LINUX · FTRACE UPROBES · OPENSSL · ZERO EBPF

proc-trace-tls

Intercept plaintext TLS traffic before it's encrypted — per-process, in real time. Shows the remote host via SNI or /proc/net/tcp. Hooks SSL_read / SSL_write via ftrace uprobes. No eBPF. No ptrace. No CA install.

📦 Install ⭐ GitHub Screenshots → Usage →

proc-trace-tls — bash

$ sudo proc-trace-tls -p $(pgrep curl)
proc-trace-tls v0.1.0
  lib : /lib/x86_64-linux-gnu/libssl.so.3
  pids: 14821
Watching 4 probe(s). Press Ctrl-C to stop.

14:23:01.441  14821  curl      RX  SSL_read     api.github.com:443
14:23:01.442  14821  curl      TX  SSL_write    api.github.com:443
14:23:01.449  14821  curl      RX  SSL_read     api.github.com:443
14:23:01.458  14905  python3   TX  SSL_write    pypi.org:443
14:23:01.462  14905  python3   RX  SSL_read_ex  pypi.org:443
^C
captured 5 TLS events

CAPABILITIES

🔓

Plaintext Before Crypto

Hooks SSL_read / SSL_write at the function boundary — you see data exactly as the application sees it, before OpenSSL touches it.

📍

ftrace Uprobes

Uses the kernel's built-in uprobe infrastructure via /sys/kernel/debug/tracing. Available on every Linux distro since kernel 4.17 — no eBPF, no kernel modules, no extra packages.

🎯

Per-Process Filter

Use -p PID[,PID,...] to watch only specific processes, or omit it to catch all TLS calls system-wide.

🌐

Remote Host Resolution

Shows the hostname being connected to on every event. Uses SNI from SSL_get_servername first; falls back to /proc/<pid>/net/tcp + reverse DNS for non-SNI connections. Use -R to show raw IPs.

🛡️

Bypasses Cert Pinning

Works regardless of cipher suite or certificate pinning. The uprobe fires on the function, not the network packet — TLS fingerprinting and pinning are irrelevant.

🔌

Zero Dependencies

Single static binary. Requires only debugfs (mounted by default) and root. No BCC tools. No kernel headers. No Python.

WHY THIS EXISTS

See what your app is actually sending over HTTPS

Every HTTPS request your app makes is encrypted. But somewhere between your application code and the network, there's a moment when the data is plaintext — right at the OpenSSL function boundary.

Existing approaches are painful: MitM proxies break cert pinning. Wireshark needs TLS key material. strace works but is slow and verbose. eBPF-based tools like bcc/ssl_sniff require kernel headers and a working BCC install.

proc-trace-tls uses the same kernel mechanism as eBPF uprobes — but accessed via the much simpler ftrace interface that's been in every kernel since 4.17, with no compiler, no headers, and no extra packages.

How it works in one sentence: ftrace uprobes insert a kernel hook at the entry point of SSL_read / SSL_write in libssl.so; proc-trace-tls reads the resulting event stream from /sys/kernel/debug/tracing/trace_pipe.

App → libssl.so:SSL_write
↓ [ uprobe hook ]
ftrace trace_pipe
↓
proc-trace-tls
— — — — — — — — — — —
ciphertext → 🌐 network

Tool	Mechanism	eBPF req.	Affects app	Cert pinning	Static binary
proc-trace-tls	ftrace uprobes	✓ no	✓ no	✓ works	✓ yes
bcc ssl_sniff	eBPF uprobes	✗ required	✓ no	✓ works	✗ no
mitmproxy	MitM proxy	✓ no	✗ yes	✗ breaks	✓ yes
ssldump	pcap + key file	✓ no	✓ no	✗ needs keys	✓ yes
strace -e read	ptrace	✓ no	✗ slow	✓ works	✓ yes

USE CASES

🔐

Security Research

See exactly what a binary sends over HTTPS without setting up a proxy or installing a custom CA. Works even with certificate pinning.

🐛

API Debugging

Inspect the raw HTTP/1.1 frames your application sends and receives — without modifying the app, its config, or its certificate store.

📦

Third-Party Auditing

Verify what a closed-source binary transmits before you trust it. See every TLS call it makes, what it reads, and what it writes.

🔍

Incident Response

On a compromised host, see exactly what malware exfiltrates over HTTPS without needing to decrypt the packet capture.

🎓

Learning TLS

Watch the actual HTTP request / response plaintext flow in real time. A hands-on way to understand what lives inside a TLS connection.

🤖

Automated Monitoring

Pipe events to a log file with -o for long-running monitoring. Integrate with alerting pipelines to catch unexpected data exfiltration.