There's a swarm of them on social media, with almost everyone who manages to get their hands on one posting about it over and over again. Honestly, I love those posts—I really do. I also love those devices. To be honest, I’m a little jealous of the people who own them. A Raspberry Pi-based device running Kali Linux, designed to look like a BlackBerry, complete with a screen, keyboard, and battery? It’s impossible not to fall in love with those things.

No?

Now, if you’re one of those people who owns such a device, well, good for you. You were either lucky enough to buy it while it was still available, patient enough to wait 90 days for delivery, or resourceful enough to take an open-source project and build it yourself. I don’t fit into any of those categories.

I’m always late to the party with new gadgets. I’d never buy a device that requires waiting three weeks for delivery, let alone three months. As for building one myself—buying separate components, putting everything together, and hoping it works? 3D printing a case and praying everything fits? It all sounds great in theory, but that’s way too much effort for my taste. I want to use the device, not build it.

To be fair, the main reason I didn’t attempt to build one is that I knew it would take a lot of time to finish, and I just don’t have the interest or patience to see it through. That’s how I feel today, at the time of writing this article. I’m sure I’ll change my mind at some point—I always do.

OK, never mind then...

So, what were my options? Did I have any at all? Well, yes—just one: Kali NetHunter.

You’re probably thinking, “Didn’t he just say he doesn’t want to invest a ton of time making things work and prefers a ready-to-use device instead?” And yes, I did. But I also mentioned that my reluctance comes from a lack of interest in building a device. Setting things up on an Android device, however, is a completely different story. In fact, I’ve always wanted to explore Android at a deeper technical level but never had a compelling reason to start. A small project that lets me get my hands dirty while diving into the Android ecosystem seemed like the perfect opportunity. The idea of having NetHunter gave me the motivation to jump in, and setting it up on an Android phone sounds like a challenging—but exciting—project.

Kali NetHunter

For those unfamiliar, Kali NetHunter is a version of Kali Linux that you can set up on your phone. There are several types of NetHunter setups, each determining the capabilities of your device. Here’s an overview:

NetHunter Pro
This version is installed on a bare-metal phone and supports all hardware and peripherals (external Wi-Fi adapters, Bluetooth adapters, HID tools, etc.). The downside? It’s only available for a limited number of devices, and ordering one often means waiting weeks for delivery (and you already know how I feel about that).
NetHunter Rootless
Designed for unrooted, unmodified devices. It’s essentially Kali Linux, but with notable limitations like no support for Wi-Fi injection or HID attacks.
NetHunter Lite
This version works on rooted devices but doesn’t use a custom kernel. As a result, it shares the same major limitations as the Rootless edition, since the default kernel won’t support external devices.
NetHunter
The full NetHunter experience, available for rooted devices with custom kernels (for supported devices only). This setup enables advanced capabilities like Wi-Fi injection and HID attacks.

Ok, go!

I decided to go for the full NetHunter version. I knew it would be a hassle to set up, but I definitely wanted the advanced capabilities like Wi-Fi injection and HID attacks.

Setting Things Up

Scrolling through the list of phones that support NetHunter, I decided to go with the OnePlus 7T. Why? Because there was a used one available on Amazon for just $100 with next-day delivery. Could I have gotten something better? Sure, there were used Nexus 5/6 phones, but none offered next-day delivery (and you already know how I feel about that).

The phone arrived in great condition—everything worked well. The Android version wasn’t as advertised (I was expecting Android 11, as required by the NetHunter installation package, but got Android 12 instead), though that shouldn’t be an issue. I found a tutorial online that explained the installation process, so I was ready to dive in. Of course, as is often the case with random online resources, most of the instructions didn’t work. Still, it gave me a general sense of what needed to be done, so I pieced things together from other guides and created a step-by-step plan.

For the OnePlus 7T running Android 12, here’s what the process looks like:

Download the official firmware with Android 11 (and keep it handy in case you need to revert to the original state).
Unlock the bootloader.
Downgrade to Android 11.
Root your phone.
Install NetHunter with the OnePlus 7T custom kernel using Magisk.

Simple, right? Steps 1 through 3 are described in detail in my other post. Regarding Step 4, I’m unclear about the legal implications, so I’ll refrain from providing detailed instructions for now. For Step 5, I initially thought the official NetHunter documentation would be my best guide—or so I thought.

Can I use it now, please?

