gojue/ecapture ? reverse-engineered prompt

Build me a security tool that can show me plaintext SSL and TLS traffic from running apps without using a MITM proxy or installing a custom CA.

I want it to run on Linux and Android, on both x86_64 and arm64, and to work with root or the right system capabilities. It should detect common TLS libraries like OpenSSL, BoringSSL, LibreSSL, GnuTLS, NSS, and Go programs using TLS, then let me capture what’s actually being sent and received in a readable way.

Please make it feel like a normal command line tool with subcommands for different capture modes, like printing plaintext to the console, saving it to a pcap style file for Wireshark, or writing TLS key logs for later inspection. If possible, include modules for things like bash history and database query auditing too, since that seems useful for host security monitoring.

If you need current docs or kernel details, look them up online first.