I Enabled Wireless Debugging. xAgent and a 27B Quantized Model Did the Rest

Description and use

The author leveraged xAgent powered by a 27B quantized LLM to enable wireless debugging and capture traffic on an Android device. Browser traffic was fully decrypted, while native app traffic remained limited due to certificate trust boundaries.

Problem

Determine if a 27B quantized LLM can orchestrate wireless debugging and packet capture on an unrooted Android device.

Outcome

Wireless debugging and packet capture were successfully set up. Browser traffic was fully decrypted; some WebView traffic partially decrypted; native app traffic limited to TLS handshake. The boundary of Android’s trust model was identified, and root options were evaluated.

Workflow

• Enable wireless debugging on the phone
• Connect phone and server to same network
• Use xAgent to inspect device and deploy tools
• Deploy mitmproxy and Frida on server and phone
• Configure wireless ADB, reverse port forwarding, global proxy
• Capture traffic and read mitmproxy logs
• Analyze which traffic is decrypted
• Identify boundary of native app trust
• Assess root options and risks

Evidence

xAgent first checked the phone model, Android version, wireless ADB endpoint, and pairing state. It then started connecting the server and phone.

Source

The phone browser's main HTTPS request returned 200 OK and could be decrypted, showing that the browser or WebView trusted the user CA.

Source

xAgent also cleaned up upstream-certificate handling and persistent logging on the proxy.

Source