After a couple of weeks of effort (which mostly involved cursing, banging my head on the desk, and testing the patience of the Kali NetHunter Discord community), I finally got it to work.

I now have a fully functional Kali setup on my phone. Wi-Fi attacks? Check. HID injections? You bet. SDR? Absolutely. Bluetooth attacks? Why even ask—of course!

To celebrate this milestone, I recorded a few videos to showcase what I can now do with my $100 OnePlus 7T running NetHunter. Enjoy!

Wi-Fu

HID Attacks

Bluetooth

SDR

My Setup

Curious about how my handheld hacking device looks? Here are some pictures of the entire setup, including all the peripherals.

NetHunter

Alfa Network USB Adapter (AWUS036NHA)

SABRENT USB Bluetooth 4.0 Mikro Adapter (BT-UB40)

RTL-SDR Blog V4 R828D (RTL2832U)

Troubleshooting

Documentation

Unfortunately, as of the time of writing, the official NetHunter documentation for the OnePlus 7T is outdated.

NetHunter

The first issue I encountered was an inability to flash NetHunter using Magisk—it kept stopping halfway through. As it turns out, the latest version isn’t always the best. At the time of writing, the latest version of Magisk is v28, which unfortunately doesn’t work. I had to downgrade to v27, and after that, the installation went smoothly—or at least almost smoothly (see the next issue).

NetHunter/WiFi

For a few days, NetHunter wasn’t detecting my Alfa adapter. I tried countless fixes, but thanks to the Kali Discord community, I discovered the root of the issue. Despite setting up the NetHunter version with a custom, supported kernel, the installation process hadn’t actually deployed that kernel—causing problems with modules and firmware for external devices.

It took me another couple of days of trial and error, but I finally found a workaround. By flashing the same NetHunter image on top of the existing one, I effectively skipped the full installation process and deployed the kernel only. From that moment on, I had the full version of NetHunter running, along with a fully functioning Wi-Fi adapter.

Interestingly, no one else I spoke to had encountered this issue on their phones, but no one else had a OnePlus 7T either. It’s likely this problem is specific to the firmware on this model.

RTL-SDR

To make it work, I needed to install drivers called SDR Drivers. These are available in the NetHunter Store, making it a simple process—just click Install and you’re done. Or so I thought. Unfortunately, the drivers from the NetHunter Store (image below on the left hand side) didn’t work and appeared quite outdated.

I then noticed a newer version of the drivers available in the Google Play Store (image below on the right hand side). I downloaded and installed that version instead. During the installation, you’ll be prompted to confirm if you want to overwrite the existing version with the one from the Play Store—just hit Yes.

Things to Try Next

RFID

One thing I haven’t tried yet is connecting a Proxmark3 to the phone to see if it works. I might give that a shot next.

Quack-quack - HID attacks with NetHunter

A few days ago, I decided to dive deeper into the Android ecosystem and its security aspects. I got a device that I wouldn’t mind breaking, rooted it, and was all set to begin my research. I was... but what did I end up doing instead? Naturally, I set up Kali NetHunter and started experimenting with it. Let me tell you, this thing is a lot of fun—especially features like HID attacks! I've been having so much fun with it that I decided to record an example of how it works in practice. This is a simple example of a keystroke injection attack, where an adversary connects a phone to a victim’s PC, simulating an HID device and rapidly sending a series of keystrokes. Check out the video below.

Meanwhile, I do want to learn about Android security, so I’d better get to it!

Flashing an OS image to your Android device

DISCLAIMER: You follow this guide at your own discretion. If you have an Android phone other than a OnePlus or Nexus, there’s a high chance you may brick your device unless you really know what you’re doing. Performing any of the actions described may void your phone's warranty. It’s best to try this only on an old or expendable device.

Introduction

I've recently started learning about the Android ecosystem from an architecture and security perspective. One of the first steps I took was to buy an old, used phone that I could root easily. I chose the OnePlus 7T, which came with Android 12 installed. Interestingly, the last official software release for this model was on August 12, 2022, with Android 11. I’m not sure why mine has Android 12, but since I plan to experiment with the system extensively (and will likely break it multiple times), it’s important to set up a baseline that I can reliably restore. Given that the Android 11 image is the latest official release available on the OnePlus website, it will serve as my baseline.

Initially, I wasn’t sure how to set up this baseline. Although the process is relatively straightforward, being new to this and finding most of the information aimed at more experienced users, I struggled at first.

