Device baseline and hard limits
The laboratory is not an abstract “Android phone.” Check every claim against this baseline and revalidate it when moving to another model.
| Layer | Public baseline | Meaning |
|---|---|---|
| Device | OnePlus 8T, codename kebab |
A/B partition device; flashing and recovery vary by release |
| ROM | LineageOS 21 | Android 14; Google Play services are not assumed |
| Root | Magisk 30.7 | Granted only when a lab needs it; modules are not default infrastructure |
| User space | Release-signed Termux | Debug-signed builds are not a durable main environment |
| Linux toolbox | Kali under PRoot | A compatibility environment, not host root or extra kernel capabilities |
| Network forwarding | Optional Android VPN/TUN | A key icon does not prove routing, DNS, TCP, and TLS all work |
| Dynamic app observation | Frida with matched client/server versions | Only for owned or explicitly authorized apps |
| AI agent | OpenCode or equivalent, on demand | Model output is a hypothesis to test, not device truth |
What counts as verified
Every “works” claim should include:
- component version and source;
- date and relevant device state;
- original command plus redacted output;
- a success condition and a possible counterexample;
- a rollback or stop procedure.
Hard limits
- Wi-Fi monitor mode and injection depend on chipset, driver, firmware, and kernel support;
- Android root does not change radio hardware;
- PRoot cannot grant privileges withheld by the host kernel;
- a globally trusted CA expands the MITM surface of every participating app and is not a default debugging method;
- Magisk safe mode and boot counters require early-boot evidence—an after-boot value cannot reconstruct the earlier decision by itself;
- an app tied to a third-party service or store policy may stop working when upstream behavior changes.
Continue with the English field guide.