Dying 79xx phones: erase flash entirely and repartition?

[Just Someone YKnow]

Is there any public documentation available on how to logon to the root shell of the Cisco Native Unix (CNU) that runs on the 7945 phones?

I believe I have discovered why the flash eventually fails on these phones... the problem is flash memory bit rot which is just a normal part of how flash data is stored.

There are file system data structures (Partition table, static Unix partition data) written once during the phone manufacturing that are apparently never rewritten for the life of the phone, not even when a new phone load is installed. Eventually these flash cells lose their charge, the Unix partition table evaporates, and the phone will never boot again.

So, to fix this problem, it appears that what I need to do is to fully erase the flash file system and then build a new partition table and filesystem. This will then refresh and rewrite those data cells with new electric charges that then extends the life of the phone for many more years.

Apparently the only way to do this is to logon directly to the root shell of the CNU that runs on the phones, and potentially see if there is some way to enable or possibly even boot from NFS, so that the flash can be fully erased and rewritten without killing CNU and bricking the phone. 

Does anyone know more about this?

[Just Someone YKnow]

I am not really expecting an official response from Cisco support for this question. Cisco seems to hold the secrets of CNU tightly to its chest, and probably will not release this info, as end-users "aren't supposed to know this sort of thing".

If I try to logon as root, the phone prompts with a "challenge code" which likely involves a secret decoder program used by Cisco hardware support to produce a response code and access the root shell.

So... is it acceptable to discuss hacking of CNU on Cisco's forums? I see a possible way via editing the phone load files to bypass the /etc/passwd challenge authenticator, and just enable a normal password.