Last reviewed 43 min read

Intermediate
Verified end-to-end 2026-10-17 · LineageOS 23.2 · Magisk 30.7 · NetHunter 2026.2

Kali NetHunter Setup

Check Your Model Number Before Anything Else

Settings → About phone → Model number. This guide is only for the Exynos S10 family:

  • SM-G973F, SM-G973F/DS, SM-G973N (Galaxy S10) → continue
  • SM-G975F, SM-G975F/DS, SM-G975N (Galaxy S10+) → continue
  • SM-G970F, SM-G970F/DS, SM-G970N (Galaxy S10e) → continue
  • SM-G977B, SM-G977N (Galaxy S10 5G) → continue

Stop if your model ends in U, U1 or W (e.g. SM-G973U), or if it is one of the Chinese Snapdragon models SM-G9700, SM-G9730, SM-G9750 or SM-G9770 (beyond*q): those are all Snapdragon variants with locked bootloaders. There is no LineageOS build and no NetHunter build for them, so this path cannot work — use NetHunter Rootless instead. The Galaxy S10 Lite (SM-G770F) is not supported either.

Many people misread the model off the About screen. Once USB debugging is on, the getprop block in Pre-Flight & Rollback Prep is the authoritative check — ro.product.model plus ro.product.device together name the exact variant.

Continuing on an unsupported model means wiping the phone and permanently tripping Knox for nothing.

Device Model Number Codename
Galaxy S10 (Exynos) SM-G973F beyond1lte
Galaxy S10+ (Exynos) SM-G975F beyond2lte
Galaxy S10e (Exynos) SM-G970F beyond0lte
Galaxy S10 5G (Exynos) SM-G977B / SM-G977N beyondx
Galaxy S10 (Snapdragon) SM-G973U beyond1q — locked bootloader, no LineageOS

/DS dual-SIM and Korean N variants of the S10/S10+/S10e are also supported. Only the Exynos beyond*lte / beyondx codenames are — Snapdragon *q variants and the S10 Lite (SM-G770F) are not.

Install full Kali NetHunter on an unlockable Android device with a Samsung Galaxy S10 Exynos path as the primary example. This refresh prioritizes version checks, device fit, and recovery checkpoints so you can stop early if your hardware or firmware path is wrong.

Read This First

  • This will wipe your device. Back up everything first.
  • You must already be on Android 12 stock firmware. LineageOS builds for this device require an Android 12 version of the stock OS to be installed before you start — an older stock build or any custom ROM does not satisfy it.
  • Remove all Google accounts from the phone before the wipe, or Factory Reset Protection will lock you out of the fresh install.
  • Samsung Galaxy S10-family NetHunter builds currently require a matching LineageOS-based path, not stock Samsung firmware.
  • Exynos Samsung models are the intended target. Many Snapdragon carrier variants still cannot be unlocked reliably.
  • Use a Linux machine for flashing, a known-good data cable, and a direct motherboard USB port instead of a hub or dock.
  • Set aside 1-2 hours for the whole job (roughly 30-60 minutes of downloads and preparation, 15-30 minutes of flashing, up to 15 minutes for the first boot), 4+ GB of downloads, and at least 60% battery on both the phone and laptop.
  • Unlocking the bootloader permanently trips Knox and may disable Samsung Pay, Secure Folder, and some enterprise controls.

Always Verify Latest Versions

Firmware, recoveries, and tools update frequently. Before flashing, confirm you have the latest compatible versions:

  • LineageOS: wiki.lineageos.org/devices/beyond1lte — beyond1lte currently ships LineageOS 23.2 (Android 16); 22.1, 22.2 and 23.0 are retired. Use whatever the official install page shows, and match your NetHunter build to it.
  • Lineage Recovery + vbmeta: both recovery.img and the vbmeta.img from your build are published in your build's file list on the LineageOS download page, alongside boot.img and dtbo.img. The install page explains the procedure — it never mentions vbmeta, and it now flashes recovery with samloader, which is also what this guide's verified run used. heimdall flash --RECOVERY recovery.img --VBMETA vbmeta.img --no-reboot does the same job if you prefer Heimdall — but stay on one tool once a path is working. That vbmeta.img is a signed 8 KB AVB image with verification and hashtree disabled (flags 0x3), which is what turns Android Verified Boot off. Take the vbmeta.img from the same build as your ROM — its rollback index tracks that build's security patch level. TWRP is no longer part of the supported S10 flow.
  • NetHunter: kali.org/get-kali/#kali-mobile — match the exact codename and LineageOS generation in the filename (e.g. beyond1lte-los for LineageOS 23.x). It installs as a Magisk module, not a recovery flash.
  • Magisk: github.com/topjohnwu/Magisk/releases — use v30.7, the version verified on this device on 2026-10-17. Do not use v28.1: its patched boot images are rejected by this phone's bootloader (see Step 4.2), so the old upstream pin now costs readers a scare and a re-flash.

The Kali S10 doc has not been refreshed — it still pins Magisk v28.1, which is now known-bad on this hardware. Magisk upstream also documents installing via recovery/sideload as deprecated, and the verified path reflects that: install the v30.7 APK, use Install → Select and Patch a File on the boot.img from your exact LineageOS build, then flash that patched image. Samsung's bootloader has no fastboot of its own, but LineageOS ships fastbootd (a recovery-level fastboot) reachable with adb reboot fastboot — so the commonly posted fastboot flash boot does work here, and the older advice on this page that it does not was wrong. If fastboot devices stays empty, flash from Download Mode with samloader flash -p BOOT … instead. Keep the unpatched boot.img on disk: it is both the patch input and the way back to a clean, un-rooted boot.

Freshness Rule for This Page

Verified end-to-end on 2026-10-17 on an SM-G973F (beyond1lte) from stock Android 12, with LineageOS 23.2 (lineage-23.2-20261016-nightly-beyond1lte), Magisk 30.7, samloader-rs 2.2.0 and NetHunter 2026.2 (los-sixteen full) — rooted, kernel in place, Kali chroot extracted, su -c id = uid 0. Everything below that is presented as verified was exercised on that hardware; anything the run did not cover is still framed as advice, not proof.

