All variants are supported (TicWatch Pro 3 GPS/LTE/Ultra GPS/Ultra LTE).

From unpacking to running NetHunter in 6 steps:

1. Unlock the bootloader
2. Revert to stock WearOS2
3. Flash TWRP, WearOS image, Magisk, dm-verity disabler
4. Finalise Magisk app to finish the rooting process
5. Install NetHunter
6. Set NetHunter watch face

• Connect your watch to your PC with a DIY USB cable or a 3D printed data dock, and fire up a terminal.
• If you have set up your watch on the phone you can access settings, otherwise hold both buttons for a few seconds on the welcome screen.
• Enable developer settings by going to System -> About -> tap Build number 10 times
• Enable ADB, re-plug USB and accept debug from PC
• Reboot into bootloader with adb reboot bootloader from the terminal
• Unlock bootloader with fastboot oem unlock

Do this step only if you got your watch with WearOS3.

• Reboot to bootloader again, using one of the above methods
• Unpack stock WearOS2 zip (ROVER_STOCK_FASTBOOT_PMRL.220704.001.zip for LTE/Ultra LTE, RUBYFISH_STOCK_FASTBOOT_PMRB.220703.001.zip for GPS/Ultra GPS)
• Run flash_all.sh or flash_all.bat if using Windows
• Reboot and accept format data if required

Magisk 24.3 is recommended. OneOS is recommended for wireless injection, as any added system files like nexmon firmware or libs will be replaced on Stock WearOS after reboot. UPDATE Stock WearOS2 is now also supported thanks to the Nexmon Magisk module by apk0mix5900.

• Again enable ADB, and reboot to bootloader with adb reboot bootloader
• Disable vbmeta verification: fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
• Flash recovery fastboot flash recovery recovery.img
• Boot into recovery by selecting it with the side buttons (switch with bottom one, select with upper button)
• Select Wipe -> Next page -> Advanced Wipe -> Format Data
• Reboot to recovery
• Select “Install -> ADB Sideload”
• If you want to keep stock WearOS, skip the next two steps
  • Flash OneOS with adb sideload
  • Flash Mobvoi Apps package with adb sideload
• If you have an Ultra, adb sideload the Ultra addon package (TWRP-OEM_FOR_TICWATCH_PRO_3_ULTRA(rover).zip for Ultra LTE, TWRP-OEM_FOR_TICWATCH_PRO_3_ULTRA_GPS(rubyfish).zip for Ultra GPS)
• Flash Magisk with adb sideload Magisk-v24.3.apk
• Copy and flash DM-Verity_ForceEncrypt Disabler with adb push Disable-DM-Verity_ForceEncrypt.zip /sdcard/ and install via TWRP
• Reboot & do initial setup (pair with your phone through WearOS app)

• Enable ADB again
• Set density so app menu buttons will be reachable on OneOS adb shell wm density 300
• Finalise Magisk installation with app install adb install Magisk-v24.3.apk
• Launch Magisk Manager
• Find the settings button on top right corner (a bit tricky to reach)
• You may want to disable auto-update, set grant access in auto response, and disable toast notifications for easier navigation in the future

• Reboot to recovery
• Select Install -> ADB Sideload
• Flash NetHunter image with adb sideload
• Flash Magisk apk again with adb sideload
• Reboot
• Start NetHunter app & chroot (it may reboot after first start)
• Reboot

• Install Facer onto your phone
• Unzip facer zip for wearos and install the contents using adb install-multiple *.apk
• Search for NetHunter on your phone
• Select & Sync

• Build files:
  • Magisk
  • TWRP image for rover or rubyfish
  • vbmeta image
  • dm-verity disabler
  • OneOS, Stock ROMs, Ultra addon and Mobvoi packages (optional)
  • TicWatch Pro 3 NetHunter zip - Daily 2026.2 kalifs with patched systemd, udev, and latest stable NetHunter app (2026.1)
  • Facer app for WearOS 2

• TotalCommander: useful for selecting eg. a Ducky script, use “adb install” method
• Hijacker & Nexmon: install via Magisk

• Monitor mode with injection
• Kali services
• Custom Commands
• Bluetooth Arsenal
• KeX
• MAC Changer
• HID Attacks
• DuckHunter
• Nmap Scan
• WPS Attacks

• Router Keygen (to be optimised)
• Mifare Classic Tool (need to build OS with android.hardware.nfc enabled)

• Power resource is not enough for any external adapters, although this kernel might support Y cable in the future!