• Displaying Images on the Phone

    The Sycorax01/23/2021 at 22:40 0 comments

    [Continued from previous log entry]

    Once APT was configured, I was now able to download and install software to the phone. At this point the phone was basically a low end but fully functional Linux computer and I could pretty much do whatever I wanted, with the exception of a few limitations. I wanted to start off small though and then work my way up to installing more advanced software. 

    The first thing that I wanted to install was something that could display a picture on the phones LCD display. I decided to use a program called "fbi" (framebuffer imageviewer) to do that. This program has nothing to do with the actual FBI so don't let the name fool you. It just simply display's images on the framebuffer device (/dev/fb0).                                                      

                               Displaying Images Using fbi

    To download and install fbi I issue the following command: 

    apt-get install fbi

    This will also install additional dependencies that are needed for the program to work. The installation will only use about 31.1 MB's of disk space so it's pretty small.


    Once fbi is installed I needed to obtain an image to display on the screen. So changed my directory to /home/user/ (the location that I use for things that I download), and then used wget to download an image of the of the Debian logo to the phone (Pictured below).

    wget --no-check-certificate https://wiki.videolan.org/images/Debian-logo.jpg

      *The argument --no-check-certificate is be used because Debian Squeeze has an older version of Open SSL and therefore dose not support https. I will get into updating Open SSL for Debian Squeeze in a future log entry.


    Once the image is downloaded, fbi could then be used to display it to the phones LCD. To try and do that I issued the following command:

    fbi -d /dev/fb0 ./Debian-logo.jpg

    Using what I assumed were the correct command arguments, I got an error  message (Pictured below).

    Doing a little bit of research, I found that fbi needs access to a TTY to display an image. So I re-issued the command with an additional argument (-T 1) to give it access to /dev/tty1. 

    fbi -d /dev/fb0 -T 1 ./Debian-logo.jpg

    This time I got a different error message (Pictured below).

    Noticing this, I realized that I did not add tty1 to /dev/. So just as I did in one of my previous log entries about accessing the phones hardware, I used the following mknod command to do that. 

    mknod /dev/tty1 c 4 1

    After doing that, I issued the fbi command again and was able to successfully display the image to the phones LCD (Pictured below).

    Now that I had the ability to display images on the phone, I wanted to see what else I could do. So I decided to begin experimenting with more advanced software that can be run on the device including DOOM, which I will cover in a future log entry.

    [To be continued in next log entry...]

  • Configuring the Package Manager

    The Sycorax01/19/2021 at 15:47 0 comments

    [Continued from previous log entry]

    To download and install software on the phone I used the default package manager, APT, which already comes with Debian. However it must be configured first. APT relies on the file /etc/apt/sources.list to locate, retrieve, and obtain information about the desired repositories of software packages that are available on the internetThe repositories for Debian Squeeze that were originally included in it's sources.list file are no longer hosted on the internet, so therefore I had to find one that still is and then add it to it's sources.list file, in order to make use of APT for the retrieval and installation of software packages.

    A few Google searches later and I was able to find a repository for Debian Squeeze that is still hosted (Included below).

    deb http://archive.debian.org/debian squeeze main

    This repository is the official archive for all of the software packages that are available for and compatible with Debian Squeeze.

    To add the repository to sources.list I used "nano" to edit the file by issuing the following command:

    nano /etc/apt/sources.list

    I commented out the already existing repositories and added the new one, as pictured below.

    After that I saved the file and then issued the command "apt-get update" in order to download the package lists from the repository, and update them to get information on the newest available software for Debian Squeeze. After doing that, I was then able to get software downloaded and installed on the phone using "apt-get install".

    If  "apt-get update" fails and you get an error that says "Temporary failure resolving 'archive.debian.org'" then run the command:

    echo "nameserver 8.8.8.8" | tee /etc/resolv.conf > /dev/null 
    

    *This changes the DNS server that Debian uses to one that can resolve the IP address associated with the repository that we've added to the "sources.list" file. In this case, the DNS server we use is Google's. But you can use another one of your choosing.

    After doing that , run the command "apt-get update" again and it should work.

    [To be continued in next log entry...]

  • Allowing Access to the Phone's Hardware

    The Sycorax01/10/2021 at 20:31 0 comments

    [Continued from previous log entry]

    Having Debian running on the phone was good and all but to do anything useful with it I had to first set it up so that I could install software packages and give it access to the phone's hardware. The first step was to give Debian access to the phone's hardware devices. This can be done by using the "mknod" command, which is mainly used to create the character and block devices that populate /dev/. Tutorials on how to use mknod can easily be found on the internet. The two main hardware devices that I want to allow Debian to access are the LCD display and the keypad.

