diff --git a/README.md b/README.md index ad0c231..de9de20 100644 --- a/README.md +++ b/README.md @@ -1,22 +1,38 @@ -# Showcase +# Showcase — Rootless Repack (Dopamine / iOS 15–17) -Showcase turns a jailbroken cellular iPad into a software wireless CarPlay receiver. The iPhone pairs through Settings, joins the iPad hotspot, sends the encrypted CarPlay video stream, and receives touch input from the iPad. +Unofficial rootless repack of [Amine Rostane's **Showcase**](https://github.com/amineross/showcase) — a software-only wireless CarPlay receiver for jailbroken iPads. The first public beta ships in two package architectures. Rootful users get the iOS 12-14 build. Rootless users get the iOS 15-17 build for Dopamine and palera1n rootless. -## Install +All credit for the original research, reverse engineering, and code goes to **Amine Rostane** ([hello@aminerostane.com](mailto:hello@aminerostane.com)). This repo only provides a repackaged `.deb` compatible with rootless jailbreaks. -Add the package source in Sileo, Cydia, or Zebra. +--- -```text -https://aminerostane.com/repo -``` +## What is Showcase? + +Showcase lets a jailbroken iPad act as a wireless CarPlay receiver **without any external MFi dongle or hardware coprocessor**. It works by reusing the iPad's own Apple BAA (Basic Attestation Authority) credentials to satisfy the CarPlay authentication handshake. + +Full technical write-up by the original author: [mfi-carplay-baa-bypass.pdf](https://aminerostane.com/showcase/report/mfi-carplay-baa-bypass.pdf) + +--- -Then install `Showcase`. +## Why this repack? -Install guide and protocol write-up +The original `.deb` (`iphoneos-arm`) targets **rootful** jailbreaks (paths under `/usr/`, `/Library/`, `/Applications/`). -https://aminerostane.com/articles/showcase +This repack fixes three things so it works on **rootless** jailbreaks (Dopamine, palera1n rootless): + +| What was changed | Original | Fixed | +|---|---|---| +| All install paths | `/usr/`, `/Applications/`, `/Library/` | `/var/jb/usr/`, `/var/jb/Applications/`, `/var/jb/Library/` | +| `carplay_services` dylib link | `/usr/lib/libcrypto.3.dylib` | `/var/jb/usr/lib/libcrypto.3.dylib` | +| `carplay_bt` dylib link | `/usr/lib/libBTstack.dylib` | `/var/jb/usr/lib/libBTstack.dylib` | +| `libBTstack.dylib` install name | `/usr/lib/libBTstack.dylib` | `/var/jb/usr/lib/libBTstack.dylib` | +| Launch daemon path | `/usr/bin/BTdaemon` | `/var/jb/usr/bin/BTdaemon` | +| Package architecture | `iphoneos-arm` | `iphoneos-arm64` | +| `libssl3` version requirement | `>= 3.2.1` | `>= 3.0.0` | + +--- ## Requirements @@ -31,43 +47,72 @@ Sileo, Cydia, and Zebra install runtime packages through normal APT dependency r The package bundles `BTdaemon`, `libBTstack.dylib`, and the BTstack launch daemon needed for `/tmp/BTstack`. It conflicts with the old `ch.ringwald.btstack` package to avoid file ownership collisions. -## What Works +> **Rootless sideloading extra:** also install `libssl3 >= 3.0.0` and `uikittools` from [Procursus](https://apt.procurs.us/) before running `dpkg -i`. +> +> Tested on: iPad 7th gen, iOS 17.0, Dopamine (rootless) + +--- -- Wireless CarPlay discovery over Bluetooth and AirPlay/mDNS. -- BTstack takeover while the receiver runs. -- iAP2 link setup, identification, BAA authentication, Wi-Fi handoff, and EAP session setup. -- AirPlay pair-setup, pair-verify, auth-setup, RTSP control, timing, event channel, and screen stream setup. -- H.264 screen stream decryption with ChaCha20-Poly1305. -- Single-finger touch forwarding over the encrypted event channel. +## Installation -## Source Layout +### Via APT (Sileo / Cydia / Zebra) + +Add the package source: ```text -source/ app, Bluetooth helper, AirPlay helper, pairing code -btstack-rootless/ - patched BTstack v1.1 iOS daemon source used by the rootless package -packaging/ Debian control files, depictions, package scripts -icon/ app icons +https://aminerostane.com/repo ``` -## Build From Source +Then install `Showcase`. Runtime dependencies (`libssl3`, `uikittools`) are pulled in automatically. -Showcase builds on the jailbroken iPad. The build script expects