DOOM On A Desk Phone Is Just The Tip Of The Iceberg

These days we expect even the cheapest of burner smartphones to feature a multi-core processor, at least a gigabyte of RAM, and a Linux-based operating system. But obviously those sort of specs are unnecessary for an old school POTS desktop phone. Well, that’s what we thought. Then [Josh Max] wrote in to tell us about his adventures in hacking the CaptionCall, and now we’re eager to see what the community can do with root access on a surprisingly powerful Linux phone.

As the names implies, the CaptionCall is a desk phone with an LCD above the keypad that shows real-time captions. Anyone in the United States with hearing loss can get one of these phones for free from the government, so naturally they sell for peanuts on the second hand market. Well, at least they did. Then [Josh] had to go ahead and crack the root password for the ARMv7 i.MX6 powered phone, started poking around inside of its 4 GB of onboard NAND, and got the thing running DOOM.

Tapping into the serial port.

If you’re interested in the technical details, [Josh] has done a great job taking us step by step through his process. It’s a story that will be at least somewhat familiar to anyone who’s played around with embedded Linux devices, and unsurprisingly, starts with locating a serial port header on the PCB.

Finding the environment variables to pretty tightly locked down, he took the slow-route and dumped the phone’s firmware 80 characters at a time with U-Boot’s “memory display” command. Passing the recovered firmware image through binwalk and a password cracker got him the root credentials in short order, and from there, that serial port got a whole lot more useful.

[Josh] kicked the phone’s original UI to the curb, set up an ARM Debian Jessie chroot, and started working his way towards a fully functional Linux environment. With audio, video, and even keypad support secured, he was ready to boot up everyone’s favorite 1993 shooter. He’s been kind enough to share his work in a GitHub repository, and while it might not be a turn-key experience, all the pieces are here to fully bend the hardware to your will.

Historically, running DOOM on a new piece of hardware has been the harbinger of bigger and better things to come. With unfettered access to its Linux operating system up for grabs, we predict the CaptionCall is going to become a popular hacking target going forward, and we can’t wait to see it.

21 thoughts on “DOOM On A Desk Phone Is Just The Tip Of The Iceberg

      1. You’re correct, of course.
        It was a 386DX-33 with 4 mb of RAM and a whopping 40 mb worth of spinning rust. It also had a VGA video card with a whopping 512 kb of VRAM, if memory serves. It might have only been 256k, not sure.

        I think I also had a 387 math co-processor in it. Anyone else remember those?

    1. He mentions in the write-up that he got Bluetooth working, but I’d be surprised if the SoC didn’t have some integrated USB support that just hasn’t been broken out to a port.

  1. For anyone else curious about the state of work, I’m currently reverse-engineering the platform code in their kernel (since they still refuse to provide their source tree) in order to get mainline workable on it. After that, it should be a breeze to compile in support for the Vivante GPU and get hardware-accelerated 3D graphics instead of using swrast.

        1. If they’ve modified the kernel (which it seems they have, since he can’t get a vanilla mainline to run on it), then at the very least they should be releasing their patches.

          It’s also entirely possible some other GPL-covered system components were fiddled with in the course of developing their GUI, but the kernel is a given.

  2. I could see a real use for this… if DOOM can be installed, so can any SIP client.

    I don’t have a PSTN telephone line anymore, but do still have a land-line via VoIP, and have been pretty underwhelmed with the commercially available IP phone offerings I’ve seen so far.

  3. You’re thinking 486SX vs DX. The 386SX was a 16 bit bus part that could run on 286 motherboard chipsets and was limited to 16 megabytes of RAM. The 386DX was a 32 bit bus part that could actually (theoretically at least, since no chipsets actually did…) support 4 gigabytes of RAM (although I think the chips may have had a lower limit of 512 meg or something, regardless of the chipset itself.) Neither model had an integrated 80387 FPU, which had to be purchased separately if you wanted bearable floating point calculations.

    Source: I had a 386SX-16 and a 486DX-33 and my dad ran Julia and Mandelbrot set demos he programmed in from books when I was a kid. The 386SX-16 took all night, 6-8 hours to complete a screen of any non-trivial fractal, whereas the 486DX-33 could complete it in around 30 seconds to 2 minuts.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.