Comprehensive documentation for eCapture - eBPF-based SSL/TLS capture and system auditing tool
This repository hosts the official documentation website for eCapture (旁观者), a powerful eBPF-based network traffic capture and system auditing tool. The documentation provides comprehensive guides on installation, architecture, module development, and usage patterns.
eCapture enables capture of SSL/TLS encrypted communications in plaintext without requiring CA certificates or application modifications. It also provides system auditing capabilities for shell commands, database queries, and network packets.
- ✨ SSL/TLS Plaintext Capture - Intercept encrypted data from OpenSSL, BoringSSL, GnuTLS, NSS/NSPR, and Go crypto/tls
- 🔒 No CA Certificates Required - Transparent capture without certificate installation
- 🐚 System Auditing - Monitor Bash/Zsh commands and MySQL/PostgreSQL SQL queries
- 📦 Multiple Output Formats - Text, PCAP-NG, Keylog (SSLKEYLOGFILE), and Protobuf streams
- 🚀 eBPF Technology - Kernel-level hooking with minimal performance overhead
- 🔧 CO-RE Support - Compile Once, Run Everywhere on compatible kernels
| Architecture | Minimum Kernel | Status |
|---|---|---|
| x86_64 (amd64) | Linux 4.18+ | ✅ Fully Supported |
| aarch64 (arm64) | Linux 5.5+ | ✅ Fully Supported |
| Android (amd64/arm64) | Android 12+ | ✅ Supported (BoringSSL) |
| Windows / macOS | N/A | ❌ Not Supported |
The documentation is organized into the following sections:
- Introduction - System purpose and capabilities
- Introduction and Core Capabilities - Core features
- Supported Platforms and Versions - Platform support
- Installation and Prerequisites - Installation guide
- Minimum Privileges - Privilege configuration
- Quick Start - Run the first example in 5 minutes
- Output Formats - Text, PCAP, and KeyLog output
- Probe Reference Overview - Module registry
- TLS/SSL Probes
- TLS/SSL Plaintext Capture - OpenSSL/BoringSSL
- GoTLS Capture - Go crypto/tls
- GnuTLS Capture - GnuTLS support
- NSS/NSPR Capture - Firefox/Chrome NSS
- System Audit Probes
- Shell Auditing - Bash/Zsh monitoring
- Database Traffic Capture - MySQL/PostgreSQL queries
- Integration Overview - Deployment and integration guide
- Remote Event Streaming - WebSocket/TCP streaming
- Remote Dynamic Configuration API - Remote configuration
- Logging and Output Configuration - Logging configuration
- Performance Overhead and Benchmarks - Performance data
- Architecture Overview - System architecture design
- Three-layer Architecture - Three-layer system design
- Probe Framework and Extension Mechanism - Probe framework
- Event Processing Pipeline - Event data flow
- Developer Guide Overview - Developer documentation
- Compilation and Build - Compilation and build process
- How to Add a New Probe - Extend eCapture with new probes
- Testing Strategy and CI/CD - Testing and CI/CD pipeline
- FAQ Overview - Solutions to frequent problems
- Detection and Defense - Detection and defense strategies
- Glossary - Key terms and concepts
# Clone the repository
git clone https://github.com/gojue/ecapture.cc.git
cd ecapture.cc
# Install dependencies
pnpm install
# Start development server
pnpm docs:dev
# Build static site
pnpm docs:buildThe documentation is automatically deployed to https://ecapture.cc via Vercel when changes are pushed to the main branch.
The documentation content is generated from Devin AI Wiki. Follow these steps to refresh the docs with the latest wiki content:
Open the Devin AI Wiki page and trigger a refresh to ensure the wiki reflects the latest source code:
👉 https://app.devin.ai/org/gojue/wiki/gojue/ecapture?branch=master
Download the full multi-language wiki and overwrite scripts/wiki.json:
curl -o scripts/wiki.json \
"https://app.devin.ai/api/wiki/get_full_multi_language_wiki?repo_name=gojue%2Fecapture&branch_name=master"A helper script scripts/update_docs.sh automates Steps 3–6 in one command:
# Generate docs and start the preview server
bash scripts/update_docs.sh
# Generate docs only, without starting the preview server
bash scripts/update_docs.sh --no-devOr run each step manually:
Step 3 — Clear the doc cache:
rm -rf docs/en docs/zhStep 4 — Generate docs from wiki:
node scripts/generate_docs.jsStep 5 — Migrate docs to src/:
node scripts/migrate_docs.jsStep 6 — Preview locally:
pnpm run devOpen your browser and verify the rendered documentation looks correct.
Once everything looks good, commit the changes:
git add .
git commit -m "docs: update from latest wiki"
git pushWe welcome contributions to improve the documentation! Here's how you can help:
- Report Issues - Found a typo or incorrect information? Open an issue
- Submit Pull Requests - Improve existing docs or add new content
- Translate - Help translate documentation to other languages
- Share Feedback - Suggest improvements to structure and content
- Write clear, concise content with practical examples
- Include diagrams and code samples where appropriate
- Follow the existing structure and formatting
- Test all code examples before submitting
- Add source references from the main repository
- Main Project: github.com/gojue/ecapture
- Documentation Site: ecapture.cc
- Issue Tracker: GitHub Issues
- Discussions: GitHub Discussions
Apache License 2.0
Copyright (c) 2022-present, CFC4N (https://www.cnxct.com)
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Special thanks to all documentation contributors:
- @CFC4N - Project Lead & Core Developer
- @Marandi269 - Documentation Contributor
- @liushengxue - Documentation Contributor
Made with ❤️ by the eCapture Team