevent nil pointer panic in gnutls probe when setup fails by @Copilot in https://github.com/gojue/ecapture/pull/879\n* bugfix(gotls_kern): use actual data_len while reading payload by @h0x0er in https://github.com/gojue/ecapture/pull/882\n* fix(ecaptureq): adjust heartbeat frequency and trigger immediate ping by @zenyanle in https://github.com/gojue/ecapture/pull/884\n* feat: add support for BoringSSL on Android 16 with updated offsets by @cfc4n in https://github.com/gojue/ecapture/pull/885\n* Fix HTTP/2 parser logging spurious \"unexpected EOF\" errors during TLS capture by @Copilot in https://github.com/gojue/ecapture/pull/886\n* feat: add e2e testing framework and multiple HTTPS client examples by @cfc4n in https://github.com/gojue/ecapture/pull/887\n* Add comprehensive e2e tests for TLS, GnuTLS, and GoTLS modules with CI integration by @Copilot in https://github.com/gojue/ecapture/pull/888\n* feat: add remote configuration update API documentation and event forwarding details by @cfc4n in https://github.com/gojue/ecapture/pull/889\n* Enhance e2e tests with content verification and multi-mode coverage by @Copilot in https://github.com/gojue/ecapture/pull/890\n* fix(gotls): correct event output logic and support protobuf by @zenyanle in https://github.com/gojue/ecapture/pull/891\n* fix: simplify PR comment condition to trigger on all pull requests by @cfc4n in https://github.com/gojue/ecapture/pull/894\n\n## New Contributors\n* @namoen0301 made their first contribution in https://github.com/gojue/ecapture/pull/857\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.4.3...v1.5.0\n
\n\n# v1.4.3 (2025-10-12)\n\n## What's Changed\n* fix: resolve kernel 4.19 compatibility issue with .rodata maps in eBPF bytecode by @Copilot in https://github.com/gojue/ecapture/pull/846\n* bugfix: keep nanoseconds precision for timestamps by @h0x0er in https://github.com/gojue/ecapture/pull/850\n* Refactor: Migrate Agent-Server Communication Protocol to Protobuf by @zenyanle in https://github.com/gojue/ecapture/pull/851\n* bugfix: update permissions and improve error handling in PR comment workflow by @cfc4n in https://github.com/gojue/ecapture/pull/853\n* feat: update eCapture logo and enhance eCaptureQ GUI application section in README files by @cfc4n in https://github.com/gojue/ecapture/pull/854\n\n## New Contributors\n* @Copilot made their first contribution in https://github.com/gojue/ecapture/pull/846\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.4.2...v1.4.3\n
\n\n# v1.4.2 (2025-09-27)\n\n## What's Changed\n* feat: add eCaptureQ GUI application documentation in English, Chinese… by @cfc4n in https://github.com/gojue/ecapture/pull/836\n* kern/gotls_kern: refactored event creation logic by @h0x0er in https://github.com/gojue/ecapture/pull/839\n* feat: enhance PR build debug workflow with permissions and detailed completion message by @cfc4n in https://github.com/gojue/ecapture/pull/843\n\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.4.1...v1.4.2\n
\n\n# v1.4.1 (2025-08-23)\n\n## What's Changed\n* fix: refactor event logging to use new CollectorWriter and improve error handling by @cfc4n in https://github.com/gojue/ecapture/pull/821\n* typo: comment in cmd packages by @webfrogs in https://github.com/gojue/ecapture/pull/827\n* bugfix: support keylog mode for OpenSSL 3.0.12 by @foxayy in https://github.com/gojue/ecapture/pull/826\n* feat: update Go version to 1.24.6 across multiple configuration files by @cfc4n in https://github.com/gojue/ecapture/pull/828\n\n## New Contributors\n* @webfrogs made their first contribution in https://github.com/gojue/ecapture/pull/827\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.4.0...v1.4.1\n
\n\n# v1.4.0 (2025-08-11)\n\n## What's Changed\n\n* feat: implement WebSocket client and server for log transmission by @cfc4n\n in https://github.com/gojue/ecapture/pull/806\n* Fix: Correctly resolve relative paths in /etc/ld.so.conf by @foxayy in https://github.com/gojue/ecapture/pull/808\n* fix: missing trailing bytes for some keys in gotls keylog by @yhlooo in https://github.com/gojue/ecapture/pull/812\n* feat: add WebSocket server and PacketData structure for log handling by @cfc4n\n in https://github.com/gojue/ecapture/pull/810\n* feat: refactor event types to use unified Type structure across events by @cfc4n\n in https://github.com/gojue/ecapture/pull/814\n* feat: add GitHub Actions workflow for PR debug builds and artifact uploads by @cfc4n\n in https://github.com/gojue/ecapture/pull/815\n* fix: update GitHub Actions workflow for PR debug builds and artifact uploads by @cfc4n\n in https://github.com/gojue/ecapture/pull/817\n* fix: correct return statements and improve error handling in BoringSSL by @cfc4n\n in https://github.com/gojue/ecapture/pull/816\n* feat: implement OpenSSL version downgrade logic and improve logging by @cfc4n\n in https://github.com/gojue/ecapture/pull/819\n* feat: update OpenSSL version offsets for 3.0, 3.2, 3.3, 3.4, and 3.5 by @cfc4n\n in https://github.com/gojue/ecapture/pull/820\n\n## New Contributors\n\n* @foxayy made their first contribution in https://github.com/gojue/ecapture/pull/808\n* @yhlooo made their first contribution in https://github.com/gojue/ecapture/pull/812\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.3.1...v1.4.0\n
\n\n# v1.3.1 (2025-06-29)\n\n## What's Changed\n\n* fix: share same hpack decoder for one tuple connect #744 by @chilli13 in https://github.com/gojue/ecapture/pull/798\n* fix: Improve bash path detection and correct probe attachment by @zenyanle\n in https://github.com/gojue/ecapture/pull/805\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.3.0...v1.3.1\n
\n\n# v1.3.0 (2025-06-22)\n\n## What's Changed\n\n* feat: enhance BPF core read macros and add new utility functions by @cfc4n\n in https://github.com/gojue/ecapture/pull/797\n* feat: support gnutls early secret by @yuweizzz in https://github.com/gojue/ecapture/pull/801\n* fix: keylog lost in openssl by @yuweizzz in https://github.com/gojue/ecapture/pull/802\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.2.0...v1.3.0\n
\n\n# v1.2.0 (2025-06-14)\n\n## What's Changed\n\n* feat: add JetBrains logo and acknowledgements to README files by @cfc4n in https://github.com/gojue/ecapture/pull/793\n* feat: Implement dual lifecycle management for eventWorker by @zenyanle in https://github.com/gojue/ecapture/pull/785\n* rorate: add eventroratesize, eventroratetime to support file rorate #720 by @chilli13\n in https://github.com/gojue/ecapture/pull/794\n* feat: define early_secret in SSL structures for enhanced security by @cfc4n\n in https://github.com/gojue/ecapture/pull/792\n\n## New Contributors\n\n* @zenyanle made their first contribution in https://github.com/gojue/ecapture/pull/785\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.1.0...v1.2.0
\n\n# v1.1.0 (2025-05-30)\n\n## What's Changed\n\n* feat: allow capture icmp protocol by @yuweizzz in https://github.com/gojue/ecapture/pull/779\n* opt: redesign the truncate effect logic to reduce memory cost in text mode #718 by @chilli13\n in https://github.com/gojue/ecapture/pull/775\n* fix: clean up SSLDataEvent string methods and improve logging #776 by @cfc4n\n in https://github.com/gojue/ecapture/pull/777\n* fix: improve logging for truncated events and update string formatting by @cfc4n\n in https://github.com/gojue/ecapture/pull/780\n* feat: support openssl version 3.5.0 #783 by @chilli13 in https://github.com/gojue/ecapture/pull/787\n* fix: avoid writing empty decryption secrets block in savePcapng method by @cfc4n\n in https://github.com/gojue/ecapture/pull/786\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.0.2...v1.1.0\n
\n\n# v1.0.2 (2025-05-03)\n\n## What's Changed\n\n* feat: add support for OpenSSL 3.3.3 and 3.4.1, update version mappings by @cfc4n\n in https://github.com/gojue/ecapture/pull/769\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.0.1...v1.0.2\n
\n\n# v1.0.1 (2025-04-08)\n\n## What's Changed\n\n* fix: update clang version to 10 in installation scripts by @cfc4n in https://github.com/gojue/ecapture/pull/758\n* refactor: support loopback interface, remove loopback device checks from pcap probe files by @cfc4n\n in https://github.com/gojue/ecapture/pull/762\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v1.0.0...v1.0.1\n