    Just for reference here is a link to the Linux Device List (https://tinyurl.com/yysktwsq). This list is the official registry of all allocated device numbers and /dev/ directory nodes for the Linux operating. When using the mknod command this device list is a very important reference to have when populating /dev/ with character or block devices.                                                                       

                                             Accessing the Display

    I wanted to first give Debian access to the Linux Framebuffer device (/dev/fb0) which is what drives the phone's LCD display. To do that I issued the following command:

    mknod /dev/fb0 c 29 0

    I then used the "ls /dev" just to make sure that fb0 was added to /dev/. Which it was (Pictured below).

    The next step was to test the framebuffer device in order to see if Debian can actually make use of it and display some form of graphics. I did this by issuing the following command:

    cat /dev/urandom > /dev/fb0

     The command will basically write random pixels to the phone's display as pictured below.

    To clear the display I used the command:

    cat /dev/zero > /dev/fb0

                                                                      

                                              Accessing User Input

    Now that Debian was able to access the framebuffer and display graphics to the screen, I then wanted to get user input working by giving it access to the phone's keypad (/dev/input/event0). So I first created the input directory at /dev/ with the command "mkdir /dev/input/". I then issued the following command to add "event0" to /dev/input/.     

    mknod /dev/input/event0 c 13 64

    As I did previously did with /dev/fb0, I checked to make sure that event0 had been successfully added to /dev/input/ (Pictured below). 

    I then tested to make sure that input on the keypad was working properly. I did this by issuing the following command:

    cat /dev/input/event0 | hexdump

    This command will basically output a hexdump of the the data received from the phone's keypad as I press down on it's keys. 

    *To return back to the shell use Ctrl+C.

                                                    What's Next?

    Now that Debian has access to these two main hardware devices, the next thing that I wanted to do is to download and install software on the phone.

    [To be continued in next log entry...]

  • Running Debian on the Phone

    The Sycorax01/10/2021 at 15:45 0 comments

    Just a little update before I begin this log entry. This is for anyone that wants to hack their own ACN Iris 3000 but finds my log entries are  too detailed or confusing. I will be making a simple step by step tutorial for everything soon.  Hopefully within the next week or two I should have something ready, so stay tuned! 

    [Continued from previous log entry]

    After getting Debian Squeeze on the SD card, I inserted it into the ACN Iris 3000, turned it on, and logged into it through SSH (explained in my 2nd log entry). Once logged in, I could now use a set of commands to switch over to the SD Card loaded with Debian Squeeze. 

    As mentioned in one of my previous log entries, the user AUTUIN  made a blog post in 2013 on his personal site specifically for his "Phonetendo" project. In the comment section of the blog post he provides the set of commands that are necessary for switching over to the SD Card. The commands that AUTUIN provided are as follows:

    killall mx27 (not needed)
    killall acn (not needed)
    killall dropbear (not needed)
    mount /proc /mnt/sd/proc -t proc
    mount /sys /mnt/sd/sys -t sysfs
    /sbin/pivot_root /mnt/sd /mnt/sd/mnt/mtd
    cd /etc/init.d
    ./ssh start
    exec /bin/bash

    *Don't run any of these commands yet. I made a script to do this automatically. Please read on. 

    The first two commands we're not needed because there are no running processes which are called "mx27" or "acn". The third command is also not needed because it kills the phone's SSH service, and would disconnect me from it. 

    Before issuing the set of commands I had to type the command "mkdir /mnt/sd/mnt/mtd", this is because pivot_root needs a directory in the Root Partition of Debian Squeeze to mount the phone's original Root Partition. I then issued the commands one by one, leaving out the first three. 

    After issuing the commands I was greeted with a new bash shell and was able to use the ACN Iris 3000 as if it was running a standard version of Debian Squeeze...which it basically was at this point. I now had multitude of commands and features which the phone did not originally have, that means that I can do a lot more with it then what it was originally designed for, e.g. running DOOM!!!

                                                   Automating This Process

    Remember, this is not permanent. Every time the ACN Iris 3000 is turned on after being powered off it will switch back to it's internal OS. That means one would have to manually switch over to the SD Card loaded with Debian every time they log into the phone. This was annoying...So I decided to create a script that can do this automatically. The script is called sd-script-v1 and can be downloaded from the Files section of this project. After which, it should be copied to the root directory of the SD card.  When the SD card is inserted into the phone and you are logged into it through SSH then the script can be executed by issuing the command "sh /mnt/sd/sd-script-v1". 

