Thanks to support by PCBWay we're releasing a MOD2 variant that allows for removing the electronics of the Ticwatch from the metal shell and then encasing them in a screw mount printed case. This allows for a reduction in weight, better balancing and also future proofs this projects if you want to adapt the screw mount system to make your own modules. We recommend you print this in PETG, ASA, or perhaps even Nylon. PLA will just break if you're not careful. Mind you this is still experimental at this point and we are also still trying to get headless mode to work reliably.
According to a recent paper by the BSI, the German institute for information security, a drone is a threat if it's able to exploit the following:
• Taking control of wireless devices such as mice, keyboards, smart whiteboards or webcams and
sniffing/manipulating information by using a drone as a relay station.
• Using a drone as WIFI Access Point, collecting requests from mobile devices like smartphones,
searching for known home networks and local networks previously used by the device. With the use
of geolocation services, one could map out a targets office locations creating contact and movement profiles.
• By impersonating a device’s trusted networks, a drone could be used as a fake access point
intercepting and manipulating all the traffic transmitted through it.
Fake Access points and Bluetooth exploits have been tested and they work. However a lot of stuff still runs quite wonky and currently there's no known way to attach a second network adapter to it, so it has to be adapted to very specific use cases. The chipset of the Ticwatch however does seem to support monitor mode but we just haven't been able to utilize it successfully yet.
Advantages Over Directional Antennas:
- Persistence and Low Profile: Remains discreet once deployed, battery of the smart watch will last you a day.
- Accessibility: Reaches areas inaccessible by long-range antennas (e.g., rooftops).
- Remote Access: Can be accessed via LTE.
The hacking drones we have seen are bulky and loud. We want to create a more stealthy yet functional drone.
Objective
The idea is to have a mobile server capable of remotely scanning networks in usually inaccessible areas, while keeping the design simple enough to be reproducible. Though we try to keep things as DIY-friendly as possible, assembling the electronics and installing the custom ROM will be challenging if you're a complete beginner.
Components and Construction
This project uses an AstroRC 2.0'' frame and components as its base. Construction requires soldering skills and experience with assembling FPV drones, as the assembly video is in Mandarin.
Initially, we used a Raspberry Pi Zero W with an LTE module and battery, the first sketch below is the result of that. However, this setup was overly complicated and too heavy for the small, originally used 2-inch propellers.
We discovered the Kali team’s documentation for installing NetHunter on a TicWatch Pro 3 LTE, which was perfect for this purpose. Surprisingly, no other drone platform had implemented this.

The design evolved from a rough sketch to a more balanced design with extended rotor protection, landing feet, and a watch container inspired by lidar. The current design is flat and light, featuring a watch case and rotor protection with opposing landing gear, making it easier to print and assemble.

Parts printed in high quality on an A1 Mini in about 1.20h
The final 3D printing files are straightforward and don't require supports, they are suitable for various filaments with implemented tolerances, we have tried both PETG and PLA but ASA could be an interesting candidate as well, without any of them being too heavy for the drone. We designed the parts using Tinkercad, Fusion360, and ZBrush.

Test Flight of the current design, parts and load is well balanced now, the Nethunter software is still fairly wonky though and we're...