The difference is that when you specify "libssl.so", Frida looks for SSL_CTX_set_keylog_callback specifically within that library. When you pass null, Frida searches across all loaded modules. If the function is not exported globally or is only available within libssl.so, findExportByName(null, "...") will return null. You can try Module.findExportByName("libssl.so", "SSL_CTX_set_keylog_callback") first to confirm the function exists in that module.