使用attach_uprobe在SSL_read挂载，读取的内容为0字节。SSL_read和SSL_write的逻辑应该是相通的，不清楚为啥不能读取响应内容。

代码如下：
`#!/usr/bin/env python

coding: utf-8

from bcc import BPF

bpf_source = """
#include <uapi/linux/ptrace.h>
#define MAX_BUF_SIZE 4000
struct event_t {
u32 pid;
u32 len;
u8 buf[MAX_BUF_SIZE];
};

BPF_PERF_OUTPUT(events);

BPF_HASH(bpf_context_1, u64, struct event_t, 2048);
BPF_ARRAY(bpf_context_gen_1, struct event_t, 1);

static struct event_t *make_event_1() {
int zero = 0;
struct event_t *bpf_ctx = bpf_context_gen_1.lookup(&zero);
if (!bpf_ctx) return 0;
u64 id = bpf_get_current_pid_tgid();
bpf_context_1.update(&id, bpf_ctx);
return bpf_context_1.lookup(&id);
}

int trace_SSL_read_return(struct pt_regs *ctx) {

struct event_t *event = make_event_1();
if (!event) return 0;

event->pid = bpf_get_current_pid_tgid() >> 32;

int len = PT_REGS_RC(ctx);
event->len = (u32)len;
 
u32 buf_copy_size = min((size_t)MAX_BUF_SIZE, (size_t)len);
void *buf_arg_ptr = (void *)PT_REGS_PARM2(ctx);
bpf_probe_read_user(&event->buf, buf_copy_size, (char *)buf_arg_ptr);
events.perf_submit(ctx, event, sizeof(struct event_t));
return 0;

}
"""

def print_event(cpu, data, size):
event = bpf["events"].event(data)
buf_size = event.len
payload_str = bytearray(event.buf[:buf_size]).decode()
payload_str = bytes(payload_str, encoding='utf-8')
print("PID: %d read %d bytes: %s" % (event.pid, event.len, payload_str))

bpf = BPF(text=bpf_source)
ssl_lib_path = '/usr/lib64/libssl.so.10'
bpf.attach_uprobe(name=ssl_lib_path, sym="SSL_read", fn_name="trace_SSL_read_return")

bpf["events"].open_perf_buffer(print_event)

while True:
try:
bpf.perf_buffer_poll()
except KeyboardInterrupt:
exit()

`
结果

利用你提供的probe_SSL_rw_enter和probe_SSL_read_exit也不行

部分go程序并不能抓取https，例如https://github.com/ginuerzh/gost，通过gost生成了个SS，然后进行抓取报错。