\n\n# v1.0.0 Stable Versions (2025-03-25)\n\n## 🚀 eCapture Features Overview\n\neCapture is a powerful network traffic capture and decryption tool focusing on TLS/SSL protocol transparency and\nanalysis. It supports multiple protocols and architectures, providing efficient and flexible capture and decryption\ncapabilities.\n\n---\n\n### Core Features\n\n1. **Multi-Protocol Support**\n\n- Supports TLS, gnutls, nss, openssl, and other encryption protocols, compatible with different versions of SSL/TLS\n implementations.\n\n2. **Smart Packet Capture**\n\n- Based on eBPF technology, enabling efficient network data capture and protocol parsing. Supports IPv4, IPv6 dual-stack\n and 4-tuple filtering.\n\n3. **Master Key Capture**\n\n- Supports TLS 1.2 and 1.3 protocol master key capture. Integrates with Wireshark for decryption, allowing direct\n viewing of encrypted traffic in plain text.\n\n4. **Modular Architecture**\n\n- Modular design allows for easy extension and flexible configuration of different protocol modules.\n\n5. **Cross-Platform Support**\n\n- Supports Linux, Android, and other platforms, compatible with ARM64 and x86 architectures, adapting to different\n environments.\n\n---\n\n### Features\n\n- **Automation** \n Automatically detects SSL/TLS library versions, intelligently identifies CO-RE and non-CO-RE modes, optimizes memory\n usage.\n\n- **Flexible Configuration** \n Supports custom filters, log files, decryption modes (keylog, pcap, text), and multiple output formats.\n\n- **High Performance** \n High-efficiency data processing based on eBPF, supports large-scale concurrent captures and long-term packet\n capturing.\n\n- **Strong Compatibility** \n Supports multiple SSL/TLS library versions, including openssl 1.1.1, 3.0.x, boringssl, etc.\n\n- **Extensibility** \n Provides Wireshark plugin support for easy data analysis and visualization.\n\n---\n\n### Technical Advantages\n\n- **eBPF Engine** \n Utilizes advanced eBPF technology to improve capture and decryption efficiency, reducing system resource usage.\n\n- **Modular Architecture** \n Core functionality is modularized for easy extension and maintenance.\n\n- **Intelligence** \n Automatically detects the runtime environment and intelligently adapts to different protocols and architectures.\n\n---\n\n### Application Scenarios\n\n1. **Network Debugging** \n Real-time capture and decryption of TLS/SSL traffic to assist in development and debugging.\n\n2. **Security Analysis** \n Analyze encrypted communications to identify potential security vulnerabilities.\n\n3. **Protocol Research** \n Study TLS/SSL protocol implementations and analyze traffic characteristics.\n\n4. **Monitoring and Auditing** \n Monitor network communications, record, and audit sensitive operations.\n\n### Links\n\n1. [eCapture旁观者](https://ecapture.cc)\n2. [eCapture Github](https://github.com/gojue/ecapture)\n3. 微信公众号\n ![ecapture-wechat](./images/wechat_gzhh.png)\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.9.5...v1.0.0\n
\n\n# v0.9.5 (2025-03-08)\n\n## What's Changed\n\n* fix: incorrect stream id in http2 protocol data frame by @yuweizzz in https://github.com/gojue/ecapture/pull/737\n* Fix: #740, the bug of incomplete SSL data for excessively long lengths. by @cfc4n\n in https://github.com/gojue/ecapture/pull/742\n* improve: provide opts to set the truncate size in text mode to reduce memory cost by @yuweizzz\n in https://github.com/gojue/ecapture/pull/731\n* improve: handle COMPRESSION_ERROR to reduce the error log displayed by @yuweizzz\n in https://github.com/gojue/ecapture/pull/745\n* fix: #739 the tuple to be unreachable. by @cfc4n in https://github.com/gojue/ecapture/pull/741\n* improve: add frame length by @yuweizzz in https://github.com/gojue/ecapture/pull/748\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.9.4...v0.9.5\n
\n\n# v0.9.4 (2025-02-16)\n\n## What's Changed\n\n* feat(boringssl): add support Android15 BoringSSL by @cfc4n in https://github.com/gojue/ecapture/pull/723\n* feat: support ipv6 4-tuple (#724) by @chilli13 in https://github.com/gojue/ecapture/pull/728\n* improve: include a stream id field when parse http2 event by @yuweizzz in https://github.com/gojue/ecapture/pull/734\n* tuple: bugfix for tuple ipv4 dst ip info by @chilli13 in https://github.com/gojue/ecapture/pull/735\n\n## New Contributors\n\n* @chilli13 made their first contribution in https://github.com/gojue/ecapture/pull/728\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.9.3...v0.9.4\n
\n\n# v0.9.3 (2025-01-18)\n## What's Changed\n\n* fix(make): improve error handling and clean target logic in Makefile by @cfc4n\n in https://github.com/gojue/ecapture/pull/713\n* fix: incorrect CAP_BPF check method by @hengyoush in https://github.com/gojue/ecapture/pull/715\n* feat(ci): update GitHub Action runners with Linux arm64 host by @cfc4n in https://github.com/gojue/ecapture/pull/722\n\n## New Contributors\n\n* @hengyoush made their first contribution in https://github.com/gojue/ecapture/pull/715\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.9.2...v0.9.3\n
\n\n# v0.9.2 (2024-12-29)\n\n## What's Changed\n\n* Limit GitHub action serialization and increase CI caching function by @cfc4n\n in https://github.com/gojue/ecapture/pull/698\n* fix : add openssl_3_1_0 target by @cuijing90 in https://github.com/gojue/ecapture/pull/704\n* performance: use first h2 frame header detect instead of read first frame from whole payload by @yuweizzz\n in https://github.com/gojue/ecapture/pull/705\n* fix #697, When building in nocore mode, use only non-core bytecode les by default. by @cfc4n\n in https://github.com/gojue/ecapture/pull/708\n* fix: check CAP_BPF by capget syscall by @Asphaltt in https://github.com/gojue/ecapture/pull/707\n* fixed the issue of missing cross-compilation environment. by @cfc4n in https://github.com/gojue/ecapture/pull/709\n* fix(ci): fix github action release notes generation by @cfc4n in https://github.com/gojue/ecapture/pull/710\n\n## New Contributors\n\n* @cuijing90 made their first contribution in https://github.com/gojue/ecapture/pull/704\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.9.1...v0.9.2\n
\n\n# v0.9.1 (2024-12-18)\n\n## What's Changed\n\n* fix: invalid indirect read from stack by @Asphaltt in https://github.com/gojue/ecapture/pull/694\n* fix: use other hooks to probe 5-tuple by @Asphaltt in https://github.com/gojue/ecapture/pull/695\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.9.0...v0.9.1\n
\n\n# v0.9.0 (2024-12-15)\n\n## What's Changed\n\n* fix: pcap filter not work as expected by @yuweizzz in https://github.com/gojue/ecapture/pull/680\n* feat support capture zsh command by @SenberHu in https://github.com/gojue/ecapture/pull/683\n* feat: detect CAP_BPF by @Asphaltt in https://github.com/gojue/ecapture/pull/681\n* feat: Enrich addr info with remote addr info by @Asphaltt in https://github.com/gojue/ecapture/pull/684\n* fix ecapture docker images CVE-2024-24790 by @cfc4n in https://github.com/gojue/ecapture/pull/687\n* fix #685, the Processor print \"incoming chan is full\",and exit. by @cfc4n\n in https://github.com/gojue/ecapture/pull/686\n* feat: Support for new version detection feature. by @cfc4n in https://github.com/gojue/ecapture/pull/688\n* build(deps): bump golang.org/x/crypto from 0.23.0 to 0.31.0 by @dependabot\n in https://github.com/gojue/ecapture/pull/690\n* feat: Clean map when destroy socket by @Asphaltt in https://github.com/gojue/ecapture/pull/691\n\n## New Contributors\n\n* @SenberHu made their first contribution in https://github.com/gojue/ecapture/pull/683\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.12...v0.9.0\n
\n\n# v0.8.12 (2024-12-02)\n\n## What's Changed\n\n* Fix the version number string cannot be found in the dynamic library of boringssl. by @cfc4n\n in https://github.com/gojue/ecapture/pull/679\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.11...v0.8.12\n
\n\n# v0.8.11 (2024-12-01)\n## What's Changed\n\n* fix(user/module): read version from libcrypto.so by @xxxxxliil in https://github.com/gojue/ecapture/pull/661\n* fix MariaDB typo in README.md by @robertsilen in https://github.com/gojue/ecapture/pull/672\n* Add a reminder for failure when hooking libnss3.so. by @cfc4n in https://github.com/gojue/ecapture/pull/677\n\n## New Contributors\n\n* @robertsilen made their first contribution in https://github.com/gojue/ecapture/pull/672\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.10...v0.8.11\n
