iRiver Story running arbitrary code in stock firmware

It is possible to run arbitrary code with root privileges in stock firmware (1.6.1 version).

Put the following files to SD card:

factory/
  forcecopy <- empty file
  elisamake_sh <- shell script

Reboot (press the reboot button next to SD card using needle, move power switch to the right).

elisamake_sh will be run at the end of boot progressbar (at ~90% of it).

Note that firmware passes elisamke_sh through dos2unix, so binary files won't survive it.