Evil-M5Project: one Arduino sketch per M5Stack device, and no README answers
Evil-M5Project is an innovative tool developed for ethical hacking and exploration of WiFi networks. It's compatible with Cardputer, Atoms3, Fire, core2. You can scan, monitor, and interact with WiFi networks in a controlled environment. This project is designed for educational purposes, aiding in understanding network security and vulnerabilities
At a glance
- What is it?
- A repository of .ino files for a family of M5Stack boards, where the interesting decisions are the per device forks and the missing build instructions.
- Who is it for?
- The thing to understand about Evil-M5Project is that it is a firmware distribution rather than a software product. There is no package to install, no CLI and no build system in the repository, just one Arduino sketch per supported board sitting at the top level with version numbers in the filenames.
- Can I use it commercially?
- Not without permission. GitHub finds no licence file in the repository, and without a licence all rights are reserved by default: you may read the code but not reuse it. Check the README, or ask the authors, before using it.
- Is it still maintained?
- Yes. The repository last received commits 12 days ago.
- What is it written in?
- Mainly C++, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on October 25, 2026, and from our analysis. They are not legal advice.
Editorial analysis
The repository root is a shelf of .ino files, one per board
Open the tree and the design decision is immediate. There is no `src/`, no `include/`, no build configuration and no package manifest. Instead there are nine Arduino sketches named after the device they target, each carrying a version number in the filename: `Evil-Cardputer-v1-5-5.ino`, `Evil-M5Core2-1-5-1.ino`, `Evil-M5Core3-1-1-9.ino`, `Evil-AtomS3-v1-1-7.ino`, `Evil-Face-v1-0.ino`, `Semi-Evil-M5Dial-v1-1-0.ino`, plus two marked beta, `Evil-CYD-Beta.ino` and `Evil-Stick-Beta.ino`.
Alongside them sit five supporting directories with names that describe their purpose rather than their contents: `binaries/`, `SD-Card-File/`, `m5dial-data/`, `slave/` and `utilities/`. A `Github-Img/` directory holds the images the README embeds, which is a small sign of a repository maintained by one person rather than a team with a docs pipeline.
The practical consequence is that a board is a file, not a build target. If you move from a Cardputer to an AtomS3 you switch files, you do not switch profiles. That is a simple model to understand and an awkward one to maintain, because a feature added to one sketch has to be hand ported to the others, and the version numbers drifting apart across the nine filenames are the visible symptom of exactly that.
Supported hardware, beta hardware, and the two things you must buy
The hardware table is long and worth reading as two lists rather than one. The stable group covers the M5Cardputer, which the README marks as the better option, then M5Stack Core2, Fire, Core1, AWS, CoreS3 and CoreS3 SE, plus M5AtomS3. The beta group is CYD2USB, CYD1USB, M5Stick v1.1 and M5Stick v2, and two of those beta entries have no purchase link at all.
Two extras are listed separately under required extras, which is unusual phrasing and worth noticing. The first is an SD card, specified as FAT32, SDHC, 16GB maximum, with the note that 8GB is already enough. The second is a GPS module, and the M5AtomS3 row in the hardware table says GPS needed in parentheses, so for that board the module is not optional in practice.
An LLM module also appears in the hardware table as an accessory rather than a target, which suggests some workflow attaches one rather than flashing a dedicated build for it. The homepage is 7h30th3r0n3.fr and the README routes all further documentation to the GitHub wiki rather than trying to keep it in the repository. Every device link in the table is an M5Stack shop URL carrying the author's affiliate parameter, and there is a Ko-fi link alongside it, so the funding route is at least visible up front.
The compatibility matrix is where feature gaps become visible
The README is candid that features vary by device, and it opens the discussion with a matrix rather than a claim of parity. The rows are capability names and the columns are firmware builds: Evil-Cardputer v1.5.4, Evil-M5Core2 1.3.9, Evil-M5Core3 1.1.9, Evil-AtomS3 v1.1.7 and Evil-Face v1.0.
