Evil-M5Project

Evil-M5Project is an open-source firmware suite that turns inexpensive M5Stack ESP32 development hardware into a self-contained Wi-Fi and Bluetooth security-testing tool. The name covers a family of per-device builds — most prominently Evil-Cardputer (for the M5Stack Cardputer) and Evil-M5Core2 (for the M5Stack Core2), the build the project was originally named after — that share a common feature base and a common on-screen menu. The firmware is authored and maintained by the developer 7h30th3r0n3 and is distributed under the MIT license.

This deep dive documents the firmware at reference level: what it is and where it came from (this volume), what it can do (Volume 2), how it is installed and flashed (Volume 3), and the specific hardware it targets together with an honest version map (Volume 4). It is written for an owner running the firmware on hardware they own, on networks they own or are authorized to test.

1.1 What it is

Evil-M5Project belongs to the same broad category as ESP32 Marauder and Bruce: firmware that replaces a development board’s stock software with a menu-driven Wi-Fi/BLE toolkit. What distinguishes it is its tight coupling to M5Stack’s own product line — the Core, Core2, CoreS3, Fire, AtomS3, StickC and, above all, the Cardputer with its built-in QWERTY keyboard. The keyboard is the reason the Cardputer build is the reference platform: several of the firmware’s interactive features (naming files, editing an SSID, entering a shell command) are far more usable with real keys than with the two or three buttons on a Core- or Stick-class device.

The firmware carries out its work using the ESP32’s own 2.4 GHz radio in promiscuous and SoftAP modes, plus whatever peripheral modules the host device carries (a GPS unit for wardriving, for example). It is ESP32-only firmware; this fact matters for the hardware notes below and is the source of a correction the project deliberately records.

1.2 Lineage and maintainer

The project began as Evil-M5Core2 — a single-device tool for the M5Stack Core2 — and expanded into a family as the developer ported the feature base to other M5Stack devices, at which point the umbrella name Evil-M5Project came into use. Development is centralized in one repository under the maintainer 7h30th3r0n3 rather than being a fork of another firmware; the Evil-Cardputer build is where new features generally land first. Support and discussion are coordinated through the project’s Discord and its GitHub wiki.

Unlike ESP32 Marauder, whose ecosystem is defined by many third-party hardware vendors shipping it as a guest firmware, Evil-M5Project is built around one vendor’s hardware family and one maintainer’s release cadence. This is a practical strength for a documentation page — the target hardware is a short, well-defined list — and a caveat for version-pinning, since the per-device builds advance on independent version numbers (see Volume 4).

1.3 Runs on

The devices this firmware runs on — the Firmware ↔ Device “runs on” matrix (each links to its Hack Tools deep dive):

• M5Stack Cardputer ADV — ESP32-S3 handheld with QWERTY; Evil-Cardputer is the canonical port.
• M5Stick S3 — ESP32-S3 stick form factor; runs the Evil-S3 build.

(The M5Stack Cardputer Zero is not a target: despite the family name, the confirmed 2026 product is a Raspberry Pi CM0 Linux handheld, not an ESP32 device — and Evil-M5Project is ESP32-only firmware.)

Volume 4 expands this into the fuller catalogue of M5Stack devices the upstream project supports, with the per-device build names and version numbers.

1.4 How this dive is organized

• Volume 1 (this volume) — what the firmware is, its lineage, and the hardware it runs on.
• Volume 2 — the capability set: Wi-Fi tooling, BLE, the network layer, the packet monitor, captive portals, peripheral/RF features, and the screen and UI.
• Volume 3 — installation and flashing: M5Burner versus a manual Arduino build, the mandatory microSD evil/ folder, and first-boot behavior.
• Volume 4 — the supported hardware, a per-device version map, wardriving and GPS notes, and operating constraints.

1.5 Version and date note

This dive was written on 2026-09-16. Its capability descriptions reflect the most feature-complete build, Evil-Cardputer, at the versions documented in the project repository and the M5Burner catalogue during 2025–2026 (the wiki was last revised in July 2025). The firmware moves quickly and per-device builds are numbered independently; where a specific version is relied on it is named, and readers should treat any single version number as a snapshot rather than a permanent fact.

1.6 Legal and ethical posture

Every active feature in this suite — deauthentication, beacon and probe flooding, captive-portal credential capture, network hijacking — is unlawful in most jurisdictions when directed at networks the operator does not own or is not authorized to test. The firmware’s own documentation states it is intended for education and authorized testing only. The rest of this dive assumes the operator is working on a personal bench network or under written authorization.

1.7 Related elsewhere

• Hack Tools → the M5 devices above (the Firmware ↔ Device “runs on” matrix).