# TraceEagle System-Level Capture Tutorial: Capture macOS Built-in Apps and Stubborn Apps as Plaintext

# System-Level Capture

> This guide shows you how to use "System-Level Capture" to capture **macOS built-in apps** and those **stubborn, deeply hidden** apps: without entering the process and without touching certificates, observing purely in bypass from beneath the system, so that even targets other capture methods can't reach are read as plaintext. This is the **last resort** among local capture methods — use it when the previous ones all fail.

## 1. When to Use This Capture Method

It fits if any one of the following applies to you:

- You want to see what **macOS built-in apps / system services** (App Store, system components, background services, etc.) are saying to their servers.
- The target is a **stubborn, deeply hidden** third-party app: it rejects all external intervention, proxies can't get in, and pulling plaintext from inside the process is blocked as well.
- You've tried the previous capture methods — proxy rejected, application-layer capture refuses to intervene, only ciphertext left on the NIC — and you still need plaintext.

If it's just an ordinary program (browser / script / CLI), **Specified Program Capture** or **Application-Layer Capture** is easier; system-level capture is overkill.

## 2. Prerequisites

- Running on **macOS** (this guide covers the macOS system-level method).
- TraceEagle is installed and started; simply agree to the system permissions on first launch.
- You know the capture target: a **running program**, or its **program path / name**.
- **No** certificates to install and **no** system proxy to change — this capture method performs no man-in-the-middle and never touches certificates.

## 3. Start Capturing: Three Steps to Your First Capture

1. Create a session and choose **"Local System-Level Capture"**.
2. **Pick a target**: select a **running program** from the dropdown, or enter the **program path / name** directly.
3. Optionally enable **capture "the moment it starts"**: once checked, the tool first shuts down the target and then launches it itself, so that traffic from the **early startup phase** is captured as well — a great deal of authentication and handshaking happens at that very instant, and leaving it unchecked makes it easy to miss.
4. Click **Start**. The tool observes this program in bypass from beneath the system and reads out the plaintext it sends and receives.

> Have the target program generate network requests (in a system app, click an operation that goes online) and the traffic will show up in the request list in real time.


## 4. Verification: Confirm the Capture and Decryption

Click any entry in the request list and look at the details:

- **The request is visible**: request line, request headers, and body are all there.
- **TLS shows "Decrypted"**: the request and response are readable plaintext (such as JSON), not garbled ciphertext.

System-level capture does not inject, does not modify the program, and does not touch certificates, so even if the target performs strict certificate validation, it cannot affect the plaintext read out here.


## 5. Nothing Captured / Can't Decrypt? Troubleshoot Item by Item

| Symptom | Most likely cause | What to do |
| --- | --- | --- |
| Can't select a target / it's not in the dropdown | The program isn't running yet | Start the target program first, then come back and select it from the dropdown; or enter the program path / name directly |
| Captured, but the very first handshake / authentication is missing | The key traffic happened in the **early startup phase**, already over by the time you started capturing | Check **capture "the moment it starts"** so the tool first shuts down the target and then launches it, covering the early startup phase as well |
| Not a single request | The wrong target was selected, or that program isn't online right now | Confirm you selected the program that is actually doing the networking; trigger an operation that goes online and look again |
| You want to use it for ordinary programs too | System-level capture is overkill for ordinary programs | For ordinary programs, switch to Specified Program Capture (which can launch it by command) or Application-Layer Capture (already running) |

---

## 6. How to Choose Among the Four Local Capture Methods

| Your situation | Which to use |
| --- | --- |
| macOS built-in apps and stubborn apps (other methods can't capture them) | **System-level capture** (this guide) |
| The program is already running / certificate pinning / doesn't honor proxies / proprietary encryption | Application-layer capture |
| An ordinary program that can be launched by command (browser / script / CLI) | Specified program capture |
| You want to see all traffic on the machine, including non-HTTP traffic | NIC capture |


## Next Steps

- How to read what you captured, switch views, and decode it: see Data Viewing and Decoding.
- For private / proprietary protocols you want to teach it to read yourself: see Custom Protocol Decoding.
- To modify a request and resend it, or intercept it mid-flight and edit it by hand: see Request Construction and Replay and Rule Rewriting and Breakpoint Interception.