#920·ecapture

三星S23U 使用keylog模式 报错master secret length is too long

Author: wabailuCreated Jan 5, 2026Updated Apr 29, 2026
Labels🐞 bug

描述:在三星S23U上使用keylog模式尝试抓包时出现master secret长度报错,ecapture_openssl_key.log为空。

相似issue :https://github.com/gojue/ecapture/issues/569#issue-2348289150

设备:三星S23U 内核:Linux localhost 5.15.189-android13-8-style-g2a562ccb #1 SMP PREEMPT Mon Aug 25 09:00:01 CST 2025 aarch64 Toybox

操作步骤: 1、adb shell --> su 2、./ecapture tls -m keylog

现象: 持续报错:ERR master secret length is too long, truncate to 64 bytes, but it may cause keylog file error length=xxxx

完整运行日志: dm3q:/data/local/tmp # ./ecapture tls -m keylog 2026-01-05T09:11:56Z INF AppName="eCapture(旁观者)" 2026-01-05T09:11:56Z INF HomePage=https://ecapture.cc 2026-01-05T09:11:56Z INF Repository=https://github.com/gojue/ecapture 2026-01-05T09:11:56Z INF Author="CFC4N [email protected]" 2026-01-05T09:11:56Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64." 2026-01-05T09:11:56Z INF Version=androidgki_arm64:v1.5.2:6.8.0-1044-azure 2026-01-05T09:11:56Z INF Listen=localhost:28256 2026-01-05T09:11:56Z INF Listen for eCaptureQ= 2026-01-05T09:11:56Z INF eCapture running logs logger= 2026-01-05T09:11:56Z INF the file handler that receives the captured event eventCollector= 2026-01-05T09:11:56Z INF listen=localhost:28256 2026-01-05T09:11:56Z INF https server starting...You can upgrade the configuration file via the HTTP interface. 2026-01-05T09:11:56Z INF Kernel Info=5.15.189 Pid=4644 2026-01-05T09:11:56Z INF TruncateSize=0 Unit=bytes 2026-01-05T09:11:56Z WRN Your environment is like a container. We won't be able to detect the BTF configuration. If eCapture fails to run, try specifying the BTF mode. use -b 2 to specify non-CORE mode. 2026-01-05T09:11:56Z INF BTF bytecode mode: CORE. btfMode=0 2026-01-05T09:11:56Z INF master key keylogger has been set. eBPFProgramType=KeyLog keylogger=ecapture_openssl_key.log 2026-01-05T09:11:56Z INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL 2026-01-05T09:11:56Z INF Module.Run() 2026-01-05T09:11:56Z WRN bpfFile=boringssl_a_15_kern.o sslVersion=android_default 2026-01-05T09:11:56Z INF HOOK type:Openssl elf ElfType=2 binrayPath=/apex/com.android.conscrypt/lib64/libssl.so masterHookFuncs=["SSL_in_init"] 2026-01-05T09:11:56Z INF target all process. 2026-01-05T09:11:56Z INF target all users. 2026-01-05T09:11:56Z INF setupManagers eBPFProgramType=KeyLog 2026-01-05T09:11:56Z INF BPF bytecode file is matched. bpfFileName=user/bytecode/boringssl_a_15_kern_core.o 2026-01-05T09:11:57Z INF perfEventReader created mapSize(MB)=4 2026-01-05T09:11:57Z INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL 2026-01-05T09:12:02Z ERR master secret length is too long, truncate to 64 bytes, but it may cause keylog file error length=2435363977 2026-01-05T09:12:02Z ERR master secret length is too long, truncate to 64 bytes, but it may cause keylog file error length=2435363977 2026-01-05T09:12:02Z ERR master secret length is too long, truncate to 64 bytes, but it may cause keylog file error length=2435363977 2026-01-05T09:12:02Z ERR master secret length is too long, truncate to 64 bytes, but it may cause keylog file error length=2435363977 2026-01-05T09:12:02Z ERR master secret length is too long, truncate to 64 bytes, but it may cause keylog file error length=2435363977 2026-01-05T09:12:02Z ERR master secret length is too long, truncate to 64 bytes, but it may cause keylog file error length=2435363977