    *There are ways to run the script after the phone boots up but I wouldn't recommend doing this because it could soft brick the phone if configured the wrong way. 

    Another important thing that I've added to the script is a way to stop the phones UI before it switches over to Debian. If the phones UI is running while it is running Debian then it could cause some issues with running graphical programs and accessing the phones hardware (e.g. the screen or keypad). 

    Anyway, I think it's fair to say that I have fully unlocked the potential of my ACN Iris 3000. The next step was to configure the Debian to install and run software packages, load kernel modules and drivers if needed, and to give it access to the phones hardware devices (e.g. /dev/fb0,  /dev/input/event0, etc...)....

    Read more »

  • Transferring Debian to an SD Card

    The Sycorax12/31/2020 at 03:39 0 comments

    [Continued from previous log entry]

    To get the virtual partitions within the QCOW2 image transferred to the SD card I went back the second tutorial that I found (Which I've mentioned in one of my previous log entries). The tutorial provides a way to convert a QCOW image to a raw image format, then kpartx would be used to mount the virtual partitions to the PC, then rsync would be used to transfer the mounted partitions to a USB stick. This would work but to me this method was inefficient and time consuming so I decided to not go this route. I had to find other options.

    Doing more research, I found a Stack Exchange question that was posted by a user in 2011 which has to do with transferring a QCOW2 image to a physical drive. The answer that was provided in the post was enough information for me to successfully do the same thing. The following command is the answer to the user's question. 

    qemu-img convert -f qcow2 -O raw my-qcow2.img /dev/sdb

    *Don't issue this command yet.

    Just like the in the second tutorial that I found, this uses the qemu-img command but with different arguments which allows for the virtual partitions within the QCOW2 image to be transferred/converted to physical media.  I altered the command arguments to include the QCOW2 image for Debian Squeeze and the storage device that I want it to be transferred to. I also included the -p argument in order to view the progress of the transfer. The final command is as follows:

    sudo qemu-img convert -p -f qcow2 -O raw debian_squeeze_armel_standard.qcow2 /dev/sdb 
    
    

    *Very Important: Before running this command please make sure that the storage device that you are transferring everything to is the SD Card and NOT another drive! This command will format everything on whichever drive that it is pointing to, so make sure that the last argument of the command matches the /dev/ node of  your SD Card. You can find this out by using Gparted or the "fdisk -l" command. 

    I ran the command and the transfer of the QCOW2 image began. The transfer took about 30 minuets. When it was complete I saw that the SD card was mounted properly and had the entire Root Filesystem of Debian Squeeze on it. This was great, and meant that I now had Debian Squeeze loaded on an SD Card. This also meant that I could now insert the SD Card into the ACN Iris 3000, and run Debian Squeeze on the phone by issuing a set of commands that switches over to it.

    [To be continued in next log entry...]

  • A New Hope: Obtaining Debian Squeeze

    The Sycorax12/23/2020 at 23:49 0 comments

    [Continued from previous log entry]

    As I continued my research, I discovered that the website which explains how to install Debian on an emulated ARM machine (The one that AUTUIN added to his Blogspot article), includes a link to an archive where I could download QCOW2 images of pre-installed versions Debian Squeeze and run them in QEMU. This was just what I needed and was the only feasible option that I could find for obtaining Debian with a kernel version that was as close to the ACN Iris 3000's as possible. So I decided to go along with it.

    The archive includes two versions of Debian Squeeze. The standard version and the desktop version. The standard version is just a basic command line interface, while the desktop version includes a fully fledged GUI interface. I decided to download the standard version for performance and compatibility purposes. The files that I downloaded from the archive was the kernel image (vmlinuz-2.6.32-5-versatile), the initrd image (initrd.img-2.6.32-5-versatile), and the QCOW2 image with a pre-installed version of Debian Squeeze (debian_squeeze_armel_standard.qcow2).  

    I had to make sure that everything would run properly in QEMU. Thankfully enough, the page for the archive includes the commands for doing just that. The Linux command to run the aforementioned files in QEMU is as follows:

    qemu-system-arm -M versatilepb -kernel vmlinuz-2.6.32-5-versatile -initrd initrd.img-2.6.32-5-versatile -hda debian_squeeze_armel_standard.qcow2 -append "root=/dev/sda1

    Upon running the command, a QEMU window appeared and Debian Squeeze began to boot up. Within a minute or so I was able to log in by typing "root" as the username and password.

