[ROM][Official] Kali NetHunter for the TicWatch Pro WearOS - Wear OS Software and Hacking General

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
All variants are supported (TicWatch Pro, Pro 2020, Pro 4G/LTE)
I present to you: Kali NetHunter for the TicWatch Pro WearOS
Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform. Now it's available for your smartwatch with some limitations.
The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks.
Beyond the penetration testing tools arsenal within Kali Linux, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, WPS attacks, and much more. For more information about the moving parts that make up NetHunter, check out our NetHunter Components page.
NetHunter is an open-source project developed by Offensive Security and the community.
## 1. Unlock the bootloader
- Connect your watch to your PC with it's USB cable, and fire up a terminal.
- If you have set up your watch on the phone you can access settings, otherwise hold both buttons for a few seconds on the welcome screen.
- Enable developer settings by going to System -> About -> tap Build number 10 times
- Enable ADB, re-plug USB and accept debug from PC
- Reboot into bootloader with "adb reboot bootloader" from the terminal
- Unlock bootloader with "fastboot flashing unlock"
## 2. Flash vendor image, TWRP, and optimized WearOS
Download and extract the installation files into a folder. Please not this tutorial is for the TicWatch Pro 2020 (catfish), your ROM might be different on other models, please refer to @janjan's repo found here for the other ROMs.
Please note Magisk 21.0 is recommended, included in the following link.
Download link for ROM, vendor, TWRP, and Magisk: https://build.nethunter.com/contributors/re4son/catfish/
Download link for NetHunter zip. Scroll down to TicWatch for latest release: https://www.kali.org/get-kali/#kali-mobile
- Again enable ADB, and reboot to bootloader with "adb reboot bootloader"
- "fastboot flash vendor vendor.img"
- "fastboot flash recovery twrp-3.4.0-0-catfish.img"
- Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
- Select "Wipe -> next page -> Format Data"
- Reboot to Recovery
- Select "Install -> ADB Sideload" and tick "Wipe Dalvik Cache, Wipe Cache
- "adb sideload 2-ROM-PWDD.190617.074-AUG-09.zip"
- Reboot & do initial setup (pair with your phone through WearOS app)
## 3. Resize system partition in TWRP
- Again enable ADB
- "adb reboot recovery"
- Select Wipe -> next page -> File System Options - select System - Resize (to have ~175MB free on /system instead of 0)
## 4. Flash and launch Magisk app to finish the rooting process
- "adb sideload Magisk-v21.0.zip"
- Reboot to System
- Launch Magisk Manager
- You might want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future
## 5. Flash NetHunter
- "adb reboot recovery"
- Select Install -> ADB Sideload
- "adb sideload" NetHunter image
- Reboot
- Start NetHunter app & chroot
- Reboot
## 6. Set NetHunter watch face
- Install Facer onto your phone from Play Store
- Search for NetHunter
- Install Facer companion app to watch
- Select & Sync
## Download link
TicWatch_Pro_NetHunter_files.zip | by yesimxev for Ticwatch Pro (2018)
Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.
www.androidfilehost.com
## Additional supported apps
- Drivedroid: use "adb install" to install the latest version
Download link: https://store.nethunter.com/repo/com.softwarebakery.drivedroid_105000.apk
- TotalCommander: useful for selecting eg. a Ducky script, use "adb install" method
Download link: https://www.totalcommander.ch/android/tcandroid323-armeabi.apk
## Supported features
- Kali services
- Custom Commands
- MAC Changer
- HID Attacks
- DuckHunter
- Bad USB
- Nmap Scan
- WPS Attacks
## Upcoming features (not guaranteed)
- Nexmon, as the chipset is supported, needs some time
- Bluetooth Arsenal (internal bluetooth via blueblinder, as carwhisperer fails to r/w when SCO channel is connected)
- Router Keygen (to be optimised)
- Hijacker (if nexmon succeeds)
- Mifare Classic Tool (need to build OS with android.hardware.nfc enabled)
## Hardware limitations
- Power resource is not enough for any external adapters
Credits: The Offensive Security Team and the NetHunter community
Another extremely big thanks for @janjan for making this possible!
WearOS version: 2.17
XDA: DevDB Information
Kali Nethunter, Kernel & ROM for the TicWatch Pro
Contributors
@yesimxev
Source Code: https://gitlab.com/kalilinux/nethunter/
Kernel Source: https://github.com/yesimxev/msm-catfish-9.0-wear-os

---

RESERVED

---

Excited to try this with Catshark!
Thank you!

