cfc4n@vm-server:~$# cat /boot/config-`uname -r` | grep CONFIG_DEBUG_INFO_BTF
CONFIG_DEBUG_INFO_BTF=y

# no CO-RE
eCapture version: linux_aarch64:0.4.2-20220906-fb34467:5.4.0-104-generic
# CO-RE
eCapture version: linux_aarch64:0.4.2-20220906-fb34467:[CORE]

root@vm-server:/home/cfc4n/# ecapture -h
     --hex[=false]  print byte strings as hex encoded strings
 -l, --log-file=""  -l save the packets to file
 -p, --pid=0   if pid is 0 then we target all pids
 -u, --uid=0   if uid is 0 then we target all users

root@vm-server:/home/cfc4n/project/ssldump# bin/ecapture tls -h
OPTIONS:
     --curl=""  curl or wget file path, use to dectet openssl.so path, default:/usr/bin/curl
     --firefox="" firefox file path, default: /usr/lib/firefox/firefox.
     --gnutls="" libgnutls.so file path, will automatically find it from curl default.
     --gobin="" path to binary built with Go toolchain.
 -h, --help[=false] help for tls
 -i, --ifname="" (TC Classifier) Interface name on which the probe will be attached.
     --libssl="" libssl.so file path, will automatically find it from curl default.
     --nspr=""  libnspr44.so file path, will automatically find it from curl default.
     --port=443 port number to capture, default:443.
     --pthread="" libpthread.so file path, use to hook connect to capture socket FD.will automatically find it from curl.
     --wget=""  wget file path, default: /usr/bin/wget.
 -w, --write="" write the  raw packets to file as pcapng format.

{
   Section:          "uprobe/SSL_write",
   EbpfFuncName:     "probe_entry_SSL_write",
   AttachToFuncName: "SSL_write",
   UprobeOffset:       0xFFFF00, // TODO
   BinaryPath:       binaryPath,
},

//  g++ -I include/ -I src/ ./src/offset.c -o off
#include <stdio.h>
#include <stddef.h>
#include <ssl/internal.h>
#include <openssl/base.h>
#include <openssl/crypto.h>
#define SSL_STRUCT_OFFSETS               \
   X(ssl_st, session)              \
   X(ssl_st, s3)              \
   X(ssl_session_st, secret)        \
   X(ssl_session_st, secret_length)  \
   X(bssl::SSL3_STATE, client_random) \
   X(bssl::SSL_HANDSHAKE, new_session) \
   X(bssl::SSL_HANDSHAKE, early_session) \
   X(bssl::SSL3_STATE, hs) \
   X(bssl::SSL3_STATE, established_session) \
   X(bssl::SSL_HANDSHAKE, expected_client_finished_)    
struct offset_test
{
   /* data */
   int t1;
   bssl::UniquePtr<SSL_SESSION> session;
};
int main() {
   printf("typedef struct ssl_offsets { // DEF \n");
#define X(struct_name, field_name) \
   printf("   int " #struct_name "_" #field_name "; // DEF\n");
   SSL_STRUCT_OFFSETS
#undef X
   printf("} ssl_offsets; // DEF\n\n");
   printf("/* %s */\nssl_offsets openssl_offset_%d = { \n",
          OPENSSL_VERSION_TEXT, OPENSSL_VERSION_NUMBER);
#define X(struct_name, field_name)                         \
   printf("  ." #struct_name "_" #field_name " = %ld,\n", \
           offsetof(struct struct_name, field_name));  
   SSL_STRUCT_OFFSETS
#undef X
   printf("};\n");
   return 0;
}

ubuntu@VM-0-5-ubuntu:~$sudo apt-get update
ubuntu@VM-0-5-ubuntu:~$sudo apt-get install --yes wget git golang build-essential pkgconf libelf-dev llvm-12 clang-12  linux-tools-generic linux-tools-common
ubuntu@VM-0-5-ubuntu:~$wget https://golang.google.cn/dl/go1.18.linux-arm64.tar.gz
ubuntu@VM-0-5-ubuntu:~$sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.18.linux-arm64.tar.gz
ubuntu@VM-0-5-ubuntu:~$for tool in "clang" "llc" "llvm-strip"
do
sudo rm -f /usr/bin/$tool
sudo ln -s /usr/bin/$tool-12 /usr/bin/$tool
done
ubuntu@VM-0-5-ubuntu:~$export GOPROXY=https://goproxy.cn
ubuntu@VM-0-5-ubuntu:~$export PATH=$PATH:/usr/local/go/bin