Crossfyre vs PCAPdroid
A very good free on-device capture app vs a platform that also gets past pinning.
PCAPdroid is a well-built, free, open-source Android app that captures traffic without root using VpnService, and its mitmproxy addon adds real TLS decryption. For inspecting your own device or an unpinned app, it does the job and costs nothing. Two honest limits: its own documentation is upfront that pinned apps need root, and it is a capture tool rather than a platform. Crossfyre does the same on-device capture, then adds a server-assisted APK repackage so pinned apps open up with no root and no PC, and streams the results into intercept, a node-backed Repeater, and a shared asset graph.
PCAPdroid
- Free and open source; no root needed for on-device VpnService capture
- mitmproxy addon adds genuine TLS decryption with a user CA
- Per-app filtering, PCAP export, and a clean, well-maintained Android app
- Pinned apps need root, as its own docs state; that is an Android limitation, not a flaw
- A capture tool: no intercept-and-modify gate, no Repeater, no asset graph or scanning
Crossfyre
- The same no-root VpnService capture, scoped per app and paired by QR
- Server-assisted APK repackage opens pinned apps without root or a PC
- Intercept gate: hold a request in flight, then modify, forward, or drop it
- Bench Repeater replays through a distributed node, not from your browser
- Endpoints join the asset graph and feed authenticated scanning and authz testing
The honest take
PCAPdroid is a good tool and free, and if you only need to watch traffic from apps that are not pinned, use it. Choose Crossfyre when pinning is the thing standing between you and the request bodies, or when you want the capture to become findings instead of a PCAP file. On-device no-root capture is not our differentiator; getting past pinning without root or a workstation is.
Frequently asked
Is on-device capture without root unique to Crossfyre?
No, and we will not claim it is. PCAPdroid, Reqable, Packet Capture, NetCapture, and HTTP Canary all do VpnService MITM with a user CA. They share the same wall: Android 7 and later distrust user CAs by default, and pinned apps trust only their own certificate.
How does Crossfyre get past pinning if PCAPdroid cannot?
By patching the app rather than the device. The phone uploads the target app’s split APKs plus the session CA, our patch service rewrites and re-signs the app so it trusts your session certificate, and the phone reinstalls the patched splits. Repackaging to defeat pinning is a commodity technique; doing it from the phone with no root and no PC is the part we could find no competitor offering.