Android 16: ecapture only captures http responses

[jeromekleinen]

Important

You can mention the @dosu AI robot, which can quickly answer your questions.

Describe the bug
My pixel 6a was recently forced updated to Android 16. Ecapture still runs and is still able to capture http responses but for some reason http requests are completely dropped. Also keylog mode does not seem to work.

To Reproduce
Steps to reproduce the behavior:

1. run ecapture on Android 16
2. open an app to generate some traffic
3. observe only http responses are shown

Linux Server/Android (please complete the following information):

• Device: Pixel 6a
• Kernel Info: Linux localhost 6.1.124-android14-11-g8d713f9e8e7b-ab13202960 #1 SMP PREEMPT Wed Mar 12 13:40:07 UTC 2025 aarch64 Toybox
• eCapture Version: androidgki_arm64:v1.4.1:6.8.0-1031-azure

Additional context
I tried the specifying all three existing ssl versions (13, 14 and 15) but the behavior seems to be the same.
Running with debug mode does not seem to yield any useful logs.

[dosubot]

Hi @jeromekleinen! I'm Dosu and I’m helping the ecapture team.

Your issue is likely caused by kernel changes in Android 16 (kernel 6.1.x) that broke ecapture's eBPF probes for HTTP requests and keylog mode. This is a classic symptom when kernel structure offsets or function signatures change, causing ecapture to only partially intercept traffic—responses may still work, but requests and keylog extraction fail.

Recent fixes were merged to support OpenSSL 3.0.12 (used in Android 16), specifically for keylog mode (PR #826), and to handle its unique offsets (PR #828). These changes are not present in your current ecapture version, so updating to a build that includes these PRs is required for keylog mode to work on Android 16.

For HTTP request capture, the underlying issue is likely a mismatch between ecapture's eBPF probes and the updated kernel structures. This requires explicit updates to ecapture's kernel offset mappings for Android 16. Until those updates are made, request capture will remain unreliable on this kernel version.

In summary: update ecapture to a version with OpenSSL 3.0.12 support for keylog mode, and watch for future releases that address kernel compatibility for HTTP request capture on Android 16.
Relevant sources: keylog mode bugfix, OpenSSL 3.0.12 offset support, kernel-dependent probe issues.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[jeromekleinen]

Hello,

Indeed @dosu this will likely require a pull request similar to #723 but based on https://android.googlesource.com/platform/external/boringssl/+/refs/heads/android16-release instead. Do you happen to know whether such a pull request can be automatically generated based on the source code of boringssl?

[dosubot]

A pull request to add Android16 BoringSSL support in ecapture can be mostly generated using the existing automation in the repo. There's a script (utils/boringssl_android_offset.sh) that automates cloning the BoringSSL repo, checking out android-release branches, and generating the necessary offset header files using a C utility. To support android16-release, you just need to add it to the script's mapping and rerun the script—no manual struct offset inspection is needed. However, there isn't a fully automated system that detects new BoringSSL releases and creates PRs automatically; a contributor still needs to update the script and review the output before submitting a PR. This makes the process streamlined but not fully hands-off.
See script details

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}