There are many devices on the market with hardware more advanced than we imagine, and they quickly become fertile ground for enthusiasts looking for low-level access with a single goal: install and run Doom. With that in mind we come to the experiment by Josh Max, who took a landline phone equipped with an ARM SoC and a modified version of Linux, obtained root credentials after a long wait, and opened the infernal portals for the marine once more…
While part of the world is moving away from traditional landlines, there are still many products and services tied to this technology. One such service is CaptionCall, which offers phones equipped with a real-time close captioning system for users with hearing disabilities. CaptionCall phones are subsidized by the U.S. government (through the FCC and the "Americans with Disabilities Act" of 1990), and it's not hard to find used units at reasonable prices (less than $30).
CaptionCall phones have another interesting detail: they are essentially computers. On his personal blog, Josh Max explains that a CaptionCall phone has an ARMv7 i.MX6 SoC, 1 GB of DDR3 RAM, and 4 GB of NAND storage. The problem is that its software is locked up tight, and by using a modified version of the Linux kernel, the company has been accused of violating the GPL. Josh decided not to stop there and proceeded to hack the phone with one idea in mind: Run Doom.
How to run Doom on a hacked landline phone
After some external testing, Josh opened the phone and found a UART access point, which in turn allowed him to reach the system console. The root account was protected, but with a U-Boot console available (by pressing Escape in the first second after powering on the phone), Josh initiated a firmware dump via U-Boot over a serial connection... which took nine hours, and required several attempts due to communication interference.
With his dump complete, Josh used binwalk to decompress the image, and "John" (I believe it's John the Ripper) to crack the root password, which fell in less than ten seconds. In the final phase, Josh removed the phone's proprietary interface, installed a chroot for Debian Jessie ARM, re-enabled audio, video, and touch support, loaded IceWM, and finally, DOOM.
The best part? Josh's work turns the CaptionCall into an excellent low-cost development platform. He is currently reverse-engineering the code (since the company doesn't share it), and hopes to achieve 3D acceleration. DOOM is just the beginning...
Sources: Josh Max's personal blog, Hackaday.
