This is a full walkthrough for getting Kali NetHunter running on a OnePlus Nord (avicii) from a completely stock or bricked state. The process involves restoring to OxygenOS 10 with the MSM tool, upgrading to OOS 11, unlocking the bootloader, flashing TWRP, installing a custom kernel, rooting with Magisk, and finally installing the NetHunter image. It's a long road but at the end of it you'll have a fully functional mobile penetration testing platform in your pocket.
This guide assumes you're working with a OnePlus Nord (codename: avicii). Do not follow this for other devices as the images and recovery files are device-specific and will brick your phone.
Step 1: Restore to OxygenOS 10 with MSM Tool
First, restore your OnePlus Nord to a clean OxygenOS 10 installation using the Qualcomm MSM Download Tool. This is the same process used to unbrick a hard-bricked device. You'll need a Windows machine for this as the MSM tool is Windows-only.
Follow the full MSM unbrick guide here: TheCustomDroid OnePlus Nord Unbrick Guide
Once the flash completes, boot the phone and go through the initial Android setup. You don't need to sign into anything or configure much since we'll be wiping the device again later.
Step 2: Update to OxygenOS 11
From the freshly installed OOS 10, navigate to Settings > System > System Updates and update the phone to OxygenOS 11. This is important because the NetHunter kernel and image we'll be using later are built specifically for OOS 11. Once the update completes and the phone reboots, go through the setup process again.
Step 3: Install ADB and Fastboot
You'll need Android Debug Bridge (ADB) and Fastboot installed on your computer. These are command-line tools that let you communicate with your phone from a terminal.
Linux (Debian/Ubuntu):
sudo apt install android-tools-adb android-tools-fastbootLinux (Arch):
sudo pacman -S android-toolsmacOS (with Homebrew):
brew install android-platform-toolsWindows:
Download the Android SDK Platform Tools from Google and extract the zip. Run commands from that directory or add it to your PATH.
Step 4: Enable Developer Options and USB Debugging
On the phone, go to Settings > About Phone and tap Build Number seven times until it tells you that you are now a developer. Then go to Settings > System > Developer Options and enable both USB Debugging and OEM Unlocking.
Connect your phone to your computer via USB. A popup will appear on the phone asking you to allow USB debugging from this computer. Tap Allow and check the box to always allow from this computer.
Step 5: Unlock the Bootloader
With the phone connected and USB debugging authorised, run the following from a terminal:
adb devices
adb reboot fastboot
fastboot oem unlockOn the phone, you'll see a screen asking you to confirm the bootloader unlock. Use the volume keys to select "Unlock the bootloader" and press the power button to confirm. The phone will be completely wiped. Once it reboots, go through the Android setup one more time.
Step 6: Download TWRP
Download the TWRP image for the OnePlus Nord (avicii):
You'll also need the installer zip (not the .img) for permanently installing TWRP later:
twrp-installer-3.7.1_12-0-avicii.zip
Step 7: Boot into TWRP
From the same directory where you downloaded the TWRP image, run:
adb reboot fastboot
fastboot boot twrp-3.7.1_12-0-avicii.imgThis temporarily boots the phone into TWRP without permanently installing it yet. You should see the TWRP recovery screen appear on the phone.
Step 8: Permanently Install TWRP
Now you need to permanently install TWRP so it persists across reboots. Copy twrp-installer-3.7.1_12-0-avicii.zip (the zip, not the img) to the device via USB file storage. In TWRP, tap the Install button in the top left, navigate to where you copied the zip, select it and swipe to flash. When it's done, wipe the Dalvik cache when prompted.
Step 9: Flash the NetHunter Kernel
Download the custom NetHunter kernel for the OnePlus Nord on OOS 11:
kernel-nethunter-20260214_224826-oneplus-nord-oos-eleven.zip
You have two options for flashing it:
Option A: Copy the zip to the device via USB file storage, then use TWRP's Install option to flash it (same as you did with the TWRP installer).
Option B: In TWRP, go to Advanced > ADB Sideload, then from your computer run:
adb sideload kernel-nethunter-20260214_224826-oneplus-nord-oos-eleven.zipStep 10: Install Magisk 27
Download the Magisk v27.0 APK from the official release page:
Once you have the APK, make a copy of it and change the file extension from .apk to .zip. Then sideload it through TWRP using ADB:
adb sideload Magisk-v27.0.zipStep 11: Verify Magisk Installation
Boot back into OxygenOS. Magisk should already be installed and visible in your app drawer. If it isn't, install it manually via ADB:
adb install Magisk-v27.0.apkOpen the Magisk app and verify that it shows Installed: 27.0 and Ramdisk: Yes. Don't worry about the Zygisk status, it isn't needed for NetHunter.
Step 12: Download the NetHunter Image
This is the critical step. You need this exact version of the NetHunter image. It was weirdly buried on the Kali download servers but this is the one that works:
nethunter-2024.2-oneplus_nord-eleven-kalifs-full.zip
WARNING: Do NOT install the version 16 (2024.1/16.x) NetHunter image. It will brick your phone and you will need to recover with the MSM tool all over again. Use only the 2024.2 version linked above.
Step 13: Install NetHunter via Magisk
This is where it all comes together. Install the NetHunter image through Magisk's module installer, NOT through TWRP.
Copy the NetHunter zip to the device via USB. Then open the Magisk app, go to the Modules tab, tap "Install from storage", and select the NetHunter zip you copied over. The installation will take a long time as it's a large image with the full Kali filesystem. Be patient and do not interrupt it.
Once the installation completes, reboot the phone.
You're a NetHunter
After the reboot, you should have Kali NetHunter installed alongside OxygenOS. Open the NetHunter app and run any available updates from the NetHunter Store to make sure everything is current.
Congratulations, you now have a full mobile penetration testing platform. Go forth responsibly.
> End of output.