[ROM][Official] Kali NetHunter for the TicWatch Pro 3 WearOS

Search This thread
I did all the steps and did the reboot. Then i got a screen with 4 dots that a running clockwise. How long does it take to boot?

Nevermind. Missed a step because off small screen and bad eyes :cool:

Still got one question.

"You might want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future"

Where can i find those settings?
 
Last edited:

NUMAflex

Member
Dec 31, 2017
13
9
Google Nexus 5
Huawei Nexus 6P
I did all the steps and did the reboot. Then i got a screen with 4 dots that a running clockwise. How long does it take to boot?

Nevermind. Missed a step because off small screen and bad eyes :cool:

Still got one question.

"You might want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future"

Where can i find those settings?
hey there its in "magisk manager"
but "menu" kinda hide in there up corner right (sorry in case of dyslexia) =] and it will show up, watch screens...
 

yesimxev

Senior Member
May 8, 2017
375
156
Hi Sir, for TWP3 there's no custom kernel (due to use nethunter generic one). Is that duckhunter and HID attacks really works normally? I thought it need its custom kernel. Am i wrong? thank you
There will be, however HID and duckhunter works by default on this because it's kernel 4.x
 

col_forbin

Member
Jan 28, 2022
22
9
@yesimxev, In the first post, you have this step:

- Select Wipe -> Advanced Wipe -> select Format Data

Does that mean, Select Wipe -> Advanced Wipe -> Check box for Data -> Wipe

Or does that mean, Select Wipe -> Next Page -> Format Data -> Type yes to continue?

I've been trying to install 2022.3, and I keep getting a boot loop after I install Nethunter.
 

enter2explore

Senior Member
@yesimxev, In the first post, you have this step:

- Select Wipe -> Advanced Wipe -> select Format Data

Does that mean, Select Wipe -> Advanced Wipe -> Check box for Data -> Wipe

Or does that mean, Select Wipe -> Next Page -> Format Data -> Type yes to continue?

I've been trying to install 2022.3, and I keep getting a boot loop after I install Nethunter.
I use below step

Select Wipe -> Next Page -> Format Data -> Type yes to continue

I had installed nethunter few time with no boot loop for me
 
  • Like
Reactions: yesimxev

col_forbin

Member
Jan 28, 2022
22
9
When u get boot loop..can u force to reboot to recovery?

Format data again from twrp and reboot back to system didn't work for you?.
I can get back to recovery, yes.

I can format data again (Select Wipe -> Next Page -> Format Data -> Type yes to continue).

I can do everything according to the instructions in the first post. After I install Nethunter, that's when I'm back to the boot loop. I've tried this more than 10 times now. That's what leading me to believe I've screwed up my watch somehow. If others have not issues, than this is a PEBKAC
 

yesimxev

Senior Member
May 8, 2017
375
156
I can get back to recovery, yes.

I can format data again (Select Wipe -> Next Page -> Format Data -> Type yes to continue).

I can do everything according to the instructions in the first post. After I install Nethunter, that's when I'm back to the boot loop. I've tried this more than 10 times now. That's what leading me to believe I've screwed up my watch somehow. If others have not issues, than this is a PEBKAC
Do a clean OneOS flash then without wipe and let it start. Then reboot to recovery, format data, reboot to recovery and continue the steps
 

col_forbin

Member
Jan 28, 2022
22
9
Do a clean OneOS flash then without wipe and let it start. Then reboot to recovery, format data, reboot to recovery and continue the steps
I reboot to recovery, adb sideload OneOS-22.01.30_rubyfish.zip, reboot and the watch reboots to recovery.

Then I try; reboot to bootloader, fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img, reboot to recovery, adb sideload OneOS-22.01.30_rubyfish.zip, MobvoiAPPS-TWP3_pico.zip, Magisk-v24.3.zip, push and twrp install Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip, reboot & do initial setup, enable debugging, adb install Magisk-v24.3.apk, setup Magisk, reboot to recovery, adb sideload nethunter-2022.3-ticwatchpro-wearos-kalifs-nano.zip, reboot, and watch sits at the TicWatch screen indefinitely. I have let it sit for about a half an hour.
 

yesimxev

Senior Member
May 8, 2017
375
156
I reboot to recovery, adb sideload OneOS-22.01.30_rubyfish.zip, reboot and the watch reboots to recovery.

Then I try; reboot to bootloader, fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img, reboot to recovery, adb sideload OneOS-22.01.30_rubyfish.zip, MobvoiAPPS-TWP3_pico.zip, Magisk-v24.3.zip, push and twrp install Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip, reboot & do initial setup, enable debugging, adb install Magisk-v24.3.apk, setup Magisk, reboot to recovery, adb sideload nethunter-2022.3-ticwatchpro-wearos-kalifs-nano.zip, reboot, and watch sits at the TicWatch screen indefinitely. I have let it sit for about a half an hour.
Wrong NH zip. That's for the old TWP

 

yesimxev

Senior Member
May 8, 2017
375
156
You can try the all new 2022.3 version, but still has to be the generic nano image (Lite), as kernel flashing is not supported yet. You'll still get all the features except BadUSB attack (RNDIS)
 

col_forbin

Member
Jan 28, 2022
22
9
You can try the all new 2022.3 version, but still has to be the generic nano image (Lite), as kernel flashing is not supported yet. You'll still get all the features except BadUSB attack (RNDIS)
Derp! You've told me this before. Sorry about that.

nethunter-2022.3-generic-armhf-kalifs-nano.zip works fine. Had to sideload twice, in order for chroot to start, but after that, it's all on point.

