Open firmware is FINALLY here...

[ninja-]

The moment you've been waiting for is FINALLY here...

After more than a year of hard work, I am releasing a project without precedent in the open source space - fully functional Carplay2Air firmware for Carlinkit dongles.

Grab your Carlinkit Mini Ultra dongle and test the first build 😎

https://github.com/catplay-labs/catplay#quick-start

doc_2026-07-07_20-54-33.mp4

[Zubastic]

Good job. I have ultra3 mini dongle (old+newer), is there any limitations of fw to run exploit?

[ninja-]

if it's VehiConn SSID, and if it identifies itself as AX1800M in the interface, then likely yes it will work. but I don't have a full proof of there being an ingenic chip inside.

[ludwig-v]

Bought a Carlinkit Ultra Device, it was shipped with VehiConn firmware.

Few details to flash from Windows (Python 3.14)

• Ingenic Boot drivers have to be downloaded from : https://github.com/CrealityOfficial/K1_Series_Annex/releases/download/V1.0.0/cloner-2.5.18-windows_alpha.zip
• Factory IP is 192.168.50.100
• pip install paramiko pyusb needed

Everything went fine:

C:\Users\User\Desktop\clk-mini-ultra-nor\tools>python reboot2recovery.py --mode ultra_exploit --early-host "192.168.50.100"
[+] ultra_exploit request sent, socket closed after 1s (success)
[+] USB recovery device detected: a108:eaef

C:\Users\User\Desktop\clk-mini-ultra-nor\tools>python recov.py ../ax1800_spi_nor_burner_u-boot-spl.bin ../clk-mini-ultra-nor-recov.uzImage.bin  ../clk-mini-ultra-nor-recov.initrd.bin
[+] Parsed uImage(name='Linux-6.18.36', size=3186800, load=0x82f00000, entry=0x82f00000, os=5, arch=5, type=2, comp=0)
[+] kernel payload: file=..\clk-mini-ultra-nor-recov.uzImage.bin, payload_size=3186800 B, load=0x82f00000, entry=0x82f00000
[+] initramfs: file=..\clk-mini-ultra-nor-recov.initrd.bin, size=5378048 B, load=0x82100000
[+] bootargs/cmdline: 'init=/usr/bin/carlinkit_otalib root=/dev/initrd mem=64M@0x0 console=ttyS2,3000000n8 rootfstype=erofs rw clk_ignore_unused lpj=549888 driver_async_probe=dwc2,jz4740-mmc c2a_boot=recovery rd_start=0x82100000 rd_size=0x00521000', size=247 B, addr=0x83ff0000, argc=2, argv=0x83ff0000, envp=0x83ff000c
[+] trampoline: size=48 B, addr=0x83ff1000, linux_a0=0x00000002, linux_a1=0x83ff0000, linux_a2=0x83ff000c, linux_a3=0x00000000
[*] Looking for X1600 USB boot device...
[+] Device found
[+] CPU info 'X1600'
[*] Upload SPL: ..\ax1800_spi_nor_burner_u-boot-spl.bin -> 0x80001800 (11784 B), entry=0x80001800
[*] Start SPL (VR_PROGRAM_START1)
[*] Waiting for SPL to return to BootROM...
[+] Device returned to BootROM
[+] CPU info after SPL: 'X1600'
[*] Upload kernel payload -> 0x82f00000 (3186800 B)
[*] Upload initramfs -> 0x82100000 (5378048 B)
[*] Upload bootargs -> 0x83ff0000 (247 B)
[*] Upload trampoline -> 0x83ff1000 (48 B)
[*] Flush caches (VR_FLUSH_CACHES)
[*] Start trampoline (VR_PROGRAM_START2) entry=0x83ff1000 -> kernel=0x82f00000
[+] Done, trampoline started and kernel launched
[*] Verifying SSH on 192.168.51.2:22 (timeout 20.0s)...
[+] SSH is open on 192.168.51.2:22

