Replacing binary blobs

[hassankhan]

There's some interesting work going on at https://github.com/45clouds/WirelessCarPlay that might allow compilation of the AppleCarplay binary inside the firmware.

Just wanted to see what the maintainers thoughts were on this? I made a (incomplete) list:

Binary	Description
/usr/lib/libARMtool.so	?
/usr/lib/libavcodec.so	FFmpeg libavcodec
/usr/lib/libavformat.so	FFmpeg libavformat
/usr/lib/libavutil.so	FFmpeg libavutil
/usr/lib/libbluetooth.so	BlueZ
/usr/lib/libcrypto.so	OpenSSL
/usr/lib/libdbus-1.so	dbus
/usr/lib/libdns_sd.so	mDNSResponder
/usr/lib/libfdk-aac.so	Encode/decode AAC-LC (media) and AAC-LD (telephony)
/usr/lib/libswresample.so	FFmpeg libswresample
/usr/lib/libtinyalsa.so	tinyalsa
/usr/lib/libusb-1.0.so	libusb
/usr/lib/libxml2.so	libxml2
/usr/sbin/ARMadb-driver	ADB driver for Android maybe?
/usr/sbin/ARMiPhoneIAP2	Probably an SDK for the iAP2 protocol
/usr/sbin/ARMimg_maker	?
/usr/sbin/AppleCarPlay	CarPlay Accessory SDK
/usr/sbin/bluetoothDaemon	Bluetooth Service
/usr/sbin/bluetoothDaemonTest	?
/usr/sbin/boa	HTTP server for the update page on 192.168.50.2
/usr/sbin/dbus-daemon	Binary from dbus
/usr/sbin/dtmf_decode	DTMF decoder. Used to convert phone keypress sounds into actual numbers
/usr/sbin/fakeiOSDevice	Fake iOS device presented to car's head unit for CarPlay passthrough
/usr/sbin/flash_erase	?
/usr/sbin/hciconfig	Binary from BlueZ
/usr/sbin/hcid	Binary from BlueZ
/usr/sbin/hostapd	hostapd
/usr/sbin/hwSecret	?
/usr/sbin/mdnsd	mdnsd
/usr/sbin/reset_usb	?
/usr/sbin/rtk_hciattach	?
/usr/sbin/sdptool	Binary from BlueZ
/usr/sbin/set_wifi_mac	Probably sets device's MAC address
/usr/sbin/tinycap	Binary from tinyalsa
/usr/sbin/tinymix	Binary from tinyalsa
/usr/sbin/ui.tar.gz	Startup theme/UI
/usr/sbin/usbmuxd	usbmuxd

[CiNcH83]

I made a (incomplete) list:

/usr/lib/libfdk-aac.so - Encode/decode AAC-LC (media) and AAC-LD (telephony)

There's some interesting work going on at https://github.com/45clouds/WirelessCarPlay

Last commit has been in January of 2020 though.

[hassankhan]

That's true, but there is a recent PR with a massive update: 45clouds/WirelessCarPlay#4

[hassankhan]

Also updated the table above with the lib you posted

[hassankhan]

@CiNcH83 They've recently merged the PR I linked

[CiNcH83]

Probably how the device fools the car into thinking its connected by wire

Yes. Towards the HU, the dongle has to emulate the iPhone and connect via wired CarPlay (HU > fakeiOSDevice). Towards the iPhone, the dongle emulates the Wireless CarPlay HU (AppleCarPlay(WirelessCarPlay) > iPhone). So the dongle bridges between wired and Wireless CarPlay having to play the role of both sides, the accessory(HU) and the iPhone. And sometimes, it is not a simple passthrough. In case of audio, the dongle has to de- (towards HU)/encode (towards iPhone) audio due to wired CarPlay via USB using LPCM and Wireless CarPlay using AAC-LC for conventional audio and AAC-LD (or Opus) for telephony which will definitely hurt latency a lot.

