[ROM][Official] Kali NetHunter for the TicWatch Pro 3 WearOS

Search This thread

k27079024

Member
Feb 9, 2014
10
1
my gps pro 3 change ultra screen
and i flash the TWRP-OEM_FOR_TICWATCH_PRO_3_ULTRA_GPS(rubyfish).zip
now i can change e-ink color and more watchface
thank for all
 
  • Like
Reactions: enter2explore

Radem

Senior Member
Jan 29, 2010
62
4
Góra
Hello, how does the rom work in general, how long does the battery last, how does LTE GPS work.
 

k27079024

Member
Feb 9, 2014
10
1
hi i flash onerom and i fail
and i try flash stock rom for fastboot
but now my watch still in fastboot
not reboot not going recovery
what can i do
 

lxjin81

Member
Apr 28, 2023
5
0
JP
@yesimxev I have strange problem on the ticwatch pro 3 ultra lte.
After flash magisk and nethunter. system boot successful. add Nethunter app show's chroot status is OK.
I can start the nethunter 's ssh service.

But when i connect to ssh,
I cann't run any command,. eg. ls ,cat.
this is the ssh shell info:
zsh: failed to load module `zsh/zle': /usr/lib/arm-linux-gnueabihf/zsh/5.9/zsh/zle.so: cannot open shared object file: No such file or directory
kali# ls zsh: required key not available: ls
kali# who zsh: required key not available: who

but i can use adb shell su
to see these file is located at /data/local/xxxxx right folder。(eg: /usr/lib/arm-linux-gnueabihf/zsh/5.9/zsh/zle.soxxxx/usr/lib/arm-linux-gnueabihf/zsh/5.9/zsh/zle.so)

The nethunter.terminal app also not work at all, the same problem.

looks like it is the /data file encryption problem?

adb shell getprop show it is encrypted:
[ro.crypto.state]: [encrypted]
[ro.crypto.type]: [file]

I've tried flashing Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip throgh TWRP before 。
Although the flashing reporting job is successful,
But it will cause the startup system to fail. just stay in boot animation. or auto reboot to recovery.

I've spent days dealing with this issue and all failed。
eg:
try flash diffent rom version,
try use dfe-neo instead the Disable_Dm-Verity,
edit the fstab.rover file to remove fileencryption=ice
...
But these attempts all failed to disable the /data encryption

How to solve this problem?pls
 

Attachments

  • 20230522_211728.JPG
    20230522_211728.JPG
    823.2 KB · Views: 35
  • ssh-info.png
    ssh-info.png
    40.6 KB · Views: 33
  • adb shell info.png
    adb shell info.png
    83.7 KB · Views: 33
Last edited:

yesimxev

Senior Member
May 8, 2017
589
193
@yesimxev I have strange problem on the ticwatch pro 3 ultra lte.
After flash magisk and nethunter. system boot successful. add Nethunter app show's chroot status is OK.
I can start the nethunter 's ssh service.

But when i connect to ssh,
I cann't run any command,. eg. ls ,cat.
this is the ssh shell info:
zsh: failed to load module `zsh/zle': /usr/lib/arm-linux-gnueabihf/zsh/5.9/zsh/zle.so: cannot open shared object file: No such file or directory
kali# ls zsh: required key not available: ls
kali# who zsh: required key not available: who

but i can use adb shell su
to see these file is located at /data/local/xxxxx right folder。(eg: /usr/lib/arm-linux-gnueabihf/zsh/5.9/zsh/zle.soxxxx/usr/lib/arm-linux-gnueabihf/zsh/5.9/zsh/zle.so)

The nethunter.terminal app also not work at all, the same problem.

looks like it is the /data file encryption problem?

adb shell getprop show it is encrypted:
[ro.crypto.state]: [encrypted]
[ro.crypto.type]: [file]

I've tried flashing Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip throgh TWRP before 。
Although the flashing reporting job is successful,
But it will cause the startup system to fail. just stay in boot animation. or auto reboot to recovery.

