LeapFrog Pollux Platform: DFTPdevice
Work in progress, just jotting down notes currently.
DFTPdevice is a custom server LeapFrog includes with the Explorer and LeapPad. This is the main interface between LFConnect, and these devices. DFTPdevice seems loosely based on an FTP server, while including customized features for the purposes of updating the firmware, and a general maintenance.
DFTPDevice is included in both LeapPad and Explorer versions of Surgeon.cbf and their respective firmwares. Surgeon's come with version 1.12, although there seems to be a slight difference in the two, as Explorer Surgeon will reboot if you destroy the sockets connected to it, LeapPad's will reset the DFTPDevice and got back to broadcasting its IP address. Explorer firmware contains version 1.18. TODO: Get LeapPad's version number
Making a Connection.
When the device starts up port 5000 is open, once you make a socket connection, you then need to send the ETH command. The device then opens up a socket to port 5001, make your second connection, and you can then start communicating with.
5000 is the port you send commands to.
5001 is the port you read the responses from.
There are currently 2 versions of DFTPdevice, 1.12, mostly used in Surgeon, and 1.8 for firmware. The Explorer and LeapPad version, while containing the same version number, do seem to differ, most notably in that if you disconnect from the Explorer version it reboots, while the LeapPad version goes back to broadcasting its address, waiting for another connection.
The success code is sent for most commands to signify everything went okay. Will not be sent for data transfers, except on the 101 EOF packet.
File transfer ACK. This is returned when the device is receiving data from an upload, it also needs to be send when downloading from it. The number seems to be the size of the last amount of data read.
100 ACK <num>
EOF is the marker to signify all data has been sent, and to stop expecting it. When receiving data you need to check for this packet, and when uploading data you need to send it when finished.
Server errors generate a response back that start with 5xx and then the error text.
500 Command not found
504 Unknown Setting
The command list is fairly undocumented, there is a few listed in the sources, but most will be discovered by other means, like using Wireshark. This is the list so far.
All commands must have a trailing 0x00 attached. In python it would look something like.
In OpenLFConnect there is a special command send. It allows you to send any command you like, the 0x00 is appended for you, otherwise its all raw read/write. Obviously STOR, RETR, RUN won't work with it, but the rest you can play around with.
remote>send LIST /path/to
Some commands are Surgeon only.
DFTP Version 1.12
SETS MOUNTPATIENT=0,1, or 2
0 Unmounts both
1 Mounts Bulk and Rootfs
2 Mounts Rootfs
ETH <host ip> 1383
Action: Has to do with establishing a connection.
Must be sent before opening the second port.
<directory path> list
D 00000000 755 root:root
Notes: Seems to not always work as expected.
Action: Initiate file upload.
Next: Send file data till EOF then send 101 EOF.
Device responds with a lot of 100 ACK: <number> (Seems to be last amount of len(data) received.)
Action: Ends STOR data transfer
Notes:Must flush receive buffer first
Action: Downloads file.
Next: Read socket buffer for data and send back 100 ACK: <number> (Seems to be last amount of len(data) received.)
Ends: When 101 EOF is received.
Action: Removes file
Notes:Found listed in source code, does something with firmware.
a number, that doesn't seem to make sense
Action: Sets time.
DATETIME=20120126083014 200 OK
Note: This is the serial number of the device.
Action: Runs shell script
Next: Send data then 101 EOF
Note: Make sure to remove any \r line ends as it will cause an error.
#!/bin/sh /etc/init.d/telnet start
Would start the telnet client.
GETS SCRIPT_RUNNING Returns:
Note: If script is still running returns 1
Reboot after update or in general
Reboot to usb mode