Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
nexmon — The C-based Firmware Patching Framework for Broadcom/Cypress WiFi Chips that enables Monitor Mode, Frame Injection and much more | Kitploit
Tools/GitHubGitHub/seemoo-lab/nexmon
Embedded Systems SecurityPacket Sniffing & AnalysisWi-Fi AuditingReverse EngineeringInformation GatheringWireless SecurityHardware HackingHardware & IoT SecurityFirmware Analysis
GitHubseemoo-lab/nexmon

nexmon

The C-based Firmware Patching Framework for Broadcom/Cypress WiFi Chips that enables Monitor Mode, Frame Injection and much more

2.9k505615 days agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository

NexMon logo

What is nexmon?

Nexmon is our C-based firmware patching framework for Broadcom/Cypress WiFi chips that enables you to write your own firmware patches, for example, to enable monitor mode with radiotap headers and frame injection.

Below, you find an overview what is possible with nexmon. This repository mainly focuses on enabling monitor mode and frame injection on many chips. If you want additional features, the following projects might be interesting for you:

  • http://nexmon.org/jammer: A real Wi-Fi jammer that allows to overlay ongoing frame transmissions with an arbitrary jamming signal.
    • It uses the Wi-Fi chip as a Software-defined Radio to generate jamming signals
    • It allows using non-standard channels such as 80 MHz bandwidth in the 2.4 GHz bands
    • It allows to set arbitrary transmission powers
    • It allows patching the D11 core's real-time MAC implementation
  • http://nexmon.org/csi: Channel State Information extractor for various Wi-Fi chips
    • It allows to extract CSI of up to 4x4 MIMO transmissions at 80 MHz bandwidth
  • http://nexmon.org/debugger: Debugging ARM microcontrollers without JTAG access
    • It allows low-level access to debugging registers to set breakpoints and watchpoints and allows single stepping
  • http://nexmon.org/covert_channel: Covert Channel that hides information in Wi-Fi signals
    • More advanced Software-defined Radio capabilities than the jammer
    • Example application for channel state information extraction
  • http://nexmon.org/sdr: Use your Wi-Fi chip as Software-defined Radio
    • Currently only transmissions are working in both 2.4 and 5 GHz Wi-Fi bands

NexMon logo

WARNING

Our software may damage your hardware and may void your hardware’s warranty! You use our tools at your own risk and responsibility! If you don't like these terms, don't use nexmon!

Supported Devices

The following devices are currently supported by our nexmon firmware patch.

WiFi ChipFirmware VersionUsed inOperating SystemMRTIFPUCCT
bcm43305_90_100_41_staSamsung Galaxy S2Cyanogenmod 13.0XXXXO
bcm4335b06.30.171.1_staSamsung Galaxy S4LineageOS 14.1XXXXO
bcm43396_37_34_43Nexus 5Android 6 StockXXXXXO
bcm43430a117_45_41_26      Raspberry Pi 3 and Zero WRaspbian 8          XXXXXO
bcm43430a117_45_41_46      Raspberry Pi 3 and Zero WRaspbian Stretch    XXXXXO
bcm43439a077_95_49 (2271bb6 CY)Raspberry Pi Pico WPico SDK  XXXX
bcm43451b17_63_43_0iPhone 6iOS 10.1.1 (14B100)XX
bcm434557_45_77_0_hwHuawei P9Android 7 StockXXXXX
bcm434557_120_5_1_sta_C0Galaxy J7 2017?XX
bcm434557_45_77_0_hw(8-2017)Huawei P9Android 7 StockXXXXX
bcm4345557_46_77_11_hwHuawei P9Android 8 China StockXXXXX
bcm434557_45_59_16Sony Xperia Z5 CompactLineageOS 14.1XXXXX
bcm43455c07_45_154Raspberry Pi B3+/B4Raspbian Kernel 4.9/14/19XXXX
bcm43455c07_45_189Raspberry Pi B3+/B4Raspbian Kernel 4.14/19, 5.4XXXX
bcm43455c07_45_206Raspberry Pi B3+/B4Raspberry Pi OS Kernel 5.4XXXXX
bcm43455c07_45_234 (4ca95bb CY)Raspberry Pi B3+/B4/5Raspberry Pi OSXX
bcm43436b039_88_4_65Raspberry Pi Zero 2 WRaspberry Pi OS Kernel 5.10XXXXX
bcm43567_35_101_5_staNexus 6Android 7.1.2XXXXO
bcm43587_112_200_17_staNexus 6PAndroid 7 StockXXXXO
bcm43587_112_201_3_staNexus 6PAndroid 7.1.2 StockXXXXO
bcm435827_112_300_14_staNexus 6PAndroid 8.0.0 StockXXXXXO
bcm43596a039_75_155_45_sta_c0Samsung Galaxy S7Android 7 StockXOX
bcm43596a03,29_96_4_sta_c0Samsung Galaxy S7LineageOS 14.1XXXOX
bcm4375b13,5,618_38_18_staSamsung Galaxy S10Rooted + disabled SELinuxXXXOX
bcm4375b13,5,618_41_8_9_staSamsung Galaxy S20Rooted + disabled SELinuxXXXOX
bcm4389c15,8,920_82_42_sta (r994653)Samsung Galaxy S22 PlusAndroid 14, Rooted with MagiskXX
bcm4389c15,8,920_101_36_2 (r994653)Google Pixel 7 and 7 ProRooted with MagiskXX
bcm4389c15,8,920_101_57 (r1035009)Google Pixel 7 and 7 ProRooted with MagiskXX
bcm4398d05,8,924_671_6_9 (r1031525)Google Pixel 8Rooted with MagiskXX
bcm6715b0517_10_188_6401 (r808804)Asus RT-AX86U ProStock firmware 3.0.0.4_388.23565/X
qca950044-1-0_55TP-Link Talon AD7200Custom LEDE Image

1 bcm43430a1 was wrongly labeled bcm43438 in the past.

2 use LD_PRELOAD=libnexmon.so instead of LD_PRELOAD=libfakeioctl.so to inject frames through ioctls

3 flash patches need to be 8 bytes long and aligned on an 8 byte boundary

4 802.11ad Wi-Fi chip from first 60 GHz Wi-Fi router Talon AD7200. Patch your firmware using nexmon-arc and run it with our custom LEDE image lede-ad7200

5 Disabled the execution protection (called Execute Never) on region 1, because it interferes with the nexmon code (Permission fault on Section)

6 To use nexutil, you need to deactivate SELinux or set it to permissive

7 See pico-nexmon for example applications using Pico SDK with nexmon.

Download Tool