\n\n# v0.8.10 (2024-11-16)\n## What's Changed\n\n* feat(user/module): add ossl version 3.4.0 support by @xxxxxliil in https://github.com/gojue/ecapture/pull/660\n* docs: fix jp translation by @ame-yu in https://github.com/gojue/ecapture/pull/663\n* feat: support keylog and pcap mode in gnutls by @yuweizzz in https://github.com/gojue/ecapture/pull/654\n* Fix the parameter error issue of the uprobe type hook. by @cfc4n in https://github.com/gojue/ecapture/pull/665\n* chore: remove unused flags `BuildRequires` in rpmBuild.spec by @cfc4n in https://github.com/gojue/ecapture/pull/666\n* builder: fix init script fails to run on ubuntu 24.04 system #667 by @cfc4n\n in https://github.com/gojue/ecapture/pull/668\n\n## New Contributors\n\n* @ame-yu made their first contribution in https://github.com/gojue/ecapture/pull/663\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.9...v0.8.10\n
\n\n# v0.8.9 (2024-10-26)\n\n## What's Changed\n\n* typo: 3中 --> 3种 by @CC11001100 in https://github.com/gojue/ecapture/pull/641\n* fix: SSLDataEvent's fd is 0 Error by @yuweizzz in https://github.com/gojue/ecapture/pull/642\n* fix: couldn't find bpf bytecode file error by @yuweizzz in https://github.com/gojue/ecapture/pull/650\n\n## New Contributors\n\n* @CC11001100 made their first contribution in https://github.com/gojue/ecapture/pull/641\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.8...v0.8.9\n\n# v0.8.8 (2024-10-09)\n## What's Changed\n\n* Fix the bug that the arm64 version cannot work (#649) by @cfc4n in https://github.com/gojue/ecapture/pull/648\n* builder: docerk build error: header not found by @cfc4n in https://github.com/gojue/ecapture/pull/648\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.7...v0.8.8\n
\n\n# v0.8.7 (2024-10-07)\n## What's Changed\n\n* feat: remove tcp packet limitation by @yuweizzz in https://github.com/gojue/ecapture/pull/619\n* kern: support openssl 3.3.2/3.2.3/3.1.7/3.0.15 by @cfc4n in https://github.com/gojue/ecapture/pull/624\n* workflows: update linux source tgz file version. by @cfc4n in https://github.com/gojue/ecapture/pull/644\n* fix the issue with retrieving the return value of the Read function in the Golang TLS module. by @cfc4n\n in https://github.com/gojue/ecapture/pull/646\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.6...v0.8.7\n
\n\n# v0.8.6 (2024-09-06)\n## What's Changed\n\n* GitHub action codecov by @cfc4n in https://github.com/gojue/ecapture/pull/594\n* fix: fix undeclared identifier error when make in debug mode by @yuweizzz\n in https://github.com/gojue/ecapture/pull/593\n* user: adjusted the timing of the display of the kernel version is too low by @cfc4n\n in https://github.com/gojue/ecapture/pull/607\n* kern: support uid/pid filter in ebpf TC hook. by @cfc4n in https://github.com/gojue/ecapture/pull/606\n* fix: fallback to default version with warn by @xxxxxliil in https://github.com/gojue/ecapture/pull/613\n* chore: Use `-tags 'netgo'` in bulding process to avoid SIGSEGV because of the different version of glibc in dfferent\n Linux distros by @Zheaoli in https://github.com/gojue/ecapture/pull/616\n\n## New Contributors\n\n* @xxxxxliil made their first contribution in https://github.com/gojue/ecapture/pull/613\n* @Zheaoli made their first contribution in https://github.com/gojue/ecapture/pull/616\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.5...v0.8.6\n
\n\n# v0.8.5 (2024-08-19)\n## What's Changed\n* feat: parse http2 data in text mode by @yuweizzz in https://github.com/gojue/ecapture/pull/580\n* pkg: add http2 request/response unit test. by @cfc4n in https://github.com/gojue/ecapture/pull/583\n* feat: allow capture ipv6 packet by @yuweizzz in https://github.com/gojue/ecapture/pull/586\n* workflows: remove Qodana CI workflow. by @cfc4n in https://github.com/gojue/ecapture/pull/589\n* Constant parameter notice by @cfc4n in https://github.com/gojue/ecapture/pull/591\n* user: split loggers, which are divided into loggers and event collectors by @cfc4n in https://github.com/gojue/ecapture/pull/592\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.4...v0.8.5\n
\n\n# v0.8.4 (2024-07-09)\n## What's Changed\n* add possible linux kernel config path by @w568w in https://github.com/gojue/ecapture/pull/561\n* workflows: add Qodana by @cfc4n in https://github.com/gojue/ecapture/pull/563\n* fix create output.log failed. by @cfc4n in https://github.com/gojue/ecapture/pull/566\n* pkg: fix send on closed channel by @cfc4n in https://github.com/gojue/ecapture/pull/567\n* fix: DumpResponse error in HEAD request by @yuweizzz in https://github.com/gojue/ecapture/pull/572\n* fix: truncated body dump error by @yuweizzz in https://github.com/gojue/ecapture/pull/573\n* kern: support openssl 3.3.* by @cfc4n in https://github.com/gojue/ecapture/pull/575\n* kern: Adjust the timing of key acquisition to distinguish between TLS by @cfc4n in https://github.com/gojue/ecapture/pull/576\n\n## New Contributors\n* @w568w made their first contribution in https://github.com/gojue/ecapture/pull/561\n* @yuweizzz made their first contribution in https://github.com/gojue/ecapture/pull/572\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.3...v0.8.4\n
\n\n# v0.8.3 (2024-06-01)\n## What's Changed\n* user: fix #553, `hashLen` is not allowed to be more than 64 bytes by @cfc4n in https://github.com/gojue/ecapture/pull/554\n* cli: update docker usage by @cfc4n in https://github.com/gojue/ecapture/pull/556\n* kern: Support for the non-Android boringssl library has been added. by @cfc4n in https://github.com/gojue/ecapture/pull/555\n* user: format clientRandom string in gotls module by @cfc4n in https://github.com/gojue/ecapture/pull/557\n* cli: support logger level by @cfc4n in https://github.com/gojue/ecapture/pull/558\n* use kprobe/__sys_connect inseated uprobe/connect. by @cfc4n in https://github.com/gojue/ecapture/pull/559\n\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.2...v0.8.3\n
\n\n# v0.8.2 (2024-05-19)\n## What's Changed\n* android version compilation has failed. by @cfc4n in https://github.com/gojue/ecapture/pull/548\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.1...v0.8.2\n
\n\n# v0.8.1 (2024-05-19)\n## What's Changed\n* makefile: Optimized the generation mechanism of kernel header files by @cfc4n in https://github.com/gojue/ecapture/pull/536\n* add dockerfile by @sancppp in https://github.com/gojue/ecapture/pull/537\n* cli: Use a formatted logger rs/zerolog by @cfc4n in https://github.com/gojue/ecapture/pull/539\n* utils: supported openssl 1.1.1w, 3.0.13, 3.1.5, 3.2.1 by @cfc4n in https://github.com/gojue/ecapture/pull/540\n* BPF name should be appended after _core/_noncore by @darren in https://github.com/gojue/ecapture/pull/545\n* user: fixed #542, masterkey being written to pcapng multiple times. by @cfc4n in https://github.com/gojue/ecapture/pull/546\n* user: prepare for service-oriented architecture. by @cfc4n in https://github.com/gojue/ecapture/pull/541\n\n## New Contributors\n* @darren made their first contribution in https://github.com/gojue/ecapture/pull/545\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.8.0...v0.8.1\n
\n\n# v0.8.0 (2024-05-04)\n## 🚀 Breaking Changes\n- for User: No need to distinguish between CO-RE and non-CO-RE versions, automatically identified by eCapture.\n - 无需区分CO-RE和non-CO-RE版本，由eCapture自动识别。\n- for Developer: Supports cross-compilation for both amd64 and arm64 CPU architectures, building CO-RE and non-CO-RE versions respectively.\n - 支持在amd64\\arm64两个CPU架构下的交叉编译，分别构建CO-RE和non-CO-RE版本\n\n## What's Changed\n* chore: rename ecapture module name. by @cfc4n in https://github.com/gojue/ecapture/pull/530\n* Fix keylog mode not working correctly on certain OpenSSL versions by @AmazingPP in https://github.com/gojue/ecapture/pull/534\n* feat: support CORE and non-CORE mode in one by @cfc4n in https://github.com/gojue/ecapture/pull/532\n* workflows: change steps.get_tags.outputs.VERSION to github.ref_name by @sancppp in https://github.com/gojue/ecapture/pull/535\n\n## New Contributors\n* @AmazingPP made their first contribution in https://github.com/gojue/ecapture/pull/534\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.7.7...v0.8.0\n
