Successfully Running Debian on the Phone

A project log for Hacking an Iris 3000 Videophone

This project has to do with my attempt of gaining full access to an ACN Iris 3000 videophone.

The SycoraxThe Sycorax 01/10/2021 at 15:450 Comments

Just a little update before I begin this log entry. This is for anyone that wants to hack their own ACN Iris 3000 but finds my log entries are  too detailed or confusing. I will be making a simple step by step tutorial for everything soon.  Hopefully within the next week or two I should have something ready, so stay tuned! 

[Continued from previous log entry]

After getting the RootFS for Debian Squeeze on the SD card, I inserted it into the ACN Iris 3000, turned it on, and logged into it through SSH (explained in my 2nd log entry). Once logged in, I could now use a set of commands to switch over to the new RootFS on the SD card. 

As mentioned in one of my previous log entries, the user AUTUIN  made a blog post in 2013 on his personal site specifically for his "Phonetendo" project. In the comment section of blog post he provides the set of commands necessary for switching over the internal RootFS to the new one. The commands that AUTUIN provided are as follows:

killall mx27
killall acn
killall dropbear
mount /proc /mnt/sd/proc -t proc
mount /sys /mnt/sd/sys -t sysfs
/sbin/pivot_root /mnt/sd /mnt/sd/mnt/mtd
cd /etc/init.d
./ssh start
exec /bin/bash

The first two commands we're not needed because there are no running processes which are called "mx27" or "acn". The third command is also not needed because it kills the phone's SSH service, and would disconnect me from it. I also had to use the command "mkdir /mnt/sd/mnt/mtd" because pivot_root needs a directory to place the old RootFS to a location in the new RootFS. This location that AUTUIN provided is at /mnt/sd/mnt/mtd and was not present on the new RootFS of my SD card. So upon doing that, I then issued the commands one by one, leaving out the first three. 

After issuing the commands I was greeted with a new bash shell and was able to use the ACN Iris 3000 as if it was running a complete standard version of Debian, and having a multitude of commands and features which the phone did not originally have. 

Just a side note, every time the ACN Iris 3000 is turned on after being powered off it will switch back to it's internal RootFS. That means that I would have to manually switch over to the new one every time I log into it. So I decided to somewhat automate the process by adding the aforementioned commands to a script which I could then run after logging into the phone through SSH. As mentioned, the first three commands are not needed and therefore I did not add them to the script.

This script, titled "sd-script", can be downloaded from the Files section of this project. After which it can be copied from a USB drive or an SD card to the ACN Iris 3000 using the "cp" command, and then executed using the command "sh ./sd-script". To execute the script properly you must be in the directory where it was copied to.

Another IMPORTANT thing to do is to either copy the directory /opt/Qtopia to another location or delete it entirely and then restart the phone. This is to make sure that the phones UI is not still running whenever you switch over to the new RootFS. If the phones UI is running then it could cause some issues in the future with accessing the phones hardware or running graphical programs from the new RootFS. Also, if /opt/Qtopia is deleted then a back up of it should be made just in case you want to bring the phone back to it's normal operations; This would be done by simply copying the backup of Qtopia to the /opt/ directory.    

In any case, I think it's fair to say that I have fully unlocked the potential of my ACN Iris 3000. The next step was to configure the Debian to install and run software packages, load kernel modules and drivers if needed, and to also give it access to hardware devices (e.g. /dev/fb0,  /dev/input/event0, etc...).

[To be continued in next log entry...]