Kali NetHunter is an Android-based mobile penetration-testing platform, and the Redmi Note 5 — known as whyred in custom ROM work — can be made to run it. This is not a one-click install. The path runs through Xiaomi bootloader unlock, a developer ROM, root access, TWRP, Magisk, a ROM that can finish Android setup, and then the NetHunter package and kernel.
Before flashing
- Apply for Xiaomi bootloader unlock.
- Download the global Fastboot and Recovery ROM for
whyred. - Download MiFlash, Xiaomi's official flashing tool.
Developer ROM and root
- Flash the developer ROM with MiFlash.
- In Settings, search for root and enable root permission.
- On the phone, download the TWRP app and the Magisk app.
TWRP and Magisk
Search for whyred on twrp.me and in TeamWin/android_device_xiaomi_whyred. Get Magisk from topjohnwu/Magisk.
There are two routes for TWRP: use the TWRP app's automatic install, or have Magisk flash TWRP. Before that, set up ADB with Android SDK Platform Tools and the universal ADB driver. The TWRP image used here is twrp-3.7.0_9-0-whyred.img.
Use Magisk to patch the boot.img from the Fastboot ROM. The patched image is the one referred to as magiskboot.img in the commands below.
adb reboot bootloader
fastboot flash boot magiskboot.img
fastboot flash recovery twrp.img
fastboot reboot
Once the phone is back up, power it off and hold power plus volume-up to enter Recovery.
NetHunter packages
Download the NetHunter universal package from the nethunter-images/current/ directory. The matching kernel is Release Team420 Nethunter RAD x5.4 EAS Whyred v3.4 from Team-420/Nethunter-Whyred-Eas.
Use the universal NetHunter package with that whyred kernel. The package notes are thin, so it is worth checking each flash result rather than trusting a success message. Keep the hardware-key caveat in mind too: Recovery entry normally depends on the power plus volume-up combination, so unreliable buttons need attention before you count on that combo.
Problems you may hit
The rootfs package says success but does not take
The rootfs flash can report success while actually failing. In this case the cause was that the Android setup wizard had not been completed. Finish the wizard first.
No official LineageOS package found
If the official LineageOS package cannot be found, flash MoKee first and complete its setup wizard. MoKee Open Source Project files are available from SourceForge.
Not enough memory for the full kalifs package
Flashing the full kalifs package failed with an insufficient-memory message. The mini version flashed successfully.
Permission errors in the Kali apps
The Kali apps installed by the package still report insufficient permissions even after all permissions are granted. A likely reason is that the universal package does not match this device cleanly; this needs further investigation.
The working order that emerged was: unlock the bootloader; flash the developer ROM and enable root; install TWRP and Magisk; flash MoKee and complete setup; flash the NetHunter universal package and kernel; install the NetHunter apps and configure permissions. The fiddly parts are setup-wizard completion, rootfs size, and permission handling.