r0rt1z2/kaeru
1
0
Fork 0
mirror of https://github.com/R0rt1z2/kaeru.git synced 2026-06-21 11:25:40 +02:00
Code Issues Projects Releases Packages Wiki Activity
ARMv7 payload that provides arbitrary code execution on MediaTek bootloaders
239 commits 1 branch 1 tag 1.5 MiB
  • C 81.7%
  • C++ 5%
  • Makefile 3.7%
  • Python 3.2%
  • Assembly 2.3%
  • Other 4%
Find a file
Exact
R0rt1z2 4324bdac9f
 kaeru: Append git SHA to version string 
Tag builds with the short commit (plus -dirty if the tree is dirty) so an
image maps to a commit.

Change-Id: I9934ce995a45546979bf45c3c30b3a98b87069bc
2026-06-21 02:24:30 +02:00
arch arm: Save/restore SCTLR.A in unaligned helpers 2026-06-21 01:54:53 +02:00
board kaeru: Append git SHA to version string 2026-06-21 02:24:30 +02:00
configs kaeru: Add support for Insulet OmniPod 5 PDM 2026-06-21 01:00:24 +02:00
drivers drivers: Switch to mmio.h for register access 2026-04-15 12:43:23 +02:00
include arm: Save/restore SCTLR.A in unaligned helpers 2026-06-21 01:54:53 +02:00
lib bootargs: Fix unaligned crash in cmdline_replace 2026-06-21 01:56:27 +02:00
main kaeru: Update my own contact mail 2026-05-23 16:41:44 +02:00
scripts kconfig: Convert xfgets() to ANSI C function definition 2026-02-07 13:09:49 +01:00
soc soc: Add support for MediaTek MT6853 2026-05-20 13:15:56 +02:00
stage1 kaeru: Update my own contact mail 2026-05-23 16:41:44 +02:00
utils kaeru: Update my own contact mail 2026-05-23 16:41:44 +02:00
.clang-format kaeru: Initial code upload 2025-05-17 21:32:29 +02:00
.gitattributes kaeru: Add in a minimal .gitattributes 2026-04-13 12:04:50 +02:00
.gitignore kaeru: Add stageone binary to .gitignore 2025-11-27 23:22:38 +01:00
build.sh kaeru: Update my own contact mail 2026-05-23 16:41:44 +02:00
docker_run.sh kaeru: Fix shebangs for bash scripts 2025-12-04 00:45:59 +01:00
Dockerfile kaeru: Append git SHA to version string 2026-06-21 02:24:30 +02:00
flake.lock kaeru: Add nix development shell 2025-10-27 22:55:46 +01:00
flake.nix kaeru: Add missing python dependency to nix flake 2025-11-27 23:20:08 +01:00
format.sh kaeru: Fix shebangs for bash scripts 2025-12-04 00:45:59 +01:00
Kconfig arch: Refactor cache maintenance APIs 2026-04-11 17:46:21 +02:00
LICENSE kaeru: Initial code upload 2025-05-17 21:32:29 +02:00
Makefile kaeru: Append git SHA to version string 2026-06-21 02:24:30 +02:00
README.md kaeru: Update my own contact mail 2026-05-23 16:41:44 +02:00
README_ja-JP.md kaeru: Update my own contact mail 2026-05-23 16:41:44 +02:00
setup.sh kaeru: Fix shebangs for bash scripts 2025-12-04 00:45:59 +01:00

README.md

🐸 かえる

Language: 日本語

This repository contains an ARMv7 payload that provides arbitrary code execution on MediaTek bootloaders (LK).

Overview

Caution

If you don't know what you're doing, you can brick your device. This is not a beginner's project. Please READ THE DOCUMENTATION carefully and understand the implications of modifying your bootloader.

Given a bootloader image, this tool will output a patched version that can be flashed to the device. The patched image will contain a custom payload that allows you to run arbitrary code during the boot process.

Things to keep in mind:

  • This payload is designed for devices using an ARMv7 Little Kernel (LK) as their bootloader.
  • Offsets and addresses are specific to the device and bootloader version. You may need to adjust them for your specific device and bootloader version.

The following list showcases the most common use cases for kaeru:

  • Advanced debugging: Use the payload to debug the boot process of your device by hooking into the bootloader's functions and variables.
  • Custom fastboot commands: Add your own fastboot commands to the bootloader.
  • Remap button combinations: You can set up custom boot modes and key combinations to enter different modes (e.g., recovery, fastboot, etc.).
  • Remove bootloader warnings: Remove the "unlocked bootloader" warning that appears when the device is booted with an unlocked bootloader.

... and much more!

Wiki

An elaborate wiki with multiple guides and notes has been provided to help you understand how kaeru works. Please refer to it to learn how to build, add support for a new device, and more:

  1. Table of contents
  2. Introduction
  3. Can I use kaeru on my device?
  4. Porting kaeru to a new device
  5. Customization and kaeru APIs

License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).

Key points to be aware of:

  • You are free to use, modify, and distribute the software.
  • If you modify and use the software publicly, you must release your source code.
  • You must retain the same license (AGPL-3.0) when redistributing modified versions.
  • You cannot keep modifications private if the software is used to provide a networked service.

For full details, please refer to the LICENSE file.

Copyright & Developers

Acknowledgments

Linux

Some of the Makefile and build-related scripts were adapted from the Linux kernel source code.

Linux which is licensed under the GNU General Public License v2.

© The Linux Foundation and contributors.

Original source: https://github.com/torvalds/linux

nanoprintf

This project includes nanoprintf, a minimal implementation of printf-style formatting designed for embedded systems.

nanoprintf is dual-licensed under the Unlicense and the Zero-Clause BSD (0BSD).

© 2019 Charles Nicholson.

Original source: https://github.com/charlesnicholson/nanoprintf

libsej

This project includes libsej, a library for interacting with MediaTek's Security Engine (SEJ/HACC) hardware.

libsej is licensed under the GNU General Public License v3.

© 2024 B.Kerler, 2025 Shomy.

Original source: https://github.com/shomykohai/mtk-payloads/tree/main/libsej

Disclaimer

This software is provided "as is" without any warranty of any kind, express or implied. By using this tool, you acknowledge that:

  • Modifying the bootloader or flashing modified images carries a high risk of permanently damaging your device (bricking).
  • You are solely responsible for any consequences resulting from the use, misuse, or inability to use this software.
  • The maintainers and contributors of this project are not liable for any damage, data loss, device malfunction, or legal issues that may arise.
  • This project is intended for educational and research purposes only. It is not intended for illegal or unauthorized use.

Proceed only if you fully understand the risks and implications.