\n\n# v0.7.7 (2024-04-21)\n## What's Changed\n* [Fix] get textStart from pclnTable by @wlingze in https://github.com/gojue/ecapture/pull/516\n* fix: amd64, offset read error issue for PIE executable. PR #516 by @cfc4n in https://github.com/gojue/ecapture/pull/517\n* makefile: used CC=$(CROSS_COMPILE)gcc for CGO compile. by @cfc4n in https://github.com/gojue/ecapture/pull/519\n* user: return error when detect openssl version failed. by @cfc4n in https://github.com/gojue/ecapture/pull/521\n* user : fixed the invalid address reference of the SSL_in_before symbol OpenSSL 1.0.2k. by @cfc4n in https://github.com/gojue/ecapture/pull/520\n* feat: support cross-compilation for workflows. by @cfc4n in https://github.com/gojue/ecapture/pull/523\n* readme: improve English README.md translation and add TOCs by @zhoukuncheng in https://github.com/gojue/ecapture/pull/525\n* build(deps): bump golang.org/x/net from 0.17.0 to 0.23.0 by @dependabot in https://github.com/gojue/ecapture/pull/528\n\n## New Contributors\n* @wlingze made their first contribution in https://github.com/gojue/ecapture/pull/516\n* @zhoukuncheng made their first contribution in https://github.com/gojue/ecapture/pull/525\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.7.6...v0.7.7\n
\n\n# v0.7.6 (2024-03-30)\n## What's Changed\n* fix #500 to avoid potential hang and event loss by @ruitianzhong in https://github.com/gojue/ecapture/pull/501\n* fix issue#504 by @sancppp in https://github.com/gojue/ecapture/pull/506\n* tentative fix to address bash problem #490 by @ruitianzhong in https://github.com/gojue/ecapture/pull/510\n* Fix cant found RET offset in gotls mode. fix #502. by @cfc4n in https://github.com/gojue/ecapture/pull/512\n\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.7.5...v0.7.6\n
\n\n\n# v0.7.5 (2024-03-03)\n## What's Changed\n* Improve makefile by @cfc4n in https://github.com/gojue/ecapture/pull/488\n* Fix: init GoTLSProbe.tcPacketsChan #492 by @ruitianzhong in https://github.com/gojue/ecapture/pull/493\n* fix: avoid printing confusing message when input contains special character by @ruitianzhong in https://github.com/gojue/ecapture/pull/495\n* correctly update ContentLength for uncompressed response body by @ruitianzhong in https://github.com/gojue/ecapture/pull/498\n* add -race flags for `go test` and fix data race warning by @ruitianzhong in https://github.com/gojue/ecapture/pull/499\n* openssl: encode the value of fd (ssl->wbio->num) to gen uuid, rather than an unexpected random number by @wuyexkx in https://github.com/gojue/ecapture/pull/494\n\n## New Contributors\n* @ruitianzhong made their first contribution in https://github.com/gojue/ecapture/pull/493\n* @wuyexkx made their first contribution in https://github.com/gojue/ecapture/pull/494\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.7.4...v0.7.5\n
\n\n# v0.7.4 (2024-02-24)\n## 🚀 Breaking Changes\neCapture supports [Pcap Filter Syntax] (https://www.tcpdump.org/manpages/pcap-filter.7.html), and you can use the pcap filter expression to filter network packets like tcpdump.\n\nIn the tls\\gotls module, when the running mode is 'pcap', the pcap filter expression is supported, which can be set in the last parameter of the command line, for example:\n\n------\neCapture支持[Pcap Filter Syntax](https://www.tcpdump.org/manpages/pcap-filter.7.html)，你可以像tcpdump一样使用pcap filter表达式来过滤网络包。\n\n在tls\\gotls模块中，当运行模式为`pcap`时，支持pcap filter表达式，在命令行最后的参数中设定，例如：\n```shell\necapture tls -m pcap -i wlan0 -w save.pcapng host 192.168.1.1 and tcp port 443\n```\n\n![](https://github.com/gojue/ecapture/blob/master/images/ecapture-help-v0.8.9.svg)\n\n## What's Changed\n* Update probe_bash.go by @sancppp in https://github.com/gojue/ecapture/pull/479\n* docs: Optimized the error message in the gotls module.(fix: #482) by @cfc4n in https://github.com/gojue/ecapture/pull/484\n* feat: Support pcap-filter expression for pcap mode by @Asphaltt in https://github.com/gojue/ecapture/pull/478\n* chore: Pcap filter tidy,support ubuntu arm64 to make libpcap by @cfc4n in https://github.com/gojue/ecapture/pull/487\n\n## New Contributors\n* @sancppp made their first contribution in https://github.com/gojue/ecapture/pull/479\n* @Asphaltt made their first contribution in https://github.com/gojue/ecapture/pull/478\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.7.3...v0.7.4\n
\n\n# v0.7.3 (2024-01-28)\n## What's Changed\n* makefile: Optimize the feature list for the Android version by @cfc4n in https://github.com/gojue/ecapture/pull/457\n* user: support event processor by @cfc4n in https://github.com/gojue/ecapture/pull/462\n* chore: remove refs to deprecated io/ioutil by @testwill in https://github.com/gojue/ecapture/pull/465\n* user: fix concurrent map read and map write #467 by @cfc4n in https://github.com/gojue/ecapture/pull/468\n* utils: support openssl 3.1.0-3.1.4 and 3.0.9-3.0.12 by @cfc4n in https://github.com/gojue/ecapture/pull/469\n* user: imporve dynamic link library path loading logic on aarch64 ubuntu by @cfc4n in https://github.com/gojue/ecapture/pull/470\n* user: imporve #463, impact on the performance of the tested program by @cfc4n in https://github.com/gojue/ecapture/pull/471\n* kern: support openssl 3.2.x , change ssl_st to ssl_connection_st by @cfc4n in https://github.com/gojue/ecapture/pull/472\n\n## New Contributors\n* @testwill made their first contribution in https://github.com/gojue/ecapture/pull/465\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.7.2...v0.7.3\n
\n\n# v0.7.2 (2024-01-01)\n## What's Changed\n* user: improve pcapng writer, flush every 2s. by @cfc4n in https://github.com/gojue/ecapture/pull/455\n* builder: add debian package build script. by @cfc4n in https://github.com/gojue/ecapture/pull/456\n\n## New Contributors\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.7.1...v0.7.2\n
\n\n# v0.7.1 (2023-12-23)\n## What's Changed\n* cli: reduce mapsize to 1024 * PAGESIZE. by @cfc4n in https://github.com/gojue/ecapture/pull/440\n* Add optimization in openssl detection logic to consume less memory by @h0x0er in https://github.com/gojue/ecapture/pull/438\n* cli: fix nss module panic by @mannkafai in https://github.com/gojue/ecapture/pull/444\n* build(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0 by @dependabot in https://github.com/gojue/ecapture/pull/448\n* pkg: support android on docker(redroid). by @cfc4n in https://github.com/gojue/ecapture/pull/453\n\n## New Contributors\n* @mannkafai made their first contribution in https://github.com/gojue/ecapture/pull/444\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.7.0...v0.7.1\n
\n\n# v0.7.0 (2023-12-03)\n## 🚀 Breaking Changes\n- Split `nss/gnutls/openssl` into three separate submodules. Corresponding to the `./ecapture nss`, `./ecapture gnutls`, `ecapture tls` commands.\n- Support `keylog` mode, equivalent to the functionality of the `SSLKEYLOGFILE` environment variable. Captures SSL/TLS communication keys directly without the need for changes in the target process.\n- Refactor the mode parameters supported by the `openssl`(aka tls) module using the `-m`parameter, with values `text`, `pcap`,`keylog`.\n - `pcap` mode: Set with `-m pcap` or `-m pcapng` parameters. When using this mode, it is necessary to specify `--pcapfile` and `-i` parameters. The default value for the `--pcapfile` parameter is `ecapture_openssl.pcapng`.\n - `keylog` mode: Set with `-m keylog` or `-m key` parameters. When using this mode, it is necessary to specify `--keylogfile`, defaulting to `ecapture_masterkey.log`.\n - `text` mode: Default mode when `-m` parameter is unspecified. Outputs all plaintext packets in text form. (As of v0.7.0, no longer captures communication keys, please use `keylog` mode instead.)\n- Refactor the mode parameters supported by the `gotls` module, similar to the `openssl` module, without further details.\n- Optimize the memory size of eBPF Map, specify with the `--mapsize` parameter, defaulting to 5120 KB.\n- Remove the `-w` parameter, use `--pcapfile` parameter instead.\n- Change `log-addr` parameter to `logaddr`, with unchanged functionality.\n\nThanks to the genius idea from @blaisewang.\n\n------\n* 将nss/gnutls/openssl拆分为独立的三个子模块。分别对应`./ecapture nss`、`./ecapture gnutls`、`ecapture tls`三个子命令。\n* 支持`keylog`模式，等同于`SSLKEYLOGFILE`环境变量的功能，无需目标进程改动，直接捕获SSL/TLS通信密钥。\n* 重构`openssl`(aka tls)模块支持的模式参数，使用`-m`参数指定，分别为`text`,`pcap`,`keylog`三个值。\n * `pcap`模式：`-m pcap`或`-m pcapng`参数来设定。当使用本模式时，必需指定`--pcapfile`、`-i`这两个参数才能使用。 其中`--pcapfile`参数的默认值为`ecapture_openssl.pcapng`。\n * `keylog`模式：`-m keylog`或`-m key`参数来设定。当使用本模式时，必需指定`--keylogfile`，默认为`ecapture_masterkey.log`。\n * `text`模式：`-m`参数不指定时，默认为本模式。将以文本形式输出所有的明文数据包。（自v0.7.0起，不再捕获通讯密钥，请使用`keylog`模式代替）\n* 重构`gotls`模块支持的模式参数，与`openssl`模块一样，不再赘述。