The authoritative upstream sources remain the official Kali NetHunter Galaxy S10 install doc, the LineageOS install page and the NetHunter downloads page — re-check all three every time you reuse this guide. Where upstream still pins an older Magisk than v30.7, this page's dated build set wins: the older version is known-bad here. For any other filename, LineageOS generation or recovery difference, trust upstream and adjust before flashing.

The Whole Job

The required sequence, end to end. Each step links to its section; the checkpoint tells you whether you can move on.

  1. Check the model number — Exynos = go, Snapdragon = stop
  2. Download everything — all files on local disk before you start
  3. Confirm Android 12 stock firmware — the LineageOS firmware prerequisite; update the stock build first if you are below it
  4. Unlock the bootloader — erases the phone, trips Knox permanently; Download Mode must be entered from a full power-off or the unlock prompt never appears
  5. Flash Lineage Recovery + vbmeta — samloader flash -p RECOVERY … -p VBMETA …
  6. Boot straight into Lineage Recovery — do not let Android boot first
  7. Format data — required before sideloading
  8. Sideload LineageOS — skip GApps on a pentest device, and watch the screen for Completed status 0
  9. Root with Magisk v30.7 — patch your build's boot.img in the app, flash it, check the Magisk app shows a version and not "N/A"
  10. Install NetHunter as a Magisk module — first boot takes 5-15 minutes
  11. Verify — su -c id returns uid=0(root) and nethunter drops you into Kali

Isolate First

A bootloader unlock and a NetHunter chroot are not contained by a hypervisor, so the boundary has to be physical: a device you are willing to wipe, on an SSID you own. Flashing the phone you carry every day is the mobile version of bridging to the home LAN.

Network type
Physical device, no virtual network
Lab network
n/a
Subnet
No local subnet — this lab is a phone you own

There is no VM network to create here. Isolation means one owned device, fully backed up, with your SIM, work profile and personal accounts removed before the flash.

IP plan

Role Identifier
Test device owned, backed up, codename verified
Host workstation adb over USB
Network your practice SSID (see the Wireless Lab)

Nothing to create here — this lab has no virtual network. The boundary is the account or the device itself, not an adapter.

Prove it is isolated

adb devices -l; adb shell ip -4 route

Expected: the device listed once, and its only route on the practice AP subnet. A route through your home router means the phone is still on your home network while you flash it.

Never flash or test a device you do not own or cannot afford to lose, and never leave personal accounts on the test device.

Lab Runbook

Use this page as a controlled lab build, not a production hardening guide. Prove the network is isolated before running exercises, then validate and clean up from the operational section at the end of the page.

Critical risk Intermediate 2-4 hr

Plan

N/A — no local VM; 4 GB downloads plus backups. Device dependent. Isolation: Use only owned devices and authorized wireless targets.

Outcomes

  • - Model verified
  • - Backups complete
  • - Matched ROM/recovery/NetHunter files
  • - Rollback path documented

Compatibility Check — Go / No-Go

Do this before you download anything. Success depends on the exact model, codename, bootloader state, recovery support, base-ROM generation, and a known rollback path. Device-family names are not enough — if any row lands in the Stop column, resolve it before flashing.

Check Go signal Stop signal Evidence to keep
Official support Exact codename appears on the official Kali mobile download page. Only a similar model or an old forum build exists. URL, codename, filename, date.
Bootloader Unlock is supported for your exact model and region. Carrier, Snapdragon region, or OEM policy blocks unlock. Download Mode screenshot, samloader output, or adb shell getprop ro.boot.flash.locked = 0.
Recovery Lineage Recovery (or supported recovery) matches your exact codename. Recovery exists only for another variant. Recovery filename, hash, source URL.
Base ROM LineageOS generation matches the NetHunter build (e.g. both 23.x). NetHunter ZIP expects a different LineageOS/Android generation. ROM version, Android version, codename.
Rollback Stock firmware, recovery path, and key combos are documented. No known stock image or unreliable USB detection. Firmware link, checksum, rollback notes.

Good Candidate

Official NetHunter build, unlockable bootloader, matching recovery, active ROM docs, and a known rollback path.

Research Candidate

Partial or community support exists, but one of recovery, ROM, kernel, or rollback is uncertain.

Do Not Flash Yet

Locked bootloader, mismatched codename, missing stock firmware, unclear recovery support, or no trustworthy source.

Which Edition Fits Your Device

Use This Guide

You have an unlockable device, you are comfortable wiping it, and you want full NetHunter with root and the full kernel feature set.

Choose Lite Instead

Your phone can be rooted but does not have a practical custom-kernel path. You still want the app, Kali container, and post-exploitation tooling.

Choose Rootless Instead

Your bootloader is locked, your model is a carrier Snapdragon Samsung, or you only need portable Kali tooling without kernel features.

Pre-Flight & Rollback Prep

Pre-Flight Checks

  1. Confirm your exact model number and codename with the getprop block below — not from a glance at the About screen — then map it to the correct codename before downloading anything.
  2. Confirm the phone is on Android 12 stock firmware — not Android 10/11 and not a custom ROM. See the firmware prerequisite in this section before you download anything else.
  3. Confirm your NetHunter filename and your LineageOS build target the same generation (e.g. both LineageOS 23.x).
  4. You will run these checks later: adb devices after Step 2.1, and once in Download Mode samloader (or fastboot devices inside fastbootd) must see the phone.
  5. Download everything to local disk first. Do not depend on live mirror scraping while the phone is already in recovery mode.
  6. Keep a manual recovery path ready: official LineageOS install page, official NetHunter download page, and a fallback flashing machine if samloader misbehaves.

Device identity gate. Once USB debugging is on, read the state off the device rather than off the About screen — ro.product.model and ro.product.device together name the exact variant, the bootloader lines say whether the phone is already unlocked, and the last line says whether Samsung is willing to expose the unlock toggle at all: 

adb devices -l

# Identity — read the two model lines together
adb shell getprop ro.product.model            # e.g. SM-G973F
adb shell getprop ro.product.device           # e.g. beyond1 (stock firmware)
adb shell getprop ro.build.version.release    # must be 12 (stock Android prerequisite)

# Bootloader state
adb shell getprop ro.boot.flash.locked        # 1 = locked bootloader, 0 = unlocked
adb shell getprop ro.boot.verifiedbootstate   # green = stock, orange = custom

# OEM unlocking toggle — Samsung only exposes it with Wi-Fi + a correct clock
adb shell getprop sys.oem_unlock_allowed      # 1 = toggle is ON

Stop here if ro.product.device is a Snapdragon *q codename, or if ro.build.version.release is anything other than 12. A sys.oem_unlock_allowed of 0 is not a dead end — see the unlock prerequisites in Step 2.1.

