NetHunter kernel rebuild for the Samsung Galaxy S10e (beyond0lte)

Rebuild of V0lk3n's Kali NetHunter kernel for the Samsung Galaxy S10e with the USB gadget configfs functions (HID, mass storage, serial, ECM) actually enabled, plus the userspace glue (Magisk modules) needed to make HID attacks work end-to-end on Samsung Exynos.

The shipped Kali NetHunter prebuilt for this device advertises HID-4 but does not actually have it: the binary was built against the stock LineageOS defconfig instead of the NetHunter one. This project root-causes that, produces a corrected build, and drafts the upstream fixes.

Based on

Component	Pinned version
Device	Samsung Galaxy S10e - codename beyond0lte - model SM-G970F - SoC Exynos 9820
Kernel source	V0lk3n/nethunter_kernel_samsung_exynos9820
Branch / commit	nethunter-lineage-23.2 @ de028ddb4 ("Update README to los 23.2")
Kernel version	Linux 4.14 (4.14.356)
Defconfig	nethunter_beyond0lte_defconfig (the NetHunter defconfig, not the stock LOS one)
LOCALVERSION	-v0lk3n-beyond0lte_los-23.2-NOX (the -NOX suffix marks this build)
ROM	LineageOS 23.2 (Android 16, Kali NetHunter channel sixteen)
NetHunter app	source build of v2026.1 (the mass_storage.gs6 Mount Image typo is fixed upstream in 2026.2-dev)
Toolchain	Google Clang 10.0.4 + Linaro aarch64/armhf 5.5 (fetched by the builder)

What works (achieved target: T2)

• HID - DuckHunter keyboard payloads type onto the USB host; HID mouse (/dev/hidg1) moves and clicks. Requires USB Arsenal set to rndis,hid,mass_storage (plain hid is reverted by Samsung's USB gadget HAL - see STATUS.md for the full root cause).
• Mass storage / serial / ECM - enabled in the defconfig and exercised.
• Module persistence - the nox_modules / unified nox_nethunter_s10e Magisk modules overlay the out-of-tree drivers under /system/lib/modules/<uname>/ and wrap modprobe so plain modprobe 8188eu and hotplug auto-load both work on Samsung's /system-only layout.
• HID node creation - the nox_hidg_bridge Magisk module creates /dev/hidg* at boot, since Samsung's ueventd ships no rule for it.

See STATUS.md for the full engineering log, including the NetHunter app mass_storage.gs6 Mount Image typo trace and the Magisk-as-IPC privilege-path analysis.

Repository layout

Path	Contents
phase0-recon/	Recon of V0lk3n's repo and the Kali NetHunter build ecosystem; findings.md is the headline (the wrong-defconfig discovery). The vendored kernel tree is gitignored - clone it from source.
phase1-env/	Non-interactive build wrapper (run_build.sh).
phase4-flash/	Flash/test scripts and Custom Command bodies that bypass the broken UI flows.
phase5-debug/	The Magisk module source trees (scripts + props). Heavy vendored driver blobs are not duplicated here - they ship inside the packaged zips in artifacts/.
patches/	AnyKernel3 config, kernel Makefile IKCONFIG revert, Realtek clang-compat Makefile patches, and the local.config.beyond0lte build recipe.
designs/	userspace-io-mediator.md - a design proposal for NT-style per-write arbitration on contested Android kernel surfaces (configfs gadget contention).
upstream/	Ready-to-file contributions back to V0lk3n's kernel, the Kali NetHunter app, and the installer, each with rationale and (where applicable) a patch.
artifacts/	The AnyKernel3 installer zip and the Magisk module zips.
SCOPE.md	Definition of done (tiers T1-T3), on-device test matrix, recovery procedure.
STATUS.md	Full session-by-session engineering log.

Building

The build is driven by V0lk3n's submoduled kali-nethunter-kernel-builder. In short:

1. Clone the kernel source (recursively) at the pinned branch into phase0-recon/kernel/.
2. Stage patches/nh_files/local.config.beyond0lte as the builder's local.config (this sets CONFIG=nethunter_beyond0lte_defconfig explicitly - the missing piece that causes Kali's prebuilt to lack HID).
3. Apply the patches in patches/ (IKCONFIG revert, Realtek clang-compat).
4. Run phase1-env/run_build.sh. Output Image.gz-dtb lands under phase0-recon/kernel/out/.
5. Pack with the AnyKernel3 config in patches/anykernel3/ and flash via Heimdall (Samsung Download mode), or use a prebuilt zip from artifacts/.

Recovery is fast and non-destructive: kernel-only AnyKernel3 flashes touch only the boot partition, and a known-good Magisk-patched boot image restores in ~90s via Heimdall. See SCOPE.md for the full risk/recovery matrix.

Credits and licensing

• Kernel source: V0lk3n (GPLv2).
• Build infrastructure and app: Kali NetHunter.
• This work is derived from GPLv2 kernel sources, so it is released under the GNU General Public License v2 - see LICENSE. The same terms apply to the kernel-derived artifacts here (the Image and .ko modules).

Magisk modules in artifacts/ are signed under the NoxIndustries identity.

Built for security research and HID/USB-gadget experimentation on a personally owned device. Flashing custom kernels can brick a phone and voids warranties - proceed at your own risk.