All variants are supported (TicWatch Pro 3 GPS/LTE/Ultra GPS/Ultra LTE).

From unpacking to running NetHunter in 6 steps:

1. Unlock the bootloader
2. Revert to stock WearOS2
3. Flash TWRP, WearOS image, Magisk, dm-verity disabler
4. Finalise Magisk app to finish the rooting process
5. Install NetHunter
6. Set NetHunter watch face

• Connect your watch to your PC with a DIY USB cable or a 3D printed data dock, and fire up a terminal.
• If you have set up your watch on the phone you can access settings, otherwise hold both buttons for a few seconds on the welcome screen.
• Enable developer settings by going to System -> About -> tap Build number 10 times
• Enable ADB, re-plug USB and accept debug from PC
• Reboot into bootloader with adb reboot bootloader from the terminal
• Unlock bootloader with fastboot oem unlock

Do this step only if you got your watch with WearOS3.

• Reboot to bootloader again, using one of the above methods
• Unpack stock WearOS2 zip (ROVER_STOCK_PMRL.220111.001.zip for LTE/Ultra LTE, RUBYFISH_STOCK_PMRB.220703.001.zip for GPS/Ultra GPS)
• Run flash_all.sh or flash_all.bat if using Windows
• Reboot and accept format data if required

Magisk 24.3 is recommended. OneOS is recommended for wireless injection, as the system files will be replaced on Stock WearOS after reboot.

• Again enable ADB, and reboot to bootloader with adb reboot bootloader
• Disable vbmeta verification: fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
• Flash recovery fastboot flash recovery recovery.img
• Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
• Select Wipe -> Next page -> Advanced Wipe -> Format Data
• Reboot to recovery
• Select “Install -> ADB Sideload”
• Flash OneOS with adb sideload
• Flash Mobvoi Apps package with adb sideload
• If you have an Ultra, adb sideload the Ultra addon package (TWRP-OEM_FOR_TICWATCH_PRO_3_ULTRA(rover).zip for Ultra LTE, TWRP-OEM_FOR_TICWATCH_PRO_3_ULTRA_GPS(rubyfish).zip for Ultra GPS)
• Flash Magisk with adb sideload Magisk-v24.3.apk
• Copy and flash DM-Verity_ForceEncrypt Disabler with adb push Disable-DM-Verity_ForceEncrypt.zip /sdcard/ and install via TWRP
• Reboot & do initial setup (pair with your phone through WearOS app)

• Enable ADB again
• Set density so app menu buttons will be reachable on OneOS adb shell wm density 300
• Finalise Magisk installation with app install adb install Magisk-v24.3.apk
• Launch Magisk Manager
• Find the settings on top right corner (a bit tricky to reach)
• You may want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future

• Reboot to recovery
• Select Install -> ADB Sideload
• Flash NetHunter image with adb sideload
• Flash Magisk apk again with adb sideload
• Reboot
• Start NetHunter app & chroot (it may reboot after first start)
• Reboot

Hijacker and Nexmon wireless injection install guide can be found on Kali Forums

• Install Facer onto your phone
• Unzip facer zip for wearos and install the contents using adb install-multiple *.apk
• Search for NetHunter on your phone
• Select & Sync

• Build files:
  • Magisk
  • TWRP image for rover or rubyfish
  • vbmeta image
  • dm-verity disabler
  • OneOS, Stock ROMs, Ultra addon and Mobvoi packages (optional)
  • TicWatch Pro 3 NetHunter zip - Get the latest update under TicWatch section
  • Facer app for WearOS 2

• TotalCommander: useful for selecting eg. a Ducky script, use “adb install” method

• Monitor mode with injection
• Kali services
• Custom Commands
• Bluetooth Arsenal
• KeX
• MAC Changer
• HID Attacks
• DuckHunter
• Nmap Scan
• WPS Attacks

• Router Keygen (to be optimised)
• Mifare Classic Tool (need to build OS with android.hardware.nfc enabled)

• Power resource is not enough for any external adapters, although this kernel might support Y cable in the future!