ZN5
From OpenEZX
Contents |
Enabling Telnet Access
You can access the ZN5 command line by telnet over both USB and wifi. To use USB networking, you'll need to prepare the host, as described on Get a shell
In either case, the following files should be copied to the ".system" folder of the microSD card. You'll need to update the lines that say "IMEI = " with your IMEI number. It is printed on a sticker behind the battery.
The phone should then be rebooted. A "Telnet" option will appear under the Games menu. Clicking it will appear to do nothing, but telnetd will be activated and stay active until the phone is rebooted again.
If the host is properly prepared, the ZN5 should now be accessible over 'usbnet' through through 192.168.16.2.
Telnet is also accessible over wifi. You can find the IP to use over wifi through "Settings: Wifi: Current Connection". It is assumed that both your host computer and the phone are connected to the same wireless access point. For maximum security, turn wifi power off before starting through the phone settings, and reboot after you are done. Realize that if both wifi and telnet or enabled, others on the same wireless network could also potentially access the phone.
Use the username "root". The password is empty by default.
Copy this to script.sh in the ".system" folder of the microSD card. Any leading spaces on the lines should be removed.
#!/bin/sh busybox killall inetd if ! mount |grep -q devpts; then mount -t devpts devpts /dev/pts; fi # This is is the key line. It starts up "engineering mode" on the phone, including telnetd inetd /etc/inetd.engr sleep 3 /usr/local/bin/vendor_usb 13 sleep 5 if ! ifconfig | grep -q 192.168.16.2; then ifconfig usbl0 192.168.16.2 broadcast 192.168.16.7 netmask 255.255.255.248; fi
Copy this to "CardRegistry" in .system/java folder:
[5a95bdf3-b9ff-4893-891e-0b781587f1e0]
AniIcon =
AppID = {5a95bdf3-b9ff-4893-891e-0b781587f1e0}
Args = /mmc/mmca1/.system/script.sh;/mmc/mmca1/.system/script.sh
Attribute = 1
BigIcon = Files/suiteicon.png
Daemon = 0
Directory = ../../../bin
Erasable = 1
Exec = sh
GroupID = root
IMEI = # YOUR IMEI HERE
Icon = Files/suiteicon.png
InstalledDate = 2007/9/1
LockEnabled = 0
Name = Telnet
SVGIcon =
Shared = 1
Size = 138985
Type = 2
UserID = root
Vendor =
Copy this to "MemoryCardConfig" in the .system/java folder:
[5a95bdf3-b9ff-4893-891e-0b781587f1e0] Folder = 67dc1191-2928-4938-abce-1a73cb5ce490 IMEI = # YOUR IMEI HERE move the directory where you
Transferring files to the phone (FTP alternative)
Files can be transfered to the ZN5s internal storage using netcat, which is already installed on the phone. This depends on having telnet access, described above.
On the phone, to receive foo.txt, using port 5600:
busybox nc -p 5600 -l >/ezxlocal/download/mystuff/foo.txt
On your Linux desktop, using the same IP you telnet'ed to:
nc -v -w 2 192.168.1.104 5600 </home/mark/Desktop/foo.txt
Netcat may give some warnings, even if it succeeds. For example:
192.168.1.104: inverse host lookup failed: Unknown host (UNKNOWN) [192.168.1.104] 5600 (?) open
That's it! You can now see "foo.txt" listed through the file manager on the phone.
Entering boot loader
To enter boot loader mode turn off the ZN5. Then press and hold both the '*' and '#' buttons and press the power button.
The screen will display:
Bootloader 06.2A Battery OK OK to Program Connect USB Data Cable
Connect the USB cable and the Display will show "Transfer Mode: USB".
USB modes
Set your ZN5 USB setting to modem, connect to /dev/ttyACM0 (you'll need to Prepare the host) and then Change the Modem Mode with one of these values:
- AT+MODE=0 Seems to be the current (ACM) mode
- AT+MODE=8 Networking (IP address is 192.168.16.2 see: Get a shell)
- AT+MODE=24 USB mass storage
- AT+MODE=26 PTP Picture transfer protocol
Other values return ERROR and don't seem to have any effect. The above values cause minicom to "return OK", the phone beeps and minicom quits. So far this is like the Razr2, but there must be a missing step to discover.
