Close

Running Debian on the Phone

A project log for Hacking an Iris 3000 Videophone

This project is centered around repurposing the ACN Iris 3000 videophone, with an aim to unlock its full capabilities.

the-sycoraxThe Sycorax 01/10/2021 at 15:450 Comments

[Continued from previous log entry]

Following the successful transfer of Debian Squeeze's root filesystem to an SD card, the SD card was inserted into an ACN Iris 3000. The device was subsequently powered on and SSH was utilized to gain access to its system. Having logged into the device, a series of commands were executed to transition from the internal root filesystem to the newly loaded root filesystem on the SD card.

As documented in a prior log entry, a user named AUTUIN provided valuable insight through a blog post from 2013, specifically related to his "Phonetendo" project. Particularly useful was a sequence of commands mentioned in the blog's comment section that facilitate the transition to the SD Card filesystem. The specific commands provided by AUTUIN are:

killall mx27
killall acn
killall dropbear
mount /proc /mnt/sd/proc -t proc
mount /sys /mnt/sd/sys -t sysfs
/sbin/pivot_root /mnt/sd /mnt/sd/mnt/mtd
cd /etc/init.d
./ssh start
exec /bin/bash

The relevance of the first two commands depends on the specific processes running on your device. I used the "ps aux" command to see which processes were running on the videophone and in my case, there were no active processes named "mx27" or "acn". This was probably due to AUTIIN's Iris 3000 running an earlier version operating system. However, I did notice that there was a running process called "veditions_mx27_fs_r3". This is essentially the main UI process for the device. I presume this is a variant of the "mx27" process (listed above) as implied by it's name. Therefore, I proceeded to terminate it using the command "killall veditions_mx27_fs_r3".

This action led to an unexpected reboot of my Iris 3000. After an hour or so of investigating the cause, it turns out that this was triggered by a safeguard mechanism within a bash script called "healthmon". This script essentially reboots the phone if a disruption in the UI process is observed. This fail-safe makes sense for consumer-oriented devices but for the purposes of this project it was no longer needed. To circumvent this fail-safe, I accessed the "healthmon" script via the "vi" text editor and removed any instance of the reboot command. I would recommend doing this if your device should exhibit similar behavior.

After making those changes, terminating the UI process no longer led to an unexpected reboot of the device. Moving on, issuing the third command serves to terminate the SSH service. I did not execute this command as it would result in an interruption to my SSH connection with the device.

Prior to running the series of commands, it was necessary to generate a new directory using the command "mkdir /mnt/sd/mnt/mtd". This action is vital because of the specific needs of the pivot_root command.

The pivot_root command essentially exchanges the root filesystem of a running system. It allows one filesystem to become the new root filesystem while simultaneously shifting the old root filesystem to another directory, in this case, /mnt/sd/mnt/mtd. This particular configuration is necessary for the pivot_root command because it's a two-step process involving both 'unmounting' and 'mounting' actions. 

When the pivot_root command is executed, the existing root filesystem is moved to the directory that we created (i.e., /mnt/sd/mnt/mtd), making way for the new root filesystem (from our Debian-loaded SD card) to take its place. Thus, the directory must exist prior to the execution of the pivot_root command. Once the directory was created, I proceeded to execute the necessary commands sequentially, omitting the ones that were irrelevant to my specific circumstances (as previously mentioned). 

These are the commands I used:

killall veditions_mx27_fs_r3 (The name of the UI process may be different for your device)
mount /proc /mnt/sd/proc -t proc
mount /sys /mnt/sd/sys -t sysfs
mkdir /mnt/sd/mnt/mtd
/sbin/pivot_root /mnt/sd /mnt/sd/mnt/mtd
cd /etc/init.d
./ssh start
exec /bin/bash

Following the successful execution of these commands, a new bash shell was initiated (pictured below). At this point, the ACN Iris 3000 was effectively operating on a standard Debian Squeeze setup, unlocking a plethora of features that were not originally present. This expanded functionality significantly broadened the device's potential uses.

It is important to note that these changes are not persistent. Each time the ACN Iris 3000 is rebooted, it reverts to its original internal operating system, necessitating a manual transition to the SD Card filesystem. To streamline this process, I developed a script named sd-script-v1. This script can be obtained from this project's Files section and should be copied to the SD card's root directory. Upon insertion of the SD card and SSH login, the script can be invoked with the command "sh /mnt/sd/sd-script-v1".

While it's theoretically possible to execute this script automatically post-boot, this is not recommended due to the risk of causing a soft brick condition if incorrectly configured.

An additional feature incorporated into the script is a mechanism to halt the phone's UI prior to transitioning to Debian. This is crucial to avoid potential issues when running graphical programs or accessing the phone's hardware (e.g., screen or keypad) while the Debian OS is active.

With these steps completed, I believe I have effectively maximized the potential of the ACN Iris 3000. The next stage involves configuring Debian to install and run software packages, load any necessary kernel modules and drivers, and grant access to the device's hardware devices (e.g., /dev/fb0, /dev/input/event0, etc...).

[To be continued...]

Discussions