     Now that I knew that Debian Squeeze could run properly in QEMU, the next step was to transfer the virtual partitions of the QCOW2 image  (pre-installed with Debian Squeeze) to an SD Card. At this point I was no longer working with a QCOW image but rather a QCOW2 image which is basically an updated version of the QCOW format. This didn't matter much because both types can be transferred to physical media in the same fashion. 

    However, before I did that I needed to know the exact size of the virtual partition within the QCOW2 image so I could determine how much space the SD card should have. This is because QCOW2 images use compression and are read by QEMU in a decompressed manor. The compressed file size of a QCOW2 image dose not equate to the actual size of it's partitions if decompressed, or transferred to physical media. In fact it is multitudes larger. 

    So while I was still running Debian Squeeze in QEMU, I used the command fdisk -l to determine how big the virtual partition within the QCOW2 image actually is. I and found that that virtual partition it is nearly 88 times larger then it's initial compressed size of 305.9 MB. Equating to 26.8 GB when decompressed or transferred to physical media. Now that I knew how big the partition would, I decided to use a 32 GB SD card to transfer it to. After this I no longer had to use QEMU.  

    [To be continued in next log entry...]


  • Doing More Research

    The Sycorax12/17/2020 at 21:36 0 comments

    [Continued from previous log entry]

    After gaining a root shell on the phone, I wanted to get a better version of Linux running on it. So I did more research and discovered that AUTUIN has his own personal blog which is dedicated to his various electronics projects, but it has not been active since 2018. On his blog site he made a post in 2013 specifically for his "Phonetendo" project. Just like his Blogspot article he did not explain a step by step process that he took for actually putting Linux on an SD card. However, in the comment section of his post he dose in fact provide the commands that are needed for switching over the phone's internal OS to one that is on SD card. This saved me a lot of time because without the commands I probably would have had to do even more research. 

    Having commands for switching over the phones internal OS to a new one was great and all. But to actually make it happen I needed to first figure out how to put Linux on an SD card. So I went back to AUTUIN's Blogspot article. And in the section titled "A Better Operating System", AUTUIN included a link which includes similar steps that he used for doing just that. So I clicked the link and it brought me to a website that explains how to install Debian Etch to a QCOW image using QEMU

    This was a big step forward because from what I understand, QCOW images are basically virtual hard drives that are used by QEMU to contain a variety of disk images and partitions which are generally associated with most operating systems. QCOW images can also be converted into various formats, and transferred to a physical storage device such as an SD card. This was precisely what I needed. 

    Anyway, the links that the website provides for the Debian Etch installer are no longer hosted, meaning it can't be downloaded. This was quite the bottleneck, so I had to find another way of getting Debian installed to a QCOW image using QEMU. 

    Doing more research I found a blog created in September 2015 by an unknown user who successfully got Debian Linux running on the ACN Iris 3000. They provide a step by step tutorial for installing Debian Squeeze to a QCOW image using QEMU. The QCOW image would then be converted into a raw format and then transferred to an SD card. Unlike the previous website, this one provides the URL's for the Debian Squeeze installer and kernel, which can still be downloaded. 

    By following this new step by step tutorial I was able to get the Debian Squeeze Installer running in QEMU. However it is not an offline installer. It needs to download the necessary files to install Debian Squeeze on the virtual partition within the QCOW image. These files are usually downloaded by the installer from a single server/mirror that is included in a list of many. This server/mirror is typically chosen by the user in the installation menu. The issue that arises is that Debian Squeeze is unfortunately too old, and is not supported anymore. Because of this, the files that are necessary to install it are no longer hosted on any of the servers/mirrors that are listed in the installer. Therefore I was not able to install Debian in this manner. 

    A newer version of Debian can be installed this way but it will not be able run on the ACN Iris 3000 because it's kernel is too old. The kernel version for Debian has to be as close to the kernel version of the ACN Iris 3000 as possible. The ACN Iris 3000 uses the kernel version 2.6.22.6. Therefore the only possible option is to use Debian Squeeze which has a kernel version of 2.6.32.5 because anything newer uses kernel version 3.2 or above.

    [To be continued in next log entry...]


  • Gaining a Root Shell on the Device

    The Sycorax12/11/2020 at 20:51 0 comments

    2[Continued from previous log entry]

    While scouring through the forum thread that AUTUIN provided in his Blogspot Article, I found a lot of information and resources for gaining full access to the ACN Iris 3000. The forum thread is pretty long so I'm not going to go into to much detail on it. But by reading through the thread, it seems that at one point the ACN Iris 3000 had an active but small community of people who we're dedicated to tinkering around with it. Unfortunately it seems that there hasn't been much activity since 2017, with only a few posts from users since then.   

