It's been awhile since I've been directly in the loop with the implementation of location technologies on Android, but my understanding is that Android devices don't observe WAAS signals directly. Any assistance information comes over IP, as either gpsOneXTRA or SUPL. An extensive discussion of my understanding of Android gpsOneXTRA and SUPL is here:
IF a handset did directly observe WAAS satellites, in theory they should show up with PRNs 33-64:
I haven't yet seen any PRNs in this range on Android devices I've worked with.
You can try to isolate a handset from assistance information over IP by turning off all Internet access (i.e., put it in Airplane mode), and then doing "Clear aiding data" in GPSTest. In theory, this should clear any assistance data on the device, and if the device supports autonomous mode, it should do a cold start fix purely off of GPS signals (if its a NAVSTAR-only chipset).
I say "in theory", as I'm not sure this works on all Android devices. Per the documentation, the framework is supposed to return true if the command was processed, and false if it wasn't. But, if I execute this on a LG G4, it returns true but in Logcat I see:
LgeGpsLocationProvider: SPR Framework Carrier App Extra Command : delete_aiding_data
10-20 21:42:05.104 1180-4383/? E/LgeGpsLocationProvider: invalid SPR Framework Extra Command : delete_aiding_data
So it looks like the underlying native code is rejecting the command. However, I know this definitely worked on older Android devices.
An alternate method is to put the device in Airplane mode, and then restart it. On some devices this would also clear the assistance data.
So, unfortunately a lot of this behavior isn't standardized across devices. Your best best is probably to hook up a device up to Logcat and see what the log output looks like when doing the "Inject XTRA data" and "Clear aiding data" commands in GPSTest.
Let me know what you're able to find, I'm curious too as to the behavior of other devices out there.
In regards to spoofing the GPS signal, this can be difficult due to assistance data coming over IP, as well as the time reference on the device (this is also related to the "Inject time data" command in GPSTest). In other words, any spoofed signal has to match up with these other reference data, or the device can't calculate a position. Also, I believe you still technically need a license from the FCC to do this ;). I think your best bet is to try and force autonomous mode on the device by deleting the assistance data.
Sean