Skip to content

Showcase — Rootless Repack (Dopamine / iOS 15–17)

Latest
Latest

Choose a tag to compare

View all tags
@TorranceTech TorranceTech released this 11 May 05:25
· 25 commits to main since this release
Showcase
763c1c4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Unofficial rootless repack of Amine Rostane's Showcase — a software-only wireless CarPlay receiver for jailbroken iPads.

Patched and maintained by TorranceTech for rootless jailbreak compatibility (Dopamine / iOS 15–17).

All credit for the original research, reverse engineering, and code goes to Amine Rostane (hello@aminerostane.com). This repo only provides a repackaged .deb compatible with rootless jailbreaks.

What is Showcase?

Showcase lets a jailbroken iPad act as a wireless CarPlay receiver without any external MFi dongle or hardware coprocessor. It works by reusing the iPad's own Apple BAA (Basic Attestation Authority) credentials to satisfy the CarPlay authentication handshake.

Full technical write-up by the original author: mfi-carplay-baa-bypass.pdf

Why this repack?

The original .deb (iphoneos-arm) targets rootful jailbreaks (paths under /usr/, /Library/, /Applications/).

This repack fixes three things so it works on rootless jailbreaks (Dopamine, palera1n rootless):

What was changed Original Fixed
All install paths /usr/, /Applications/, /Library/ /var/jb/usr/, /var/jb/Applications/, /var/jb/Library/
carplay_services dylib link /usr/lib/libcrypto.3.dylib /var/jb/usr/lib/libcrypto.3.dylib
carplay_bt dylib link /usr/lib/libBTstack.dylib /var/jb/usr/lib/libBTstack.dylib
libBTstack.dylib install name /usr/lib/libBTstack.dylib /var/jb/usr/lib/libBTstack.dylib
Launch daemon path /usr/bin/BTdaemon /var/jb/usr/bin/BTdaemon
Package architecture iphoneos-arm iphoneos-arm64
libssl3 version requirement >= 3.2.1 >= 3.0.0

Requirements

  • iPad with cellular (Personal Hotspot required)
  • Rootless jailbreak: Dopamine or palera1n rootless
  • iOS 15.0 – 17.x
  • libssl3 >= 3.0.0 — install from Procursus
  • uikittools — install from Procursus

Tested on: iPad 7th gen, iOS 17.0, modified Dopamine (rootless)

Installation

1. Add Procursus repo and install dependencies

In Sileo or Zebra, add the source:

https://apt.procurs.us/

Then install:

  • libssl3
  • uikittools

2. Download the .deb

Grab the latest release from the Releases page.

3. Transfer to your iPad

Via AirDrop, or via SSH:

scp com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb root@<iPad-IP>:/var/mobile/

4. Install via SSH / NewTerm

dpkg -i /var/mobile/com.rostane.showcase_1.0.beta1-1_iphoneos-arm64.deb

5. Re-sign the patched binaries

The dylib path patches invalidate the original code signature. Re-sign with ldid:

ldid -S /var/jb/Applications/Showcase.app/carplay_services
ldid -S /var/jb/Applications/Showcase.app/carplay_bt
ldid -S /var/jb/usr/lib/libBTstack.dylib

6. Load the Bluetooth daemon

launchctl load /var/jb/Library/LaunchDaemons/ch.ringwald.BTstack.plist

7. Open Showcase and follow the pairing flow

  • Enable Personal Hotspot on the iPad
  • Open the Showcase app
  • On your iPhone: Settings → General → CarPlay → Add Car → select your iPad

How it works (summary)

iPhone ──Bluetooth/iAP2──► iPad (Showcase)
                                │
                    BAA cert + ECDSA sign
                                │
         ◄──── join iPad Hotspot ────
                                │
         ──── AirPlay RTSP TCP 7000 ──►
                                │
                    BAA-backed MFi-SAP auth
                                │
         ◄──── H.264 screen stream ────
         ──── HID touch reports ───────►

The iPad reuses its own Apple-issued device identity (BAA certificate chain) to satisfy both the iAP2 Bluetooth authentication and the AirPlay MFi-SAP auth-setup. No external MFi coprocessor needed.

Troubleshooting

dpkg rejects the package
Make sure you installed libssl3 and uikittools from the Procursus rootless repo first.

CarPlay doesn't appear on iPhone

  • Confirm Personal Hotspot is active on the iPad
  • Run launchctl list | grep BTstack to verify the daemon is running
  • Check /var/log/BTstack.log for errors

App crashes on launch
Re-run the ldid -S commands from step 5 — the patched binaries must be re-signed after install.

Credits

  • Amine Rostane — original Showcase app, BAA bypass research
  • TorranceTech — rootless repack (dylib path patches, iphoneos-arm64 repackaging, iOS 17 / Dopamine compatibility)

License

This repo redistributes a modified binary. All original intellectual property belongs to Amine Rostane. Use at your own risk.

Assets 3
Loading