[Hardware Hacking General] MonroeLake:
The Clarity Ensemble phone is an Android-based captioning land-line phone. The newest model has an 8" touchscreen. Older model has 7" touchscreen. It comes with an app that runs at startup and keeps you from gaining access to the Android home screen or any other Android apps or settings. While booting up you momentarily see the time and can pull down to touch on Settings and bring up the regular Android settings but very soon as the boot process continues the splash screen and later the ThorB app will take over the screen.

In order to telnet to the device, you first need to start telnetd running on the Ensemble. This can be done by configuring your computer to appear to the Ensemble to be the update server. I directly connected the phone to a laptop Ethernet port. On the laptop, I installed a DHCP server, a DNS server, and a web server. I am running Windows and I used "DHCP Server for Windows" version 2.5.1, ApateDNS, and WWebserver with PHP 5.4.45. I set the laptop to a static IP of 8.8.4.4 since Wireshark revealed that the Ensemble was using that as the DNS server. I set ApateDNS server to return 8.8.4.4 as the IP address for all queries.

In my htdocs folder, I created a directory called thorbfota and inside that a directory called purple_prod. Inside purple_prod I created three files, download_file.php, query_site.php, and query_versions.php.

<?php
//download_file.php

ignore_user_abort(true);
set_time_limit(0);

//Replace with actual path to your files
$path = "C:/Users/User/Documents/ClarityEnsembleFiles/";
$dl_file = preg_replace("([^\w\s\d\-_~,;:\[\]\(\).]|[\.]{2,})", '', $_GET['filename']);
$dl_file = filter_var($dl_file, FILTER_SANITIZE_URL);
$fullPath = $path.$dl_file;

if ($fd = fopen ($fullPath, "r")) {
$fsize = filesize($fullPath);
$path_parts = pathinfo($fullPath);
$ext = strtolower($path_parts["extension"]);
switch ($ext) {
case "pdf":
header("Content-type: application/pdf");
header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
break;
case "bin":
header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
break;
case "zip":
header("Content-type: application/zip");
header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
break;
case "apk":
header("Content-type: application/vnd.android.package-archive");
header("Content-Disposition: attachment; filename=\"".$path_parts["basename"]."\"");
break;
//Add more headers for other content types here
default;
header("Content-type: application/octet-stream");
header("Content-Disposition: filename=\"".$path_parts["basename"]."\"");
break;
}
header("Content-length: $fsize");
header("Cache-control: private");
while(!feof($fd)) {
$buffer = fread($fd, 2048);
echo $buffer;
}
}
fclose ($fd);
exit;

<?php
//query_site.php
//This forum would not allow me to post links since this is my first post.
//Feel free to move the "h" below right up against the "ttp..."
echo "h" . "ttp://clarityengineering.us/thorbfota/purple_prod/";
?>

<?php
//query_versions.php

//Replace with actual path to your files
$path = "C:/Users/User/Documents/ClarityEnsembleFiles/";

//Replace file versions with your current version numbers
//To cause phone to update a file, use a number larger that the current version
$file = "ThorB.apk";
$file_ver = "2.63";
$fullPath = $path.$file;
echo $file . "=" . $file_ver . "," . strtoupper(md5_file($fullPath)) . "|\r";

$file = "thorb-ota.zip";
$file_ver = "20150305.182516";
$fullPath = $path.$file;
echo $file . "=" . $file_ver . "," . strtoupper(md5_file($fullPath)) . "|\r";

$file = "dcx.bin";
$file_ver = "b033";
$fullPath = $path.$file;
echo $file . "=" . $file_ver . "," . strtoupper(md5_file($fullPath)) . "|\r";

$file = "eep.bin";
$file_ver = "be25";
$fullPath = $path.$file;
echo $file . "=" . $file_ver . "," . strtoupper(md5_file($fullPath)) . "|\n";

echo "survey=0,0|";

?>

I found that eep.bin was actually just a shell script that is downloaded to the device and run as root. I put my update files in "C:\Users\User\Documents\ClarityEnsembleFiles" but you can put them anywhere you like, just make sure to update the php files above to reflect their location. So far I have only used eep.bin but to keep my php script happy I also created placeholder files, dcx.bin, thorb-ota.zip, and ThorB.apk and placed them with eep.bin in my ClarityEnsembleFiles folder. Below is my eep.bin that starts telnet and simulates pressing the Home button. Just touch "Home Sample" when the "Complete action using" window pops up on the Ensemble. The semicolon at the end of the line avoids having the carriage return kill the command. Alternatively, you could run dos2unix on the eep.bin file and not need the semicolon at the line end.

#eep.bin
telnetd -l /system/bin/sh;am start -a android.intent.action.MAIN -c android.intent.category.HOME;

Every time you change the eep.bin file and want to run it on the phone make sure to close the Software upgrade screen and touch "Check now" button and then "Upgrade" button.

To install apps on the phone, first download the apk file to the phone with wget and then run "pm install -r YourApp.apk".

I have not found a physical Home, Back or Menu button on the phone so one of the first things you may want to install is a software solution for those. I installed "To Home" and it didn't work when configured with the root option for "Floating Buttons". It works fine when configured with the non-root option for "Floating Buttons". I have not tried any of the several other soft button apps available.

There is a 14 pin connector on the underside of the phone that presumably is used in the factory to connect to a dock for programming. I have not investigated the function of any of the pins but I suspect USB is there as well as possibly serial port(s) and maybe JTAG.

Before connecting the phone to the internet, you probably will want to either disable/uninstall the ThorB.apk app or create a firewall on the phone or on your router to keep it from being able to automatically update and from being able to report back to it's maker.

Besides being available for purchase, the phone is also available from ClearCaptions at no charge if you provide them with a 3rd party certification of being hard of hearing.

As far as using the phone, "Federal law prohibits anyone but registered users with hearing loss from using this device with the captions on." So if your hearing it fine, make sure to turn captions off or don't turn them on.