about eCapture supports kernel version. #131

cfc4n · 2022-07-08T13:20:22Z

cfc4n
Jul 8, 2022
Maintainer

Overview

Linux Kernel

Type	Arch	Kernel Version	ref	other
Globa Params	X86_64	5.2	cilium ebpf	.rodata cilium/ebpf#628
BTF	X86_64	4.18	cilium ebpf
ALL	ARM64	5.5	Kernel Bugs	bpf_probe_read_user returns error (-14) on Android 11, Kernel 4.14, ARM64 bpf: Add probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers iovisor/bcc#3783 iovisor/bcc#2253

Android Device

型号	代号	版本	说明	推荐度
Pixel 6	oriole	5.10	官方出品	**
Redmi Note 11T Pro	xaga	5.10	略过时	**
Redmi Note 12R	sky	5.10	性价比	***
Redmi Note 12	topaz	5.15	4G海外版	*
Redmi Note 12 Turbo	marble	5.10	略贵	*
Redmi Note 13	gold	5.10	新出不贵	**

load ebpf bytecode failed on kernel version 4.15

bash_2022/07/08 20:50:29 couldn't init manager error:program uretprobe_bash_retval: load program without BTF: permission denied: 0: (bf) r6 = r1
1: (85) call bpf_get_current_pid_tgid#14
2: (77) r0 >>= 32
3: (63) *(u32 *)(r10 -4) = r0
4: (85) call bpf_get_current_uid_gid#15
5: (79) r8 = *(u64 *)(r6 +80)
6: (bf) r2 = r10
7: (07) r2 += -4
8: (18) r1 = 0xffff9de0786f1a00
10: (85) call bpf_map_lookup_elem#1
11: (bf) r7 = r0
12: (15) if r7 == 0x0 goto pc+16
 R0=map_value(id=0,off=0,ks=4,vs=284,imm=0) R6=ctx(id=0,off=0,imm=0) R7=map_value(id=0,off=0,ks=4,vs=284,imm=0) R8=inv(id=0) R10=fp0
13: (63) *(u32 *)(r7 +264) = r8
 R0=map_value(id=0,off=0,ks=4,vs=284,imm=0) R6=ctx(id=0,off=0,imm=0) R7=map_value(id=0,off=0,ks=4,vs=284,imm=0) R8=inv(id=0) R10=fp0
14: (bf) r2 = r10
15: (07) r2 += -4
16: (18) r1 = 0xffff9de0786f1a00
18: (bf) r3 = r7
19: (b7) r4 = 0
20: (85) call bpf_map_update_elem#2
R3 type=map_value expected=fp , couldn't load eBPF programs, cs:&{map[events:PerfEventArray(keySize=0, valueSize=0, maxEntries=0, flags=0) events_t:Hash(keySize=4, valueSize=284, maxEntries=1024, flags=0)] map[uretprobe_bash_readline:0xc000138000 uretprobe_bash_retval:0xc000138140] 0xc000409320 LittleEndian}

ref : iovisor/bcc#3118

As the error message mentioned,
R3 type=map_value expected=fp
for 4.15, you cannot lookup a map, get a map_value and use it as input to another map_value for map update. The map_value used for map update needs to be on stack. This restriction has been lifted in later kernels.

unsupported Kernel Version 4.19 ARM64 ARCH

[root@VM-0-5-centos ssldump]# bin/ecapture tls
2022/06/22 23:31:13 pid info :4428
2022/06/22 23:31:13 start to run EBPFProbeOPENSSL module
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 start to run EBPFProbeGNUTLS module
2022/06/22 23:31:13 read file :ld.so.conf.d/*.conf error .
2022/06/22 23:31:13 HOOK type:2, binrayPath:/usr/lib64/libssl.so.1.1
2022/06/22 23:31:13 libPthread so Path:/usr/lib64/libpthread.so.0
2022/06/22 23:31:13 start to run EBPFProbeNSPR module
2022/06/22 23:31:13 stat /usr/lib/libnspr4.so: no such file or directory
2022/06/22 23:31:13 start to run EBPFProbeGoSSL module
2022/06/22 23:31:13 go binary not found
2022/06/22 23:31:13 HOOK type:2, binrayPath:/usr/lib64/libgnutls.so.30
2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Send 77 bytes to [ADDR_NOT_FOUND], Payload:

2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Recived 1179 bytes from [ADDR_NOT_FOUND], Payload:

2022/06/22 23:31:20 PID:4438, Comm:curl, TID:4438, Version:TLS1_2_VERSION, Recived 1664 bytes from [ADDR_NOT_FOUND], Payload:

Screenshots

#108

fixed at https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.5

commit ae8a76fb8b5d03fa2adc7249dc6131ba6a0c6119
Merge: d31e95585ca6 358fdb456288
Author: David S. Miller davem@davemloft.net
Date: Sat Nov 2 15:27:42 2019 -0700

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Alexei Starovoitov says:

====================
pull-request: bpf-next 2019-11-02

The following pull-request contains BPF updates for your *net-next* tree.

We've added 30 non-merge commits during the last 7 day(s) which contain
a total of 41 files changed, 1864 insertions(+), 474 deletions(-).

The main changes are:

1) Fix long standing user vs kernel access issue by introducing
   bpf_probe_read_user() and bpf_probe_read_kernel() helpers, from Daniel.

2) Accelerated xskmap lookup, from Bj枚rn and Maciej.

3) Support for automatic map pinning in libbpf, from Toke.

4) Cleanup of BTF-enabled raw tracepoints, from Alexei.

5) Various fixes to libbpf and selftests.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

cfc4n · 2023-01-18T13:33:23Z

cfc4n
Jan 18, 2023
Maintainer Author

in https://kernelnewbies.org/Linux_5.5

Add probe_read_user, probe_read_kernel and probe_read_user_str, probe_read_kernel_str helpers commit

0 replies

sJJdGG · 2024-10-05T13:06:58Z

sJJdGG
Oct 5, 2024

@cfc4n @gojue What about android 14 kernel 6.1? Currently getting "Permission Denied" on rooted android device

1 reply

cfc4n Oct 6, 2024
Maintainer Author

It should be supported. If you encounter problems, please send an issue.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

about eCapture supports kernel version. #131

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

about eCapture supports kernel version. #131

Uh oh!

Uh oh!

cfc4n Jul 8, 2022 Maintainer

Overview

Linux Kernel

Android Device

load ebpf bytecode failed on kernel version 4.15

unsupported Kernel Version 4.19 ARM64 ARCH

Replies: 2 comments · 1 reply

Uh oh!

cfc4n Jan 18, 2023 Maintainer Author

Uh oh!

sJJdGG Oct 5, 2024

Uh oh!

cfc4n Oct 6, 2024 Maintainer Author

cfc4n
Jul 8, 2022
Maintainer

Replies: 2 comments 1 reply

cfc4n
Jan 18, 2023
Maintainer Author

sJJdGG
Oct 5, 2024

cfc4n Oct 6, 2024
Maintainer Author