SmartBox HW501 CarPlay dongle reverse engineering

The SmartBox HW501 is a cheap USB wireless CarPlay adapter sold on AliExpress under a dozen different brand names. It runs embedded Linux on a RISC-V (RV32) SoC, ships closed firmware, and has no public documentation. This is my workspace for taking it apart.

It is organised as six pinned Git submodules, each with its own repository: tooling for downloading and diffing stock firmware, guarded display-density patches, an experimental Sony head-unit audio profile, macOS USB gadget and iAP2 probes, an Andes/QEMU RV32 emulation bench, and the screen-mirroring investigation.

The tooling side is the part that works today: a device inspector and offline diagnostic collector that never touch firmware, a downloader that verifies the structure and checksums of stock images, a comparison pipeline that inventories every file between versions, and annotated RV32 disassembly of the application binaries.

The mods are honestly labelled as experiments. The density125 and density150 CarPlay display patches were tested on exactly one physical setup, an HW501 v131 in a 2017 Opel Corsa on iOS 27, where density150 produced a 5×3 launcher grid. density137.5 installs and boots, but its layout is unverified. The Sony XAV-AX1005DB audio profile passes offline negotiation checks only. The previously built mirroring image is withdrawn and must not be installed.

None of this is a product, and flashing firmware off the internet onto a device wired into your dashboard is exactly as unwise as it sounds. Every write tool refuses to run against hardware it does not recognise as HW501.

Coordinated by me and written with GPT-6-Astra.