AutoPro / Mayton AutoPro2 Research Release

Public release package for authorized security research on the Mayton AutoPro2 / ly2601 wireless CarPlay adapter family. This repository keeps the useful documentation, findings, evidence summaries, and tools while excluding raw firmware images, extracted filesystems, payload packages, local agent instructions, and personal/API secrets.

Target

Field	Value
Research target	Mayton AutoPro2 Wireless CarPlay Adapter / ly2601 CarPlay adapter
Public product link	https://maytonofficial.com/products/mayton-apple-carplay-wireless-adapter
Related product line	https://maytonofficial.com/products/mayton-autopro-x-android-auto-wireless-adapter-for-samsung-dex
Brand	Mayton
Firmware vendor strings	Lylink / Liaoyuan
Main researched firmware	24010615.2601.1
Earlier image also analyzed	23121917.2601.1
SoC	Allwinner V831, ARM Cortex-A7
Kernel	Linux 4.9.118
Main device name / SSID	MAYTON_Pro2-3C48
Device IP on hotspot	192.168.1.101
Bluetooth MAC from test unit	14:85:54:03:1F:B7
Normal USB VID:PID	05ac:12a8
CDC/A2A mode VID:PID	0525:a4a7
FEL boot ROM VID:PID	1f3a:efe8

The adapter acts as a wireless bridge between a vehicle head unit and a phone. It exposes Wi-Fi AP services, Bluetooth RFCOMM services, USB gadget modes, a web/CGI update surface, and proprietary Lylink/CarPlay control paths.

Repository Map

Path	What it contains
docs/	Overview docs, deployment notes, protocol notes, and test plans.
notes/NOTES/	Organized working research notes.
findings/	Findings, leads, evidence-derived finding notes, and sanitized repro placeholders.
reports/disclosure/	Vendor advisory, CVE submission drafts, disclosure package material, and status notes.
evidence/	Curated logs, scans, reverse-engineering notes, non-secret configs, and evidence manifests.
tools/	Source trees, scripts, web UIs, and tool READMEs.
packages/autopro-offline/	Offline deployment package skeleton with binary/shim blobs excluded.

Vulnerability Summary

ID	Title	Severity / CVSS	CWE	Short description
VULN-001	Bluetooth RFCOMM persistent DoS	6.5	CWE-404	Malformed or disrupted RFCOMM handling can leave Bluetooth services refusing connections until physical power cycle.
VULN-002	Unauthenticated Bluetooth services	7.4	CWE-306	RFCOMM channels for Wireless iAP, Android Auto, and HFP accepted connections without pairing in testing.
VULN-003	Unauthenticated unsigned firmware update	8.8-9.8	CWE-494	HTTP CGI update flow accepted update material without authentication or cryptographic signature verification.
VULN-004	FEL mode full chip access	6.8	CWE-1191	Reset-triggered Allwinner FEL mode allowed SPI flash read/write and JTAG enablement with physical access.
VULN-005	Hardcoded default credentials	7.5	CWE-798	Firmware used shared root and Wi-Fi credentials across the tested model family.
VULN-006	Weak password hashing	5.3	CWE-328	Root credential stored with legacy DES crypt.
VULN-007	Pre-Airborne CarPlay SDK exposure	8.8	CWE-416 / CWE-119	libcarplay.so and rcpservice predate 2025 AirBorne patches; rcpservice lacks stack canary.
VULN-008	Cloud credential exposure	7.5	CWE-798	CGI binary contained hardcoded Aliyun STS-related material.
VULN-009	Weak entropy behavior	5.9	CWE-331	Boot scripts replace /dev/random with a symlink to /dev/urandom.

Finding detail lives in:

• findings/findingslist.md
• findings/leads.md
• reports/disclosure/DISCLOSURE-PROPER/vendor-security-advisory.md
• reports/disclosure/DISCLOSURE-PROPER/cve-submissions.md
• notes/NOTES/attack-surface.md
• notes/NOTES/rfcomm-crash-finding.md
• notes/NOTES/recv-overflow-analysis.md

Negative results are also included:

• HFP AT-command fuzzing: 344 payloads tested, no crashes found.
• btapp recv() overflow hypothesis: ruled out; callers allocate 0xffff buffers.
• CGI command injection: ruled out for reviewed system() calls; calls used hardcoded strings.
• lylinkapp port 8299: still not fully reversed; no confirmed crash in available notes.

