The complete list of models, with special references for developers!
This list was possible thanks to the feedbacks of our users, all people like you, and serves to guide developers in choosing a KaiOS device on which they can test applications, study bugs and improve the operating system as freely as possible using ADB and development tools.
Its thanks to the research of the community that it was possible to "free" these phones by bringing together the experiences of each of us.
The sideload of applications and the ability to access the debug tools belongs to the nature of Firefox OS, which is the heart that moves KaiOS, and should be so for all.
The devices supported by the Development Tools (WebIDE, Kaiostr, ADB, etc...) require access to the USB debugging, normally accessible using codes, however, there are many devices whose access requires specific tools to manipulate the partitions, safely (userdata or cache) or in a risky way (boot). It all depends on the OEMs and their decision to hide or not the natural properties of the software once installed on their devices.
After two years of research, since summer 2018, we have finally come to a precise pattern on how jailbreak works on different KaiOS devices.
The approach is based on the type of processor used on the device, Qualcomm, Spreadtrum or Mediatek (learn more here):
Qualcomm devices are the most prone to OEM blocking (CAT, Doro, Alcatel...), but for some of them debugging is the easier (Nokia), using just one code;
Spreadtrum devices use codes, just like Qualcomm phones, but statistically they are the most numerous among debug-enabled devices;
Mediatek devices do not have codes, but are much more versatile for Fastboot connections.
The devices in this list are broken down according to five search situations in which the researcher attempted to enable USB debugging and the Developer menu. We can further subdivide them on the basis of effectiveness and utility:
From the first to the fourth situation all the devices enabled for debugging are listed;
The fifth concerns devices that are still locked (for now).
We start by listing the debug-enabled devices, and then move on to locked phones up, ending with the devices unknown. If you want to let us know about any KaiOS phone, please contact us. It will be of great help to other people like you. Because alone we are nothing, but all together we are so much!
Let's see them together. Just click on the devices with the name underlined for more details.
Devices where debugging is possible...
Start by reading the device class features listed below to understand what you can do with your device. Detect the chipset model, so you know where to start.
...using the integrated browser (BONUS)
This solution is not based on any particular situation, as it is a natural capability of KaiOS, discovered on September 22, 2020 by Tbrrss (on Discord) and implemented in a web page by Luxferre. It consists to connect the browser of your phone to https://w2d.bananahackers.net/ to open the hidden Developer Menu, then select "Debugger" and enable "ADB and DevTools", a bug icon should appear in the system tray above. In the end, just jailbreak using OmniSD or Wallace Toolbox. Try it now from your KaiOS phone:
This solution has proven effective not only for debug-enabled devices (situation 1 and 2), but also for many models that have been classified as "Debug-locked", for example, Blu Zoey Smart, various Qualcomm-based Jio phones and CAT B35 (see situation 4). NOTE that only Doro-branded KaiOS phones require to be started in FFBM mode in order to use ADB and WebIDE.
On any other device, if using the "adb devices" command you get "unauthorized" as output message, you probably need to patch the boot partition. Use Fastboot (see MEDIATEK-BASED devices) or jump to the situation 4.
...using one code (situation 1)
this situation is typical of Qualcomm-based devices. If the code *#*#33284#*#* needed for debugging works, we must verify if we have access to ADB and WebIDE. If all goes well we can use OmniSD or Wallace to perform a "privileged factory reset" and get the jailbreak.
Listed below are all Qualcomm-based devices where this rule is confirmed:
Although this situation is the easiest to move into, many other Qualcomm-based devices (for example Doro, CAT and Maxcom) are more likely to be "debug-locked" by their manufacturers, so by knowing this rule, we can be more aware of the problems we might encounter if we wanted to develop applications on a KaiOS device (skip to the points 4 and 5 for more information about debug-locked Qualcomm phones).
...using two codes (situation 2)
this situation is typical of Spreadtrum-based devices. If the code *#*#33284#*#* needed for debugging works, we must verify if we have access to ADB and WebIDE. If the result is negative, enable debugging using the code *#*#0574#*#* and retry the access to ADB and WebIDE. If all goes well we can use Wallace-toolbox to perform a "privileged factory reset" and get the jailbreak. Like before, all Spreadtrum-based phones where this rule is confirmed are listed here:
other unknown Spreadtrum-based phones
Listed below are some unknown Spreadtrum-based phones that should work the same way as the ones just listed above, but we don't have any researchers on them to confirm or deny this rule:
...using cache injection (situation 3)
this situation is typical of Mediatek-based devices. The debug code does not work, let's check if Fastboot is available and if it is possible to flash the "cache" partition. If all goes well, use the "cache injection" method, and we will get the Developer menu. This rule was tested and confirmed on:
other unknown Mediatek-based phones
Listed below are some unknown Mediatek-based phones that should work the same way as the ones just listed above, but we don't have any researchers on them to confirm or deny this rule:
...using flashing tools (situation 4)
this situation is typical for devices that are no longer locked (see "situation 5"). The debug code does not work and Fastboot is not available even to flash the partitions. Check if we have other tools to flash the partitions. If yes, we can use the "cache injection" method, or the "manual jailbreak", and we will get the "developer" menu. Click on a device for more details:
...but not for now: Debug-locked (situation 5)
the situation 5 includes all the devices in which the debug code does not work, Fastboot is not available and we do not even have the tools to perform the partition flash. Those interested in developing applications for KaiOS are advised to do not buy one of these phones:
All of the known locked phones are Qualcomm-based and sold exclusively in Europe (CAT, Doro and Maxcom) and the United States (Alcatel and Doro), however, with the right tools we would be able to bring them back to situation 4, (see above), unlocking them, as has already happened for CAT B35 and Alcatel A405DL. Although debugging is not possible, you can use a non-root "adb shell" on them. Find out how to do on their common page:
- Unspecified chipset
Listed here are some devices whose chipset is not specified anywhere:
Sometimes the official website of the manufacturer provides an idea and these phones really exist, but only in the form of prototypes to be presented on the stands of the main technology fairs, without the belief of being able to produce others in the future, perhaps for something better.
Sometimes to inflate the product portfolio on a site or fill blog pages with articles... as with many topics outside of technology, we easily come across fake news.
We know the shape of these devices and some articles, but they are not available. Learn more on the page of KaiOS devices that you will never find on the market:
Official list (www.KaiosTech.com)
In the meanwhile, many more KaiOS phones are coming ... stay tuned!