I Enabled Wireless Debugging. xAgent and a 27B Quantized Model Did the Rest

Описание и применение

Автор использовал xAgent с 27‑битной моделью Qwen3.8-27B AWQ INT4 для настройки беспроводного отладки и захвата трафика на Android‑устройстве. Были успешно захвачены браузерные запросы, но трафик нативных приложений остался недоступен из‑за ограничений доверия сертификатов.

Задача

Determine if a 27B quantized LLM can orchestrate wireless debugging and packet capture on an unrooted Android device.

Результат

Wireless debugging and packet capture were successfully set up. Browser traffic was fully decrypted; some WebView traffic partially decrypted; native app traffic limited to TLS handshake. The boundary of Android’s trust model was identified, and root options were evaluated.

Рабочий процесс

• Enable wireless debugging on the phone
• Connect phone and server to same network
• Use xAgent to inspect device and deploy tools
• Deploy mitmproxy and Frida on server and phone
• Configure wireless ADB, reverse port forwarding, global proxy
• Capture traffic and read mitmproxy logs
• Analyze which traffic is decrypted
• Identify boundary of native app trust
• Assess root options and risks

Доказательства

xAgent first checked the phone model, Android version, wireless ADB endpoint, and pairing state. It then started connecting the server and phone.

Источник

The phone browser's main HTTPS request returned 200 OK and could be decrypted, showing that the browser or WebView trusted the user CA.

Источник

xAgent also cleaned up upstream-certificate handling and persistent logging on the proxy.

Источник