Root capture with other non-magisk root methods

[67113513]

Hi Emanuele,

I installed pcapdroid 1.6.4 on my TV box(arm64). It works fine on non-root mode, but failed on root mode.
I looked into the issue list and found 2 similar cases, the error message were same with the error on my TV box: 'pcapd daemon did not spawn'. I tried to start pcapd on command line and saw the real error:
/data/app/~~A4AXpZseapiCA2R_7clHkg==/com.emanuelef.remote_capture-wpI8uxqeEZMUjREKhnwMJw==/lib/arm64/libpcapd.so -l pcapd.log -i '@inet' -d -u 10059 -t -b ''
:/data/local/tmp # [I] 25/Apr/2023 18:37:22 - Connecting to client...
[E] 25/Apr/2023 18:37:22 - client connection failed[2]: No such file or directory
[I] 25/Apr/2023 18:37:22 - Pkts: 0 rcvd, 0 drops (0.0%), 0 iface_drops

And I also found it can be started on command line with the '-n' parameter:
:/data/local/tmp #
apd.so -l pcapd.log -i '@inet' -d -u 10059 -t -b '' -n <
:/data/local/tmp # [D] 25/Apr/2023 18:38:19 - Using BPF: ip or ip6
[I] 25/Apr/2023 18:38:19 - Internet interface changed [-1 -> 8], (re)starting capture
[I] 25/Apr/2023 18:38:19 - Could not get interface "wlan0" IPv6[0]: Success
[D] 25/Apr/2023 18:38:19 - wlan0(8): datalink=ethernet(1)
[I] 25/Apr/2023 18:38:19 - "wlan0" is the new internet interface
[wlan0:0] [TCP4] 192.168.3.4:54566 -> 42.186.85.175:30900 (320 B) [RX] (10059)
[wlan0:0] [TCP4] 192.168.3.4:54566 -> 42.186.85.175:30900 (66 B) [TX] (10059)
[wlan0:0] [TCP4] 192.168.3.4:54566 -> 42.186.85.175:30900 (74 B) [TX] (10059)
[wlan0:0] [TCP4] 192.168.3.4:54566 -> 42.186.85.175:30900 (66 B) [RX] (10059)

Can you please have a look and maybe arrange a new release to fix it?
Thanks in advance.

[emanuele-f]

Hi,
It seems like the pcapd daemon cannot find the unix socket used for communication with PCAPdroid. It should be created by PCAPdroid under the cache directory (see here). Maybe the cache directory is not writable?

[67113513]

Thanks for quickly response.

The path of pcapd contains weird strings（looks like base64): /data/app/~~A4AXpZseapiCA2R_7clHkg==/com.emanuelef.remote_capture-wpI8uxqeEZMUjREKhnwMJw==/lib/arm64/libpcapd.so.
So what's the exact path of the cache dir? I can check the permission.

[67113513]

Non of the file (pcapd.log, pcapd.pid, pcapsock) can be found on android, the pcapdroid.log is here:
:/data # find . -type f -name pcapdroid.log
./user/0/com.emanuelef.remote_capture/cache/pcapdroid.log
./data/com.emanuelef.remote_capture/cache/pcapdroid.log
:/data # find . -type f -name pcapd.log
:/data # find . -type f -name pcapsock
:/data # find . -type f -name pcapd.pid
:/data # cd ../

And I ran 'ps' right after clicked start button, but nothing returned:
:/ # ps -ef| grep pcap
root 3887 3690 2 13:07:14 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
root 3892 3690 1 13:07:15 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
^[[Aroot 3894 3690 2 13:07:15 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
^[[Aroot 3897 3690 1 13:07:16 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
^[[Aroot 3899 3690 2 13:07:16 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
root 3902 3690 1 13:07:16 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
root 3907 3690 2 13:07:17 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
root 3909 3690 1 13:07:17 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
^[[Aroot 3912 3690 2 13:07:18 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
^[[Aroot 3915 3690 1 13:07:19 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
root 3917 3690 3 13:07:19 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
^[[Aroot 3920 3690 1 13:07:20 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
root 3922 3690 4 13:07:21 pts/1 00:00:00 grep pcap
:/ # ps -ef| grep pcap
root 3925 3690 1 13:07:21 pts/1 00:00:00 grep pcap

[emanuele-f]

The cache dir is the one with the pcapdroid.log. Please note that the pcapsock is deleted once the capture is stopped (or fails to starts). How is the device rooted? In my experience, only root with magisk works reliably with pcapdroid

[67113513]

The box is compiled with root.
127|rockchip001:/ $ su -
:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:su:s0
:/ # uname -a
Linux localhost 4.19.172 #2 SMP PREEMPT Sun Jun 27 16:44:55 CST 2021 armv8l
:/ #

[emanuele-f]

Since many users are experiencing issues with non-magisk root, it will be good to analyze the issue on such devices and provide support for them. Currently I don't have such a device to test, it would be great if you could fix this and provide a pull request. The code which invokes the "su" executable is

PCAPdroid/app/src/main/jni/common/utils.c

Line 214 in 68daa31

char *argp[] = {"sh", "-c", as_root ? "su" : "sh", NULL};

[67113513]

sure, it works great on all my android phones and I only see the permission issue on one of my tv box, I will try to get some time and made some more investigation.