\n* 优化eBPF Map的内存大小，使用`--mapsize`参数指定，默认为5120 KB。\n* 移除`-w`参数，请使用`--pcapfile`参数代替。\n* 更改`log-addr`参数为`logaddr`，功能含义不变。\n\n感谢 @blaisewang 的天才思路。\n\n### Demo of keylog Mode Usage\nUsing eCapture to capture communication keys in real-time and combining it with tshark for real-time decryption enables the real-time plaintext output of encrypted traffic. The steps are as follows:\n\n使用`eCapture`实时捕获通信密钥，并结合`tshark`实时解密，可以做到实时的加密流量明文输出。步骤如下：\n\n#### Terminal 1\nStart the keylog mode of eCapture first.\n\n先启动eCapture的`keylog`模式\n\n```shell\necapture tls -m keylog --keylogfile=ecapture_masterkey.log\n```\n\n### Terminal 2\nStart the tshark tool by specifying tls.keylog_file as the captured key file by eCapture, named ecapture_masterkey.\n\n再启动`tshark`工具，指定`tls.keylog_file`为eCapture捕获的密钥文件`ecapture_masterkey`\n\n**http 1.x**\n```shell\ntshark -o tls.keylog_file:ecapture_masterkey.log -Y http -T fields -e http.file_data -f \"port 443\" -i eth0\n```\n\n**http 2.0**\n```shell\ntshark -o tls.keylog_file:ecapture_masterkey.log -Y http2 -T fields -e http2.data.data -f \"port 443\" -i eth0\n```\nAfterward, any software that uses the eCapture HOOK with OpenSSL libraries can achieve real-time decryption and display of all encrypted communication traffic without requiring any modifications to these software applications.\n\n之后，其他使用`eCapture` HOOK的openssl类库的软件，所有加密通讯的流量，都可以实现实时解密并展示了，无需这些软件做任何改动。\n\nSee [issue #432](https://github.com/gojue/ecapture/issues/432) for more detail.\n\n## What's Changed\n* ignore connect symbol cant found. by @cfc4n in https://github.com/gojue/ecapture/pull/431\n* Add support for stripped go binaries by @h0x0er in https://github.com/gojue/ecapture/pull/426\n* splitting gnutls/nss module from tls module lists. by @cfc4n in https://github.com/gojue/ecapture/pull/434\n* user: custom mapSize flag. improve memory usage #433 . by @cfc4n in https://github.com/gojue/ecapture/pull/435\n* add the `model` flag to distinguish the captured modes, support keylog captured. by @cfc4n in https://github.com/gojue/ecapture/pull/436\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.6.6...v0.7.0\n\n
\n\n# v0.6.6 (2023-11-19)\n## What's Changed\n* add ubunutu23.04 aarch64 clang-15 into init_env.sh by @BiteFoo in https://github.com/gojue/ecapture/pull/413\n* Decode kernel time to user time by @h0x0er in https://github.com/gojue/ecapture/pull/418\n* Fix : openssl event output invalid with hex mode by @cfc4n in https://github.com/gojue/ecapture/pull/421\n* user : Set the connect hook as an optional parameter. by @cfc4n in https://github.com/gojue/ecapture/pull/423\n\n## New Contributors\n* @BiteFoo made their first contribution in https://github.com/gojue/ecapture/pull/413\n* @h0x0er made their first contribution in https://github.com/gojue/ecapture/pull/418\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.6.5...v0.6.6\n\n
\n\n# v0.6.5 (2023-11-11)\n\n## What's Changed\n* supports all ports when target_port is set to 0. by @cfc4n in https://github.com/gojue/ecapture/pull/409\n* support for the boringssl library on Android 12\\13\\14. by @cfc4n in https://github.com/gojue/ecapture/pull/410\n* update golang version to 1.21 from 1.18 by @cfc4n in https://github.com/gojue/ecapture/pull/412\n* 支持所有端口的网络数据捕获(target_port为0时) by @cfc4n in https://github.com/gojue/ecapture/pull/409\n* 在Android 12\\13\\14上，支持borlingssl类库的明文捕获 by @cfc4n in https://github.com/gojue/ecapture/pull/410\n* 更新Golang类库到1.21，cilium/ebpf类库到0.12.3 by @cfc4n in https://github.com/gojue/ecapture/pull/412\n\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.6.4...v0.6.5\n
\n\n# v0.6.4 (2023-10-15)\n## What's Changed\n* bugfix: Hook the ssl_set_fd function to get FD. by @cfc4n in https://github.com/gojue/ecapture/pull/399\n* build(deps): bump golang.org/x/net from 0.7.0 to 0.17.0 by @dependabot in https://github.com/gojue/ecapture/pull/402\n* refactor : Shared Object (so) path load logic by @cfc4n in https://github.com/gojue/ecapture/pull/401\n* improve: add missing eBPF maps parameters. by @cfc4n in https://github.com/gojue/ecapture/pull/405\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.6.3...v0.6.4\n\n
\n\n# v0.6.3 (2023-09-27)\n## What's Changed\n* fix : out of silice range. by @cfc4n in https://github.com/gojue/ecapture/pull/398\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.6.2...v0.6.3\n\n
\n\n# v0.6.2 (2023-09-24)\n## What's Changed\n* openssl module: add some prompts when the kernel is less than 5.2 by @cfc4n in https://github.com/gojue/ecapture/pull/387\n* refactor: removal of deprecated flag support. by @cfc4n in https://github.com/gojue/ecapture/pull/388\n* Revert ip address by @cfc4n in https://github.com/gojue/ecapture/pull/391\n* fix : OpenSSL's file descriptor is always 0 by @cfc4n in https://github.com/gojue/ecapture/pull/393\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.6.1...v0.6.2\n\n
\n\n# v0.6.1 (2023-07-16)\n## What's Changed\n* fix #378 , error: use of undeclared identifier 'KBUILD_MODNAME' by @cfc4n in https://github.com/gojue/ecapture/pull/379\n* feat:add openssl 1.1.1u and 3.0.9 by @cfc4n in https://github.com/gojue/ecapture/pull/380\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.6.0...v0.6.1\n\n
\n\n# v0.6.0 (2023-07-02)\n## 🚀 Breaking Changes\nAssociating process information with network packets. usage: `cp utils/ecapture.lua ~/.wireshark/plugins` .\n![](images/ecapture-pid.png)\n![](images/ecapture-wireshark-lua-plugin.png)\n\n## What's Changed\n* code refactoring by @cfc4n in https://github.com/gojue/ecapture/pull/371\n* Tls response unexpected eof by @cfc4n in https://github.com/gojue/ecapture/pull/372\n* modify func isCOntainerCgroup to isContainerCgroup, and where referenced by @chusyclub in https://github.com/gojue/ecapture/pull/374\n* feat: Associate corresponding process information with each network packet. by @cfc4n in https://github.com/gojue/ecapture/pull/376\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.5.3...v0.6.0\n\n
\n\n# v0.5.3 (2023-05-21)\n## What's Changed\n* user: fixes slice out of range by @cfc4n in https://github.com/gojue/ecapture/pull/366\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.5.2...v0.5.3\n\n
\n\n# v0.5.2 (2023-05-01)\n## What's Changed\n* add CircleLinux rpm and mannul build support by @bella485 in https://github.com/gojue/ecapture/pull/345\n* gomod: update github.com/mdlayher/netlink to v1.7.1 by @cfc4n in https://github.com/gojue/ecapture/pull/348\n* use makefile to build rpm by @xjas in https://github.com/gojue/ecapture/pull/344\n* fix : DumpResponse error: unexpected EOF by @cfc4n in https://github.com/gojue/ecapture/pull/349\n* bugfix: Error unknown flag gobin (fixes #354 ) by @cfc4n in https://github.com/gojue/ecapture/pull/355\n* GitHub actions deprecating by @cfc4n in https://github.com/gojue/ecapture/pull/356\n* kern : support gotls request and response by @cfc4n in https://github.com/gojue/ecapture/pull/357\n* user: fixes the network card ID cannot be found when writing to a pcapng file. (#347) by @cfc4n in https://github.com/gojue/ecapture/pull/358\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.5.1...v0.5.2\n\n
\n\n# v0.5.1 (2023-04-08)\n## What's Changed\n* user: add ifname's default value of gotls module. by @cfc4n in https://github.com/gojue/ecapture/pull/332\n* kern: fix wrong uid by @lazybetrayer in https://github.com/gojue/ecapture/pull/334\n* support rpm build by @xjas in https://github.com/gojue/ecapture/pull/341\n* pkg : add proc(go version) unit testing by @cfc4n in https://github.com/gojue/ecapture/pull/342\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.5.0...v0.5.1\n\n
\n\n# v0.5.0 (2023-03-10)\n\n## What's Changed\n* fix: typo in the section name by @spacewander in https://github.com/gojue/ecapture/pull/311\n* user : increase buffer size of ebpf map. (improve #291 , #314) by @cfc4n in https://github.com/gojue/ecapture/pull/315\n* build(deps): bump golang.org/x/net from 0.0.0-20211112202133-69e39bad7dc2 to 0.7.0 by @dependabot in https://github.com/gojue/ecapture/pull/320\n* refactor : rename Golang TLS module name to gotls from gossl . by @cfc4n in https://github.com/gojue/ecapture/pull/319\n* refactor: Use camel case instead of snake case. by @cfc4n in https://github.com/gojue/ecapture/pull/321\n* kern: fix typo in bpf_tracing.h by @eltociear in https://github.com/gojue/ecapture/pull/323\n* Add JA readme by @eltociear in https://github.com/gojue/ecapture/pull/324\n* Gotls crash : incorrect variable used. (fixes:#322) by @cfc4n in https://github.com/gojue/ecapture/pull/325\n* kern: refactor golang ABI by register and stack. by @cfc4n in https://github.com/gojue/ecapture/pull/326\n* feat: add Gotls master secrets module. by @cfc4n in https://github.com/gojue/ecapture/pull/329\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.4.12...v0.5.0\n\n
