Root capture stopped working about pcapdroid HOT 18 CLOSED

Oops. I got the name of the permission (INTERACT_ACROSS_USERS, not INTERNET_ACROSS_USERS) slightly wrong. AppManager shows the permission as granted, so maybe PCAPdroid puts that message on the screen on first run before the system can grant the permission. Anyway, works fine now. Thanks for fixing this issue.

from pcapdroid.

Hello, can you please try https://pcapdroid.org/fdroid/repo/PCAPdroid_1.6.7-0531ea2.apk and see if it works?

from pcapdroid.

Yes, this one works.
Thank you.

from pcapdroid.

Can confirm that apk is working on my phone too.

from pcapdroid.

Thank you guys, the fix was in 0531ea2. The new official release with the fix should be available tomorrow.

from pcapdroid.

Update: the actual fix is in 2360dd3. The bug was introduced due to the switch to the AAB packaging for the Google Play build

from pcapdroid.

@emanuele-f Unfortunately, 1.6.8 does not work for me (root mode). When I attempt to start capturing, I get a message (for a few seconds): "Capture start failure. Make sure you grant root access to PCAPdroid" followed by two "PCADdroid was granted Superuser rights" messages. Downgrading (again) to 1.6.5 solves this problem.

from pcapdroid.

@2011 Can you try unistalling the app and reinstalling from Google Play? Alternatively, try to install latest release from github

from pcapdroid.

I did that (uninstalled completely and reinstalled (from F-Droid - I don't know if you have reproducible builds, but if so, F-Droid would offer an identical .apk file). I still have the issue.

I have a relatively old device (Android 7), and the log entry at 11:50:42.489 looks like a possible indication of something gone wrong.

[09-08 11:50:42.383 21255:21255 D/CaptureService]
onCreate

[09-08 11:50:42.387 21255:21255 D/CaptureService]
onStartCommand

[09-08 11:50:42.388 21255:21255 D/CaptureService]
alwaysOn? false

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 2 -> ifb0

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 3 -> ifb1

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 4 -> tunl0

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 5 -> sit0

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 6 -> ip6tnl0

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 18 -> tun0

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 1 -> lo

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 15 -> wlan0

[09-08 11:50:42.390 21255:21255 D/CaptureService]
ifidx 16 -> p2p0

[09-08 11:50:42.393 21255:21255 D/CaptureService]
registerNetworkCallback

[09-08 11:50:42.400 21255:21500 D/pcapdroid-native]
getIntPref(isVpnCapture) = 0

[09-08 11:50:42.400 21255:21500 D/pcapdroid-native]
getIntPref(isPcapFileCapture) = 0

[09-08 11:50:42.401 21255:21500 D/pcapdroid-native]
getStringPref(getWorkingDir) = /data/user/0/com.emanuelef.remote_capture/cache

[09-08 11:50:42.401 21255:21500 D/pcapdroid-native]
getStringPref(getPersistentDir) = /data/user/0/com.emanuelef.remote_capture/files

[09-08 11:50:42.446 21255:21500 D/pcapdroid-native]
getStringPref(getCaptureInterface) = @inet

[09-08 11:50:42.453 21255:21500 D/pcapdroid-native]
run_shell_cmd[21501]: /data/app/com.emanuelef.remote_capture-1/lib/arm64/libpcapd.so -l pcapd.log -L 10127 -i '@inet' -u -1 -t -b '' -d

[09-08 11:50:42.489 21506:21506 W/linker]
/data/app/com.emanuelef.remote_capture-1/lib/arm64/libpcapd.so: unsupported flags DT_FLAGS_1=0x8000001

[09-08 11:50:42.557 21255:21500 D/CaptureService]
Joining threads...

[09-08 11:50:42.557 21255:21500 D/CaptureService]
Joining conn update thread...

[09-08 11:50:42.558 21255:21500 D/CaptureService]
stopService called (instance? true)

[09-08 11:50:42.585 21255:21255 D/CaptureService]
onDestroy

[09-08 11:50:42.586 21255:21255 D/CaptureService]
unregisterNetworkCallback

[09-08 11:50:42.588 21255:21255 D/CaptureCtrl]
notifyCaptureStopped: 0 pkts

from pcapdroid.

Can you try to run /data/app/com.emanuelef.remote_capture-1/lib/arm64/libpcapd.so manually as root from termux/adb to check if it runs correctly? See -h for details.

from pcapdroid.

That looks like an efficient (I would describe myself as an old-timer who likes working in the shell) way of doing things.

