Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

error:cant found 'connect' function to hook in files::[libpthread.so.0 libc.so.6 libc.so] #400

Closed
yzw-trt opened this issue Oct 8, 2023 · 6 comments · Fixed by #401
Closed
Assignees
Labels
🐞 bug Something isn't working

Comments

@yzw-trt
Copy link

yzw-trt commented Oct 8, 2023

[root@iZgc71dvfdfwzxml2gfuc0Z ecapture-v0.6.3-linux-x86_64]# uname -a
Linux iZgc71dvfdfwzxml2gfuc0Z 5.10.84-10.4.al8.x86_64 #1 SMP Tue Apr 12 12:31:07 CST 2022 x86_64 x86_64 x86_64 GNU/Linux

[root@iZgc71dvfdfwzxml2gfuc0Z ecapture-v0.6.3-linux-x86_64]# cat /boot/config-uname -r | grep CONFIG_DEBUG_INFO_BTF
CONFIG_DEBUG_INFO_BTF=y
[root@iZgc71dvfdfwzxml2gfuc0Z ecapture-v0.6.3-linux-x86_64]# ./ecapture tls --libssl="/lib64/libssl.so.1.1"
tls_2023/10/08 11:40:22 ECAPTURE :: ecapture Version : linux_x86_64:0.6.3-20230927-f0cfbdf:5.15.0-1046-azure
tls_2023/10/08 11:40:22 ECAPTURE :: Pid Info : 871353
tls_2023/10/08 11:40:22 ECAPTURE :: Kernel Info : 5.10.84
tls_2023/10/08 11:40:22 EBPFProbeOPENSSL module initialization failed. [skip it]. error:cant found 'connect' function to hook in files::[libpthread.so.0 libc.so.6 libc.so]
tls_2023/10/08 11:40:22 EBPFProbeGNUTLS module initialization
tls_2023/10/08 11:40:22 ECAPTURE :: Module.Run()
tls_2023/10/08 11:40:22 EBPFProbeGNUTLS BPF bytecode filename:user/bytecode/gnutls_kern.o
tls_2023/10/08 11:40:22 EBPFProbeGNUTLS module run failed, [skip it]. error:tls(gnutls) module couldn't find binPath stat /lib/x86_64-linux-gnu/libgnutls.so.30: no such file or directory
tls_2023/10/08 11:40:22 EBPFProbeNSPR module initialization
tls_2023/10/08 11:40:22 ECAPTURE :: Module.Run()
tls_2023/10/08 11:40:22 EBPFProbeNSPR BPF bytecode filename:user/bytecode/nspr_kern.o
tls_2023/10/08 11:40:22 EBPFProbeNSPR module run failed, [skip it]. error:tls module couldn't find binPath stat /usr/lib/firefox/libnspr4.so: no such file or directory
tls_2023/10/08 11:40:22 ECAPTURE :: No runnable modules, Exit(1)

@cfc4n cfc4n added the 🐞 bug Something isn't working label Oct 8, 2023
@cfc4n cfc4n changed the title 求助,我在阿里云主机上运行发现以下报错,导致无法启动,同样的问题我在自己安装的centos7系统中也会出现。 error:cant found 'connect' function to hook in files::[libpthread.so.0 libc.so.6 libc.so] Oct 8, 2023
@cfc4n
Copy link
Member

cfc4n commented Oct 9, 2023

可以搜下libpthread.so/libc.so文件所在的路径吗?
Can you search for the paths of the libpthread.so/libc.so files?

@cfc4n cfc4n self-assigned this Oct 9, 2023
@yzw-trt
Copy link
Author

yzw-trt commented Oct 10, 2023

Here are my results on Alibaba Cloud ECS:
[root@iZgc71dvfdfwzxml2gfuc0Z ~]# find / -name libpthread.so
/usr/lib64/libpthread.so
[root@iZgc71dvfdfwzxml2gfuc0Z ~]# find / -name libc.so
/root/libc/libc.so
/usr/lib64/libc.so

@cfc4n
Copy link
Member

cfc4n commented Oct 10, 2023

also CentOS 7..

@yzw-trt
Copy link
Author

yzw-trt commented Oct 10, 2023

Yes, but the kernel version meets the requirements.
And I upgraded the Centos7 version of the kernel, which is also the same.

@cfc4n
Copy link
Member

cfc4n commented Oct 11, 2023

please retry PR #401

@yzw-trt
Copy link
Author

yzw-trt commented Oct 13, 2023

thanks Openssl is now ok! run as follows:

[root@iZgc71dvfdfwzxml2gfuc0Z home]# ./ecapture tls
tls_2023/10/13 10:02:15 ECAPTURE :: ecapture Version : linux_x86_64:0.6.3-20231011-6febcb3:[CORE]
tls_2023/10/13 10:02:15 ECAPTURE :: Pid Info : 881924
tls_2023/10/13 10:02:15 ECAPTURE :: Kernel Info : 5.10.84
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL module initialization
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL master key keylogger: ecapture_masterkey.log
tls_2023/10/13 10:02:15 ECAPTURE :: Module.Run()
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL UPROBE MODEL
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL origin version:OpenSSL 1.1.1k, as key:openssl 1.1.1k
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL HOOK type:2, binrayPath:/usr/lib64/libssl.so.1.1
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL libPthread:/usr/lib64/libpthread.so.0
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL Hook masterKey function:SSL_write
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL target all process.
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL target all users.
tls_2023/10/13 10:02:15 EBPFProbeOPENSSL BPF bytecode filename:user/bytecode/openssl_1_1_1j_kern.o
tls_2023/10/13 10:02:17 EBPFProbeOPENSSL module started successfully.
tls_2023/10/13 10:02:17 EBPFProbeGNUTLS module initialization
tls_2023/10/13 10:02:17 ECAPTURE :: Module.Run()
tls_2023/10/13 10:02:17 EBPFProbeGNUTLS BPF bytecode filename:user/bytecode/gnutls_kern.o
tls_2023/10/13 10:02:17 EBPFProbeGNUTLS module run failed, [skip it]. error:tls(gnutls) module couldn't find binPath stat /lib/x86_64-linux-gnu/libgnutls.so.30: no such file or directory
tls_2023/10/13 10:02:17 EBPFProbeNSPR module initialization
tls_2023/10/13 10:02:17 ECAPTURE :: Module.Run()
tls_2023/10/13 10:02:17 EBPFProbeNSPR BPF bytecode filename:user/bytecode/nspr_kern.o
tls_2023/10/13 10:02:17 EBPFProbeNSPR module run failed, [skip it]. error:tls module couldn't find binPath stat /usr/lib/firefox/libnspr4.so: no such file or directory
tls_2023/10/13 10:02:17 ECAPTURE :: start 1 modules

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🐞 bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants