3 ms·
I believe that's how https://github.com/gojue/ecapture https://github.com/gojue/ecapture works. I don't know the details, but it seems to work!
by jeroenhd 2y ago
I believe that's how https://github.com/gojue/ecapture https://github.com/gojue/ecapture works. I don't know the details, but it seems to work!
- ddelnano 2y agoYep, that's correct. It uses eBPF upprobes to attach to the SSL_write/SSL_read functions.