I’m trying to investigate the background network behaviour of an app. I have installed PCAP-droid and PCAP-mitm and following the instructions to install a certificate via Settings > Security and privacy > More security and privacy > Encryption and credentials > Install a certificate > CA certificate, the certificate that PCAP-mitm exports is only 4 bytes, and obviously can’t be installed.
The web tells me a lot about failure to install, but not failure to export. Has anybody here used this app?
I have no idea what the app is, but Plexus gives it a “gold rating” for microG users (but very few reports, most recent is Nov 2025 from a LineageOS user). If you can link to the instructions you are following it would be helpful. Is it a CA certificate or a app user certificate, for example? 4 bytes seems too small though?
PCAP-droid is a GUI-wrapped version of tcpdump with all the CLI options available thru buttons. I wanted to examine the background traffic from a couple of apps on my phone, Some of it is TLS encrypted, so PCAP-droid has an ability to extract the key during handshake by acting as a MITM on the device, but this requires installing the optional PCAP-mitm. Instructions on how to install and setup this are embedded in the main app as a functional step-by-step guide. I didn’t see separate instructions on the dev’s github site.
The 4 bytes of the exported “certificate” are the word “null” which leads me to believe either the makings of the certificate are missing or hidden on my phone, or BraX3 prohibits the export of such certificates.
PCAPdroid has internal instructions on where to go to download the mitm add-on, and in its settings it has “Open by default > In the app” selected. So why does it ask the system default browser to do the download? Dev thinks it may be this interruption - resumption of activity that is causing the Null certificate export.
On that “Open by default” section have you clicked the “+ Add link” and added / enabled any available options there? They are not enabled by default with iodéOS for privacy reasons.
Hmmm, I thought it might have been something I overlooked, but I’ve just been through 95 apps installed on my phone, and only 6 (six) have a “+ Add link”. 2 are the official app stores Aurora and ioDroid, one is my telco’s app, and the other three are ad-supported maps. I’ve been through the Security and Privacy section but I must be a bit dim today didn’t find anything
If the + Add link isn’t there, then the app isn’t written to handle any web links. So in that case I think the “Open in the app / browser” is not relevant? Sorry I am not too familiar with how this works beyond this level.
So tossing in another random guess, if the link is in the form https://foo/bar.apk then it is treated as not a link, because a link should have the suffix .htm
I’ve got a beta build from the dev and it seems to work: I can see the dns traffic so I know who is calling home to where. I now need to do some sim and token swapping to get the paid version on this phone so I can look at the payloads …
didn’t find anything