SSH access through a local forwarded port. +### Sideloading the rootless `.deb` manually -```sh -iproxy 2222 -IPAD_PORT=2222 IPAD_PASS=alpine ./build_and_install.sh +For users who prefer to install the `iphoneos-arm64.deb` directly without adding an APT source: + +**1. Install dependencies first** + +In **Sileo** or **Zebra**, add the Procursus source: ``` +https://apt.procurs.us/ +``` +Then install: `libssl3` and `uikittools`. -For a jailbreak SSH daemon on port 22, run this command. +**2. Transfer the `.deb` to your iPad** -```sh -iproxy 2222 22 +Via AirDrop, or via SSH: +```bash +scp com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb root@:/var/mobile/ ``` -The script compiles the three binaries on-device, signs them with `ldid`, installs `/Applications/Showcase.app`, and refreshes SpringBoard. +**3. Install via SSH / NewTerm** -## Build The Deb +```bash +dpkg -i /var/mobile/com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb +``` + +**4. Re-sign the patched binaries** + +The dylib path patches invalidate the original code signature. Re-sign with `ldid`: + +```bash +ldid -S /var/jb/Applications/Showcase.app/carplay_services +ldid -S /var/jb/Applications/Showcase.app/carplay_bt +ldid -S /var/jb/usr/lib/libBTstack.dylib +``` + +**5. Load the Bluetooth daemon** + +```bash +launchctl load /var/jb/Library/LaunchDaemons/ch.ringwald.BTstack.plist +``` + +**6. Open Showcase and follow the pairing flow** + +- Enable Personal Hotspot on the iPad +- Open the Showcase app +- On your iPhone: Settings → General → CarPlay → Add Car → select your iPad + +### Building from source Build and test the app on the iPad first. @@ -85,6 +130,29 @@ For GitHub Releases, upload both `.deb` files from `packaging/build/` after you For Sileo, Cydia, and Zebra, publish the generated `packaging/repo/` contents to the web path that serves `https://aminerostane.com/repo`. +--- + +## How it works (summary) + +``` +iPhone ──Bluetooth/iAP2──► iPad (Showcase) + │ + BAA cert + ECDSA sign + │ + ◄──── join iPad Hotspot ──── + │ + ──── AirPlay RTSP TCP 7000 ──► + │ + BAA-backed MFi-SAP auth + │ + ◄──── H.264 screen stream ──── + ──── HID touch reports ───────► +``` + +The iPad reuses its own Apple-issued device identity (BAA certificate chain) to satisfy both the iAP2 Bluetooth authentication and the AirPlay MFi-SAP auth-setup. No external MFi coprocessor needed. + +--- + ## Logs ```text @@ -94,7 +162,27 @@ For Sileo, Cydia, and Zebra, publish the generated `packaging/repo/` contents to /var/mobile/Library/Showcase/logs/carplay_services.log ``` -Check logs before posting them in public issues. Logs can include device names, hotspot names, network details, and pairing traces. +--- + +## Troubleshooting + +**`dpkg` rejects the package** +Make sure you installed `libssl3` and `uikittools` from the Procursus rootless repo first. + +**CarPlay doesn't appear on iPhone** +- Confirm Personal Hotspot is active on the iPad +- Run `launchctl list | grep BTstack` to verify the daemon is running +- Check `/var/log/BTstack.log` for errors + +**App crashes on launch** +Re-run the `ldid -S` commands from step 4 — the patched binaries must be re-signed after install. + +--- + +## Credits + +- **Amine Rostane** — original Showcase app, BAA bypass research +- **TorranceTech** — rootless repack (dylib path patches, iphoneos-arm64 repackaging, iOS 17 / Dopamine compatibility) ## BTstack Rootless Source @@ -104,4 +192,4 @@ The patch set fixes classic BR/EDR authentication state, incoming RFCOMM cid reg ## License -GPL-3.0-or-later. The pairing code includes work adapted from UxPlay and csrp. Binary packages bundle BTstack runtime files from the historical `ch.ringwald.btstack` jailbreak package by Matthias Ringwald. +This repo redistributes a modified binary. All original intellectual property belongs to Amine Rostane. Use at your own risk. diff --git a/com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb b/com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb new file mode 100644 index 0000000..cdbd0de Binary files /dev/null and b/com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb differ