The Spotify CarThing was discontinued late 2022 and subsequently heavily discounted. I got a friend of mine to send one to me, because at that time it was pretty apparent that there was a good chance of this being very hackable. First order of business for me was: internet access.

Here, we’re setting up a Raspberry Pi with a Socks-Proxy, a local webserver and the relevant settings on the CarThing itself.

The shoulders of giants

I wish to acknowledge a few projects and source without which all of the following would have been impossible.

• CarThing Reverse Engineering by error404 (check the info on the issue tracker!)
• The Car Thing Hacking Community Discord Community
• superbird-tool by bishopdynamics (flashing, activating adb)
• superbird-custom-webapp by pajowu (inspiration for how to get onto the device)

The CarThing / Superbird

Superbird is the codename of the device, which is why this word is found everywhere when you look at related projects. It is originally a custom-made device to remote-control spotify on your phone. It consists of a touchscreen, a handful of buttons and a very prominent wheel. It has bluetooth but no wifi. It also does not have a battery. It’s not a very mobile device.

The screen elements are driven by a webview.

A Linux Computer

My goal is, to have the CarThing work standalone as much as possible. Because it lacks wifi, we need something to fill the gap. A perfect place for a Raspberry Pi Zero W. I installed Raspberry Pi OS Lite on mine, did all the updates, connected wifi and activated SSH. Don’t forget to change the default password!

The next larger step was to install some kind of SOCKS-Proxy. I have no personal preference, and the first pretty simple tutorial I found was one form Digital Ocean which explains Dante. So Dante it is. We’re setting it up to route everything to wlan0. We don’t need to add the firewall-rules because this SOCKS-Proxy is not used from the outside. It’s only used from the CarThing which will be connected locally a few steps from now.

Updating

My carthing came with a very old firmware (5.12.11) that I wanted to update to the current version (8.2.5 in June 2023). Mostly because the old version apparently uses a very old webview from Qt and the newer version seems to use a chrome tab. I was not planning on connecting this to spotify, and so i turned to superbird-tool which let me update and activate adb at the same time.

supervisord.conf

After the update, we’re making a few changes to the device’s configuration. Since we now have adb, we can run adb shell mount -o remount,rw / to make the root partition writeable. We can then edit the config file with adb shell and then vi /etc/supervisord.conf. I made these changes:

• Not auto-starting superbird
• Not auto-starting swupdate
• Changing the chrome command to this:
  command=/usr/bin/chromium-browser/chrome --no-sandbox --in-process-gpu --remote-debugging-port=2222 --user-data-dir=/var/cache/chrome_storage --kiosk --disable-pinch --allow-file-access-from-files --app=http://localhost:8000 --proxy-server="socks5://127.0.0.1:1080"

Our chrome process is now trying to use our local Dante SOCKS-Proxy. It can’t reach it, yet. That’s our next step.

CTADBRPWWW

Back on our Raspberry Pi, we’re setting an ADB reverse proxy for the SOCKS Proxy port:

adb reverse tcp:1080 tcp:1080

We also want to set the correct local time on the CarThing:

adb shell date -s \"`date +"%Y-%m-%d %H:%M"`\"

(escaping is weird on this one, but the right half spits out Raspberry-Pi time in a format that i can send to the CarThing in the left half of the command.)

The only thing that’s missing right now for a first test, is a local webserver. I chose to do it this way, because I will then easily be able to change the “default” contents by just connecting to the raspberry pi. You can just as well adb push your default content all the way to the CarThing, that works well, too.

For the very first test, I’ll add an empty directory, place a HTML-file in it. That HTML-File just contains a few handwritten lines of HTML so that I can confirm that the CarThing can even load this page.

mkdir ~/car-thing-root
cd ~/car-thing-root
touch index.html

contents of the index.html (not valid HTML, that’s not the point of this file right now)

<html>
<body>
<h1>TEST</h1>
</body>
</html>

We can serve this with python -m http.server and then I personally just like to unplug and replug the CarThing to reboot it.

Hooray!

Next Steps

My next steps will be to automate all of these commands, so that this device “just works” after plugging it in.