iRiver Story running arbitrary code in stock firmware

It is possible to run arbitrary code with root privileges in stock firmware (1.6.1 version).

Put the following files to SD card (it must be formatted as FAT for this trick to work):

factory/
  forcecopy <- empty file
  elisamake_sh <- shell script

Reboot (press the reboot button next to SD card using needle, move power switch to the right).

elisamake_sh will be run at the end of boot progressbar (at ~90% of it).

Note that firmware passes elisamke_sh through dos2unix, so binary files won't survive it.