C:\Users\User\Desktop\clk-mini-ultra-nor\tools>python flash.py --host 192.168.51.2 --fw ../clk-mini-ultra-nor.c2aflash
[*] uploader --host 192.168.51.2 --exec-cmd rm -rf /tmp/backup.bin
[*] Executing remote command: rm -rf /tmp/backup.bin
[+] Remote command exit status: 0
[*] uploader --host 192.168.51.2 --exec-cmd carlinkit_otalib backup /tmp/backup.bin
[*] Executing remote command: carlinkit_otalib backup /tmp/backup.bin
backup completed!
[+] Remote command exit status: 0
[*] uploader --host 192.168.51.2 --download backup_1783691026.bin /tmp/backup.bin
[download] /tmp/backup.bin -> backup_1783691026.bin  16777216/16777216 bytes (100.0%)
[+] Download complete
[*] uploader --host 192.168.51.2 --exec-cmd rm -rf /tmp/backup.bin
[*] Executing remote command: rm -rf /tmp/backup.bin
[+] Remote command exit status: 0
[*] uploader --host 192.168.51.2 /tmp/fw.bin ../clk-mini-ultra-nor.c2aflash
[upload] ..\clk-mini-ultra-nor.c2aflash -> /tmp/fw.bin  16777216/16777216 bytes (100.0%)
[+] Upload complete
[*] uploader --host 192.168.51.2 --exec-cmd mount -o remount,ro /persist || exit 0
[*] Executing remote command: mount -o remount,ro /persist || exit 0
mount: can't find /persist in /proc/mounts
[+] Remote command exit status: 0
[*] uploader --host 192.168.51.2 --exec-cmd carlinkit_otalib flash /tmp/fw.bin && (sleep 2 && reboot &)
[*] Executing remote command: carlinkit_otalib flash /tmp/fw.bin && (sleep 2 && reboot &)
Starting flash...be patient...
flash completed!
[+] Remote command exit status: 0
[+] Flash sequence finished successfully

C:\Users\User\Desktop\clk-mini-ultra-nor\tools>

Now it is time to test in vehicle

[ninja-]

P.S: "Press any key to pair: iPhone 17 Pro Lud | 763692" is too long to be displayed on welcome screen, it is unreadable

yeah, I made the UI DPI-aware from the start so everything renders nicely on differen cars. but font size is one exception because it isn't normalized to DPI so it's on my backlog to change this

[ninja-]

Nice, but pairing doesn't work now

there's no hidSendReport in rtsp.log, just interact with it in any way(touch/knob) and it will count as "any key to pair"...

and make sure to start fresh so unpair Bluetooth, Wi-Fi network, and Bluetooth device of original firmware if paired

[ludwig-v]

Any idea about the pairing issue ? So close to get it working 🛜

[ninja-]

If you're very desperate

$ bluetoothctl

agent on
... wait for request. write "yes"

but if HID isn't working at all then it won't be very useful

[ludwig-v]

🤣 due to the visual bug I didn't think I had to click on HU, works perfectly now 👍🏻

[ludwig-v]

Added Catplay link to main README

[Zubastic]

@ninja- is it possible to flash allwinner device? They use risc-v arch but carlinkit switched to their base now.

[ninja-]

V821 port is very unlikely this year.

But I am looking into V851S support because it's the only known chip to support H264 transcoding which seems to be the core of AirPlay Mirroring

[Snirpo]

Nice work! You're not completely right though about the CarPlay market being completely dominated by Chinese dongles. We (AAWireless) also have CarPlay support.

AAWireless has (semi-official) support for the opensource Android Auto dongle software called aa-proxy-rs (https://github.com/aa-proxy/aa-proxy-rs). Might be cool to also add support / combine it with CatPlay?

[ninja-]

maybe in future if the userbase significantly grows, right now I don't feel dealing with AA would be a good use of my limited amount of time in non-commercial context. I don't even have any Android phones at home right now.

I have some R&D internally which takes a fresh approach at designing AA proto lib <-> Rust integration that's much nicer than existing implementations and is already at stage of dumping decoded video/audio streams, but it's shelved until there's a good reason to continue working on it again