I've spent days dealing with this issue and all failed。
eg:
try flash diffent rom version,
try use dfe-neo instead the Disable_Dm-Verity,
edit the fstab.rover file to remove fileencryption=ice
...
But these attempts all failed to disable the /data encryption

How to solve this problem?pls
Yes encryption causes these anomalies. When you edit fstab, you should edit to fileencryption=encryptable if I remember properly. Then format data in TWRP
 

lxjin81

Member
Apr 28, 2023
5
0
JP
Yes encryption causes these anomalies. When you edit fstab, you should edit to fileencryption=encryptable if I remember properly. Then format data in TWRP
Thank you. I tried this method, but it will cause the watch boot failed and auto reboot to twrp。
Is there currently have no way to disable data encryption for the TicaWatch Pro 3 Ultra LTE(ticwatch pro x)?
How the android system to know and set the ro.crypto.state=encrypted and ro.crypto.type=file when the system starts?
 

yesimxev

Senior Member
May 8, 2017
589
193
Thank you. I tried this method, but it will cause the watch boot failed and auto reboot to twrp。
Is there currently have no way to disable data encryption for the TicaWatch Pro 3 Ultra LTE(ticwatch pro x)?
How the android system to know and set the ro.crypto.state=encrypted and ro.crypto.type=file when the system starts?
Did you flash vbmeta as twp3 oneos install guide says? Generally, after you did the steps properly, when you get to flash disabler, then format data should be enough. Did you push the installer to /sdcard, then installed with twrp? So it will read disable task from filename
 

lxjin81

Member
Apr 28, 2023
5
0
JP
Did you flash vbmeta as twp3 oneos install guide says? Generally, after you did the steps properly, when you get to flash disabler, then format data should be enough. Did you push the installer to /sdcard, then installed with twrp? So it will read disable task from filename
Yes, I tried this when I first started to flashing on this watch.
my flash steps is flow the install guide:
- fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
- astboot flash recovery recovery.img
- Boot into recovery
- Select Wipe -> Advanced Wipe -> select Format Data
- Reboot to recovery
- Select "Install -> ADB Sideload"
- adb sideload OneOSxxx.zip
- adb sideload xxxx.Ultra zip
- adb sideload Mobivoxxxx.apps.zip
- adb sideload Magiskxxxx.zip
No reboot, and then finally to do this step
- adb push Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip /sdcard/
Use Twrp to install this zip, then format data.
Reboot to System
But the watch can not boot system. just stayin boot animation and reboot to twrp.

I use the 'Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip' file name.
Is it right name to disable data encryption?
 

yesimxev

Senior Member
May 8, 2017
589
193
Yes, I tried this when I first started to flashing on this watch.
my flash steps is flow the install guide:
- fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
- astboot flash recovery recovery.img
- Boot into recovery
- Select Wipe -> Advanced Wipe -> select Format Data
- Reboot to recovery
- Select "Install -> ADB Sideload"
- adb sideload OneOSxxx.zip
- adb sideload xxxx.Ultra zip
- adb sideload Mobivoxxxx.apps.zip
- adb sideload Magiskxxxx.zip
No reboot, and then finally to do this step
- adb push Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip /sdcard/
Use Twrp to install this zip, then format data.
Reboot to System
But the watch can not boot system. just stayin boot animation and reboot to twrp.

I use the 'Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip' file name.
Is it right name to disable data encryption?
Yes that's fine. You can split the steps then, see where it fails. No need to do vbmeta again. Flash oneos, ultra addon, mobvoi apps, boot up. Reboot to recovery. Flash disabler, format data. Reboot, setup watch. Reboot to recovery, flash magisk. Reboot again, install magisk apk. If all is fine, reboot to recovery, flash NH zip
 

innerfrost

Member
Jun 22, 2023
6
0
Hello, I follow the steps from kali site but when I flash nethunter-2022.2b-ticwatchpro-wearos-kalifs-nano.zip file using sideload it puts watch on boot loop, anyone has suggestion for this problem?
I have ticwatch 3 pro gps rubyfish, in all other steps I don't have any problem.
 

yesimxev

Senior Member
May 8, 2017
589
193
Hello, I follow the steps from kali site but when I flash nethunter-2022.2b-ticwatchpro-wearos-kalifs-nano.zip file using sideload it puts watch on boot loop, anyone has suggestion for this problem?
I have ticwatch 3 pro gps rubyfish, in all other steps I don't have any problem.
Can you flash Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip from twrp, after NH installer?
 

yesimxev

Senior Member
May 8, 2017
589
193
Hello, I got it when install other version - nethunter-2022.2b-generic-armhf-kalifs-nano.zip, but now I'm wondering with one chroot image to install on the watch
Just go back to TWRP and flash dm verity disabler, that might be the key. As far as I remember I didn't have to, but I might have forgotten
 

Top Liked Posts

  • There are no posts matching your filters.
  • 8
    https-_gitlab-com_kalilinux_nethunter_build-scripts_kali-nethunter-project_raw_master_images_n-png.5212297


    I present to you: Kali NetHunter for the TicWatch Pro 3 WearOS

    Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform. Now it's available for your smartwatch with some limitations.
    The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks.
    Beyond the penetration testing tools arsenal within Kali Linux, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, WPS attacks, and much more. For more information about the moving parts that make up NetHunter, check out our NetHunter Components page.
    NetHunter is an open-source project developed by Offensive Security and the community.