Rollback Notes — Read Before the First Flash

  • Restoring the stock boot.img from your ROM build removes Magisk cleanly — samloader flash -p BOOT boot.img (or fastbootd) is the whole un-root step. There is no un-root dance, no leftover daemon, no recovery script.
  • Uninstalling the NetHunter module in Magisk rolls back the Kali side.
  • Keep Magisk-v30.7.apk, the build's boot.img, recovery.img and vbmeta.img, and SHA256SUMS.local.txt in the same folder as your notes. Version numbers matter more than filenames here — record the exact LineageOS build, Magisk, samloader and NetHunter versions you used.
  • Knox has no rollback. Decide that before you unlock, not after.

Write This Down Before Flashing

  • Download stock firmware / factory images and note their checksums before the device enters Download or Recovery mode.
  • Record the exact Download Mode and Recovery key combos for your model.
  • Keep the original USB cable and a known-good direct USB port on hand.
  • Note any Knox / warranty impact so there are no surprises later.
  • Do not proceed if the battery is low, USB disconnects intermittently, or device detection is unstable.

1. Prerequisites & Downloads

Supported Devices

NetHunter has three practical installation paths. Pick the one that matches your hardware reality before you collect files:

NetHunter (Full)

Requires an unlockable device and an officially supported kernel path. This is the only route that gives you the full HID, BadUSB, and wireless feature set.

Use this page only if this is your target state.

NetHunter Rootless

No root required. Runs in Termux and avoids bootloader, recovery, and firmware changes.

Best fallback when your bootloader path is blocked.

NetHunter Lite

Rooted device with no custom-kernel dependency. App + Kali container, but not the full hardware feature set.

Useful when full NetHunter support is incomplete for your model.

This Guide Covers Full NetHunter

This walkthrough stays focused on full NetHunter for a Samsung Galaxy S10 Exynos (SM-G973F / beyond1lte). If your exact model differs, keep the flow but replace every download with the files for your codename.

LineageOS Required for Samsung Devices

Current Samsung S10-family NetHunter downloads are published against a LineageOS path (currently 23.2 / Android 16), not stock Samsung firmware. Do not rely on old screenshots, older ROM names, or a generic "latest" assumption. Verify the exact LineageOS generation encoded in the NetHunter filename and match it to the LineageOS device page for your codename before flashing.

Hard Prerequisite: Android 12 Stock Firmware

This is the step most people skip. The LineageOS install page lists it under Checking the correct firmware, after the basic requirements. Verbatim: "LineageOS builds for this device require an Android 12 version of the stock OS to be installed prior to following the installation guide."

  • Check Settings → About phone → Android version. What matters is the Android version, not the One UI / vendor version.
  • If it is lower than 12, update to the final stock firmware for your exact model first (Samsung Smart Switch, or Odin with the stock ROM), then boot it once before continuing.
  • The S10, S10+, S10e and S10 5G all stopped at Android 12 / One UI 4.1, so a fully updated phone already meets this. An S10 still on Android 10 or 11 does not.
  • Being on another custom ROM — including an unofficial LineageOS build of the same version — does not fulfil this requirement. Firmware means the stock device images, not the Android version string.
  • The install page also lists a basic requirement: boot the stock OS at least once and check that every function works — calls, camera, Wi-Fi, mobile data, sensors, and charging. Do this before the wipe, while stock firmware is still recoverable.
  • Remove all Google accounts from the phone before you wipe it, or Factory Reset Protection will block the fresh install.

The install page is explicit about the consequence of getting this wrong: a failed install, unexpected crashes after booting, or permanent damage to the device.

Expected Time and Failure Points

Most failed installs happen before flashing starts: wrong model, bad cable, unstable USB hub, or mismatched ROM/NetHunter version. Plan for 30-60 minutes of downloads and preparation, 15-30 minutes of flashing, and up to 15 minutes for the first boot.

What You'll Need

Hardware

  • ☑️ Samsung Galaxy S10 (SM-G973F/Exynos) — or your supported device
  • ☑️ Short, known-good USB-C data cable connected directly to the computer
  • ☑️ Linux PC/laptop (Kali Linux recommended)
  • ☑️ microSD card (optional, for storing images/wordlists)
  • ☑️ USB OTG adapter (for external WiFi adapters later)

Cable Quality Matters

Samsung flashing issues are often just transport issues. If ADB drops, samloader stalls, or the phone disconnects when entering Download Mode, swap the cable first and move to a direct USB port before troubleshooting software.

Software Downloads

Download all files to a folder on your Kali machine (e.g., ~/nethunter-install/).

File Source Notes
samloader-rs GitHub releases Primary flashing tool for Download Mode — recovery + vbmeta, and later the patched boot.img. Pick the asset for your CPU architecture (2.2.0 is what the verified run used). Also gives you print-pit for a partition-table dump
Heimdall (alternative) GitHub Does the same Download Mode writes and also works, but the verified 2026-10-17 run never needed it. In Kali's repos: apt install heimdall-flash. Stay on one tool once a path is working
Lineage Recovery + vbmeta LineageOS downloads Both recovery.img and the vbmeta.img from your build are in its file list — use the pair from the same build as your ROM. TWRP is not used on the current S10 path
LineageOS boot.img LineageOS downloads Required for root — the Magisk app patches this exact file and you flash the result (Step 4.2). It must come from the same build as your ROM; a boot image from a different build will not match. It is also your clean un-root image, so keep it
LineageOS ROM LineageOS downloads Required — sideload before NetHunter (match your codename & generation)
MindTheGapps (optional) LineageOS Gapps Skip it on a pentest device — NetHunter ships its own app store (NetHunter Store / F-Droid), so Google services add attack surface and setup noise for nothing. Only fetch it if you specifically want a Google account on the phone; it must match the LineageOS Android version
Magisk v30.7 (.apk) GitHub release For root. Install the APK and let it patch boot.img (Step 4.2) — do not sideload it as a zip. v28.1 is known-bad on this device: its patched boot images are rejected by the bootloader and drop the phone into Download Mode
NetHunter installer ZIP kali.org Pick your codename and channel — for LineageOS 23.2 (Android 16) that is beyond1lte-los in the sixteen channel (e.g. kali-nethunter-<release>-beyond1lte-los-sixteen-full.zip). The kernel ships inside this ZIP. Installed via Magisk → Modules, not recovery

Download by hand. The current S10 install is one ROM sideload, one adb-side boot-image patch and one Magisk module, so there is very little left to automate. The old TWRP-era auto-installer that used to live here no longer matches this flow and has been retired to avoid steering you down the wrong path.

