SOLUTION: Kali Linux on Raspberry Pi Zero W with bluetooth and wifi support

Hi all,

I've updated the Re4son-Kernel to support the new Raspberry Pi Zero W with onboard bluetooth and wifi.

There is now one kernel package that provides support for:

Raspberry Pi 1
Raspberry Pi 2
Raspberry Pi 3 with onboard wifi and bluetooth
Raspberry Pi Zero
Raspberry Pi Zero W with onboard wifi and bluetooth

Highlights:

- Based on 4.4.50 kernel sources
- Support for all common TFT screens
- Support for built-in wifi and bluetooth
- Ethernet gadget support
- Nexmon drivers with installation instruction
- Wifi injection patch

The package, installation guide and unofficial kali images with the re4son-kernel already installed are available here:

https://www.whitedome.com.au/re4son/re4son-kernel

Happy hacking,
Re4son

Awesome Thx!

Hey thanks for creating this build. I'm surprised that Kali.org haven't update their Raspberry Kali image to ensure that it will work on Zero.

I would like to configure Zero W using headless setup and is automated to:
1) persistence boot into CLI with an option to start GUI on-demand using startx. This due to laggy GUI.
2) enable SSH at boot
3) enable VNC at boot
4) auto connect by WiFi to a known network at boot
5) enable on-demand remote access to Zero W outside of local network

What do I need to do to achieve all of the above objectives? Thanks!

Best to use the Sticky Fingers image, it allows for all of these out of the box:

1) In Sticky Fingers Kali-Pi, run

Code:

---

/usr/local/src/re4son_kali-pi-tft_kernel_4.*/re4son-pi-tft-setup -b cli

---

2) SSH is enabled by default
3)

Code:

---

sudo wget -O /lib/systemd/system/[email protected] https://github.com/Re4son/vncservice/raw/master/[email protected]
sudo systemctl enable [email protected] && sudo systemctl start [email protected]

---

Note that vnc restricts access to requests from localhost only, you should tunnel your vnc traffic through ssh as described here: https://whitedome.com.au/re4son/topic/vnc/ (and then you might as well just start "vncserver" in the terminal window of your ssh session)
4) disable network-manager, configure /etc/wpa_supplicant.conf and /etc/network/interfaces: https://whitedome.com.au/re4son/re4son-kernel/#Wifi
5) As in a wifi AP?

Wow, thanks. I ordered a Zero yesterday and wondered how that would be done on it.

And the fact that you built in TFT support is, well, awesome. I just picked up an Adafruit one for a Pi 3...

does stickyfingers have Ethernet gadget support out of the box for pi 0 w? tried copying img over to sd card with win32imager and booted but no new network device

It's supported but must be enabled.
After imaging the card, just leave it in your PC and edit the following two files in the /boot partition:

– cmdline.txt: Add “modules-load=dwc2,g_ether” after “rootwait”
– config.txt: Add “dtoverlay=dwc2“

You can also create an empty file called "avahi" in /boot if you would like to enable avahi name service. With that you can ssh into "kali-pi.local".
Otherwise just do a ping sweep over 192.168.137.0/24

Hope that helps.

gotcha wasnt sure if it was automatically on the img
will try to redo the sd card tomorrow to test with an osoyoo lcd


Edit: mounting it I dont see config.txt, i tried creating one and didnt work , also tried copying a default one from raspian that had text already adding text and still not pulling up an IP from DHCP when the rdnis device is up

Good point with the config.txt. Just create a blank one and add that one line.
Windows is a bit moody when it comes to gadgets. I religiously stick to the following order and it's always worked for me:

Disable ICS
Attach gadget
Wait a few minutes
Enable ICS
Wait a few minutes
ping -4 kali-pi.local

If you don't get a reply, just wait a few minutes and ping again.

Hope that helps

Hi, Re4son you wrote you include nexmon driver in new kernel, how i can enable this driver in pi0w on Kali-pi 4.4.50-Re4son+ armv61, because i have many error if i follow your instruction( I think it's because your kernel don't have raspberrypi-kernel-headers

The nexmon drivers that come with the kernel are for the Pi3 only. I'm working on a new release that includes the drivers for the Pi0 as well but that might take a few more days.

Ok, I installed the image today. I did update & upgrade and i have still 1 package on upgradable list:

Code:

---

root@kali:~# apt update
Hit:1 http://kali.koyanet.lv/kali kali-rolling InRelease
Reading package lists... Done
Building dependency tree
Reading state information... Done
1 package can be upgraded. Run 'apt list --upgradable' to see it.
root@kali:~# apt list --upgradable
Listing... Done
bluez/kali-rolling 5.43-2 armel [upgradable from: 5.39-1+rpi1+re4son]
N: There is 1 additional version. Please use the '-a' switch to see it

---

How to upgrade this package? After apt upgrade/dist-upgrade/full-upgrade nothing happens.

