[Wear OS Software and Hacking General] yesimxev:
All variants are supported (TicWatch Pro, Pro 2020, Pro 4G/LTE)

I present to you: Kali NetHunter for the TicWatch Pro WearOS

Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform. Now it's available for your smartwatch with some limitations.

The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks.

Beyond the penetration testing tools arsenal within Kali Linux, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, WPS attacks, and much more. For more information about the moving parts that make up NetHunter, check out our NetHunter Components page.

NetHunter is an open-source project developed by Offensive Security and the community.

## 1. Unlock the bootloader

- Connect your watch to your PC with it's USB cable, and fire up a terminal.

- If you have set up your watch on the phone you can access settings, otherwise hold both buttons for a few seconds on the welcome screen.

- Enable developer settings by going to System -> About -> tap Build number 10 times

- Enable ADB, re-plug USB and accept debug from PC

- Reboot into bootloader with "adb reboot bootloader" from the terminal

- Unlock bootloader with "fastboot flashing unlock"

## 2. Flash vendor image, TWRP, and optimized WearOS

Download and extract the installation files into a folder. Please not this tutorial is for the TicWatch Pro 2020 (catfish), your ROM might be different on other models, please refer to @janjan's repo found here for the other ROMs.

Please note Magisk 21.0 is recommended, included in the following link.

Download link for ROM, vendor, TWRP, and Magisk: https://build.nethunter.com/contributors/re4son/catfish/TicWatch_Pro_NetHunter_files.zip

Download link for NetHunter zip: https://www.kali.org/get-kali/?#kali-mobile - Get the latest image under TicWatch section

- Again enable ADB, and reboot to bootloader with "adb reboot bootloader"

- "fastboot flash vendor vendor.img"

- "fastboot flash recovery twrp-3.4.0-0-catfish.img"

- Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)

- Select "Wipe -> next page -> Advanced Wipe -> Format Data"

- Reboot to Recovery

- Select "Install -> ADB Sideload" and tick "Wipe Dalvik Cache, Wipe Cache

- "adb sideload 2-ROM-PWDD.190617.074-AUG-09.zip"

- Reboot & do initial setup (pair with your phone through WearOS app)

## 3. Resize system partition in TWRP

- Again enable ADB

- "adb reboot recovery"

- Select Wipe -> next page -> File System Options - select System - Resize (to have ~175MB free on /system instead of 0)

## 4. Flash and launch Magisk app to finish the rooting process

- "adb sideload Magisk-v21.0.zip"

- Reboot to System

- Launch Magisk Manager

- You may want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future

## 5. Flash NetHunter

- "adb reboot recovery"

- Select Install -> ADB Sideload

- "adb sideload" NetHunter image

- Reboot

- Start NetHunter app & chroot

- Reboot

## 6. Set NetHunter watch face

- Install Facer onto your phone from Play Store

- Search for NetHunter

- Install Facer companion app to watch

- Select & Sync

## Download link

TicWatch_Pro_NetHunter_files.zip | by yesimxev for Ticwatch Pro (2018)

Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.

www.androidfilehost.com

## Additional supported apps

- Drivedroid: use "adb install" to install the latest version

Download link: https://store.nethunter.com/repo/com.softwarebakery.drivedroid_105000.apk

- TotalCommander: useful for selecting eg. a Ducky script, use "adb install" method

Download link: https://www.totalcommander.ch/android/tcandroid323-armeabi.apk

## Supported features

- Kali services

- Custom Commands

- MAC Changer

- HID Attacks

- DuckHunter

- Bad USB

- Nmap Scan

- WPS Attacks

## Upcoming features (not guaranteed)

- Nexmon, as the chipset is supported, needs some time

- Bluetooth Arsenal (internal bluetooth via blueblinder, as carwhisperer fails to r/w when SCO channel is connected)

- Router Keygen (to be optimised)

- Hijacker (if nexmon succeeds)

- Mifare Classic Tool (need to build OS with android.hardware.nfc enabled)

## Hardware limitations

- Power resource is not enough for any external adapters

Credits: The Offensive Security Team and the NetHunter community

Another extremely big thanks for @janjan for making this possible!

WearOS version: 2.17

XDA: DevDB Information

Kali Nethunter, Kernel & ROM for the TicWatch Pro

Contributors

@yesimxev

Source Code: https://gitlab.com/kalilinux/nethunter/

Kernel Source: https://github.com/yesimxev/msm-catfish-9.0-wear-os