TESTED — Working v1.0 Release

NetHunter Kernel
Redmi 3S / Land

A custom Linux kernel built on the LineageOS android_kernel_xiaomi_msm8937 tree, patched with Kali NetHunter capabilities. It unlocks penetration testing tools that require kernel-level access — things like Wi-Fi monitor mode, raw packet injection, BadUSB (HID) attacks, and deep networking features — all running natively on your Snapdragon 425 / MSM8917 device.

Device Xiaomi Redmi 3S / Land
SoC Qualcomm MSM8917
Base ROM LineageOS 23.2 (Android 16)
Kernel Build Redmi3S-Kernel-v1.0
Release Tag v1.0
Author ShorterKing
SHA-256 Checksum — verify before flashing
1bbeeff49c10d74f00b26ab015991ef76f74aef226d7f5517fba589cab23ae62
Redmi3S-Kernel-v1.zip
Verify: sha256sum Redmi3S-Kernel-v1.zip

Changelog

Release history for the NetHunter Kernel — newest first.

v1.1 LATEST 2026-04
✦ Added
RTL88xx drivers as signed .ko loadable modules
gspca_main.ko — USB webcam / V4L2 capture
TCP BBR as default congestion control
schedutil CPU governor
INIT_STACK_ALL_ZERO hardening
Module signing upgraded to sha512
⚑ Fixed
Kernel panic on hot-unplug of USB Wi-Fi via OTG
✕ Removed
NFS v3/v4 and CIFS/SMB
PN544 NFC (PN533 USB still present)
EEM USB gadget (replaced by NCM)
v1.0 STABLE 2026-04
✦ Added
Initial release — monitor mode + injection, USB HID gadget (BadUSB), WireGuard, full nftables/iptables, NFC (PN544 + PN533), NFS/CIFS/SMB, wide USB Wi-Fi adapter support.

Kernel Features

This kernel extends LineageOS with capabilities that are impossible without kernel-level patches. Each feature requires specific driver support or config flags compiled directly into the kernel image.

📡

Wi-Fi Monitor Mode & Injection

Drivers for USB Wi-Fi adapters are compiled with cfg80211 monitor mode and raw packet injection enabled. This lets tools like aircrack-ng, kismet, and reaver capture and inject 802.11 frames — essential for wireless auditing.

🦷

Bluetooth Full Stack

Full HCI UART, BCM, Realtek USB BT adapters, RFCOMM, BNEP, BR/EDR and BLE compiled in. Virtual HCI support (HCIVHCI) lets tools like bluez and hcitool run stably alongside the on-board WCNSS chip.

HID Attacks (BadUSB)

The USB gadget stack includes the HID function, letting the phone present itself to a target computer as a keyboard or mouse. NetHunter uses this to deliver DuckyScript-style payloads at hardware speed — no driver installation needed on the victim machine.

🌐

Advanced Networking Stack

VXLAN overlays, full TUN/TAP, WireGuard VPN, PPP/PPTP/L2TP tunnels, RNDIS/NCM USB tethering, nftables + full iptables, BATMAN-ADV mesh, NFC, CAN bus, and IEEE 802.15.4 (ZigBee) are all compiled in for complex network pivoting scenarios.

Supported USB Wi-Fi Adapters

These driver modules are compiled into the kernel. Plug in a compatible USB adapter via OTG and it should be recognized automatically. Requires the Wireless Firmware Magisk module to be installed for external adapters to function correctly.

Realtek RTL8187 — full monitor mode + injection (top recommendation)
Realtek RTL8812AU / RTL8821AU / RTL8814AU — AC adapters, injection supported
Atheros AR9271 / ATH9K_HTC / CARL9170 — reliable injection, well-supported by aircrack-ng
Ralink RT2800USB family (RT2870 / RT3070 / RT33XX / RT35XX / RT53XX / RT55XX) — injection confirmed
Realtek RTL8192CU / RTL8XXXU — injection supported
MediaTek MT7601U — basic monitor mode, injection hit-or-miss
Atheros ATH6KL / ATH6KL_USB — driver present
ZyDAS ZD1211RW, USB ZD1201 — legacy chipsets, driver present
USB RNDIS WLAN — generic RNDIS wireless adapter support

Injection confirmed    Driver present, injection may vary

Kernel Config Highlights

Notable CONFIG_* flags enabled — hover a tag to see what it does.

WireGuard VPN USB ACM / Serial VXLAN / TUN / VETH CAN bus (RAW + BCM + VCAN) IEEE 802.15.4 NFC Full Stack F2FS / EXT4 / EROFS / XFS / NTFS / exFAT ECRYPTFS USB RNDIS / NCM / ECM gadget NFS v3/v4 + CIFS/SMB PPP / PPTP / L2TP (v2+v3) SELinux enforcing ZRAM + ZSWAP + writeback USB HID gadget Module signing (SHA-256, forced) RANDOMIZE_BASE (KASLR) FORTIFY_SOURCE + HARDENED_USERCOPY STACKPROTECTOR_STRONG RTL-SDR + DVB-USB BATMAN-ADV + MAC80211_MESH nftables + NFT_NAT / MASQ / LOG Full Linux Namespaces cgroups full stack

Installation Guide

Follow all four phases in order. Read every step before you start. If anything is unclear, stop and research before proceeding — partial flashes can be harder to recover from than no flash at all.

