[ROM][Official] Kali NetHunter for the TicWatch Pro 3 WearOS - Wear OS Software and Hacking General

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I present to you: Kali NetHunter for the TicWatch Pro 3 WearOS
Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform. Now it's available for your smartwatch with some limitations.
The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks.
Beyond the penetration testing tools arsenal within Kali Linux, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, WPS attacks, and much more. For more information about the moving parts that make up NetHunter, check out our NetHunter Components page.
NetHunter is an open-source project developed by Offensive Security and the community.
All variants are supported (TicWatch Pro 3 GPS/LTE/Ultra GPS/Ultra LTE) with a generic installer as of now. This means there's no custom kernel yet, however all the features work from the TicWatch Pro, except BadUSB.
## 1. Unlock the bootloader
- Connect your watch to your PC with a DIY USB cable or a 3D printed data dock, and fire up a terminal.
- If you have set up your watch on the phone you can access settings, otherwise hold both buttons for a few seconds on the welcome screen.
- Enable developer settings by going to System -> About -> tap Build number 10 times
- Enable ADB, re-plug USB and accept debug from PC
- Reboot into bootloader with `adb reboot bootloader` from the terminal
- Unlock bootloader with `fastboot oem unlock`
## 2. Flash TWRP, WearOS image, Magisk, dm-verity disabler
Please note Magisk 24.3 is recommended.
- Again enable ADB, and reboot to bootloader with `adb reboot bootloader`
- Disable vbmeta verification: `fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img`
- Flash recovery `fastboot flash recovery recovery.img`
- Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
- Select Wipe -> Advanced Wipe -> select Format Data
- Reboot to recovery
- Select "Install -> ADB Sideload"
- Flash OneOS with `adb sideload`
- Flash Ultra addon with `adb sideload` only if you have an Ultra watch
- Flash Mobvoi Apps with `adb sideload`
- Make a copy of your Magisk apk file to Magisk-v24.3.zip
- Flash Magisk with `adb sideload`
- Flash Disabler with `adb push Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip /sdcard/` and Install via TWRP
- Reboot & do initial setup (pair with your phone through WearOS app)
## 3. Finalise Magisk app to finish the rooting process
- Finalise Magisk installation with app `adb install Magisk-v24.3.apk`
- Launch Magisk Manager
- You might want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future
## 4. Install NetHunter
- Reboot to recovery
- Select Install -> ADB Sideload
- Flash NetHunter image with `adb sideload`
- Reboot
- Start NetHunter app & chroot
- Reboot
## 5. Set NetHunter watch face
- Install Facer onto your phone and watch from Play Store
- Search for NetHunter
- Select & Sync
### Enjoy Kali NetHunter on the TicWatch Pro 3
## Downloads
- Magisk
- TWRP images
- OneOS ROM, Mobvoi apps, Ultra addon
- vbmeta image
- dm-verity and forceencrypt disabler
- NetHunter zip
## Additional recommended apps
- TotalCommander: useful for selecting eg. a Ducky script, use "adb install" method
Download link: https://www.totalcommander.ch/android/tcandroid323-armeabi.apk
## Supported features
- Kali services
- Custom Commands
- MAC Changer
- HID Attacks
- DuckHunter
- Nmap Scan
- WPS Attacks
## Upcoming features (not guaranteed)
- Nexmon, as the chipset is supported, needs some time
- Bluetooth Arsenal (internal bluetooth via blueblinder, as carwhisperer fails to r/w when SCO channel is connected)
- Router Keygen (to be optimised)
- Hijacker (if nexmon succeeds)
- Mifare Classic Tool (need to build OS with android.hardware.nfc enabled)
## Hardware limitations
- Power resource is not enough for any external adapters, although this kernel might support Y cable in the future!
WearOS version:
XDA: DevDB Information
Kali Nethunter, Kernel & ROM for the TicWatch Pro 3
Contributors
@yesimxev
Source Code: https://gitlab.com/kalilinux/nethunter/

---

Reserved

---

Thank you so much for this
Is it working on twp3ultra?
And which stockrom img incase anything went wrong.
Thank you in advance