\n\n# v0.4.12 (2023-02-10)\n\n## What's Changed\n* pkg: get GoVersion by `buildinfo` package from ELF (by golang compiled) (#262) by @cfc4n in https://github.com/gojue/ecapture/pull/295\n* docs: fixes supported kernel version on arm64(aarch64). (#296) by @cfc4n in https://github.com/gojue/ecapture/pull/298\n* user: fixes slice bounds out of range bug (#297) by @cfc4n in https://github.com/gojue/ecapture/pull/299\n* kern: fixes constant value of type uint64. (#301) by @cfc4n in https://github.com/gojue/ecapture/pull/302\n* package: update gojue/ebpfmanager to v0.4.1 by @cfc4n in https://github.com/gojue/ecapture/pull/305\n* docs: update README.md by @onism68 in https://github.com/gojue/ecapture/pull/306\n\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.4.11...v0.4.12\n\n
\n\n# v0.4.11 (2023-01-07)\n\n## What's Changed\n* builder: fix typos (#285) by @cfc4n in https://github.com/gojue/ecapture/pull/286\n* Tls 13 masterkey is taken wrong (fixes #283) by @cfc4n in https://github.com/gojue/ecapture/pull/284\n* fix(gossl): invalid memory address or nil pointer by @luckymrwang in https://github.com/gojue/ecapture/pull/288\n\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.4.10...v0.4.11\n\n
\n\n# v0.4.10 (2022-12-11)\n\n## What's Changed\n* builder: add curl shell to install develop environment. by @cfc4n in https://github.com/gojue/ecapture/pull/272\n* docs : update minimal kernel version as 4.18 (#274) by @cfc4n in https://github.com/gojue/ecapture/pull/275\n* kern: capture https plaintext failed with boringssl TLS 1.3 on android #271 by @cfc4n in https://github.com/gojue/ecapture/pull/279\n\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.4.9...v0.4.10\n\n
\n\n# v0.4.9 (2022-11-19)\n\n## What's Changed\n\n* constant value has to be of type uint64 (#261) by @cfc4n in https://github.com/gojue/ecapture/pull/264\n* builder: rename android non-core archive file name by @cfc4n in https://github.com/gojue/ecapture/pull/266\n* chore(openssl/boringssl): remove redundant calculation by @blaisewang in https://github.com/gojue/ecapture/pull/267\n* makefile : support make parallel （#265） by @cfc4n in https://github.com/gojue/ecapture/pull/268\n* disable gnutls/nss modules on Android. by @cfc4n in https://github.com/gojue/ecapture/pull/269\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.4.8...v0.4.9\n\n
\n\n# v0.4.8 (2022-11-05)\n\n## Breaking Changes\n\n1. Changed license to Apache License 2.0 from AGPL 3.0.\n2. Supported versions of openssl are 1.1.0* , 1.0.2* .\n3. Supported minimum version of Clang is 9.0.\n4. Added GitHub release action of Android X86_64 binaries(default: non-CORE version).\n\n## What's Changed\n\n* user : Tolower openssl version strings. by @cfc4n in https://github.com/gojue/ecapture/pull/250\n* cli : remove other modules on android. by @cfc4n in https://github.com/gojue/ecapture/pull/251\n* utils: add eCapture lua script for wireshark plugin. by @cfc4n in https://github.com/gojue/ecapture/pull/248\n* feat: updated new openssl version by @cfc4n in https://github.com/gojue/ecapture/pull/255\n* feat : support openssl 1.1.0* and 1.0.2* by @cfc4n in https://github.com/gojue/ecapture/pull/257\n* fix: Build failed on clang10 (#256) by @cfc4n in https://github.com/gojue/ecapture/pull/258\n* docs : Change license to Apache License 2.0 by @cfc4n in https://github.com/gojue/ecapture/pull/259\n* workflows : release Android x86_64 use nocore model. by @cfc4n in https://github.com/gojue/ecapture/pull/260\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.4.7...v0.4.8\n
\n\n# v0.4.7 (2022-10-23)\n\n## Breaking Changes\n**add `--ssl_version` flag to set the SSL libraries version**\nsupported ssl libraries version lists:\n- openssl 1.1.1* , (1.1.1a - 1.1.1r)\n- openssl 3.0.* , (3.0.0 - 3.0.6)\n- boringssl 1.1.1\n\n```bash\necapture tls\necapture tls --hex --pid=3423\necapture tls -l save.log --pid=3423\necapture tls --libssl=/lib/x86_64-linux-gnu/libssl.so.1.1\necapture tls -w save_3_0_5.pcapng --ssl_version=\"openssl 3.0.5\" --libssl=/lib/x86_64-linux-gnu/libssl.so.3 \necapture tls -w save_android.pcapng -i wlan0 --libssl=/apex/com.android.conscrypt/lib64/libssl.so --ssl_version=\"boringssl 1.1.1\" --port 443\n```\n\n\n## What's Changed\n\n* feat : support openssl 3.0 @cfc4n in https://github.com/gojue/ecapture/pull/244\n* feat: automate openssl offset header file generation @blaisewang in https://github.com/gojue/ecapture/pull/241\n\n
\n\n# v0.4.6 (2022-10-15)\n\n## What's Changed\n\n* user/module : compatiable Linux kernel less or more than 5.2 @cfc4n in https://github.com/gojue/ecapture/pull/238\n\n
\n\n# v0.4.5 (2022-10-10)\n\n## What's Changed\n\n* kern: capture master secrets for tls 1.3 @cfc4n in https://github.com/gojue/ecapture/pull/232\n\n
\n\n# v0.4.4 (2022-10-03)\n\n## What's Changed\n\n* feat: add support TLSv1.3 decryption by @blaisewang in https://github.com/gojue/ecapture/pull/209\n* user/module : hex model output. by @cfc4n in https://github.com/gojue/ecapture/pull/220\n* user/module : use const for SSL masterKey function hook. by @cfc4n in https://github.com/gojue/ecapture/pull/217\n* kern: rodata map not supported on kernel 4.19 or older by @cfc4n in https://github.com/gojue/ecapture/pull/223\n* kern: http2 response packet decode failed. by @cfc4n in https://github.com/gojue/ecapture/pull/225\n\n
\n\n# v0.4.3 (2022-09-09)\n\n## What's Changed\n\n* fix: use cipher id to derive secret by @blaisewang in https://github.com/gojue/ecapture/pull/192\n* kern: get ssl_session in the `*SSL_get_session()` order . by @cfc4n in https://github.com/gojue/ecapture/pull/193\n\n
\n\n# v0.4.2 (2022-09-04)\n\n## What's Changed\n\n* refactor user package. by @cfc4n in https://github.com/gojue/ecapture/pull/183\n* pkg/event_processor: DefaultParser init(). by @cfc4n in https://github.com/gojue/ecapture/pull/186\n* Fix: correct ssl_st member offsets by @blaisewang in https://github.com/gojue/ecapture/pull/184\n* Boringssl decrypt failed by @cfc4n in https://github.com/gojue/ecapture/pull/188\n\n
\n\n# v0.4.1 (2022-08-21)\n\n## What's Changed\n\n* kern : define variable target_port always. by @cfc4n in https://github.com/gojue/ecapture/pull/157\n* workflows : build nocore version for Android default. by @cfc4n in https://github.com/gojue/ecapture/pull/159\n* pkg : Ifname default value. by @cfc4n in https://github.com/gojue/ecapture/pull/161\n* user : skip loopback network interface by @cfc4n in https://github.com/gojue/ecapture/pull/163\n* user : tls models exit gracefully. by @cfc4n in https://github.com/gojue/ecapture/pull/165\n* git: ignore .check* files by @blaisewang in https://github.com/gojue/ecapture/pull/168\n* pkg : fix config file parse failed, when as gzip format. by @cfc4n in https://github.com/gojue/ecapture/pull/169\n* fix gzip read err by @4ft35t in https://github.com/gojue/ecapture/pull/175\n* pkg/util/ebpf : add unit testing for kernel CONFIG reader by @cfc4n in https://github.com/gojue/ecapture/pull/176\n* user : fix incorrect TimeStamp by @cfc4n in https://github.com/gojue/ecapture/pull/179\n* cli/cmd : print version info by @cfc4n in https://github.com/gojue/ecapture/pull/177\n* kern : support boringssl offset for Android 12. by @cfc4n in https://github.com/gojue/ecapture/pull/181\n\n
\n\n# v0.4.0 (2022-08-07)\n\n## Breaking Changes\n\n**Support : capture plaintext packet as pcapng files for openssl TLS encryption.**\n\n> **Note:**\n>\n> Support `Wireshark` to open directly. Do not need to setting up `Master Secrets` files.\n>\n> Capture `raw packet` by Traffic Control eBPF filter. Added `Master Secrets` information into pcapng\n> with `Decryption Secrets Block` (DSB).\n\n> **Warning**\n>\n> change `loggerFile` flag as `-l` from `-w` , because `-w` is reserved for `Wireshark`, and keep same as `-w`\n> for `tcpdump`. use `ecapture -h` for help.\n> change `master secrets` filename from `ecapture_masterkey_[pid].log` to `ecapture_masterkey.log`.\n\n## What's Changed\n\n* new feature: capture TLS 1.3 master secret by @cfc4n in https://github.com/gojue/ecapture/pull/143\n* user : echo String() or StringHex() by CLI argument. by @cfc4n in https://github.com/gojue/ecapture/pull/149\n* cli/cmd : clean up all probe while process exit. (#150) by @cfc4n in https://github.com/gojue/ecapture/pull/151\n* save as Pcapng files #145 by @cfc4n in https://github.com/gojue/ecapture/pull/148\n* user : Support writing pcapng files with Decryption Secrets Block (DSB). by @cfc4n\n in https://github.com/gojue/ecapture/pull/153\n\n