🔓
Prerequisites

Your bootloader must already be unlocked. If not, complete Xiaomi's official bootloader unlock process first (requires Mi account + waiting period). You also need a PC with ADB & Fastboot installed and a good USB-A to Micro-USB cable.

Phase 01 / 04
Install LineageOS 23.2
  1. 1
    Download LineageOS for Mi8937 Get the latest nightly — lineage-23.2-20260414-nightly-Mi8937-signed.zip — from download.lineageos.org. Verify the SHA256 checksum listed on that page before proceeding.
  2. 2
    Flash TWRP Recovery via Fastboot Download the TWRP image for Redmi 3S / Land from twrp.me. Boot your device into fastboot mode (Power + Vol Down from off) then run:
    fastboot flash recovery twrp-x.x.x-land.img
  3. 3
    Reboot into TWRP While in fastboot mode, use Volume keys to navigate to Recovery and press Power to select it. TWRP should launch.
  4. 4
    Wipe partitions In TWRP go to Wipe → Advanced Wipe and select: Data, Cache, System, Vendor. If migrating from another ROM also wipe Internal Storage (this erases all personal files).
  5. 5
    Flash LineageOS Tap Install → navigate to the LineageOS zip → swipe the confirmation bar to flash.
  6. 6
    ⚠ Do NOT reboot yet — stay in TWRP Rebooting now would boot the stock LineageOS kernel. Proceed to Phase 2 first.
Phase 02 / 04
Back Up the Boot Partition
💾
Why this matters

The boot partition holds the kernel and ramdisk. If the NetHunter kernel causes a bootloop you can restore only this partition — your LineageOS install stays intact. Without this backup, recovery is significantly harder. Do not skip.

  1. 1
    TWRP Backup → Boot partition only In TWRP tap Backup, tick only the Boot checkbox, then swipe to create the backup. TWRP saves it under /sdcard/TWRP/BACKUPS/<serial>/.
  2. 2
    Pull the backup to your PC
    adb pull /sdcard/TWRP/BACKUPS/ ./twrp-boot-backup
    Keep this folder somewhere safe on your PC — not just on the phone's internal storage.
Phase 03 / 04
Flash the NetHunter Kernel
Remember

This kernel is untested. If your device bootloops after flashing, follow the recovery steps below immediately — don't panic. The process is reversible as long as you took the boot backup in Phase 2.

  1. 1
    Verify the downloaded zip Before flashing, confirm the SHA256 checksum matches exactly:
    sha256sum Redmi3S-Kernel-v1.zip
    Expected: 1bbeeff49c10d74f00b26ab015991ef76f74aef226d7f5517fba589cab23ae62
  2. 2
    Push zip to the device (if not already there)
    adb push Redmi3S-Kernel-v1.zip /sdcard/
  3. 3
    Flash via TWRP Tap Install → navigate to Redmi3S-Kernel-v1.zip → swipe to flash. The kernel replaces only the boot partition, not the system.
  4. 4
    Reboot to System If the device boots into LineageOS the kernel loaded successfully. The first boot may take an extra 30–60 seconds — wait before assuming a bootloop.
Phase 04 / 04
Root, Firmware & NetHunter App
🔑
Root & Firmware Required

Root access via Magisk is required for NetHunter to function. The Wireless Firmware Magisk module provides the firmware blobs that external USB Wi-Fi adapters need to operate correctly — without it, many adapters will fail to initialize even though the kernel driver is present.

  1. 1
    Install Magisk for Root Download the latest Magisk APK from github.com/topjohnwu/Magisk. Reboot to TWRP, flash the Magisk zip, then reboot to system. Open the Magisk app and complete any setup it prompts.
  2. 2
    Install Wireless Firmware via Magisk In the Magisk app go to Modules → Search and find Wireless Firmware. Install it and reboot. This installs the firmware files needed by USB Wi-Fi adapters for monitor mode and injection to work properly.
  3. 3
    Install the NetHunter App Download the NetHunter APK (full or lite) from kali.org and sideload it:
    adb install NetHunter.apk
    Grant root permission when prompted, then explore the NetHunter dashboard.

If Something Goes Wrong

Don't panic — almost every situation is recoverable with the steps below.

  1. !
    Bootloop after flashing Hold Power + Vol Down at boot to enter TWRP. Go to Restore → select your boot backup → restore Boot partition only → reboot. Your LineageOS data is untouched.
  2. !
    Can't enter TWRP (fastboot only) Boot to fastboot (Power + Vol Down from off), then temporarily boot TWRP without flashing it:
    fastboot boot twrp-x.x.x-land.img
    Then restore the boot backup from within TWRP as above.
  3. !!
    Total brick (no fastboot, no recovery) Enter EDL (Emergency Download) mode — typically Power + Vol Down when the device is completely off and unresponsive to normal combos. Use QFIL or MiFlash with the stock MSM8917 firmware to restore. This requires a Qualcomm EDL/9008 cable (or the right USB driver) and the Mi8917 full ROM from Xiaomi. Worst case scenario, but fully recoverable.

Community & Feedback

The author built this kernel without a test device — your real-world feedback is what makes the project better. A high star count also signals stability to the Kali NetHunter team, which could lead to an official listing.

If it works for you

Please star the GitHub repository. Then open an Issue reporting: whether it booted, which USB adapters worked, which NetHunter tools you tested, and any bugs. Every data point helps build a stable v2 release and helps other Redmi 3S / Land users decide whether to flash.