    As I read through the thread I discovered that the user Joshoa was one of the main contributors of information, resources, and methods for gaining a root shell on the device. One of the methods that he provides is a way to update the flash storage of phone by using an SD card loaded with some files that he put together. This method would allow a user to gain a root shell of the phone though SSH.  I decided to use that method because it seemed to be the most easiest one. 

    As discussion on the thread went on, Joshoa would provided updated versions of his SD card method. All versions of it an be found at this archive https://www.techidiots.net/notes/iris-3000/downloads. The archive also includes an in depth PDF document titled "Tinkering with Iris-3000 aka CU776" which provides a wealth of information, much more then what the forum thread provides in my opinion. So it became the main resource that I used for gaining a root shell on the phone.

    By following the steps outlined in the PDF, everything for the most part was a simple and straight forward process. I downloaded Joshoa's sd-upgrade-v-02.zip and extracted the files from it. I then formatted an SD card to FAT32 and copied the extracted files to it. After I did that I inserted the SD card into the phone, turned the phone on, and watched as the update process took place. 

    Once the update was complete I turned off the phone, ejected the SD card, then turned the phone back on again in order to prevent it from going through the update process again. According to the PDF, once the phone is updated and booted up I should then be able to log into it through SSH. Thus, gaining a root shell to the phone.

    By using Windows PowerShell I was able to use the following command so that I could log into the phone through SSH.

    ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -c aes128-cbc -t root@192.168.2.110 -p 7022

    *Replace the IP Address with the one for your ACN Iris 3000.*

    If Windows PowerShell dose not work then using a third party ssh client is recommended. 

    After successfully logging into the device using the password "1234"  I was greeted with a low level, bare bones Linux shell, lacking many of the advanced feature that you would normally find in a standard Linux OS. Despite this, I was able to have a lot of control over the internals of the device.  

    Now that I had full access to the phone, The next step was to get Linux running on it. 

    [To be continued in next log entry...]

  • Where do we begin?

    The Sycorax12/11/2020 at 18:51 0 comments

    Like I said in the description of this project, I had bought an ACN Iris 3000 for $10 at a thrift shop. I had bought it in January of 2020 because around that time I was into re-purposing costumer electronics to take full advantage of their hardware and software capabilities. Assuming that the device ran on some form of Linux, and that it could be accessed through conventional means, I decided to turn it into a full on project. My assumption was right, and I found out that this device not only runs Linux but that it can also be accessed very easily.

    A simple Google search of "ACN iris 300 hack" led me to a Hackaday article published in November of 2012 about a project called "Phonetendo" by someone who goes by the username "AUTUIN". The Hackaday article outlines how AUTUIN was able to telnet into a root shell on the ACN Iris 3000, gaining complete access to it's internal Linux operating system. The article further goes on to explain that AUTUIN was then able to load the RootFS of Debian Linux to an SD card, insert it into the SD card slot of their ACN Iris 3000, and then use the "pivot_root" command to switch over from the phones internal OS to the one that is loaded on the SD card. This would allow the phone to be used like a regular linux computer and give it a multitude of features that it didn't have before. Furthermore, AUTUIN then developed a small office game that was able to be played on the device. For those who don't know RootFS means Root Filesystem

    The Hackaday article then led me to a Blogspot article, published by AUTUIN, which gives great detail on his project, including the information that he was able to find out about the ACN Iris 3000 regarding it's hardware and software capabilities, and then using that as a means to completely reverse engineer the device. This article was a very important resource for what I wanted to do, however more research was needed because the article dose not explain a step by step process that AUTUIN took for loading Debian Linux on an SD card, nor dose it include the commands needed for switching over the phone's internal OS to a new one. 

    As a side note, the Blogspot site which his article is published on has not seen activity since 2014 and is not owned by AUTUIN but rather by a non-profit community organization called  Free Geek Vancouver. I know this has nothing to do with my project but they're a pretty cool organization with principles based on Free and Open Source Software, Reducing Environmental Impact of E-waste, and Transparent Consensus-Based Organization. Here's a link to their website if you want to check them out  https://www.freegeekvancouver.org/

    Aside from all of that, I first needed to gain a root shell in order to access the device. Luckily AUTUIN  provided a link in his Blogspot article to a forum thread which provides a wealth of information for doing just that.

    [To be continued in next log entry...]