\n\n# v0.3.0 (2022-07-20)\n\n## Breaking Changes\n\n**Capture TLS master_key ,save to file. Support openssl `1.1.1.X` . `TLS 1.2` .**\n\nQuick Guide:\n\n- use `ecapture` to capture TLS master_key, will save master secret to `ecapture_masterkey_[pid].log`.\n- use `tcpdump` to capture and save packets to `xxx.pcapng` file.\n- open `xxx.pcapng` file with `wireshark`.\n- Setting : `Wireshark` --> `Preferences` --> `Protocols` --> `TLS` --> `(Pre)-Master-Secret log filename`, select `ecapture_masterkey_[pid].log`.\n- Using : right click packet item, select `follow` -> `HTTP Stream` / `HTTP/2 Stream`\n\n## What's Changed\n\n* all : refactor event_processor EventType. by @cfc4n in https://github.com/gojue/ecapture/pull/134\n* fixed #138 : You have an error in your yaml syntax on line 79 by @cfc4n in https://github.com/gojue/ecapture/pull/139\n* New feature: capture openssl masterkey #27 by @cfc4n in https://github.com/gojue/ecapture/pull/140\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.2.2...v0.3.0\n\n
\n\n# v0.2.2 (2022-07-09)\n\n## What's Changed\n* workflows: build failed on aarch 64 ubuntu : 'linux/kconfig.h' file not found #125 by @cfc4n\n in https://github.com/gojue/ecapture/pull/126\n* Makefile: shell running,with a unexcepted result: lost DKERNEL_LESS_5_2 on kernel 4.15 #129 by @cfc4n\n in https://github.com/gojue/ecapture/pull/132\n* ebpf: remove detection of BPF config when running at container #127 by @cfc4n\n in https://github.com/gojue/ecapture/pull/128\n\n## New Contributors\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.2.1...v0.2.2\n\n\n
\n\n# v0.2.1 (2022-07-05)\n\n## What's Changed\n\n* pkg : fix Kernel config read failed, error:Config not found #117 by @cfc4n\n in https://github.com/gojue/ecapture/pull/123\n* user : Clean up unnecessary information. fix #122 by @cfc4n in https://github.com/gojue/ecapture/pull/124\n\n## New Contributors\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.2.0...v0.2.1\n\n\n
\n\n# v0.2.0 (2022-07-04)\n\n## What's Changed\n\n* Directly search so in search path when /usr/bin/curl is not exist by @tiann\n in https://github.com/gojue/ecapture/pull/97\n* Add GitHub Action ：Golangci lint by @cfc4n in https://github.com/gojue/ecapture/pull/99\n* Add Chinese name 旁观者. by @cfc4n in https://github.com/gojue/ecapture/pull/103\n* build: change tar.gz file path in checksum.txt by @cfc4n in https://github.com/gojue/ecapture/pull/104\n* Support Golang HTTPS introspection by @chenhengqi in https://github.com/gojue/ecapture/pull/100\n* New Feature: support Android without GKI (kernel version > 4.18) by @cfc4n\n in https://github.com/gojue/ecapture/pull/107\n* fixed :#108 tls module cannot to capture payload on Aarch64 kernel 4.18 by @huzai9527\n in https://github.com/gojue/ecapture/pull/109\n* fixed #108: ip address lost on aarch64 kernel 4.18 by @cfc4n in https://github.com/gojue/ecapture/pull/111\n* New feature: add payload parser. by @cfc4n in https://github.com/gojue/ecapture/pull/113\n* document: message friendly by @cfc4n in https://github.com/gojue/ecapture/pull/119\n\n## New Contributors\n\n* @tiann made their first contribution in https://github.com/gojue/ecapture/pull/97\n* @chenhengqi made their first contribution in https://github.com/gojue/ecapture/pull/100\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.1.10...v0.2.0\n\n
\n\n# v0.1.10 (2022-06-20)\n\n## What's Changed\n\n* user : fixed bug. #76 libpthread.so not found. by @cfc4n in https://github.com/gojue/ecapture/pull/77\n* Support for ARM64 architecture by @cfc4n in https://github.com/gojue/ecapture/pull/75\n* fixed: outputing blank text on linux 4.18 #81 by @cfc4n in https://github.com/gojue/ecapture/pull/82\n* New feature: update ebpfmanager package to 0.3.0 by @cfc4n in https://github.com/gojue/ecapture/pull/83\n* New feature: #80 event filter by uid by @cfc4n in https://github.com/gojue/ecapture/pull/84\n* New feature: #85 event filter by uid for module tls by @cfc4n in https://github.com/gojue/ecapture/pull/86\n* New feature: #87 support Android GKI by @cfc4n in https://github.com/gojue/ecapture/pull/88\n* fixed: #92 github checkout error while a PR sent. by @cfc4n in https://github.com/gojue/ecapture/pull/93\n* New Feature: #79 Auto release for android gki by @cfc4n in https://github.com/gojue/ecapture/pull/94\n## New Contributors\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.1.9...v0.1.10\n\n\n
\n\n# v0.1.9 (2022-06-11)\n\n## 🚀 Features\n\n- code refactoring: event dispatcher\n - PR: #58\n- add notes for how to use ecapture in other libs\n - PR: #60\n-\n * : add TLS/SSL Version info (openssl).\n\n - PR: #62\n\n## 🐛 Fixes\n\n- Add nosearch argument to skip auto search lib path\n - PR: #70\n\n## What's Changed\n\n* code refactoring: event dispatcher by @cfc4n in https://github.com/gojue/ecapture/pull/58\n* add notes for how to use ecapture in other libs by @xjas in https://github.com/gojue/ecapture/pull/60\n* add TLS/SSL Version info (openssl). by @cfc4n in https://github.com/gojue/ecapture/pull/62\n* Update README.md by @nfsec in https://github.com/gojue/ecapture/pull/63\n* fix some typos by @cuishuang in https://github.com/gojue/ecapture/pull/68\n* Add nosearch argument to skip auto search lib path by @vincentmli in https://github.com/gojue/ecapture/pull/70\n\n## New Contributors\n\n* @xjas made their first contribution in https://github.com/gojue/ecapture/pull/60\n* @nfsec made their first contribution in https://github.com/gojue/ecapture/pull/63\n* @cuishuang made their first contribution in https://github.com/gojue/ecapture/pull/68\n* @vincentmli made their first contribution in https://github.com/gojue/ecapture/pull/70\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.1.8...v0.1.9\n\n
\n\n# v0.1.8 (2022-05-08)\n\n## What's Changed\n\n* ADD mysqld dispatch_command return value. by @cfc4n in https://github.com/gojue/ecapture/pull/44\n* autogen vmlinux header file to compatible current OS by @cfc4n in https://github.com/gojue/ecapture/pull/50\n* feat: support postgres query hook by @yihong0618 in https://github.com/gojue/ecapture/pull/51\n* added return value of bash module. by @huzai9527 in https://github.com/gojue/ecapture/pull/52\n* change bash line size to 256 bytes by @yindex in https://github.com/gojue/ecapture/pull/55\n* add errnumber flag for command bash by @huzai9527 in https://github.com/gojue/ecapture/pull/56\n\n## New Contributors\n\n* @huzai9527 made their first contribution in https://github.com/gojue/ecapture/pull/52\n* @yindex made their first contribution in https://github.com/gojue/ecapture/pull/55\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.1.7...v0.1.8\n\n
\n\n# v0.1.7 (2022-04-22)\n\n### What's Changed\n\n* user: fix #29 ubuntu21.10 error :connect symbol cant found by @cfc4n in https://github.com/gojue/ecapture/pull/30\n* support no co-re version on linux kernel >= 5.2 by @cfc4n in https://github.com/gojue/ecapture/pull/32\n* merge two Makefile files. by @cfc4n in https://github.com/gojue/ecapture/pull/33\n* images : fix #34 Inaccurate/Confusing Diagrams by @cfc4n in https://github.com/gojue/ecapture/pull/36\n* Fix #37 Shared object dependence by @cfc4n in https://github.com/gojue/ecapture/pull/38\n* README grammar fix by @chriskaliX in https://github.com/gojue/ecapture/pull/35\n* Fix #39 .rodata: map create: read- and write-only maps not supported (requires >= v5.2) by @cfc4n\n in https://github.com/gojue/ecapture/pull/40\n* set clang version lower to 9 from 12 by @cfc4n in https://github.com/gojue/ecapture/pull/41\n\n### New Contributors\n\n* @cfc4n made their first contribution in https://github.com/gojue/ecapture/pull/30\n\n**Full Changelog**: https://github.com/gojue/ecapture/compare/v0.1.6...v0.1.7\n\n
\n\n# v0.1.6 (2022-04-07)\n\n- 更新mysqld数据库审计模块\n- 更新tls网络捕获模块\n\n## mysqld\n\n- 支持mysql5.7/8.0, MariadDB 10.5+的Mysqld数据库的查询审计。\n - 自动识别mysqld版本 。\n - 自动查找hook的sql 查询函数。\n\n## tls\n- 支持openssl的IP地址关联\n - 支持网络IP地址的存储、关联到网络数据中。\n - 支持自定义libpthread.so路径指定（定位connect函数）。\n\n
