Evil-M5Project — Capabilities

Evil-M5Project presents its tools as a scrolling on-screen menu; the exact set that appears depends on the build and the host device. This volume catalogues what the firmware can do, grouped by subsystem. The list reflects the Evil-Cardputer build, the most feature-complete member of the family, at the versions documented during 2025–2026; leaner devices (AtomS3, StickC-class) expose a reduced subset because of smaller flash, no keyboard, or a smaller screen. Where a feature is a known upstream label it is named as the menu names it.

2.1 Wi-Fi tooling

The Wi-Fi feature set is the core of the firmware and the reason most operators choose it.

• Scanning and enumeration — scan for access points and stations, list SSIDs and BSSIDs, and select a target network from the results.
• AP cloning / “Clone & Details” — read an access point’s parameters and stand up a look-alike SoftAP with the same SSID, the basis of an evil-twin setup.
• Deauthentication — transmit spoofed 802.11 deauth frames to disconnect clients from an access point. As with all deauth tooling this is defeated by 802.11w / Protected Management Frames, which WPA3 mandates.
• Beacon spam — flood the air with synthetic beacon frames advertising many fabricated SSIDs.
• Probe and karma-style attacks — transmit probe requests, and respond to clients’ probe requests with matching probe responses.
• Handshake capture — capture the WPA/WPA2 four-way handshake (typically by inducing a reconnection), for offline cracking on a host machine.
• Captive portal / evil twin — the credential-capture harness, covered in its own section below.

2.2 Bluetooth (BLE)

• BLE scanning — enumerate nearby Bluetooth Low Energy advertisers.
• BLE flooding / spam — broadcast crafted BLE advertisements. The effectiveness of the various “spam” payloads against current phone operating systems changes as vendors patch, and should be treated as version-dependent.
• Device detection — passive detection of specific advertisers, including tracker-style devices.

2.3 Network-layer tooling

Beyond the radio layer, the firmware includes tools that operate once it is on (or hosting) a network:

• Port scanning of hosts on the joined or hosted network.
• DHCP starvation and rogue DHCP — exhaust a DHCP pool, or answer DHCP requests as a rogue server.
• DNS switching / spoofing — redirect name resolution, the mechanism the captive portal relies on.
• SSH shell — an interactive client, most usable on the Cardputer because of its keyboard.
• Web-facing tools — a crawler and related utilities; an NTLM challenge-capture path; and a small “DeadDrop” file-exchange feature.

2.4 Packet monitor

The firmware can put the ESP32 radio into promiscuous mode and display live frame activity on screen — a rolling view of Wi-Fi traffic useful for confirming a channel is active, watching deauth or beacon activity, and general situational awareness. It also supports raw sniffing to the microSD card for later analysis on a host machine (see Volume 4 for the SD requirements).

2.5 Captive portal (the “evil portal”)

The captive portal is the firmware’s most operationally complete feature. Started from the menu, it stands up four cooperating services on the device at once:

• a SoftAP broadcasting an open (no-password) SSID;
• a DHCP server that assigns joining clients an address;
• a DNS responder that resolves every lookup to the device itself; and
• an HTTP server on port 80 that serves a portal page to any request.

A client that joins the open network and opens a browser is shown the portal page; whatever is submitted through the page’s form is written to the microSD card. The portal HTML is loaded from the sites/ folder inside the evil/ directory on the card, so the pretext page can be customized without rebuilding the firmware.

This is a social-engineering capture, not an exploit: it works only if a person joins the open network and types something into the page. It is also conspicuous — a new open SSID appears to everyone in range. It is lawful to run only against an operator’s own bench network or under written authorization, and captured data must be handled as sensitive.

2.6 Peripheral and RF features

The suite reaches beyond the ESP32’s Wi-Fi/BLE radio when the host device carries the right hardware. Documented features include GPS-tagged wardriving (with an attached GPS module) and, on devices with the relevant M5Stack unit attached, sub-GHz and NFC/RFID interactions. Because these depend on optional add-on modules, the exact availability varies by device and build; treat them as present-if-the-module-is as opposed to universally available.

2.7 The screen and UI

The interface is a text menu rendered through M5Stack’s own display libraries (M5GFX / M5Unified), navigated with the device’s buttons or, on the Cardputer, its keyboard. The Cardputer’s keyboard is what makes the interactive tools — the SSH shell, file naming, portal selection, on-device text entry — practical; button-only devices such as AtomS3 and StickC-class units run a usable but noticeably reduced subset. A microSD card is effectively mandatory for full operation: the UI images, portal pages, logs, and configuration all live there (see Volume 3).

2.8 Wardriving and multi-device operation

For area surveys the firmware supports GPS-tagged wardriving with output in a format compatible with WiGLE. The upstream project also documents a coordinator/worker mode in which one device drives several ESP32 boards to monitor multiple Wi-Fi channels at once — a way to work around the single-radio limit of one ESP32. This is an advanced, hardware-heavy setup and is noted here for completeness rather than detailed.

Continue to Volume 3 for installation and flashing.