It is finally here! The Hijacker v1.7 is now available for the TicWatch Pro 3 (all variants that uses bcm43436b0 firmware).
Absolutely huge huge thanks to Jakob Link from Secure Mobile Networking Lab with the help of porting Nexmon. 3 years, hundreds of emails. Amazing collaboration 
Also big thanks to Chris Kyriakopoulos creating Hijacker. It was possibe for me to port thanks to his coding style.
And thank YOU for being patient waiting to this day!
Downloads
Hijacker app
Nexmon files
Instructions
Confirm your watch uses the supported chip and firmware in adb shell:
dmesg | grep fw_bcm43436b0
If there are no results, your chip is bcm43438a1. You have to be patient again until I patch that firmware too.
If you see results of bcm43436b0, continue.
Unzip to nexmon local dir and copy the files to watch with adb:
mkdir nexmon
unzip nexmon-twp3.zip -d nexmon
adb push nexmon /sdcard
adb shell
su
Copy and paste from here:
mount -o rw,remount /vendor
mount -o rw,remount /
cp /sdcard/nexmon/nexutil /system/bin/nexutil
cp /sdcard/nexmon/iw* /system/bin/
cp /sdcard/nexmon/air* /system/bin/
cp /sdcard/nexmon/libfakeioctl.so /system/lib/
chmod a+x /system/bin/iw*
chmod a+x /system/bin/air*
chmod a+x /system/bin/nexutil
cp /sdcard/nexmon/fw_bcm43436b0.bin /vendor/firmware/
ifconfig wlan0 down
ifconfig wlan0 up
Install Hijacker through adb:
adb install Hijacker-release-v1.7.apk
I disabled a few items to fit watch screen. Injection and airodump-ng simultaneously is still experimental. You may need to press Capture a few times to catch a handshake. Probably the best would be to compile the latest aircrack binaries for Android which I couldn’t figure out yet.