The first row, WiFi network scanning, is a check for four of the five builds and a cross for Evil-Face. Network cloning follows the same pattern so far as the visible rows go. So the Face is presented as the reduced build, which lines up with it being a dial style device rather than a handheld with a screen.
What makes this table genuinely useful is that it front loads the information you would otherwise discover the hard way, which is whether your board can do the thing you bought it for. It also gives the honest picture of a project spread across nine independently versioned sketches: the Cardputer build is at v1.5.5 in the tree while the matrix still refers to v1.5.4, and Core2 is listed at 1.3.9 in the matrix against `Evil-M5Core2-1-5-1.ino` in the tree. Both can be true at once, since a matrix describes one documented state and a filename describes the newest commit, but it means the README lags the code by a build or two. Read the sketch's own version as the current one.
What the README declines to explain, and where it sends you
The single biggest gap is that there is no flashing instruction anywhere in it. Not how to get the sketch onto a Cardputer, not which board settings the Arduino IDE needs, not how the files in `SD-Card-File/` are supposed to reach the card. Instead the README closes with two lines pointing at the wiki, and the wiki is where a reader has to go for the actual procedure.
That is a defensible choice for a project whose audience is people who already own these boards and already have a flashing toolchain, and it is a bad choice for anyone evaluating the project from a browser. There is also no architecture description, no list of what the utilities and slave directories contain, and no statement of which ESP32 firmware version a given sketch targets.
The disclaimer is the other thing the README is emphatic about, and it is worth quoting the shape of it rather than the wording. It states that the creator of Evil-M5Core2 is not responsible for misuse, that the tool is intended solely for ethical and educational purposes, that all files are designed for use in a controlled environment, and that misuse or illegal use is not supported by the creator. The project has 2,662 stars, 251 forks, 19 open issues, no topic tags, no tagged releases, and the language field says C++ even though what is in the tree is Arduino sketch source. Last push 2026-09-17, not archived.
Editorial conclusion
The thing to understand about Evil-M5Project is that it is a firmware distribution rather than a software product. There is no package to install, no CLI and no build system in the repository, just one Arduino sketch per supported board sitting at the top level with version numbers in the filenames. That is why the README can be thin and still be adequate, and it is also why you should expect to bring your own flashing workflow, probably M5Burner or the Arduino IDE. The per device matrix at the end of the README is the most useful thing in it, because it tells you which board loses which feature rather than leaving you to discover it at the bench. The last push was 2026-09-17 and there is no LICENSE file in the tree, so if you need to redistribute a modified sketch you have to ask the author rather than rely on a grant.
Frequently asked questions
How do I flash Evil-M5Project onto a Cardputer?
The README does not contain a flashing procedure. It routes all further information to the GitHub wiki for the project, and the repository itself offers no build script or IDE settings, so you need to bring your own workflow, typically M5Burner or the Arduino IDE, and the wiki covers the rest.
Which M5Stack devices does Evil-M5Project support?
Stable builds are listed for the M5Cardputer, Core2, Fire, Core1, AWS, CoreS3, CoreS3 SE and M5AtomS3. CYD2USB, CYD1USB, M5Stick v1.1 and M5Stick v2 are marked as in beta, and each supported board has its own Arduino sketch at the repository root.
Do I need an SD card or a GPS module?
The README lists an SD card, FAT32 and SDHC with a 16GB maximum, saying 8GB is already enough, and a GPS module under required extras. For the M5AtomS3 the hardware table marks GPS as needed, so for that board it is not optional.
Does every device build support the same features?
No. The README says features vary depending on the firmware and device, then gives a compatibility matrix across Evil-Cardputer v1.5.4, Evil-M5Core2 1.3.9, Evil-M5Core3 1.1.9, Evil-AtomS3 v1.1.7 and Evil-Face v1.0. WiFi network scanning and network cloning are marked as unsupported on Evil-Face.
Official sources
Add this badge to your README
If you maintain this project, the badge below links readers to this analysis and shows its maintenance status from the daily GitHub snapshot. Paste the markdown into your README; add ?metric=license or ?metric=stars to the image URL for a different field.
[](https://hysenlabs.com/projects/7h30th3r0n3-evil-m5project)Was this useful?