Proc reports
uname -a
Linux (none) 2.6.10_dev armv6l unknown
cat /proc/crypto
name : cipher_null module : kernel type : cipher blocksize : 1 min keysize : 0 max keysize : 0 name : digest_null module : kernel type : digest blocksize : 1 digestsize : 0 name : compress_null module : kernel type : compression name : md4 module : kernel type : digest blocksize : 64 digestsize : 16 name : md5 module : kernel type : digest blocksize : 64 digestsize : 16 name : sha1 module : kernel type : digest blocksize : 64 digestsize : 20 name : sha256 module : kernel type : digest blocksize : 64 digestsize : 32 name : sha384 module : kernel type : digest blocksize : 96 digestsize : 48 name : sha512 module : kernel type : digest blocksize : 128 digestsize : 64 name : des module : kernel type : cipher blocksize : 8 min keysize : 8 max keysize : 8 name : des3_ede module : kernel type : cipher blocksize : 8 min keysize : 24 max keysize : 24 name : aes module : kernel type : cipher blocksize : 16 min keysize : 16 max keysize : 32 name : arc4 module : kernel type : cipher blocksize : 1 min keysize : 1 max keysize : 256 name : deflate module : kernel type : compression
cat /proc/modules
sd8xxx 162288 1 - Live 0xbf0d7000 sdio 20668 2 sd8xxx, Live 0xbf0d0000 modemrelay 5288 0 - Live 0xbf0cd000 modembridge 3200 1 modemrelay, Live 0xbf0cb000 coredump 11064 0 - Live 0xbf08d000 tvout_driver 11068 0 - Live 0xbf089000 suapi 114945 17 - Live 0xbf06b000 dmcam 5236 0 - Live 0xbf068000 dmmsg 19672 1 dmcam, Live 0xbf062000 dmspi 9916 2 dmcam,dmmsg, Live 0xbf05e000 fuse 27148 2 - Live 0xbf056000 fm_radio 3668 0 - Live 0xbf054000 ihal 22704 22 - Live 0xbf04d000 netmux_linkdriver 8504 0 - Live 0xbf049000 netmux 52456 25 netmux_linkdriver, Live 0xbf03b000 mpmdrv 28080 1 - Live 0xbf033000 profilerdrv 6156 1 - Live 0xbf030000 gpiodev 7776 0 - Live 0xbf02d000 sipcdrv 177592 0 - Live 0xbf000000
cat /proc/cpu
Processor : Some Random V6 Processor rev 1 (v6l) BogoMIPS : 88.66 Features : swp half thumb fastmult vfp edsp java CPU implementer : 0x41 CPU architecture: 6TEJ CPU variant : 0x1 CPU part : 0xb36 CPU revision : 1 Cache type : write-back Cache clean : cp15 c7 ops Cache lockdown : format C Cache format : Harvard I size : 16384 I assoc : 4 I line length : 32 I sets : 128 D size : 16384 D assoc : 4 D line length : 32 D sets : 128 Hardware : Motorola Product - SCM-A11 Phone Revision : 0021
cat /proc/cmdline
noinitrd console=/dev/null rw mem=58M@0x90000000 init=/linuxrc root=/dev/mtdblock/root brdrev=P0A motobldlabel=R6637_G_81.03.0DR mtdparts=nand0:1152k@896k(pds),128k@2176k(logo_cli),128k(panel_script)ro,128k(device_tree)ro,128k(setup), 256k(logo),128k(secure),1664k(kern)ro,3968k(bpsw),256k(ho_data),256k(fota_ua)ro,384k(ua_temp),256k(ua_backup), 42m@9984k(root)ro,9m(user),9m(lang),18944k(resrc),6m(fota_up),407m(mass_storage),128k(kpanic),10880k(rsv
Compatible applications
The following applications have been reported to install and run on with the software installed shipped by Motorola. (The T-mobile branded ZN5 reportedly restricts network access for Java applications.
- Google Maps for Mobile
- Opera Mini 4.2 (unsigned)
- Gmail Mobile
- ShoZu (a chat program, comes pre-installed)
- Nimbuzz, a chat program
- Gizmo, a chat and VOIP program
- MidpSSH
- dropOff, a game
- Pipes, a game
See Also
- The RAZR2 V8 runs a similar Linux platform on the same processor.
- GetJar.com downloads for the ZN5 should run on the ZN5, but not all have been tested