PS. Great job Re4son! I'm waiting for new realase.

Thanks for your kind words and don't worry about that message.

The re4son-kernel installs a unique bluez version that I patched especially for the on-board bluetooth chip of the Pi 3 & Pi 0W.
The installer puts the package on hold so that future kali updates can't replace it with a generic debian version.
That's what the message points out.

Bluez 5.39-1 is the latest version I could make to work with the hardware and there doesn't seem to be any reason to go for a later version at this stage anyway.
FYI, the raspbian implementation is based on Bluez 5.23-2 so we are well ahead of them :p

Ok, thanks for explanation.

And how about new version of the image? When you planning to release it?

I've updated both, the 4.4.50 and the 4.9.24 versions of the re4son-kernel. Highlights of this release are:

- Natively compiled, incl. headers for rock solid out of tree driver compilations on your Raspberry Pi
- Nexmon drivers for Raspberry Pi 3 and Raspberry Pi 0W included, fully compiled and ready to use

Hop over the the re4son-kernel page and grab your copy while it's still hot:

https://whitedome.com.au/re4son/re4son-kernel/

Happy hacking

Great news! Thanks!

I get this error:

Code:

---

Jul 27 08:09:54 [localhost] kernel: [  23.625608] brcmfmac: brcmf_add_if: ERROR: netdev:wlan0 already exists
Jul 27 08:09:54 [localhost] kernel: [  23.627517] brcmfmac: brcmf_add_if: ignore IF event
Jul 27 08:09:54 [localhost] kernel: [  23.638264] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready

---

And than my RPI0W hangs and i must reset it...

These messages are normal with the 4.4 kernel and disappear in 4.9.
They can't cause your system to hang though.
Anything else abnormal? Any additional hardware or so?

You are right. I got this error too:

Code:

---

Jan 17 09:36:19 wpa_supplicant[1168]: wlan0: CTRL-EVENT-SCAN-STARTED
Jan 17 09:36:20 wpa_supplicant[1168]: wlan0: WPA: Group rekeying completed with 10:fe:ed:79:85:56 [GTK=CCMP]
Jan 17 09:38:19 wpa_supplicant[1168]: message repeated 119 times: [ wlan0: WPA: Group rekeying completed with xx:xx... [GTK=CCMP]]
Jan 17 09:38:19 wpa_supplicant[1168]: wlan0: CTRL-EVENT-SCAN-STARTED

---

Tho solution was to set WPA/WPA2 Group Key Update Period to 86400 in my wifi router.

I've tried registering at your forums, re4son, but for some reason I've not received a confirmation email. So I figured I'd register here and ask my question.

I'm using the pre-made re4son-kernel image found on your website. Not the sticky-fingers release, because I am not using a TFT screen of any kind. I'm using my television and a Raspberry Pi 3. Everything works great and it really is faster than standard Kali+Nexmon drivers. Great work!

My problem is that after performing the steps found on your website for copying over the Nexmon driver and installing nexutil (found in the nexmon.txt file), I can enable monitor mode exactly once. As soon as I use "nexutil -m0", the card does not enter monitor mode again. Likewise, after a reboot while in monitor mode, the card will not enter monitor mode again. Instead I see the following in my terminal:

Quote:

---

nex_init_netlink: socket error (93: Protocol not supported)
nex_init_netlink: socket error (93: Protocol not supported)
nex_init_netlink: bind error (9: bad file descriptor)
nex_init_netlink: connect error (9: Bad file descriptor)
ERR (__nex_driver_netlink): no valid answer received

---

Thinking I'd just redo the steps, I redid the steps found in the nexmon.txt file and then went here https://github.com/seemoo-lab/nexmon and did the following:

Quote:

---

Find the path of the default driver at reboot: modinfo brcmfmac #the first line should be the full path
Backup the original driver: mv "<PATH TO THE DRIVER>/brcmfmac.ko" "<PATH TO THE DRIVER>/brcmfmac.ko.orig"
Copy the modified driver: cp /home/pi/nexmon/patches/bcm43438/7_45_41_26/nexmon/brcmfmac/brcmfmac.ko "<PATH TO THE DRIVER>/"
Probe all modules and generate new dependency: depmod -a
The new driver should be loaded by default after reboot: reboot
Note: With this setting, you can toggle between Monitor mode and Managed mode with: nexutil -m2 and nexutil -m0
Note: It is possible to connect to an access point using our modified driver and firmware, just set the wireless interface in Managed mode.

---

But it didn't help. I still see the original error. Using the image and Win32DiskImager to remake the image on my 64Gb SD card allows me to use monitor mode exactly once, again. Any clue whats going on?

That's very bizarre. Any hints in your logs?