---

@yesimxev a fantastic contribution, just for the pleasure that "you do it because you can" you have my full support.
Can you upload screenshots or video, I'm curious how it interacts with the ROM when you do WPS attack, NMAP scan or any other of the functions you have enabled.
Is the ROM adapted to the much smaller screen size that the watches have?

---

bernarbernuli said:
@yesimxev a fantastic contribution, just for the pleasure that "you do it because you can" you have my full support.
Can you upload screenshots or video, I'm curious how it interacts with the ROM when you do WPS attack, NMAP scan or any other of the functions you have enabled.
Is the ROM adapted to the much smaller screen size that the watches have?
Click to expand...
Click to collapse
Yes I've optimised the NH app to fit. See some of my videos for HID, WPS attacks and even Konboot:

---

@yesimxev
Any advice for me please?
Failed before Last item in step 2. Reboot & do initial setup (pair with your phone through WearOS app)
Symptom long Boot animation for 90 seconds and booted to TWRP.
Attempt 1 using above process + JanJan files for Catshark.
Attempt 2 using Modified step + JanJan files
Modified step - Forum Post- https://forum.xda-developers.com/t/...kipjack-9aug20.3821013/page-186#post-82992173 (#3,714)
You don't need to flash the twrp. It usually cause bootloop. Use
adb reboot bootloader
fastboot boot name-of-the-twrp.img
## 1. Unlock the bootloader
## 2. Flash vendor image, TWRP, and optimized WearOS
Attempt 1
Manually
Reboot to bootloader with "adb reboot bootloader"
Fastboot flash vendor vendor.img
From TicWatch-Pro(4G)(Catshark)-EU-&-USA\TicWatch-Pro(4G)(Catshark)-EU-&-USA\Custom-ROM\TicWatch-Pro-4G-USA\ROM\2020\27-January-2020\Vendor-27-Jan-2020.zip (Vendor.img)
fastboot format userdata
fastboot format cache
"fastboot flash recovery catshark-4G-recovery.img"
From TicWatch-Pro(4G)(Catshark)-EU-&-USA\TicWatch-Pro(4G)(Catshark)-EU-&-USA\Custom-ROM\TicWatch-Pro-4G-USA\TWRP (catshark-4G-recovery.img)
Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
Select "Wipe -> next page -> Format Data"
Reboot to Recovery
- Select "Install -> ADB Sideload" and tick "Wipe Dalvik Cache, Wipe Cache
"adb sideload Ticwatch-4G-USA-PWDD.190617.032-XDA-27-JAN-2020-LMKiller.zip"
- Reboot-
Symptom long Boot animation for 90 seconds and booted to TWRP.
Attempt 2
Manually
Reboot to bootloader with "adb reboot bootloader"
Fastboot flash vendor vendor.img
From TicWatch-Pro(4G)(Catshark)-EU-&-USA\TicWatch-Pro(4G)(Catshark)-EU-&-USA\Custom-ROM\TicWatch-Pro-4G-USA\ROM\2020\27-January-2020\Vendor-27-Jan-2020.zip (Vendor.img)
Fastboot format userdata
Fastboot format cache
Fastboot boot catshark-4G-recovery.img"
From TicWatch-Pro(4G)(Catshark)-EU-&-USA\TicWatch-Pro(4G)(Catshark)-EU-&-USA\Custom-ROM\TicWatch-Pro-4G-USA\TWRP (catshark-4G-recovery.img)
Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
Select "Wipe -> next page -> Format Data"
Reboot to Recovery
- Select "Install -> ADB Sideload" and tick "Wipe Dalvik Cache, Wipe Cache
"adb sideload Ticwatch-4G-USA-PWDD.190617.032-XDA-27-JAN-2020-LMKiller.zip"
- Reboot-
Symptom long Boot animation for 90 seconds and booted to TWRP.