Attack Surface

Surface	Details
Wi-Fi AP	Device hotspot at 192.168.1.101, WPA2-PSK, max clients 8, commonly observed on 5 GHz channel 36.
HTTP/CGI	BusyBox HTTP server on port 80, CGI update and diagnostic endpoints.
Lylink control	Proprietary TCP service on port 8299 used by control tooling.
CarPlay/iAP	rcpservice, libcarplay.so, iAP/iAP2 libraries, multiple CarPlay-related ports.
Bluetooth	btapp, BlueZ 5.63 fork, RFCOMM channels 1, 2, and 7 exposed in testing.
USB normal mode	Apple-like USB gadget mode, 05ac:12a8.
USB CDC/A2A mode	Reset-after-boot mode, 0525:a4a7, serial/broadcast device info path.
FEL boot ROM	Reset-while-plugging USB mode, 1f3a:efe8, Allwinner low-level access.
Filesystems	SquashFS root/customer partitions, JFFS2 logo and UDISK writable areas, /tmp tmpfs.

Tool Suite

Tool	Path	Purpose
cpctl	tools/cpctl/	CarPlay web control service that sends Lylink packets to lylinkapp:8299.
cpcp	tools/cpcp/	Direct CarPlay library prototype around libcarplay.so and Civetweb.
carplay-shim	tools/carplay-shim/	Runtime tracing shim for libcarplay.so reverse engineering.
carplay-sink	tools/carplay-sink/	USB CarPlay sink prototype for Kali/Linux host testing.
cpcp-further-RE	tools/cpcp-further-RE/	Focused notes for CreateCarPlay() and config-struct research.
scripts	tools/scripts/	Bluetooth/RFCOMM fuzzers, capture helpers, crash monitors, probes, and packaging helpers.

Evidence And Reports

Path	Use
evidence/logs/	Bluetooth fuzzing, RFCOMM, btmon, and runtime logs.
evidence/scans/	SDP, GATT, and LAN scan outputs.
evidence/re/	Static reverse-engineering notes for libcarplay, lylinkapp, and attack surface.
evidence/configs/	Extracted runtime/config files from the firmware.
evidence/manifests/	Evidence package manifests and evidence-side findings/leads.
reports/disclosure/	Vendor-facing advisory and CVE submission drafts.

Exclusions

The public tree intentionally excludes:

• Raw firmware images and SPI flash dumps.
• Extracted root filesystems and backup trees.
• Payload directories and SWUpdate payload packages.
• Shared-library blobs and unapproved binary blobs.
• Prebuilt tool binaries.
• Local agent instructions and personal/API credentials.
• Internal release manifests and local artifact indexes.

Firmware hashes retained for traceability:

Artifact	SHA256
Possible-FIrmware/test.img	ef293795ce2df597267cdcbf7e8ca41e925c56ed11288e5fa476848d2753bb8c
Possible-FIrmware/update.img	e3c2004dd6a8c267f00a5df06bb7d793a0af75a9295b000150c22826284c009a
firmware-dump/spinor-full.bin	5f36838550eb280ecff3f47c805026f2ef5b8b96f5b940437cdcb78c53faa72c

Quick Checks

From the project root, these should not list raw firmware blobs or payload directories:

find Release -type f \( -name '*.img' -o -name '*.rom' -o -name '*.iso' -o -name '*.qcow2' -o -name '*.vmdk' -o -name '*.so' \) -print
find Release -type d \( -path '*/payload' -o -path '*/payloads' -o -path '*/test_rootfs' -o -path '*/update_rootfs' -o -path '*/test_extracted' -o -path '*/update_extracted' -o -path '*/dongle-binaries' \) -print

Research Boundaries

This package is for authorized security research, vendor disclosure, reproducibility, and defensive review. Proof-of-concept payloads and raw exploit artifacts are not included in the public release tree.