AirCard-iOS: Wallet card skins and passcode themes on iOS 27 without a jailbreak

LocalDevVPN and AirliftFFI route file writes through a loopback tunnel

AirCard-iOS does not use an Apple-sanctioned API to modify Wallet card artwork or passcode themes. The mechanism starts with LocalDevVPN, which runs in loopback mode and exposes internal device services at two addresses: `10.7.0.1` or `127.0.0.1`. Over that local channel, file operations travel through `AirliftFFI`, a compiled Rust static library packaged as `AirliftFFI.xcframework/` at the repository root. It carries an `arm64` implementation and its headers, and interfaces with the AirTraffic service, which is the layer that can write to cache paths a standard sandboxed app cannot reach.

The Credits section traces `AirliftFFI` to AirLift, a project by 0xjohnnydev, described as "AirTraffic and ATAirlock sandbox escape research." The Overview section says the app works "without a jailbreak," and that claim is technically accurate in the sense that no kernel patch is applied. What the repository's own structure table adds is that `AppViewModel.swift` handles "State management and exploit orchestration," using the word "exploit" in the project's file-to-function mapping. That detail appears only in the structural listing, not in the Features section.

v1.3, released on 2026-09-20, is the current version, and the MIT licence covers the app itself.

Wallet skins overwrite three specific Passbook cache files, including a PDF for transit cards

Applying a custom skin to a Wallet card does not go through Wallet's own UI. Card identifier detection runs while Apple Pay is active, and the app writes to three cache files: `[email protected]`, `@2x.png`, and `cardBackgroundCombined.pdf`. The PDF target is there specifically for transit cards such as Suica, which use that format in the Passbook cache.

After writing the cache files, the app flushes both the front-face and thumbnail caches so new artwork shows up immediately when Wallet opens next, rather than waiting for the cache to expire on its own. A batch mode lets all detected cards be flashed in a single pass. The README does not describe a way to restore the original cache files if a flash produces a display problem, and no undo command is mentioned anywhere in the project documentation.

Passcode dialer themes write to TelephonyUI-10 and package as .passthm files

The passcode dialer on the lock screen is the second customization target. Two layout choices are available: a single image stretched across all 10 buttons together, or a separate circular cutout for each one. Before committing a change, a live preview inside the app shows panning and zoom controls so the framing can be adjusted. The system path written is `TelephonyUI-10`, a dialer cache directory.

Themes include localized number subtext options. The README names Ukrainian and Russian Cyrillic layouts specifically, alongside the standard numeric labels. Finished themes are saved and shared as `.passthm` files, with both import and export supported. No documentation in the repository gives the internal format of a `.passthm` file or the steps for building one from scratch; only applying an imported theme and exporting a finished one are covered.

PosterBoard wallpapers arrive as .tendies archives and apply through a NeoSpring respring

Lock screen wallpapers in AirCard-iOS use a custom archive format with the `.tendies` extension. A user imports a `.tendies` file from the iOS Files app, and `TendiesEngine.swift`, listed in the repository structure table as handling "Tendies extraction and injection logic," unpacks the contents and injects them. The engine auto-detects the active PosterBoard wallpaper container and the descriptor UUIDs associated with it, then writes wallpaper configurations and assets into PosterBoard storage.

After injection, the app triggers a respring through `RespringHelper.swift`. The Credits section names NeoSpring as the respring library, with the Swift implementation credited to @skadz108 and @rooootdev and the WebKit GPU process respring technique to @neonmodder123. That respring restarts the UIKit layer so the new wallpaper takes effect without rebooting. Neither the README nor any other project file describes what the app does if UUID detection returns an empty result or if PosterBoard storage is in a state the engine does not recognize.

Sideloading is the only installation path; the App Store is not supported

AirCard-iOS is not distributed through the App Store. The README gives five installation methods for the pre-built IPA: SideStore or AltStore, TrollStore, LiveContainer, and Xcode or iOS App Signer. No guidance is given on which method is preferred, and no behavior differences between them are described.

Three prerequisites must all be in place before any customization is possible. The device must run iOS 27.0 or newer. LocalDevVPN must already be running in loopback mode at `10.7.0.1` or `127.0.0.1`. Developer Mode pairing must be completed through Settings > Privacy & Security > Developer Mode > Pair with AirCard-iOS, which writes a record to `aircard_pairing.plist`. Users with an existing pairing plist can place it in the app's documents directory to skip that Settings step. The repository includes `NetworkStatus.swift`, listed as handling "VPN loopback detection," but the README says nothing about what the app displays when the connection is absent.

Building the IPA needs macOS 14, Xcode 16 and XcodeGen; the Rust toolchain is optional

For users who want to build from source, the requirements are macOS 14.0 or newer, Xcode 16 or newer, and XcodeGen. XcodeGen reads `project.yml` at the repository root and generates the Xcode project file. The build command is:

git clone https://github.com/mak5er/AirCard-iOS.git
cd AirCard-iOS
./build-ipa.sh

That script writes the completed package to `build/AirCard-iOS.ipa`. A second script, `build-ios.sh`, recompiles the Rust framework in `rust-core/`. The Rust toolchain is marked as optional because a compiled `AirliftFFI.xcframework/` is already in the repository root, so the Swift build can proceed without rebuilding the native layer.

One entry in the repository structure is not Swift or Rust: `GrappaHelper.[h,m]`. The `.h` and `.m` extensions are Objective-C file extensions, for a header and implementation pair respectively, and the structure table lists the module as handling "ATC protocol helpers." An Objective-C source file in a SwiftUI project requires a bridging header, though the README does not mention this build detail.

iOS 27.0 is a hard floor, and the VPN loopback is a permanent dependency for every feature

Every feature depends on the LocalDevVPN loopback tunnel being active. Without that connection, the app has no path to AirTraffic, which means no writes to Passbook caches, no passcode theme changes, and no PosterBoard injection. The README does not document a graceful degradation state, and `NetworkStatus.swift` detects VPN status without any further documentation about what the user sees when detection fails.

The iOS 27.0 minimum is stated twice in the README: once in the badge metadata and once in the Prerequisites section. Cache paths such as `TelephonyUI-10` and the Passbook file names are specific to iOS internals. A point release that changes those paths would break the app until the project ships an update, and no iOS beta or release candidate testing is described in the repository. There is also no path for devices where Developer Mode is locked out by an MDM profile, since the pairing step requires that setting to be accessible from within Settings.

Editorial conclusion

AirCard-iOS fits anyone who wants custom Apple Wallet card artwork or passcode dialer graphics on a device running iOS 27.0 or newer and can sideload an unsigned IPA while keeping LocalDevVPN running. It does not suit users who need App Store distribution, devices older than iOS 27, or environments where Developer Mode is restricted by an MDM profile. Before installing, confirm that your chosen sideloading tool, whether SideStore, AltStore, TrollStore, LiveContainer or Xcode, already works on your device. The README documents no recovery steps if the VPN loopback or Developer Mode pairing handshake fails during a flash.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Mak5er/AirCard-iOS on GitHub
4. README
5. Releases