XeraX transforms Telegram from a messaging app into a complete remote control interface for any Android device. Here's how the architecture works and everything you can do with it.
How It Works
XeraX runs a polling loop on the target device that checks the Telegram Bot API every few seconds for new commands. When you tap a button in Telegram, the command is queued and picked up by the daemon on the target device. Results — photos, audio, location pins, text — are sent back to your Telegram chat instantly. No open ports, no firewall issues, no VPN required.
Why Telegram Instead of a Web Panel?
- Works through firewalls: Telegram outbound connections work on any network — corporate WiFi, mobile data, even restrictive networks that block custom ports
- End-to-end encrypted: Your monitoring data goes through Telegram's encrypted API, not a plain HTTP server
- Always accessible: Your phone is always logged into Telegram. No URL to remember, no login to manage
- Instant push notifications: Alerts arrive as Telegram messages — no polling a web dashboard
- Works from any device: Control from your phone, tablet, or desktop Telegram client
Key Commands
/photo— silent back camera capture/location— GPS pin sent to chat/shell ls /sdcard— run any shell command/sms— dump recent SMS messages/extract wifi— dump saved WiFi passwords (root)/status— full device report (battery, IP, WiFi, operator)
Bot Architecture
The XeraX bot uses a persistent HTTPS proxy connection to the Telegram API via a Unix socket, reducing per-request latency from ~800ms to ~300ms. Commands poll every 3 seconds with a 60-second long-poll timeout, minimizing battery and data usage.