JScalated Sideload

Production signature-bypass warning

This is a security-research feature. Testing confirmed that affected KaiOS firmware can accept and install a specially prepared application even when its CMS package signature is cryptographically invalid. Successful installation does not establish the package author's identity or package integrity. A package can execute code with all permissions granted by its manifest. Use only a device you own, independently review every package, keep the helper on a trusted local network, and prepare a recovery backup before proceeding.

What it uses

The sideloader talks directly to the KaiOS 3+ AppsManager daemon API. It does not call Engmode. AppsManager requires a downloadable update manifest, so a raw phone-storage path cannot be passed directly to installPackage.

Computer setup

1. Download the helper below.
2. Put it in the same folder as your packaged app, named application.zip.
3. Connect the computer and phone to the same network.
4. Run:

The helper validates the ZIP layout and prints a short app-specific address. Pocket Advance uses:

No hash must be typed. Give unrelated apps different short IDs by starting the helper with something like python jscalated_sideload_server.py application.zip --id calc. Reusing one ID for unrelated apps can produce REINSTALL_FORBIDDEN or name/origin conflicts.

Download Python helper

Phone setup

1. Return to the landing page and choose Load JScalated Sideload.
2. Complete the two-command System-page stage.
3. Enter the update URL printed by the Python helper.
4. Press Test Package Server, Connect AppsManager, then Install application.zip.

Installing multiple apps

Every app needs its own short URL. You may serve several packages at once:

The helper prints a separate address for each one, such as /pa, /c, and /n. Never use the old shared /update.manifest address for multiple apps.

Package requirements

• manifest.webmanifest or legacy manifest.webapp must be at the root of application.zip.
• The update-manifest name, developer, and origin must match the package manifest.
• Unaffected or patched firmware should report INVALID_SIGNATURE for a package whose CMS signature is invalid.
• JScalated does not certify, review, or make an untrusted package safe.

Only install software you trust and have permission to install. Keep the helper limited to your local network and stop it when finished.