Rootless repack for Dopamine / iOS 15–17 (iphoneos-arm64) - #12
Open
TorranceTech wants to merge 2 commits into
Open
Rootless repack for Dopamine / iOS 15–17 (iphoneos-arm64)#12TorranceTech wants to merge 2 commits into
TorranceTech wants to merge 2 commits into
Conversation
# Showcase — Rootless Repack (Dopamine / iOS 15–17) Unofficial rootless repack of [Amine Rostane's **Showcase**](https://github.com/amineross/showcase) — a software-only wireless CarPlay receiver for jailbroken iPads. Patched and maintained by **[TorranceTech](https://github.com/TorranceTech)** for rootless jailbreak compatibility (Dopamine / iOS 15–17). All credit for the original research, reverse engineering, and code goes to **Amine Rostane** ([hello@aminerostane.com](mailto:hello@aminerostane.com)). This repo only provides a repackaged `.deb` compatible with rootless jailbreaks. --- ## What is Showcase? Showcase lets a jailbroken iPad act as a wireless CarPlay receiver **without any external MFi dongle or hardware coprocessor**. It works by reusing the iPad's own Apple BAA (Basic Attestation Authority) credentials to satisfy the CarPlay authentication handshake. Full technical write-up by the original author: [mfi-carplay-baa-bypass.pdf](https://aminerostane.com/showcase/report/mfi-carplay-baa-bypass.pdf) --- ## Why this repack? The original `.deb` (`iphoneos-arm`) targets **rootful** jailbreaks (paths under `/usr/`, `/Library/`, `/Applications/`). This repack fixes three things so it works on **rootless** jailbreaks (Dopamine, palera1n rootless): | What was changed | Original | Fixed | |---|---|---| | All install paths | `/usr/`, `/Applications/`, `/Library/` | `/var/jb/usr/`, `/var/jb/Applications/`, `/var/jb/Library/` | | `carplay_services` dylib link | `/usr/lib/libcrypto.3.dylib` | `/var/jb/usr/lib/libcrypto.3.dylib` | | `carplay_bt` dylib link | `/usr/lib/libBTstack.dylib` | `/var/jb/usr/lib/libBTstack.dylib` | | `libBTstack.dylib` install name | `/usr/lib/libBTstack.dylib` | `/var/jb/usr/lib/libBTstack.dylib` | | Launch daemon path | `/usr/bin/BTdaemon` | `/var/jb/usr/bin/BTdaemon` | | Package architecture | `iphoneos-arm` | `iphoneos-arm64` | | `libssl3` version requirement | `>= 3.2.1` | `>= 3.0.0` | --- ## Requirements - iPad with cellular (Personal Hotspot required) - **Rootless** jailbreak: Dopamine or palera1n rootless - iOS 15.0 – 17.x - `libssl3 >= 3.0.0` — install from [Procursus](https://apt.procurs.us/) - `uikittools` — install from [Procursus](https://apt.procurs.us/) > Tested on: iPad 7th gen, iOS 17.0, modified Dopamine (rootless) --- ## Installation ### 1. Add Procursus repo and install dependencies In **Sileo** or **Zebra**, add the source: ``` https://apt.procurs.us/ ``` Then install: - `libssl3` - `uikittools` ### 2. Download the `.deb` Grab the latest release from the [Releases](../../releases) page. ### 3. Transfer to your iPad Via AirDrop, or via SSH: ```bash scp com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb root@<iPad-IP>:/var/mobile/ ``` ### 4. Install via SSH / NewTerm ```bash dpkg -i /var/mobile/com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb ``` ### 5. Re-sign the patched binaries The dylib path patches invalidate the original code signature. Re-sign with `ldid`: ```bash ldid -S /var/jb/Applications/Showcase.app/carplay_services ldid -S /var/jb/Applications/Showcase.app/carplay_bt ldid -S /var/jb/usr/lib/libBTstack.dylib ``` ### 6. Load the Bluetooth daemon ```bash launchctl load /var/jb/Library/LaunchDaemons/ch.ringwald.BTstack.plist ``` ### 7. Open Showcase and follow the pairing flow - Enable Personal Hotspot on the iPad - Open the Showcase app - On your iPhone: Settings → General → CarPlay → Add Car → select your iPad --- ## How it works (summary) ``` iPhone ──Bluetooth/iAP2──► iPad (Showcase) │ BAA cert + ECDSA sign │ ◄──── join iPad Hotspot ──── │ ──── AirPlay RTSP TCP 7000 ──► │ BAA-backed MFi-SAP auth │ ◄──── H.264 screen stream ──── ──── HID touch reports ───────► ``` The iPad reuses its own Apple-issued device identity (BAA certificate chain) to satisfy both the iAP2 Bluetooth authentication and the AirPlay MFi-SAP auth-setup. No external MFi coprocessor needed. --- ## Troubleshooting **`dpkg` rejects the package** Make sure you installed `libssl3` and `uikittools` from the Procursus rootless repo first. **CarPlay doesn't appear on iPhone** - Confirm Personal Hotspot is active on the iPad - Run `launchctl list | grep BTstack` to verify the daemon is running - Check `/var/log/BTstack.log` for errors **App crashes on launch** Re-run the `ldid -S` commands from step 5 — the patched binaries must be re-signed after install. --- ## Credits - **Amine Rostane** — original Showcase app, BAA bypass research - **TorranceTech** — rootless repack (dylib path patches, iphoneos-arm64 repackaging, iOS 17 / Dopamine compatibility) ## License This repo redistributes a modified binary. All original intellectual property belongs to Amine Rostane. Use at your own risk.
Updated README to reflect the rootless repack of Showcase for iOS 15–17, including installation instructions and troubleshooting.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this adds
A rootless-compatible repack of Showcase for users on Dopamine or palera1n rootless (iOS 15–17).
Changes from the original
iphoneos-armpackage/usr/,/Applications/,/Library//var/jb/usr/,/var/jb/Applications/,/var/jb/Library/carplay_servicesdylib link/usr/lib/libcrypto.3.dylib/var/jb/usr/lib/libcrypto.3.dylibcarplay_btdylib link/usr/lib/libBTstack.dylib/var/jb/usr/lib/libBTstack.dyliblibBTstack.dylibinstall name/usr/lib/libBTstack.dylib/var/jb/usr/lib/libBTstack.dylib/usr/bin/BTdaemon/var/jb/usr/bin/BTdaemoniphoneos-armiphoneos-arm64libssl3version requirement>= 3.2.1>= 3.0.0Tested on
Requirements
libssl3 >= 3.0.0from Procursusuikittoolsfrom ProcursusAfter install, re-sign the patched binaries with
ldid:All original research and code credit goes to you. This is only a path-patched repackage for the rootless jailbreak ecosystem.