It is quite simple to use eBPF with uprobes to hook library calls, for example: https://github.com/iovisor/bcc/blob/master/tools/sslsniff.py https://github.com/

It is quite simple to use eBPF with uprobes to hook library calls, for example: https://github.com/iovisor/bcc/blob/master/tools/sslsniff.py https://github.com/iovisor/bcc/blob/master/tools/sslsniff.py The downside is this doesn't work with anything not using OpenSSL, there are projects like https://github.com/gojue/ecapture https://github.com/gojue/ecapture which have interceptors for many common libraries, but the downside is that needs different code for each library. I think providing a TLS certificate is fine for the use cases of the tool; most tools won't be doing certificate pinning, but ecapture does support Android where this is more likely.