The goal of this blog post is to provide a step-by-step guide on installing Android on the OnePlus 7T, in case you need to recover your device during your own exploration of Android architecture and security. While I’ll use the OnePlus 7T, I’ll try to present the instructions in a way that can be adapted for other devices. The focus will be on understanding the steps and their purpose, rather than just following a checklist.

Here’s what I’ll cover in this article:

Downloading the software image
Enabling OEM unlock
Rebooting to the bootloader
Unlocking the bootloader
Flashing the software image

Get the right software

Depending on your phone model, there’s a good chance the build will be available on the vendor's website. For OnePlus devices, you can find the builds here.

After downloading the build, we’ll need to extract the boot.img file. To do this, you’ll first need a tool called payload-dumper-go, which you can download from this link.

payload-dumper-go payload.bin

This will extract all files into a new folder in the current directory, including the boot.img. The extracted boot.img is the image we’ll be flashing.

This step may vary depending on your phone model. For example, with the Samsung S9, you can use an application called Frija instead. Once started, we need to provide information about the model, CSC, and IMEI. This will then allow us to download the correct firmware for a specific Samsung phone.

The downloaded zip will contain a list of files which we'll then use to flash our Samsung S9 phone.

Avoid running any of these tools (except for Android Platform Tools) on your main OS. Instead, run them in a virtual machine (VM), as I can’t guarantee their safety. As with any application downloaded from the internet, exercise caution.

Unlock OEM

Warning: This will erase all data on your phone.

To flash a new OS image onto a device, we first need to unlock the bootloader. Historically, this has been challenging, as OEM vendors use it as a security measure to prevent modifications like the ones we’re attempting. However, this has changed over time, and many vendors now provide an option to unlock the bootloader.

The first step is to go to Settings > About Phone and tap the Build Number field several times. Note that this process may vary depending on your phone model or Android version. Below are some example screenshots from the OnePlus 7T.

In my case, OEM Unlocking was already enabled, and the bootloader was unlocked, so the option appears grayed out.

While we’re here, let’s also enable USB debugging:

This may look slightly different on other Android phones, but the process should be quite similar.

Reboot to bootloader

Before flashing the image, we need to reboot into the bootloader. On OnePlus devices, this is called Fastboot Mode. We can do this using adb:

adb reboot bootloader

The commands should look like follows:

On the phone, you should see something like this:

Note that not all Android phones have Fastboot mode. For example, my Samsung S9 has something called Download Mode, where you can simply drag and drop files. The Download mode on Samsung should look like this:

Unlock the bootloader

Warning: This will erase all data on your phone.

Once in Fastboot mode, we can proceed to unlock the bootloader:

fastboot oem unlock

You should see a prompt on the phone screen with the option to lock or unlock the bootloader.

Once you confirm your choice, the bootloader unlock will proceed. The command should look like follows:

On the Samsung S9, to remove that check, you’ll first need to flash TWRP and then use RMM State Bypass Mesa.

When downloading TWRP, make sure you select the version that is compatible with your device. You can find relevant references at the end of this article.

Flash the software image

To flash the image, run the following command:

fastboot flash boot boot.img

The command should look like this:

For the Samsung S9, instead of using Fastboot, you'll need to use a tool called Odin to flash both TWRP (as described above) and the stock firmware. Below you can see how this will look like with Odin for Samsung S9. As already mentioned, you can find relevant references for Samsung S9/S9+ at the end of this article.

And that’s it! We’ve successfully flashed an Android OS onto our phone.

Conclusions

As we've seen throughout this article, installing an Android system on your device can vary depending on the phone model. However, the process generally follows these universal steps:

Get the software image
Unlock the OEM
Reboot to the bootloader
Unlock the bootloader
Flash the software image

Now that we have a way to recover our system to its original state, let's go ahead and try to break it.

Resources

Samsung S9/S9+ Guide

How to crash a Spacecraft – DoS through Vulnerability in NASA CryptoLib v1.3.0

My research team has uncovered critical out-of-bounds vulnerabilities in NASA's CryptoLib v1.3.0, which could lead to a Denial of Service (DoS) by crashing both spacecraft and ground station systems. We demonstrated this with a Proof-of-Concept exploit that successfully crashed the Core Flight System and COSMOS within NASA’s Operational Simulator for Small Satellites. Our analysis highlights the need for improved SPI validation in CryptoLib's functions to prevent such security breaches, and we recommend specific checks to mitigate these vulnerabilities.