Here’s what I do without getting any errors:

cd /usr/local/src/re4son-kernel_4.4.50-20170729/nexmon/armhf/
cp /lib/firmware/brcm/brcmfmac43430-sdio.bin /root/.brcmfmac43430-sdio.orig.bin
cp ./brcmfmac.ko /root/
cp ./brcmfmac43430-sdio.bin /lib/firmware/brcm/
cp ./nexutil /usr/bin/
rmmod brcmfmac
insmod /root/brcmfmac.ko
nexutil -m2
nexutil -m0
nexutil -m2
nexutil -m0
nexutil -m2
nexutil -m0

journalctl | grep NEXMON
Aug 02 23:08:03 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Enter
Aug 02 23:08:03 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: 0058454e 20 36
Aug 02 23:08:03 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: calling brcmf_fil_cmd_data_set, cmd: 108
Aug 02 23:08:03 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: WLC_SET_MONITOR = 0
Aug 02 23:08:03 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Exit
Aug 02 23:08:04 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Enter
Aug 02 23:08:04 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: 0058454e 20 36
Aug 02 23:08:09 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Enter
Aug 02 23:08:09 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: 0058454e 20 36
Aug 02 23:08:09 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: calling brcmf_fil_cmd_data_set, cmd: 108
Aug 02 23:08:09 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: WLC_SET_MONITOR = 2
Aug 02 23:08:09 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Exit
Aug 02 23:08:11 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Enter
Aug 02 23:08:11 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: 0058454e 20 36
Aug 02 23:08:11 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: calling brcmf_fil_cmd_data_set, cmd: 108
Aug 02 23:08:11 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: WLC_SET_MONITOR = 0
Aug 02 23:08:58 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Enter
Aug 02 23:08:58 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: 0058454e 20 36
Aug 02 23:08:58 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: calling brcmf_fil_cmd_data_set, cmd: 108
Aug 02 23:08:58 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: WLC_SET_MONITOR = 2
Aug 02 23:08:58 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Exit
Aug 02 23:09:01 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: Enter
Aug 02 23:09:01 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: 0058454e 20 36
Aug 02 23:09:01 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: calling brcmf_fil_cmd_data_set, cmd: 108
Aug 02 23:09:01 kali kernel: brcmfmac: nexmon_nl_ioctl_handler: NEXMON: nexmon_nl_ioctl_handler: WLC_SET_MONITOR = 0

Logs look identical to yours, actually. I got to messing with Kali and broke some stuff, so I decided to rebuild using Kali as a base, then installing re4son-kernel/headers/nexmon separately. It at least lets me exit monitor mode and re-enter it, but I haven't rebooted yet to see if it survives. Will edit this post if it does.

Edit: it now survives a reboot, but I need to manually load the nexmon driver each time. This is perfectly fine and can be accomplished automatically. Thank you re4son for helping me troubleshoot!

Hi everyone.

How to disable all power saving settings in this OS? I disabled wlan0 power managegement but it seems my RPI0W still goes in sleep mode or something because after night there is no connection (wifi). Sometimes when i ping it for about 5 mins it's wake up but sometimes not...

Hi,

I tired to enable ethernet gadget but i have no config.txt file! Please help...

That's ok, just create it.
Make sure you "mount /boot" first though.

Hi...i am a new user here. As per my knowledge mounting it I dont see config.txt, i tried creating one and didnt work , also tried copying a default one from raspian that had text already adding text and still not pulling up an IP from DHCP when the rdnis device is up.

I can confirm the above: I can recive ping from 192.168.137.1 but nothing else.

Sorry for not getting back to you earlier - I was away on holiday.
Let me look into that. Are you running Sticky Fingers on the Pi and Windows 10 on your PC?

Hi,

I have newest unofficial Kali Linux 2017.1 image with Re4son Kernel, and Windows 10 but I tried also on Windows 7. On 4.4.50 was ok.

Odd, I can't reproduce the issue. It's all working fine when I do it.
Can you please try the latest unofficial 2017.2 release?

Did you enable ICS on the adapter that has the Internet access?

Hello Re4son,
I tried your kali-2017.2-rpi3-re4son.img on a rpi3, but the monitor mode is not working

root@kali:~# uname -r
4.9.41-Re4son-v7+
root@kali:~# airmon-ng start wlan0

Found 3 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to run 'airmon-ng check kill'

PID Name
289 NetworkManager
322 wpa_supplicant
337 dhclient

PHY Interface Driver Chipset

phy0 wlan0 brcmfmac Broadcom 43430


ERROR adding monitor mode interface: command failed: Operation not supported (-95)

also tried to kill those services, but it wouldn't work

Hi mickeyi,

airmon-ng won't work with the broadcom chip; use the nexutil instead.
To enable monitor mode:

Code:

---

nexutil -m2

---

To disable it:

Code:

---

nexutil -m0

---

Hope that helps,
Re4son

The version from Aircrack-ng subversion repository should. Let me know if it doesn't and I'll fix it.

Thanks Mister_X,
that version works like a charm

It works. Thanks :)
You're great!