\n\n# v0.1.5 (2022-03-25)\n\n- 增加mysqld数据库审计模块\n\n## mysqld 模块\n- 支持mysql5.6的mariaDB数据库的查询审计\n - 默认path目录为/usr/sbin/mariadb 。\n - 支持function name、offset两个参数自定义。\n\n
\n\n# v0.1.4 (2022-03-22)\n\n- 调整运行环境检测方式\n - 判断BTF支持的方法，改为优先判断`/sys/kernel/btf/vmlinux`文件，以及其他BTF特征的`vmlinux-*`目录等 。\n - 增加运行原理图。\n\n## tls(openssl) 模块\n- 支持gnutls 、 nspr 两个类库的数据捕获\n- 重命名子命令，由`openssl`改为`tls`\n\n
\n\n# v0.1.3 (2022-03-20)\n\n- 增加运行环境检测\n - 检测linux kernel必须大于4.18 。\n - 检测kernel config中CONFIG_DEBUG_INFO_BTF必须有，且值为y。\n- 去除编译生成的文件（./bin/、./assets/、./user/bytecode/）\n- 整理go mod依赖文件\n\n
\n\n# v0.1.1 (2022-03-19)\n\n- 模块拆分，启用子命令模式\n- 增加全局可选PID参数，针对特定PID进行数据捕获\n- 增加hexdump打印模式\n\n## openssl模块\n- 支持自定义openssl的so路径。\n- 支持hex进制的数据输出\n\n## bash模块\n- 支持自定义bash路径参数\n- 支持自定义readline.so路径参数\n- 支持hex进制的数据输出\n\n
\n\n# v0.1.0 (2022-03-17)\n\n## openssl模块\n- 增加openssl的libssl.so的SSL/TLS数据抓包功能。\n- 根据wget路径，自动选择libssl.so路径。\n\n## bash模块\n- 自动根据ENV查找bash\n- 根据bash自动查找`readline.so`，并进行bash命令捕获" }, { "path": "CODE_OF_CONDUCT.md", "content": "# Contributor Covenant Code of Conduct\n\n## Our Pledge\n\nWe as members, contributors, and leaders pledge to make participation in our\ncommunity a harassment-free experience for everyone, regardless of age, body\nsize, visible or invisible disability, ethnicity, sex characteristics, gender\nidentity and expression, level of experience, education, socio-economic status,\nnationality, personal appearance, race, religion, or sexual identity\nand orientation.\n\nWe pledge to act and interact in ways that contribute to an open, welcoming,\ndiverse, inclusive, and healthy community.\n\n## Our Standards\n\nExamples of behavior that contributes to a positive environment for our\ncommunity include:\n\n* Demonstrating empathy and kindness toward other people\n* Being respectful of differing opinions, viewpoints, and experiences\n* Giving and gracefully accepting constructive feedback\n* Accepting responsibility and apologizing to those affected by our mistakes,\n and learning from the experience\n* Focusing on what is best not just for us as individuals, but for the\n overall community\n\nExamples of unacceptable behavior include:\n\n* The use of sexualized language or imagery, and sexual attention or\n advances of any kind\n* Trolling, insulting or derogatory comments, and personal or political attacks\n* Public or private harassment\n* Publishing others' private information, such as a physical or email\n address, without their explicit permission\n* Other conduct which could reasonably be considered inappropriate in a\n professional setting\n\n## Enforcement Responsibilities\n\nCommunity leaders are responsible for clarifying and enforcing our standards of\nacceptable behavior and will take appropriate and fair corrective action in\nresponse to any behavior that they deem inappropriate, threatening, offensive,\nor harmful.\n\nCommunity leaders have the right and responsibility to remove, edit, or reject\ncomments, commits, code, wiki edits, issues, and other contributions that are\nnot aligned to this Code of Conduct, and will communicate reasons for moderation\ndecisions when appropriate.\n\n## Scope\n\nThis Code of Conduct applies within all community spaces, and also applies when\nan individual is officially representing the community in public spaces.\nExamples of representing our community include using an official e-mail address,\nposting via an official social media account, or acting as an appointed\nrepresentative at an online or offline event.\n\n## Enforcement\n\nInstances of abusive, harassing, or otherwise unacceptable behavior may be\nreported to the community leaders responsible for enforcement at\ncfc4n.cs@gmail.com.\nAll complaints will be reviewed and investigated promptly and fairly.\n\nAll community leaders are obligated to respect the privacy and security of the\nreporter of any incident.\n\n## Enforcement Guidelines\n\nCommunity leaders will follow these Community Impact Guidelines in determining\nthe consequences for any action they deem in violation of this Code of Conduct:\n\n### 1. Correction\n\n**Community Impact**: Use of inappropriate language or other behavior deemed\nunprofessional or unwelcome in the community.\n\n**Consequence**: A private, written warning from community leaders, providing\nclarity around the nature of the violation and an explanation of why the\nbehavior was inappropriate. A public apology may be requested.\n\n### 2. Warning\n\n**Community Impact**: A violation through a single incident or series\nof actions.\n\n**Consequence**: A warning with consequences for continued behavior. No\ninteraction with the people involved, including unsolicited interaction with\nthose enforcing the Code of Conduct, for a specified period of time. This\nincludes avoiding interactions in community spaces as well as external channels\nlike social media. Violating these terms may lead to a temporary or\npermanent ban.\n\n### 3. Temporary Ban\n\n**Community Impact**: A serious violation of community standards, including\nsustained inappropriate behavior.\n\n**Consequence**: A temporary ban from any sort of interaction or public\ncommunication with the community for a specified period of time. No public or\nprivate interaction with the people involved, including unsolicited interaction\nwith those enforcing the Code of Conduct, is allowed during this period.\nViolating these terms may lead to a permanent ban.\n\n### 4. Permanent Ban\n\n**Community Impact**: Demonstrating a pattern of violation of community\nstandards, including sustained inappropriate behavior, harassment of an\nindividual, or aggression toward or disparagement of classes of individuals.\n\n**Consequence**: A permanent ban from any sort of public interaction within\nthe community.\n\n## Attribution\n\nThis Code of Conduct is adapted from the [Contributor Covenant][homepage],\nversion 2.0, available at\nhttps://www.contributor-covenant.org/version/2/0/code_of_conduct.html.\n\nCommunity Impact Guidelines were inspired by [Mozilla's code of conduct\nenforcement ladder](https://github.com/mozilla/diversity).\n\n[homepage]: https://www.contributor-covenant.org\n\nFor answers to common questions about this code of conduct, see the FAQ at\nhttps://www.contributor-covenant.org/faq. Translations are available at\nhttps://www.contributor-covenant.org/translations.\n" }, { "path": "CONTRIBUTING.md", "content": "# How to contribute\n\neCapture is AGPL-3.0 licensed and accepts contributions via GitHub pull requests. This document outlines some of the conventions on commit message formatting, contact points for developers, and other resources to help get contributions into eCapture.\n\n[//]: # (# Email and chat)\n\n## Getting started\n\n- Fork the repository on GitHub\n- Read the [README.md](./README.md) for build instructions\n\n## Reporting bugs and creating issues\n\nReporting bugs is one of the best ways to contribute. However, a good bug report has some very specific qualities, so please read over our short document on [reporting bugs](.github/ISSUE_TEMPLATE/bug_report.md) before submitting a bug report. This document might contain links to known issues, another good reason to take a look there before reporting a bug.\n\n## Contribution flow\n\nThis is a rough outline of what a contributor's workflow looks like:\n\n- Create a topic branch from where to base the contribution. This is usually main.\n- Make commits of logical units.\n- Make sure commit messages are in the proper format (see below).\n- Push changes in a topic branch to a personal fork of the repository.\n- Submit a pull request to gojue/ecapture.\n\n[//]: # (- The PR must receive a LGTM from two maintainers found in the MAINTAINERS file.)\n\nThanks for contributing!\n\n### Code style\n\nThe coding style suggested by the Golang community is used in eCapture. See the [style doc](https://github.com/golang/go/wiki/CodeReviewComments) for details.\n\nPlease follow this style to make eCapture easy to review, maintain and develop.\n\n### Format of the commit message\n\nWe follow a rough convention for commit messages that is designed to answer two\nquestions: what changed and why. The subject line should feature the what and\nthe body of the commit should describe the why.\n\n```\ncli: update module name \"mysqld56\" to \"mysqld\" .\n\nadd shortflag for \"debug\" flag.\n\nFixes #6\n```\n\nThe format can be described more formally as follows:\n\n```\n: \n\n\n\n