Thanks again @yesimxev
 

k27079024

Member
Feb 9, 2014
8
1
hi i flash new stock rom PMRB.220703.001
but is didnt work
and my adb is not working now
so i cant flash anything for fastboot and recovery
what can i do
 

Top Liked Posts

  • There are no posts matching your filters.
  • 6
    https-_gitlab-com_kalilinux_nethunter_build-scripts_kali-nethunter-project_raw_master_images_n-png.5212297


    I present to you: Kali NetHunter for the TicWatch Pro 3 WearOS

    Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform. Now it's available for your smartwatch with some limitations.
    The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks.
    Beyond the penetration testing tools arsenal within Kali Linux, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, WPS attacks, and much more. For more information about the moving parts that make up NetHunter, check out our NetHunter Components page.
    NetHunter is an open-source project developed by Offensive Security and the community.

    All variants are supported (TicWatch Pro 3 GPS/LTE/Ultra GPS/Ultra LTE) with a generic installer as of now. This means there's no custom kernel yet, however all the features work from the TicWatch Pro, except BadUSB.

    ## 1. Unlock the bootloader

    - Connect your watch to your PC with a DIY USB cable or a 3D printed data dock, and fire up a terminal.
    - If you have set up your watch on the phone you can access settings, otherwise hold both buttons for a few seconds on the welcome screen.
    - Enable developer settings by going to System -> About -> tap Build number 10 times
    - Enable ADB, re-plug USB and accept debug from PC
    - Reboot into bootloader with `adb reboot bootloader` from the terminal
    - Unlock bootloader with `fastboot oem unlock`

    ## 2. Flash TWRP, WearOS image, Magisk, dm-verity disabler

    Please note Magisk 24.3 is recommended.

    - Again enable ADB, and reboot to bootloader with `adb reboot bootloader`
    - Disable vbmeta verification: `fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img`
    - Flash recovery `fastboot flash recovery recovery.img`
    - Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
    - Select Wipe -> Advanced Wipe -> select Format Data
    - Reboot to recovery
    - Select "Install -> ADB Sideload"
    - Flash OneOS with `adb sideload`
    - Flash Ultra addon with `adb sideload` only if you have an Ultra watch
    - Flash Mobvoi Apps with `adb sideload`
    - Make a copy of your Magisk apk file to Magisk-v24.3.zip
    - Flash Magisk with `adb sideload`
    - Flash Disabler with `adb push Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip /sdcard/` and Install via TWRP
    - Reboot & do initial setup (pair with your phone through WearOS app)

    ## 3. Finalise Magisk app to finish the rooting process

    - Finalise Magisk installation with app `adb install Magisk-v24.3.apk`
    - Launch Magisk Manager
    - You might want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future

    ## 4. Install NetHunter

    - Reboot to recovery
    - Select Install -> ADB Sideload
    - Flash NetHunter image with `adb sideload`
    - Reboot
    - Start NetHunter app & chroot
    - Reboot

    ## 5. Set NetHunter watch face

    - Install Facer onto your phone and watch from Play Store
    - Search for NetHunter
    - Select & Sync

    ### Enjoy Kali NetHunter on the TicWatch Pro 3

    ## Downloads

    - Magisk
    - TWRP images
    - OneOS ROM, Mobvoi apps, Ultra addon
    - vbmeta image
    - dm-verity and forceencrypt disabler
    - NetHunter zip

    ## Additional recommended apps

    - TotalCommander: useful for selecting eg. a Ducky script, use "adb install" method
    Download link: https://www.totalcommander.ch/android/tcandroid323-armeabi.apk

    ## Supported features

    - Kali services
    - Custom Commands
    - MAC Changer
    - HID Attacks
    - DuckHunter
    - Nmap Scan
    - WPS Attacks

    ## Upcoming features (not guaranteed)

    - Nexmon, as the chipset is supported, needs some time
    - Bluetooth Arsenal (internal bluetooth via blueblinder, as carwhisperer fails to r/w when SCO channel is connected)
    - Router Keygen (to be optimised)
    - Hijacker (if nexmon succeeds)
    - Mifare Classic Tool (need to build OS with android.hardware.nfc enabled)

    ## Hardware limitations

    - Power resource is not enough for any external adapters, although this kernel might support Y cable in the future!

    WearOS version:

    XDA: DevDB Information
    Kali Nethunter, Kernel & ROM for the TicWatch Pro 3

    Contributors
    @yesimxev

    Source Code: https://gitlab.com/kalilinux/nethunter/
    3
    any chance we’ll see a more vanilla rom for those of us that aren’t interested in network penetration etc, would be awesome to see a rom that could re-enable the compass in the ticwatch pro 3 ultra for example
    Well that goes onto my list next to the enable android.hardware.nfc + android.hardware.sensor.compass in the ROM for building OneOS if it's not disabled in kernel
    1
    Thank you so much for this
    Is it working on twp3ultra?
    And which stockrom img incase anything went wrong.

    Thank you in advance
    1
    Thank you so much for this
    Is it working on twp3ultra?
    And which stockrom img incase anything went wrong.

    Thank you in advance
    Yes it is, use rover for Ultra LTE and rubyfish for Ultra GPS. Link for stock ROMs is above in the OneOS dowbload page, scroll down for stock
    1
    my gps pro 3 change ultra screen
    and i flash the TWRP-OEM_FOR_TICWATCH_PRO_3_ULTRA_GPS(rubyfish).zip
    now i can change e-ink color and more watchface
    thank for all