If you do reuse a scripted download helper from elsewhere, never blind-run it: read it first, verify every URL and filename against upstream, run it download-only, and check hashes before anything touches a partition.

Once every download is on local disk, hash each file and keep the list with your lab notes: 

# Hash every file you are about to flash and keep the list with your lab notes
sha256sum *.img *.zip *.apk 2>/dev/null | tee SHA256SUMS.local.txt

2. Unlock the Bootloader

Step 2.3 Erases This Phone

Unlocking the bootloader factory-resets the device. Photos, apps, accounts, and 2FA authenticator enrolments are gone — you cannot back them up once the unlock screen appears. Back up now. Check your model number first (see the top of this page).

Knox Will Be Tripped

Unlocking the bootloader on Samsung devices permanently trips Knox. Samsung Pay and some enterprise features will stop working. This cannot be reversed.

Step 2.1: Enable Developer Options

  1. Connect the phone to Wi-Fi with working internet, then set Settings → General management → Date and time → Automatic date/time. Samsung checks both before it will offer the unlock toggle (ADB-visible as sys.oem_unlock_allowed).
  2. Go to Settings → About Phone → Software Information
  3. Tap Build Number 7 times until you see "Developer mode enabled"
  4. Go back to Settings → Developer Options
  5. Enable OEM Unlocking (it may not appear yet — see the callout below)
  6. Enable USB Debugging

The OEM Unlocking Toggle Needs Network + a Correct Clock

The toggle is not simply there on a fresh device: Samsung gates it on the phone having been online over Wi-Fi and its system clock being correct. A new Samsung's clock is often wrong before its first network sync, which is exactly when people go hunting for the toggle and conclude their model is locked. Leave it on Wi-Fi with Automatic date/time on, then look again.

Check it from the PC rather than by eye — adb shell getprop sys.oem_unlock_allowed must return 1. Do not start the unlock until it does, and re-check it after the post-unlock reboot (Step 2.3).

With USB debugging on, capture your starting state so you can prove what changed and roll back cleanly: 

adb devices
adb shell getprop ro.product.model
adb shell getprop ro.product.device
adb shell getprop ro.build.version.release      # must be 12
adb shell getprop ro.boot.flash.locked
adb shell getprop ro.boot.verifiedbootstate
adb shell getprop sys.oem_unlock_allowed        # 1 = the unlock toggle is ON

Step 2.2: Boot to Download Mode

  1. Unplug the USB cable first — a phone that is still charging from the PC will not stay powered off.
  2. Power the phone off completely.
  3. Hold Volume Down + Bixby together.
  4. While still holding both, connect the USB cable to the phone (the other end is already in your Kali machine).
  5. Keep holding until the warning screen appears.

Two Different Download Modes — Only One Can Unlock

This distinction is the one that stalls people. The "press Volume Up to unlock the bootloader" prompt only exists when Download Mode was entered from a full power-off, exactly as above. If you enter Download Mode from a running OS with adb reboot download, you land on the same-looking screen without the unlock option — and people then stand there holding Volume Up against the wrong mode, convinced the unlock is broken.

adb reboot download is still perfectly fine later, for flashing recovery, vbmeta and boot — just never for the unlock. If you are unsure which mode you are in, power off and repeat the key combo above.

Step 2.3: Unlock on the Device

  1. You must be in the power-off Download Mode from Step 2.2, not the one from adb reboot download — the unlock prompt does not exist in the latter.
  2. In Download Mode, long-press Volume Up (3-5 seconds) to open the bootloader unlock prompt.
  3. Read the warning, then short-press Volume Up to confirm the unlock.
  4. The phone wipes itself and reboots automatically.
  5. Complete basic Android setup again (skip the accounts), then return to Developer Options and re-enable USB Debugging.
  6. Re-enable Developer Options if the reset removed them, then confirm OEM Unlocking is still enabled. The LineageOS install page requires this check after the reset — if the toggle reverted to off, switch it back on and let the phone settle before continuing. Provable check: adb shell getprop sys.oem_unlock_allowed → 1.

Confirm the unlock actually took before you flash anything. ro.boot.flash.locked must flip to 0 and ro.boot.verifiedbootstate to orange (custom/unverified boot): 

adb shell getprop ro.boot.flash.locked        # 0
adb shell getprop ro.boot.verifiedbootstate   # orange

No Flashing Tool Can Unlock It

samloader and Heimdall write partitions; neither can initiate a Samsung bootloader unlock. The unlock confirmation happens on the device, in the power-off Download Mode, and it factory-resets the phone immediately.

3. Flash Lineage Recovery

Why Lineage Recovery, Not TWRP

The current official S10 path installs the ROM through Lineage Recovery using adb sideload, and installs NetHunter itself as a Magisk module — you never flash TWRP, and the NetHunter ZIP is installed from the Magisk app rather than flashed in recovery. Any guide that tells you to flash TWRP and then flash a NetHunter ZIP for the S10 predates this method. If in doubt, follow the official Kali S10 doc.

Step 3.1: Confirm Your Codename

Your codename table is at the top of the page. Once you have your codename, download that device's recovery.img (Lineage Recovery) and the vbmeta.img from the LineageOS download page — both sit in your build's file list next to the ROM. The install page covers the procedure.

Exynos Only

This flow targets the Exynos international models (SM-G97xF, plus SM-G977B/N on the S10 5G). The US and China Snapdragon variants (Snapdragon beyond*q, including SM-G9730) have locked bootloaders and no LineageOS build, so this path does not apply to them — use NetHunter Rootless instead. Confirm your model in Settings → About Phone and stop if your filenames do not match it.