    All variants are supported (TicWatch Pro 3 GPS/LTE/Ultra GPS/Ultra LTE) with a generic installer as of now. This means there's no custom kernel yet, however all the features work from the TicWatch Pro, except BadUSB and Bluetooth Arsenal.

    ## 1. Unlock the bootloader

    - Connect your watch to your PC with a DIY USB cable or a 3D printed data dock, and fire up a terminal.
    - If you have set up your watch on the phone you can access settings, otherwise hold both buttons for a few seconds on the welcome screen.
    - Enable developer settings by going to System -> About -> tap Build number 10 times
    - Enable ADB, re-plug USB and accept debug from PC
    - Reboot into bootloader with `adb reboot bootloader` from the terminal
    - Unlock bootloader with `fastboot oem unlock`

    ## 2. Flash TWRP, WearOS image, Magisk, dm-verity disabler

    Please note Magisk 24.3 is recommended.

    - Again enable ADB, and reboot to bootloader with `adb reboot bootloader`
    - Disable vbmeta verification: `fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img`
    - Flash recovery `fastboot flash recovery recovery.img`
    - Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
    - Select Wipe -> Next Page -> Advanced Wipe -> Format Data
    - Reboot to recovery
    - Select "Install -> ADB Sideload"
    - Flash OneOS with `adb sideload`
    - Flash Ultra addon with `adb sideload` only if you have an Ultra watch
    - Flash Mobvoi Apps with `adb sideload`
    - Make a copy of your Magisk apk file to Magisk-v24.3.zip
    - Flash Magisk with `adb sideload`
    - Flash Disabler with `adb push Disable_Dm-Verity_ForceEncrypt_11.02.2020.zip /sdcard/` and Install via TWRP
    - Reboot & do initial setup (pair with your phone through WearOS app)

    ## 3. Finalise Magisk app to finish the rooting process

    - Finalise Magisk installation with app `adb install Magisk-v24.3.apk`
    - Launch Magisk Manager
    - You might want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future

    ## 4. Install NetHunter

    - Reboot to recovery
    - Select Install -> ADB Sideload
    - Flash NetHunter image with `adb sideload`
    - Reboot
    - Start NetHunter app & chroot
    - Reboot

    ## 5. Set NetHunter watch face

    - Install Facer onto your phone and watch from Play Store
    - Search for NetHunter
    - Select & Sync

    ### Enjoy Kali NetHunter on the TicWatch Pro 3

    ## Downloads

    - Magisk
    - Installation files
    - NetHunter zip

    ## Additional recommended apps

    - TotalCommander: useful for selecting eg. a Ducky script, use "adb install" method
    Download link: https://www.totalcommander.ch/android/tcandroid323-armeabi.apk

    ## Supported features

    - Kali services
    - Custom Commands
    - MAC Changer
    - HID Attacks
    - DuckHunter
    - Nmap Scan
    - WPS Attacks

    ## Upcoming features (not guaranteed)

    - Nexmon, as the chipset is supported, needs some time
    - Bluetooth Arsenal (internal bluetooth via blueblinder, as carwhisperer fails to r/w when SCO channel is connected)
    - Router Keygen (to be optimised)
    - Hijacker (if nexmon succeeds)
    - Mifare Classic Tool (need to build OS with android.hardware.nfc enabled)

    ## Hardware limitations

    - Power resource is not enough for any external adapters, although this kernel might support Y cable in the future!

    WearOS version:

    XDA: DevDB Information
    Kali Nethunter, Kernel & ROM for the TicWatch Pro 3

    Contributors
    @yesimxev

    Source Code: https://gitlab.com/kalilinux/nethunter/
    3
    any chance we’ll see a more vanilla rom for those of us that aren’t interested in network penetration etc, would be awesome to see a rom that could re-enable the compass in the ticwatch pro 3 ultra for example
    Well that goes onto my list next to the enable android.hardware.nfc + android.hardware.sensor.compass in the ROM for building OneOS if it's not disabled in kernel
    2
    If all the steps were followed correctly, then show me /tmp/recovery.log after flashing again. Use pastebin please
    Hi @yesimxev

    Already solved, it just the matter i forgot to start chroot. Work normally now.

    Thanks
    1
    Thank you so much for this
    Is it working on twp3ultra?
    And which stockrom img incase anything went wrong.

    Thank you in advance
    1
    You can flash stock back but i never tried locking bl. In theory yes, but better ask the dev @LoboMalo_SoyDeGatita on https://t.me/ticwatchpro3testing
    I've tried to relock my Ultra and all is fine