---

Roll back a build. Here's some instructions used by security researcher Lucas Stefanko
Installing NetHunter On the TicWatch Pro | Kali Linux Documentation
All variants are supported (TicWatch Pro, Pro 2020, Pro 4G/LTE) From unpacking to running NetHunter in 6 steps: Unlock the bootloader Flash vendor image, TWRP, and optimized WearOS Resize system partition in TWRP Flash and launch Magisk app to finish the rooting process Flash NetHunter Set...
www.kali.org

---

Achi Shukuteki said:
Roll back a build. Here's some instructions used by security researcher Lucas Stefanko
Installing NetHunter On the TicWatch Pro | Kali Linux Documentation
All variants are supported (TicWatch Pro, Pro 2020, Pro 4G/LTE) From unpacking to running NetHunter in 6 steps: Unlock the bootloader Flash vendor image, TWRP, and optimized WearOS Resize system partition in TWRP Flash and launch Magisk app to finish the rooting process Flash NetHunter Set...
www.kali.org
Click to expand...
Click to collapse
Thank you!,
If I am comprehending correctly this great write up includes the build for catfish only.
Meaning other models, must refer to @janjan's repo found here for the other ROM.
I used the only build for my device that is available in JanJan's repo.
Thanks for your patience.

---

Dmcpen said:
Thank you!,
If I am comprehending correctly this great write up includes the build for catfish only.
Meaning other models, must refer to @janjan's repo found here for the other ROM.
I used the only build for my device that is available in JanJan's repo.
Thanks for your patience.
Click to expand...
Click to collapse
Indeed. Keep us posted. I havent had the time, yet, to mod mine.

---

Achi Shukuteki said:
Roll back a build. Here's some instructions used by security researcher Lucas Stefanko
Installing NetHunter On the TicWatch Pro | Kali Linux Documentation
All variants are supported (TicWatch Pro, Pro 2020, Pro 4G/LTE) From unpacking to running NetHunter in 6 steps: Unlock the bootloader Flash vendor image, TWRP, and optimized WearOS Resize system partition in TWRP Flash and launch Magisk app to finish the rooting process Flash NetHunter Set...
www.kali.org
Click to expand...
Click to collapse
The kali[.]org and these instructions are the same. I've updated both in the same time. I'm afraid you might have a different way to flash. Or try the stock, you don't really need to be on the custom ROM. The NetHunter kernel will be the same and if you don't need any Mobvoi apps, we'll google how to remove them
Also, are you sure you've got a US model?

---

yesimxev said:
The kali[.]org and these instructions are the same. I've updated both in the same time. I'm afraid you might have a different way to flash. Or try the stock, you don't really need to be on the custom ROM. The NetHunter kernel will be the same and if you don't need any Mobvoi apps, we'll google how to remove them
Also, are you sure you've got a US model?
Click to expand...
Click to collapse
Thanks!
Success!
Nethunter works
Call and Text on 4G Works!

---

Dmcpen said:
Thanks!
Success!
Nethunter works
Call and Text on 4G Works!
Click to expand...
Click to collapse
What was the issue?