Step 3.2: Flash Recovery + vbmeta with samloader

With the phone in Download Mode (from Section 2), flash Lineage Recovery and the vbmeta.img from your build in one command. That vbmeta carries verification and hashtree disabled (flags 0x3), which is what turns Android Verified Boot off so the custom recovery and ROM will boot. 

# Navigate to your download folder
cd ~/nethunter-install

# Phone in Download Mode:
#   power off -> unplug -> hold Vol Down + Bixby -> plug in USB -> keep holding
#   (for flashing, adb reboot download is fine too — only the unlock needs the
#    power-off entry)

# Write Lineage Recovery to RECOVERY and the matching vbmeta to VBMETA in one
# command. That vbmeta carries verification + hashtree disabled (flags 0x3),
# which is what switches Android Verified Boot off so recovery and the ROM boot.
samloader flash -p RECOVERY recovery.img -p VBMETA vbmeta.img

# Heimdall performs the same writes if that is what you already have —
# pick one tool and stay on it once a path is working:
#   heimdall flash --RECOVERY recovery.img --VBMETA vbmeta.img --no-reboot

Filenames

recovery.img is the Lineage Recovery image for your codename, and vbmeta.img is the AVB image from your build with verification and hashtree disabled (flags 0x3) — both come from your build's file list on the LineageOS download page, not from the install instructions. Use the pair from the same build as your ROM. Both the LineageOS wiki and this guide flash recovery with samloader (2.2.0 in the verified run); heimdall flash --RECOVERY recovery.img --VBMETA vbmeta.img --no-reboot is the Kali S10 doc's command and works equally well if Heimdall is installed. If your filenames differ, rename them or adjust the command — the -p RECOVERY / -p VBMETA (or --RECOVERY / --VBMETA) targets are what matter.

Step 3.3: Boot Straight Into Recovery

This is the single most common place people brick the flow. You must jump directly from Download Mode into recovery. If you let stock Android boot even once, it restores the stock recovery and you have to flash again.

  1. Keep the USB cable connected to your PC. The LineageOS install page performs this key combo "while the device is connected to a PC via USB cable", and sideloading in Section 4 needs the connection anyway.
  2. Force-exit Download Mode: hold Volume Down + Power for ~7-10 seconds until the screen goes black.
  3. The instant the screen goes black, switch to Volume Up + Bixby + Power and keep holding.
  4. Release when the Lineage Recovery menu appears.

Required: Format Data Before Sideloading

In Lineage Recovery, choose Factory reset → Format data/factory reset and confirm before sideloading anything. This clears Samsung's forced encryption so the new ROM boots cleanly. You can navigate the menu with the volume keys and select with power. This step is mandatory, not optional — the new ROM will not boot cleanly over Samsung's encryption.

4. Install LineageOS, Magisk & NetHunter

The ROM is sideloaded from Lineage Recovery, root is then done from a booted LineageOS by patching boot.img in the Magisk app, and NetHunter installs as a Magisk module. Do it in order — the ROM must boot before you can patch its boot image, and root must work before NetHunter.

Order of Operations

  1. In Lineage Recovery: Factory reset → Format data (done in Section 3.3).
  2. Sideload the LineageOS ROM and watch the phone screen for Completed status 0.
  3. Reboot to system and finish LineageOS setup. Skip GApps — NetHunter brings its own app store.
  4. Re-enable Developer options + USB debugging on the fresh install.
  5. Root: install Magisk v30.7, patch your build's boot.img, flash the patched image (Step 4.2).
  6. Push the NetHunter installer and install it as a Magisk module.

Step 4.1: Sideload LineageOS (and optional GApps)

In Lineage Recovery choose Apply update → Apply from ADB, then sideload each file. Re-enter Apply from ADB before each new sideload. 

# Recovery: Apply update -> Apply from ADB, then on your Kali machine:

# 1) Sideload the LineageOS ROM (match your exact filename)
adb -d sideload lineage-23.2-*-beyond1lte-signed.zip

# 2) (Optional) Google apps — skip this on a pentest device. If you do want it,
#    re-enter Apply from ADB first, then:
adb -d sideload MindTheGapps-*-arm64-*.zip
#    A "Signature verification failed" prompt is normal for GApps — choose Yes.

A 47% Stop in adb Can Still Be a Good Transfer

On some runs adb's own output stops around 47% with "failed to read command". That artefact is known-benign — the transfer is usually still happening. What decides it is the phone screen: watch the install phase through to Completed status 0 before you believe the sideload.

A silent 47% stop plus a later boot failure means the ROM was half-written, not installed — re-sideload rather than assuming. If the zip ends at an odd percentage without an on-screen status 0, also run unzip -t on it locally before trying again.

Skip GApps on a Pentest Device

NetHunter ships its own app store (NetHunter Store / F-Droid), so Google services buy you nothing here and add attack surface plus a longer first-boot setup. Install GApps only if you specifically want a Google account on the phone.

Step 4.2: Root — Patch boot.img with Magisk v30.7

Magisk v28.1 Is Known-Bad on This Device

The Kali S10 doc still pins v28.1. On this hardware a v28.1-patched boot image is rejected by the bootloader: after flashing it the phone cycles on Samsung's orange "device is corrupt" warning straight into Download Mode, even with the cable unplugged. Restoring the pristine boot.img recovers it instantly — which isolates the failure to the patched image, not the write. The identical procedure patched with v30.7 boots cleanly.

So v28.1 is not merely "an old pin" any more: it is broken here. If an older tutorial hands you v28.1, stop and use v30.7.

Root here is an image patch, not a recovery flash. The Magisk app patches your build's boot.img on the phone, and you flash the patched result. This is also why boot.img must come from the same build as the ROM you sideloaded. 

# Phone booted into LineageOS, with Developer options + USB debugging on.

# 1) Install the Magisk v30.7 app and stage this build's boot.img
adb install -r Magisk-v30.7.apk
adb push boot.img /sdcard/Download/

# 2) In the Magisk app:
#      Install -> Select and Patch a File -> Download/boot.img -> Let's go
#    It writes magisk_patched-30700_XXXX.img alongside the input file.

