接着进入到"Wireless LAN"  
勾选以下几个选项：  
"Atheros/Qualcomm devices"  
"Atheros HTC based wireless cards support"  
"Linux Community AR9170 802.11n USB support"  
"Atheros mobile chipsets support"  
"Atheros ath6kl USB support"  
"MediaTek devices"  
"MediaTek MT7601U (USB) support"  
"Ralink devices"  
"Ralink driver support"  
"Realtek devices"  
"Realtek 8187 and 8187B USB support"  
"Realtek rtlwifi family of devices"  
"RTL8723AU/RTL8188[CR]U/RTL819[12]CU (mac80211) support"  
"Include support for untested Realtek 8xxx USB devices (EXPERIMENTAL)"  
"ZyDAS devices"  
"USB ZD1201 based Wireless device support"  
"ZyDAS ZD1211/ZD1211B USB-wireless support"  
"Wireless RNDIS USB support"  

在"Ralink driver support"中勾选以下几个选项：  
"Ralink rt2500 (USB) support"  
"Ralink rt2501/rt73 (USB) support"  
"Ralink rt27xx/rt28xx/rt30xx (USB) support"  
"rt2800usb - Include support for rt33xx devices"  
"rt2800usb - Include support for rt35xx devices (EXPERIMENTAL)"  
"rt2800usb - Include support for rt3573 devices (EXPERIMENTAL)"  
"rt2800usb - Include support for rt53xx devices (EXPERIMENTAL)"  
"rt2800usb - Include support for rt55xx devices (EXPERIMENTAL)"  
"rt2800usb - Include support for unknown (USB) devices"  

在"Realtek rtlwifi family of devices" 中勾选
"Realtek RTL8192CU/RTL8188CU USB Wireless Network Adapter"  
然后返回主菜单

如图所示

进入到"Device Drivers" -> "Multimedia support" 勾选：  
"Digital TV support"  
"Software defined radio support"  
"Media USB Adapters"  

在"Media USB Adapters"中 勾选：  
"Airspy"  
"HackRF"  
"Mirics MSi 2500"  
然后拉到最下面，取消勾选  "Autoselect ancillary drivers (tuners, sensors, i2c, spi, frontends)"  
取消勾选 "I2C Encoders, decoders, sensors and other helper chips" 内所有选项  
取消勾选 "Customize TV tuners" 内除了 "Rafael Micro R820T silicon tuner" 以外所有选项  
在 "Customise DVB Frontends" 内取消勾选除了：  
"Realtek RTL2830 DVB-T"  
"Realtek RTL2832 DVB-T"  
"Realtek RTL2832 SDR"  
以外所有的选项  
然后返回主菜单

如图所示

进入到"Device Drivers" -> "HID support" 勾选：  
"Battery level reporting for HID devices"  
"/dev/hidraw raw HID device support"  
"User-space I/O driver support for HID subsystem"  
"Generic HID driver"  
勾选"Special HID drivers"  "USB HID support"  "HID over I2C transport layer"  内所有选项
然后返回上一级菜单

如图所示

接着进入到"Device Drivers" -> "USB support"  勾选：  
"Support for Host-side USB"  
"OTG support"  
"USB Modem (CDC ACM) support"  
"USB Wireless Device Management support"  
"USB Mass Storage support"  
"USB Serial Converter support"  

在"USB Serial Converter support" 中勾选：  
"USB Serial Console device support"  
"USB Generic Serial Drive"  
"USB Serial Simple Drive"  
"USB Winchiphead CH341 Single Port Serial Driver"  
"USB CP210x family of UART Bridge Controllers"  
"USB FTDI Single Port Serial Driver"  
"USB Prolific 2303 Single Port Serial Driver"  

在"USB Gadget Support"中勾选：  
"USB functions configurable through configfs"  
"Generic serial bulk in/out"  
"Abstract Control Model (CDC ACM)"  
"Object Exchange Model (CDC OBEX)"  
"Network Control Model (CDC NCM)"  
"Ethernet Control Model (CDC ECM)"  
"Ethernet Control Model (CDC ECM) subset"  
"QCRNDIS"  
"RNDIS"  
"RMNET_BAM"  
"Ethernet Emulation Model (EEM)"  
"Mass storage"  
"Function filesystem (FunctionFS)"  
"MTP gadget"  
"PTP gadget"  
"Accessory gadget"  
"Audio Source gadget"  
"Uevent notification of Gadget state"  
"MIDI function"  
"HID function"  
"USB Diag function"  
"USB Serial Character function"  
"USB CCID function"  
"USB QDSS function"  
接着返回主菜单，退出并保存配置

如图所示

保存配置

make ${args} savedefconfig

编译内核

make ${args} 2>&1 | tee kernel.log

编译内核模块

make ${args} INSTALL_MOD_PATH="." INSTALL_MOD_STRIP=1 modules_install

0x07 构建NetHunter-Kernel-Installer内核包

下载Kali官方构建脚本

git clone https://gitlab.com/kalilinux/nethunter/build-scripts/kali-nethunter-project /root/kali-nethunter-project --depth=1

编辑机型列表

mkdir -p /root/kali-nethunter-project/nethunter-installer/devices/  
touch /root/kali-nethunter-project/nethunter-installer/devices/devices.cfg  
vim /root/kali-nethunter-project/nethunter-installer/devices/devices.cfg

按照官方教程，添加以下内容并保存

# Xiaomi Redmi4X for crDroid Android 11  
[santoni]  
author = "DroidKali"  
arch = arm64  
version = "v1.0"  
flasher = anykernel  
modules = 1  
slot_device = 0  
block = /dev/block/bootdevice/by-name/boot  
devicenames = santoni,Redmi4x

创建机型对应的文件夹

mkdir -p /root/kali-nethunter-project/nethunter-installer/devices/eleven/santoni/modules/system/lib/modules

复制所需要的文件

cp out/arch/arm64/boot/Image.gz-dtb /root/kali-nethunter-project/nethunter-installer/devices/eleven/santoni  
rm -rf out/lib/modules/${make kernelversion}-NetHunter/source  
rm -rf out/lib/modules/${make kernelversion}-NetHunter/build  
cp -r out/lib/modules/${make kernelversion}-NetHunter /root/kali-nethunter-project/nethunter-installer/devices/eleven/santoni/modules/system/lib/modules/

生成NetHunter-Kernnel-Installer安装包

cd /root/kali-nethunter-project/nethunter-installer/  
python3 build.py -d santoni --eleven --kernel

0x08 下载ADB-FASTBOOT工具包

wget https://dl.google.com/android/repository/platform-tools-latest-linux.zip
unzip paltform-tools-latest-linux.zip -d /usr/share/
echo '''export PATH="/usr/share/platform-tools:$PATH"''' > /root/.zshrc
source /root/.zshrc
rm -rf platform-tools-latest-linux.zip

0x09 刷入内核安装包

重启到Recovery模式

adb reboot recovery

刷入内核刷机包

adb sideload kernel-nethunter-eleven-santoni-20210905_111235.zip

0x10 相关链接

Kali NetHunter | Kali Linux Documentation

NetHunter gitlab repository

“黑客手机”免费送-知乎专栏

跟我把Kali NetHunter编译至任意手机

Building a Kernel for the Razor Phone 2 – Live feed

Information on Compiling Android Kernels with Clang

[内核向] – 交叉编译器的选择