---

nelikp said:
Thank you so much for this
Is it working on twp3ultra?
And which stockrom img incase anything went wrong.
Thank you in advance
Click to expand...
Click to collapse
Yes it is, use rover for Ultra LTE and rubyfish for Ultra GPS. Link for stock ROMs is above in the OneOS dowbload page, scroll down for stock

---

yesimxev said:
Yes it is, use rover for Ultra LTE and rubyfish for Ultra GPS. Link for stock ROMs is above in the OneOS dowbload page, scroll down for stock
Click to expand...
Click to collapse
Thank you so much
Waiting my cable from alixpress
May i have the oneos download page sir

---

nelikp said:
Thank you so much
Waiting my cable from alixpress
May i have the oneos download page sir
Click to expand...
Click to collapse
Everything is there. Just scroll

---

Achi Shukuteki said:
Everything is there. Just scroll
Click to expand...
Click to collapse
Thanks sir
I found it
Here
Download •OneOS Wear•
wear.revtechs.me

---

any chance we’ll see a more vanilla rom for those of us that aren’t interested in network penetration etc, would be awesome to see a rom that could re-enable the compass in the ticwatch pro 3 ultra for example

---

kerode said:
any chance we’ll see a more vanilla rom for those of us that aren’t interested in network penetration etc, would be awesome to see a rom that could re-enable the compass in the ticwatch pro 3 ultra for example
Click to expand...
Click to collapse
I think the general forum would be more appropriate for that question. I was interested in the same thing, though.

---

kerode said:
any chance we’ll see a more vanilla rom for those of us that aren’t interested in network penetration etc, would be awesome to see a rom that could re-enable the compass in the ticwatch pro 3 ultra for example
Click to expand...
Click to collapse
Well that goes onto my list next to the enable android.hardware.nfc + android.hardware.sensor.compass in the ROM for building OneOS if it's not disabled in kernel

---

Edited:
My bad, kali chroot needs to be run first. Succes now
Just flashed nethunter to my twp3 but when i start nethunter app somehow there was a pop up saying "chroot is not yet installed".
Should i sideload nethunter zip again?
Can i flash zip file via twrp after push the file to the watch?.
Thanks

---

enter2explore said:
Edited:
My bad, kali chroot needs to be run first. Succes now
Just flashed nethunter to my twp3 but when i start nethunter app somehow there was a pop up saying "chroot is not yet installed".
Should i sideload nethunter zip again?
Can i flash zip file via twrp after push the file to the watch?.
Thanks
Click to expand...
Click to collapse
If all the steps were followed correctly, then show me /tmp/recovery.log after flashing again. Use pastebin please

---

yesimxev said:
If all the steps were followed correctly, then show me /tmp/recovery.log after flashing again. Use pastebin please
Click to expand...
Click to collapse
Hi @yesimxev
Already solved, it just the matter i forgot to start chroot. Work normally now.
Thanks

---

yesimxev said:
Well that goes onto my list next to the enable android.hardware.nfc + android.hardware.sensor.compass in the ROM for building OneOS if it's not disabled in kernel
Click to expand...
Click to collapse
awesome mate, looking forward to it!!

---

managed to install and chroot
but how to wps attack?
any guide would appreciate
TIA

---

Im stuck when running command fastboot oem unlock all I get it waiting for any device and thats it.

---

nemzzy668 said:
Im stuck when running command fastboot oem unlock all I get it waiting for any device and thats it.
Click to expand...
Click to collapse
Check the connection.

---

Achi Shukuteki said:
Check the connection.
Click to expand...
Click to collapse
Connewction is fine, ADB works, windows then also detects it when it reboots. Just fastboot that sticks. Using Windows 11

---

nemzzy668 said:
Connewction is fine, ADB works, windows then also detects it when it reboots. Just fastboot that sticks. Using Windows 11
Click to expand...
Click to collapse
Oh hmmm. Im on Win10. I'll leave it to the forum with that one. Unless you want to use a live Linux distro, grab the tools, you already have the files, and try that way.

---

Run fastboot devices first after reboot to bootloader..make sure ur watch detected.
Otherwise check ur driver