[Mr-Bossman]

the binaries decrypt them selfs when running btw.

execve("./usr/sbin/hwSecret", ["./usr/sbin/hwSecret"], 0xff8f6750 /* 15 vars */) = 0
open("/proc/self/exe", O_RDONLY)        = 3
mmap2(NULL, 25440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7e2b000
mmap2(0xf7e2b000, 22803, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xf7e2b000
cacheflush(0xf7e30194, 0xf7e31360, 0)   = 0
mprotect(0xf7e2f000, 9056, PROT_READ|PROT_EXEC) = 0
readlink("/proc/self/exe", "/home/pi/wireless-carplay-dongle"..., 4095) = 100
cacheflush(0xfff52eac, 0xfff52fe0, 0)   = 0
mmap2(0x10000, 163840, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x10000
mmap2(0x10000, 30208, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x10000
cacheflush(0x10000, 0x10134, 0)         = 0
mmap2(NULL, 18063, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7e26000
open("/dev/hwaes", O_RDWR)              = 4
ioctl(4, _IOC(_IOC_READ|_IOC_WRITE, 0x62, 0x6, 0xc), 0xfff52da0) = -1 ENOTTY (Inappropriate ioctl for device)
close(4)                                = 0
munmap(0xf7e26000, 17039)               = 0
cacheflush(0x10134, 0x17600, 0)         = 0
cacheflush(0x17600, 0x17608, 0)         = 0
mprotect(0x10000, 30208, PROT_READ|PROT_EXEC) = 0
mmap2(0x27000, 2512, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x27000
cacheflush(0x27600, 0x279d0, 0)         = 0
mprotect(0x27000, 2512, PROT_READ|PROT_WRITE) = 0
mmap2(0x28000, 64272, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x28000
brk(0x38000)                            = 0xc7b000
open("", O_RDONLY)                      = -1 ENOENT (No such file or directory)
exit(127)                               = ?
+++ exited with 127 +++

with touch /dev/hwaes

execve("./usr/sbin/hwSecret", ["./usr/sbin/hwSecret"], 0xff8f6750 /* 15 vars */) = 0
open("/proc/self/exe", O_RDONLY)        = 3
mmap2(NULL, 25440, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7e2b000
mmap2(0xf7e2b000, 22803, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0xf7e2b000
cacheflush(0xf7e30194, 0xf7e31360, 0)   = 0
mprotect(0xf7e2f000, 9056, PROT_READ|PROT_EXEC) = 0
readlink("/proc/self/exe", "/home/pi/wireless-carplay-dongle"..., 4095) = 100
cacheflush(0xfff52eac, 0xfff52fe0, 0)   = 0
mmap2(0x10000, 163840, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x10000
mmap2(0x10000, 30208, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x10000
cacheflush(0x10000, 0x10134, 0)         = 0
mmap2(NULL, 18063, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf7e26000
open("/dev/hwaes", O_RDWR)              = 4
ioctl(4, _IOC(_IOC_READ|_IOC_WRITE, 0x62, 0x6, 0xc), 0xfff52da0) = -1 ENOTTY (Inappropriate ioctl for device)
close(4)                                = 0
munmap(0xf7e26000, 17039)               = 0
cacheflush(0x10134, 0x17600, 0)         = 0
cacheflush(0x17600, 0x17608, 0)         = 0
mprotect(0x10000, 30208, PROT_READ|PROT_EXEC) = 0
mmap2(0x27000, 2512, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x27000
cacheflush(0x27600, 0x279d0, 0)         = 0
mprotect(0x27000, 2512, PROT_READ|PROT_WRITE) = 0
mmap2(0x28000, 64272, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x28000
brk(0x38000)                            = 0xc7b000
open("", O_RDONLY)                      = -1 ENOENT (No such file or directory)
exit(127)                               = ?
+++ exited with 127 +++

there seems to have been some talk here about this
https://wasm.in/threads/revers-arm-binarika.35281/

I'm dumb seems like you already were doing this but took it down for some reason.

[Zubastic]

It was my thread :)

It is modified upx with aes decryption. Now ludwig-v created unpacked tool for all binaries that carlinkit packed. Just download repo and research all binaries.

[Mr-Bossman]

oh, I see now. I feel very silly. Are there decrypted binaries as I do not have one of these devices?

[Zubastic]

As I could see, no. Maybe one of lastest one @ludwig-v could upload to repo for research.

[ludwig-v]

https://github.com/ludwig-v/wireless-carplay-dongle-reverse-engineering/tree/master/Firmware/U2AW/_AUTOKIT/2024.01.10.0953/Decrypted

[Mr-Bossman]

thanks so much