I received the same "unsupported flags" message in both looking at the help message and attempting a capture:

t10_e3c5_g:/data/app/com.emanuelef.remote_capture-1/lib/arm64 # ./libpcapd.so -h                                                   
WARNING: linker: /data/app/com.emanuelef.remote_capture-1/lib/arm64/libpcapd.so: unsupported flags DT_FLAGS_1=0x8000001
pcapd - root capture tool of PCAPdroid
Copyright 2021-23 Emanuele Faranda <[email protected]>

Usage: pcapd [OPTIONS]
 -i [ifname]    capture packets on the specified interface. Can be specified
                multiple times. The '@inet' keyword can be used to capture from
                the internet interface
 -d             daemonize the process
 -t             dump the interface datalink header. Default: don't dump
 -u [uid]       filter packets by uid
 -b [bpf]       filter packets by BPF filter
 -l [file]      log output to the specified file
 -L uid         specify the UID to use to create the log file
 -n             do not connect to the UNIX socket, log to stdout instead
 -q             suppress non-error output


t10_e3c5_g:/data/app/com.emanuelef.remote_capture-1/lib/arm64 # ./libpcapd.so -i @inet                                           
WARNING: linker: /data/app/com.emanuelef.remote_capture-1/lib/arm64/libpcapd.so: unsupported flags DT_FLAGS_1=0x8000001
[W] 08/Sep/2023 14:10:25 - NETLINK_INET_DIAG not working, using slow UID resolution method
[I] 08/Sep/2023 14:10:25 - Connecting to client...
[E] 08/Sep/2023 14:10:25 - client connection failed[2]: No such file or directory
[I] 08/Sep/2023 14:10:25 - Pkts: 0 rcvd, 0 drops (0.0%), 0 iface_drops

from pcapdroid.

@2011 thanks for checking this. The "unsupported flags" should not impact the capture. The binary seems to run fine, even though you would need to pass the -n option to run in this standalone fashion.

I've pushed a tentative fix, because it's not possible to tell the exact problem from the current logs. Please try it and let me know, in any case this latest commit should print some more logs. You can either install the beta APK from https://pcapdroid.org/fdroid/repo/PCAPdroid_1.6.8-44f8dd8.apk or build manually from the master branch.

from pcapdroid.

I've pushed a tentative fix, because it's not possible to tell the exact problem from the current logs. Please try it and let me know, in any case this latest commit should print some more logs. You can either install the beta APK from https://pcapdroid.org/fdroid/repo/PCAPdroid_1.6.8-44f8dd8.apk or build manually from the master branch.

Downloaded and installed that .apk.

1. It does capture packets now. :)
2. Something still doesn't look right (the NETLINK_INET_DIAG warning):

[W] 10/Sep/2023 08:00:07 - NETLINK_INET_DIAG not working, using slow UID resolution method
[I] 10/Sep/2023 08:00:07 - Connecting to client...
[I] 10/Sep/2023 08:00:07 - Connected to client
[D] 10/Sep/2023 08:00:07 - Using BPF: ip or ip6
[I] 10/Sep/2023 08:00:07 - Internet interface changed [-1 -> 30], (re)starting capture
[I] 10/Sep/2023 08:00:08 - Could not get interface "tun0" IPv6[0]: Success
[D] 10/Sep/2023 08:00:08 - tun0(30): datalink=raw(12)
[I] 10/Sep/2023 08:00:08 - "tun0" is the new internet interface

3. The first time I ran it (only the first time - I can't repeat it), I (briefly) saw a message in the app that said something like "can't change user." I don't know if that has any importance or relevance (I could probably uninstall and reinstall the debug app if you wanted me to get the exact message).

from pcapdroid.

Great! The netlink diag warning is fine, it depends on your Android version and rom. If you can reproduce the change user message again, please add a comment here. Closing the issue as fixed

from pcapdroid.

@emanuele-f I have the messages now that flashed briefly on the screen (again, for the beta version). The first time I started the (as it shows the introduction), I saw "PCAPdroid: the control request was denied". The first time I captured packets, I saw "INTERNET_ACROSS_USERS permission was denied". Neither of these messages appeared again with subsequent use.

from pcapdroid.

@2011 thanks for reporting, you have spotted two bugs 👍

The first issue is fixed in 3c6bc51. getCallingPackage() was incorrectly called during the on-boarding after the calling activity was finished

The second issue is fixed in bf6e834. The INTERNET_ACROSS_USERS should only be requested when starting in root mode, not in pcap mode.

from pcapdroid.

The second issue is fixed in bf6e834. The INTERNET_ACROSS_USERS should only be requested when starting in root mode, not in pcap mode.

Just for clarity (as mentioned many messages above), I did start (and always run) in root mode.

from pcapdroid.

Ok I see, it's a different issue, this is strange as the INTERNET_ACROSS_USERS permission should be requested again on subsequent starts until it's correctly granted.
To verify if it's actually granted, you would need to create a work profile and check if PCAPdroid installed outside can determine the app of connections started inside the work profile. If so, the permission is correctly granted. In any case, I would not bother much about this, it's a very specific use case

from pcapdroid.