# 3) Pull the patched image back
adb pull /sdcard/Download/magisk_patched-30700_XXXX.img .

# 4) Flash it. Use fastbootd — the recovery-level fastboot LineageOS ships.
#    Samsung's own bootloader has no fastboot, but fastbootd does work here:
adb reboot fastboot
fastboot devices                                  # shows "... fastbootd"
fastboot flash boot magisk_patched-30700_XXXX.img # expect "Writing 'boot' ... OKAY"
fastboot reboot

#    Alternative if fastbootd is not detected — Download Mode + samloader:
#    samloader flash -p BOOT magisk_patched-30700_XXXX.img

# 5) Verify root
adb shell 'su -c id'
# uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0

After the reboot, confirm the Magisk app shows an installed version number (not "N/A") before continuing. "N/A" means the running boot image is not carrying Magisk — re-patch with v30.7 and reflash boot. If you got there via fastbootd, try Download Mode with samloader to rule out a slot issue.

Keep the Pristine boot.img — It Is Your Un-Root

Flashing the unpatched boot.img from the same build (samloader flash -p BOOT boot.img, or the fastbootd equivalent) removes Magisk cleanly — there is no un-root procedure to run. Keep boot.img, Magisk-v30.7.apk and the patched image beside your notes.

Legacy Alternative: Sideload Magisk in Recovery

Older guides — including the Kali doc — sideload Magisk from Lineage Recovery. That is not the verified route on this device, and Magisk upstream marks recovery installs deprecated. Use it only if the patch-and-flash path above will not work for you, and still with v30.7, never v28.1.

If the sideload route leaves you booting straight into Download Mode, restore the pristine boot.img and go back to the patch-and-flash path. 

# LEGACY ALTERNATIVE ONLY — not the verified path on this device.

# Recovery expects a .zip, so copy the APK to a .zip first
cp Magisk-v30.7.apk Magisk-v30.7.zip

# Recovery: Apply update -> Apply from ADB, then:
adb -d sideload Magisk-v30.7.zip
#    "Signature verification failed" also appears here — choose Yes.

# Then Recovery -> Reboot -> System, and open the Magisk app to finish setup.

Step 4.3: Install NetHunter as a Magisk Module

With root working, push the NetHunter installer to the phone and install it from inside Magisk — there is no recovery flash for this step.

The Kernel Ships Inside the Installer

HID/BadUSB and external-adapter injection both come from the NetHunter kernel bundled in this installer ZIP — not from the ROM, and not from a separate kernel flash. You do not need to flash a kernel yourself. Built-in Wi-Fi monitor mode is the exception: it needs the optional Nexmon module described in Step 4.4.

What matters is that the channel matches your ROM: LineageOS 23.2 (Android 16) takes the sixteen build (beyond1lte-los-sixteen), while the older fifteen builds pair with LineageOS 22.2. Never mix the two — the installer's kernel modules are built for one specific LineageOS generation.

Formatting data in Section 3.3 cleared /data, which wiped the Developer options and USB debugging you enabled in Step 2.3. They have to be back on before Step 4.2's patch and before this push:

  1. In Android: Settings → About phone → Software information → tap Build number 7 times to re-enable Developer options.
  2. Settings → Developer options → enable USB debugging.
  3. Connect the phone and tap Allow on the RSA prompt on the phone screen.
# From normal Android (root working), push the NetHunter installer:
adb push kali-nethunter-2026.2-beyond1lte-los-sixteen-full.zip /sdcard/Download/

# In the Magisk app:
#   Modules -> Install from storage -> select the NetHunter zip
#   Do not reboot manually while it runs — let it finish and prompt you
#   The first boot afterwards takes 5-15 minutes (Kali chroot extraction)

Step 4.4: Optional — Internal Wi-Fi Monitor Mode (Nexmon)

The S10's built-in Wi-Fi only does monitor mode and injection if you also install the optional Nexmon Magisk module; without it, use a supported external USB adapter (see Post-Install). Match the module to your exact LineageOS and kernel build, then install it the same way you installed NetHunter: 

# From normal Android (root working), push the module — after confirming it
# exists for YOUR NetHunter release (see the callout below):
adb push nexmon-s10.zip /sdcard/Download/

# In the Magisk app:
#   Modules -> Install from storage -> select nexmon-s10.zip
#   Reboot when prompted

This Asset May Simply Not Exist for Your Release

nexmon-s10.zip is only shipped against older NetHunter releases. The newest release that publishes it is nethunter-23.0, and there is no Nexmon asset for a los-sixteen / LineageOS 23.2 build — if you cannot find it in the asset list for your NetHunter release, that is expected, not a broken download. Do not go hunting for a file that was never published, and do not install an older release's module on a newer kernel.

Check the release asset list and the module's own kernel requirement against uname -r on your device before installing; if it does not match your LineageOS 23.2 / Android 16 kernel, skip it and use an external adapter. Built-in Wi-Fi monitor mode is the one feature you lose; HID/BadUSB and external-adapter work are unaffected.

First Boot Takes Time

The first boot after installing the NetHunter module can take 5-15 minutes. The screen may stay black or sit on the logo for a while. Do not force restart — let it complete.

5. First Boot & Configuration

Step 5.1: Initial Android Setup

The phone is already set up from Step 4.2. You should now see NetHunter, NetHunter Store, NetHunter Terminal and Magisk in the app drawer.

Step 5.2: Grant Root Access

  1. Open NetHunter app
  2. A Magisk superuser prompt will appear — tap Grant
  3. The app will initialize and download additional components
  4. Open NetHunter Terminal — grant root when prompted

If the app reports Chroot not found, install it from NetHunter → Kali Chroot Manager (see Troubleshooting).

Step 5.3: Verify Installation

# Open NetHunter Terminal and run:

# 1) Root gate
su -c id
# Should show: uid=0(root)

# 2) Kernel — this must be the NetHunter kernel, not plain LineageOS
su -c uname -r
# Expect the NetHunter kernel — a -nethunter suffix on some builds; the
# verified LineageOS 23.2 build reported 4.14.356-v0lk3n-beyond1lte_los-23.2

# 3) Kernel modules are actually installed (run in the Android shell, not the
#    chroot — the chroot's /lib/modules is usually empty)
su -c ls /system/lib/modules

# 4) Kali chroot
nethunter
cat /etc/os-release
# Should show Kali Linux

# Exit chroot
exit

If uname -r shows neither a -nethunter tag nor a NetHunter build tag (the verified build read 4.14.356-v0lk3n-beyond1lte_los-23.2), or /system/lib/modules is empty, the module did not take — re-install the NetHunter zip from Magisk (Step 4.3) before troubleshooting anything inside Kali.