---

Please note I am very new to this and was only able to get this far because of hard work by @[yesimxev] and [@janjan]
Here are my notes. Use at own risk.
I had 3 failed attempts, and used [@janjan] return to stock process from:
[ROM+KERNEL+TWRP][Ticwatch Pro(Catfish)(Catshark-4G)]+[Ticwatch C2(Skipjack)[9Aug20]
-[Ticwatch Pro 4G/LTE (EU) (Catshark)-PWDD.190617.059]-[30-5-2020] - [Ticwatch Pro 2020 (Catfish-Ext)-PMP2.191203.001]-[22-6-2020] - [Ticwatch Pro (Catfish)-PWDD.190617.074]-[09-8-2020] ############################# - [Ticwatch Pro 4G/LTE (USA)...
forum.xda-developers.com
Hopefully you can learn from my mistakes with the details below.
Please note this is for the:
Ticwatch-Pro-4G(Catshark)-USA-PWDD.190617.032, your ROM might be different on other models, please refer to [@janjan](https://forum.xda-developers.com/m/490110/)'s [repo found here for the other ROM]https://forum.xda-developers.com/t/...shark-4g-ticwatch-c2-skipjack-9aug20.3821013/
Download and extract the installation files into a folder.
Please note Magisk 21.0 is recommended, included in the following link.
Download link for Magisk and Nethunter:
[https://build.nethunter.com/contrib...d.nethunter.com/contributors/re4son/catfish/)
[TicWatch_Pro_NetHunter_files.zip](https://build.nethunter.com/contributors/re4son/catfish/TicWatch_Pro_NetHunter_files.zip "TicWatch_Pro_NetHunter_files.zip")
Download link for NetHunter zip. Scroll down to TicWatch for latest release: [https://www.kali.org/get-kali/#kali-mobile](https://www.kali.org/get-kali/#kali-mobile)
**## 1. Unlock the bootloader**
- Connect your watch to your PC with it's USB cable, and fire up a terminal.
- If you have set up your watch on the phone you can access settings, otherwise hold both buttons for a few seconds on the welcome screen.
- Enable developer settings by going to System -> About -> tap Build number 10 times
- Enable ADB, re-plug USB and accept debug from PC
- Reboot into bootloader with "adb reboot bootloader" from the terminal
- Unlock bootloader with "fastboot flashing unlock"
**## 2. Flash TWRP, and optimized WearOS
- Again enable ADB, and reboot to bootloader with "adb reboot bootloader"
- "fastboot flash recovery catshark-4G-recovery" (From [@janjan] )
- Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
- Select "Wipe -> next page -> Format Data"
- Reboot & do initial setup (pair with your phone through WearOS app)
**## 3. Resize system partition in TWRP**
- Again enable ADB
- "adb reboot recovery"
- Select Wipe -> next page -> File System Options - select System - Resize (to have ~175MB free on /system instead of 0)
**## 4. Flash and launch Magisk app to finish the rooting process**
- "adb sideload Magisk-v21.0.zip"
- Reboot to System
- Launch Magisk Manager
- You might want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future
**## 5. Flash NetHunter**
- "adb reboot recovery"
- Select Install -> ADB Sideload
- "adb sideload" NetHunter image
- Reboot
- Start NetHunter app & chroot
- Reboot
**## 6. Set NetHunter watch face**
- Install Facer onto your phone from Play Store
- Search for NetHunter
- Install Facer companion app to watch
- Select & Sync
Thank you and good luck.

---

yesimxev said:
The kali[.]org and these instructions are the same. I've updated both in the same time. I'm afraid you might have a different way to flash. Or try the stock, you don't really need to be on the custom ROM. The NetHunter kernel will be the same and if you don't need any Mobvoi apps, we'll google how to remove them
Also, are you sure you've got a US model?
Click to expand...
Click to collapse
Ha! I didn't notice the equivalence of the instructions. I should've read the first one in its entirety. I skimmed it thinking it was for a newer build. My bad.

---

Achi Shukuteki said:
Ha! I didn't notice the equivalence of the instructions. I should've read the first one in its entirety. I skimmed it thinking it was for a newer build. My bad.
Click to expand...
Click to collapse
Try stock for the win!

---

I followed the instructions to the letter on my ticwatch pro but after I adb sideloaded nethunter-2022.2b-ticwatchpro-wearos-kalifs-nano.zip and rebooted... it's not there.
I did it a few times and always the same result: I don't see it in the apps list, am I missing some hidden step?

---

Jackomel said:
I followed the instructions to the letter on my ticwatch pro but after I adb sideloaded nethunter-2022.2b-ticwatchpro-wearos-kalifs-nano.zip and rebooted... it's not there.
I did it a few times and always the same result: I don't see it in the apps list, am I missing some hidden step?
Click to expand...
Click to collapse
Did you setup the watch before flashing? Show me the /tmp/recovery.log using pastebin

---

yesimxev said:
Did you setup the watch before flashing? Show me the /tmp/recovery.log using pastebin
Click to expand...
Click to collapse
How do I extract that file from the watch? There is no terminal installed, even though I flashed nethunter

---

Just wanted to add to this that it's possible to get into the settings menu to enable ADB before pairing with your phone, by holding the top button for a couple seconds on the pairing screen. Should let you save a good chunk of time from installation by avoiding setting the watch up repeatedly

---

androidyl said:
Just wanted to add to this that it's possible to get into the settings menu to enable ADB before pairing with your phone, by holding the top button for a couple seconds on the pairing screen. Should let you save a good chunk of time from installation by avoiding setting the watch up repeatedly
Click to expand...
Click to collapse
I know, but left 'both buttons' in the instructions.
Jackomel said:
How do I extract that file from the watch? There is no terminal installed, even though I flashed nethunter
Click to expand...
Click to collapse
Flash NH in twrp, then run 'adb shell cat /tmp/recovery.log'