You are done when: su -c id returns uid=0(root), nethunter drops you into a Kali shell, and the Magisk app shows an installed version. Everything below this point is optional.

6. Post-Install Setup

Update Kali Chroot

# Enter NetHunter chroot
nethunter

# Update package lists and upgrade
apt update && apt full-upgrade -y

# Install additional tools
apt install -y seclists wordlists nmap sqlmap

# Clean up
apt autoremove -y && apt autoclean

# Exit chroot
exit

Configure Kali Services

NetHunter includes a service manager. Open the NetHunter app and navigate to:

SSH Server

Enable to SSH into your phone from another machine. Change default credentials!

Apache + MySQL

Host phishing pages or run local web tools.

VNC Server

Get a full Kali desktop on your phone.

Bluetooth Arsenal

Bluetooth scanning and attacks.

External WiFi Adapter Setup

For packet injection and monitor mode, connect a supported external USB WiFi adapter via OTG: 

# Recommended adapters with NetHunter kernel support:
# - Alfa AWUS036ACH (RTL8812AU)
# - Alfa AWUS036NHA (Atheros AR9271, ATH9K_HTC)
# - Any adapter on RTL88XXAU, RTL88X2BU or RTL8188EUS
# Not supported: RT2800/RT5372 parts (e.g. the Panda PAU05) — the
# NetHunter kernel does not ship that driver.

# Connect adapter via OTG cable, then:
nethunter

# Check interface
ip a
# Should show wlan1 or similar

# Enable monitor mode (using NetHunter app is easier)
airmon-ng check kill
airmon-ng start wlan1

# Verify monitor mode
iwconfig
# Should show wlan1mon in Monitor mode

HID Attacks (Keyboard Emulation)

One of NetHunter's killer features — your phone acts as a USB keyboard to type payloads:

  1. Open NetHunter → HID Attacks
  2. Choose a payload (e.g., PowerShell reverse shell, Windows backdoor)
  3. Connect phone to target Windows PC via USB
  4. Tap Execute — phone types the payload automatically

Authorized Use Only

HID attacks are extremely powerful. Only use on systems you own or have explicit written permission to test.

Troubleshooting

"OEM unlocking" is missing or grayed out

Samsung only exposes the toggle once the phone has been online over Wi-Fi and its system clock is correct — both, not one. Set the clock to automatic, stay on Wi-Fi, and look again. On the verified run, connectivity plus a correct clock was the gate; the widely-quoted waiting period was not what blocked it.

Do not proceed until adb shell getprop sys.oem_unlock_allowed returns 1, and re-check it after the post-unlock reboot. If it stays 0 on a carrier-locked phone, the carrier may have to release the device first.

Unlock prompt never appears while holding Volume Up

You are in the wrong Download Mode. The "press Volume Up to unlock the bootloader" prompt only exists when Download Mode was entered from a full power-off (power off → unplug → hold Volume Down + Bixby → plug in). The screen you reach with adb reboot download looks identical but exposes no unlock option. Power off and repeat the key combo — adb reboot download is still fine for flashing, just not for unlocking.

samloader or Heimdall doesn't see the device

First eliminate transport issues: swap the cable, move to a direct USB port, disconnect hubs, and boot the phone fully back into Download Mode before changing packages. On the verified run, samloader's very first print-pit died on a flaky cable/port — the tool was never the problem. 

# Add udev rules for Samsung Download Mode and Google/fastbootd
sudo tee /etc/udev/rules.d/51-android.rules << 'EOF'
SUBSYSTEM=="usb", ATTR{idVendor}=="04e8", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", MODE="0666", GROUP="plugdev"
EOF

# Reload udev
sudo udevadm control --reload-rules
sudo udevadm trigger

# Reconnect device and try again

Samsung boots back to stock recovery

That usually means Android booted once before you entered Lineage Recovery, so stock restored itself. Re-flash recovery.img + vbmeta.img with samloader (or Heimdall), then boot directly into recovery (Vol Up + Bixby + Power) without letting Android boot in between.

Phone lands in teal Download Mode right after a flash

Get out of it first: force-restart with Volume Down + Power until the screen goes black, then release. If it recurs, work through these in order:

  1. Interrupted ROM install — re-sideload and watch the phone screen for Completed status 0. A ~47% adb stop with no on-screen confirmation is a half-written ROM, not a successful transfer.
  2. Recovery + vbmeta handoff — re-flash both and jump straight into recovery without letting Android boot in between (Section 3.3).
  3. A bad Magisk boot patch — if it started right after rooting, restore the pristine boot.img from your ROM build (samloader flash -p BOOT boot.img) and then use v30.7. This is exactly what a v28.1-patched image does on this device.

Boot loop after flashing

Boot back into Lineage Recovery (Vol Up + Bixby + Power) and:

  1. Go to Factory reset → Format data and confirm
  2. Verify your LineageOS ROM and NetHunter filenames target the same generation (e.g. both LineageOS 23.x)
  3. Re-sideload the LineageOS ROM, then redo root by re-patching boot.img with Magisk v30.7, then re-add the NetHunter module from the Magisk app
  4. If it still fails, do a clean re-flash following the official LineageOS install guide before retrying NetHunter

NetHunter app shows "Chroot not found"

The chroot may not have extracted. Open NetHunter → Kali Chroot Manager and tap Install Kali Chroot. Choose "Full" for all tools or "Minimal" for faster install.

Magisk shows "N/A" or root prompts never appear

"N/A" means the running boot image is not carrying Magisk — the app is installed but the patch is not live. Re-do the patch with v30.7 and reflash boot:

  1. Confirm boot.img came from the same build as the ROM you sideloaded.
  2. Magisk → Install → Select and Patch a File, then flash the new magisk_patched-*.img.
  3. If you flashed via fastbootd, try Download Mode with samloader flash -p BOOT … instead to rule out a slot issue.
  4. Open the NetHunter app and grant the Magisk superuser prompt before troubleshooting NetHunter itself.

USB drops during a flash

Cable first, then port. Drop hubs, docks and front-panel ports and use a clean port directly on the motherboard — on the verified run a marginal connection killed samloader's very first print-pit, which reads like a protocol error and is not. Re-run the command once the link is stable instead of changing tools.

WiFi injection not working

Your device may not have a custom kernel with injection patches. Check the NetHunter downloads page. If not listed, you'll need NetHunter Lite with an external adapter.

What a failed first boot looks like

Healthy First Boot

Boot animation runs for several minutes, then Android setup appears and Magisk plus NetHunter apps are present.

Recovery Loop

Usually points to a bad recovery handoff, storage mount issue, or an incomplete ROM flash.

Samsung Logo Loop

Usually means version mismatch, encryption not cleared, or the wrong flash order. Go back to recovery instead of repeatedly hard rebooting.

Other Devices (Not Your Path)

Use Vendor-Specific Unlock Paths

The overall logic stays the same on other devices, but bootloader unlock, recovery flashing, and anti-rollback behavior vary by vendor. Treat the sections below as direction, not as a substitute for the official recovery and ROM instructions for your exact model.

OnePlus Devices

Excellent NetHunter support. Bootloader unlock is simpler (Settings → Developer Options → OEM Unlock is instant).

  • • Use fastboot instead of Heimdall
  • • 7/8/9 series are A/B devices with no separate recovery partition, so recovery is normally booted from an image rather than flashed; check the device's current NetHunter target first — NetHunter publishes its own Lineage Recovery build for the OnePlus 7, so an older fastboot boot twrp.img recipe may no longer be the supported route
  • • OnePlus 7/8/9 series have full kernel support

Google Pixel

Great development support but limited NetHunter kernel features.

  • • Use fastboot
  • • fastboot flashing unlock
  • • Pixel 6a has a full NetHunter build; check the device list per model rather than assuming — other Pixel generations are often Lite-only or absent

Xiaomi Devices

Bootloader unlock requires Mi Unlock tool and a waiting period (72h-30d).

  • • Apply via Mi Unlock
  • • Some models have excellent kernel support
  • • Check XDA forums for device-specific guides

Snapdragon Samsung

US carrier variants often have locked bootloaders that cannot be unlocked.

  • • SM-G973U and SM-G973U1 are both Snapdragon beyond1q — no LineageOS build and no NetHunter build, so Rootless is the only option
  • • Consider NetHunter Rootless as fallback

Best Devices for NetHunter (2026)

Always confirm current support on the NetHunter device list before buying — support moves.

  • OnePlus 7/7T/8/8T/Nord — Long-standing favorites: easy unlock, full kernel features
  • Samsung Galaxy S10 (Exynos) — This guide's target; solid HID + LineageOS path
  • Google Pixel 6a — Trivial unlock, clean AOSP base, and a full NetHunter build; confirm other Pixel generations on the device list before buying
  • Xiaomi Poco F-series — Budget-friendly with active custom-kernel communities

Quick Reference Card

S10 Boot Key Combos

Download Mode Vol Down + Bixby + USB cable — entered from full power-off for the unlock prompt; adb reboot download for flashing
Recovery (Lineage) Vol Up + Bixby + Power (release when the Lineage Recovery menu appears)
Force Restart Vol Down + Power (hold ~7-10 seconds)
Safe Mode Hold Vol Down during boot logo 
# === NETHUNTER QUICK COMMANDS ===

# Enter Kali chroot
nethunter

# Start Kali chroot with command
nethunter -c "nmap -sV 192.168.1.1"

# Start KeX (VNC desktop)
nethunter kex &

# Check root
su -c id

# WiFi monitor mode (in chroot)
airmon-ng start wlan1

# Packet capture
airodump-ng wlan1mon

# === SAMLOADER (Download Mode) ===
samloader flash -p RECOVERY recovery.img -p VBMETA vbmeta.img
samloader flash -p BOOT boot.img                  # restore pristine boot = un-root
samloader flash -p BOOT magisk_patched-30700_*.img  # root with a v30.7 patch

# === FASTBOOTD (from booted LineageOS) ===
adb reboot fastboot
fastboot devices
fastboot flash boot magisk_patched-30700_*.img
fastboot reboot

# === S10 SIDELOAD (in Lineage Recovery: Apply update -> Apply from ADB) ===
adb -d sideload lineage-23.2-*-beyond1lte-signed.zip

# === HEIMDALL (equivalent writes, if that is your tool) ===
#   heimdall flash --RECOVERY recovery.img --VBMETA vbmeta.img --no-reboot
#   heimdall print-pit  # print partition table

Readiness And Evidence

What this lab must have before you start, and what to capture so the work is repeatable and reportable.

Minimum Viable Setup

  • One owned supported device
  • Verified codename and unlock state
  • Stock firmware or rollback path downloaded first

Evidence To Capture

  • Device model/codename output
  • Hash list for downloaded files
  • Bootloader/recovery detection output
  • First boot and NetHunter app screenshots

Keep It Fresh

Re-check these against the current release before you trust the lab again.

  • LineageOS, recovery, NetHunter ZIP Every flash attempt

    Check upstream device pages immediately before flashing.

  • Helper scripts Every run

    Review URLs, filenames, hashes, and dry-run/download-only behavior.

Setup Anti-Patterns

Habits that turn a useful lab into an unnecessary risk.

  • Flashing from stale forum screenshots
  • Trusting a helper script before auditing URLs and hashes
  • Testing wireless features against unauthorized targets

Operational Safety Baseline

Apply these rules before running any lab command on this page.

  • Work only on systems you own or have explicit authorization to test.
  • Keep vulnerable services off your home LAN and off public interfaces.
  • Take clean snapshots before every exercise and before every vulnerable configuration change.
  • Use dedicated cloud accounts, subscriptions, and projects with billing alerts before deployment.
  • Write down the teardown command before you run the setup command.

Validation Checkpoints

  • -adb and flashing tool detect device
  • -Downloaded files match codename
  • -First boot completes
  • -NetHunter app and chroot launch

Cleanup And Rollback

  • -Keep stock firmware/recovery links
  • -Document Knox/warranty state
  • -Remove unauthorized test profiles

Practice Next

Wireless Security Put the NetHunter build to work on authorized Wi-Fi methodology. Mobile Testing Move into Android and iOS security assessment workflows. Wireless Lab

Related Topics

Kali Linux Setup

Configure your desktop Kali machine

Wireless Security

WiFi attacks and WPA cracking

Physical Security

HID attacks and social engineering

Mobile Testing

Android and iOS security assessment