Difference between revisions of "LeapFrog Pollux Platform: OpenLFConnect"

From eLinux.org
Jump to: navigation, search
(Removed Command List, will add link to github page, easier to maintain just one.)
Line 405: Line 405:
== Command List ==
==== General ====
    debug <on|off>
Turning debug on, turns most any filesystem action off, such as, up/download, rm,
mkdir, etc. It is replaced with text displaying what would have happened. Useful for
checking updates before they happen, also will not eject Didj on update.
Returns the currently configured device id.
    set_dev_id <device id>
Set the device to use when creating a new mount client.
The device id, in Linux is the generic scsi device file, ex. /dev/sg2 or harddrive
/dev/sdb , or Windows the PhysicalDrive ex. PD1.
To reset to auto determine leave input blank.
Returns the currently configured mount point to use when creating a new mount client.
    set_mount_point <mount point>
Set the mount point to use when creating a new mount client.
The mount point, ex. Linux /media/didj, or Windows D:\
To reset to auto determine leave input blank.
Returns currently configured device IP to use when creating a new network client.
    set_device_ip <IP>
Set the device IP address to use when creating a new network client.
To reset to auto determine leave input blank.
Returns currently configured host IP to use when creating a new network client.
    set_host_ip <IP>
Set the host IP address to use when creating a new network client.
To reset to auto determine leave input blank.
Set to remote device for filesystem navigation.
Set to prompt to local host for filesystem navigation.
==== FileSystem ====
Print current remote directory path.
Print current local directory path.
Exit OpenLFConnect
    ls [path]
List directory contents. Where depends on which is set, remote or local
    cd <path>
Change directories. Where depends on which is set, remote or local
    mkdir <path>
Create directory. Where depends on which is set, remote or local
    rmd <path>
Delete directory. Where depends on which is set, remote or local
    rm <file>
Delete file. Where depends on which is set, remote or local
    upload <local path>
Upload the specified local path to the current remote directory, Will overwrite with out prompt.
    download <remote path>
Download the specified remote path to the current local directory, will over write with out prompt.
    cat <path>
Prints the contents of a file to the screen.
Doesn't care what kind or how big of a file.
==== Didj ====
    didj_mount [mount name]
Unlock Didj to allow it to mount on host system.
Eject the Didj which will unmount on host system, if the firmware updates are
on the Didj, an update will be triggered. If they are not, it will ask you to unplug it.
Could take some time to unmount and eject if you have written files to the device..
Returns various information about device and mount.
    didj_update <path>
!!Attempts to flash firmware, could potentially be harmful.!!
!!Make sure Battery's are Fresh, or A/C adpater is used!!
Update Didj firmware and bootloader.
lightning-boot.bin, erootfs.jffs2 and kernel.bin are all required for the update to work.
They can all be in the current directory, or in bootstrap-LF_LF1000 and firmware-LF_LF1000 respectively.
MD5 files will be created automatically.
    didj_update_firmware <path>
!!Attempts to flash firmware, could potentially be harmful.!!
!!Make sure Battery's are Fresh, or A/C adpater is used!!
Update Didj firmware.
erootfs.jffs2 and kernel.bin are both required for update to take place.
Files can have alternate names as long as their name is in the new name, ex. custom-kernel.bin, or erootfs-custom.jffs2
Files must be in the current directory or in firmware-LF_LF1000 directory.
MD5 files will be created automatically.
    didj_update_bootloader <path>
!!Attempts to flash firmware, could potentially be harmful.!!
!!Make sure Battery's are Fresh, or A/C adpater is used!!
Update Didj bootloader.
File must be in current directory, bootloader-LF_LF1000 directory or direct path to.
File can have alternate name, but must include lightning-boot in it, ex custom-lightning-boot.bin
MD5 files will be created automatically.
Remove Didj firmware and bootloader from device.
    didj_update_eb <path to emerald-boot>
!!Attempts to flash firmware, could potentially be harmful.!!
!!Make sure Battery's are Fresh, or A/C adapter is used!!
!!Requires NAND enabled Emerald Boot!!
Flash Emerald Boot to Didj NAND.
After running Didj will shutdown, unplug USB and turn on device. It should then turn itself off.
You should now be able to USB Boot like the Explorer and update using DFTP.
==== DFTP ====
Used for LeapPad and Explorer.
Connect to device for dftp session.
Will attempt to configure IPs as needed.
This could take a minute or so, if you just booted the device.
Disconnect DFTP client.
This will cause the DFTP server to start announcing its IP again, except Explorer's surgeon.cbf version, which will reboot the device.
    dftp_server_version [number]
Sets the version number of the dftp server. Or retrieves if none specified.
OpenLFConnect checks for version 1.12 for surgeon running before a firmware update.
Set this to 1.12 if getting complaints, or surgeon has its dftp version updated.
Returns various information about the device, and connection.
Note: Device name is guessed from board id.
    update <local path>
!!Attempts to flash firmware, could potentially be harmful.!!
!!Make sure Battery's are Fresh, or A/C adpater is used!!
Uploads and flashes the files found in path, or the file specified by path.
Caution: Has not been tested on LeapPad, theoretically it should work though, please confirm to author yes or no if you get the chance.
    dftp_update_partitions <partitions_file>
Sets the partition configuration file located in files/Extras/Partitions/ for use with DFTP Update.
Set to custom config file when your device uses DFTP but with modified partition sizes/addresses.
Default is LeapFrog.cfg
Caution: This does not repartition your device. The table is hard coded in the kernel/bootloader.
This will trigger a reboot.
This will reboot the device into USB mode, for sending a surgeon.cbf to boot.
If surgeon is booted, will do a standared reboot.
    dftp_mount_patient 0|1|2
Surgeon booted device only. These give you access to the devices filesystem.
0 Unmounts /patient-rfs and /patient-bulk/
1 Mounts /patient-rfs and /patient-bulk/
2 Mounts only /patient-rfs
    dftp_telnet <start|stop>
Starts or stops the Telnet daemon on the device.
    dftp_ftp <start|stop>
Starts or stops the FTP server on the device.
    dftp_sshd <start|stop>
Starts or stops the SSHD daemon on the device. Does not work on surgeon.
Patches the sshd_config file to permit login with a blank password.
Should be run before starting sshd, only needs to be done once.
    dftp_run_script <path>
This takes a shell script as an argument, and proceeds to run it on the device.
    send <raw command>
Advanced use only, don't know, probably shouldn't.
[[LeapFrog_Pollux_Platform:_DFTPdevice | DFTP Command List]]
==== USB Boot ====
    surgeon_boot <path to surgeon.cbf>
Uploads a Surgeon.cbf file to a device in USB Boot mode.
File can be any name, but must conform to CBF standards.
==== Surgeon ====
    surgeon_extract_rootfs <rootfs suffix> <path to surgeon.cbf or zImage>
Extracts the Root file system (initramfs) to <current directory>/rootfs.<suffix>
==== Firmware ====
===== LF2/LFP Packages =====
    package_extract [path]
Extracts LF Package files (lfp ,lfp2)
Takes a file path, or will extract all packages in a directory.
Will overwrite without warning.
    package_download <Didj|Explorer|LeapPad> <firmware|surgeon|bootloader|bulk>
Downloads the LF firmware package for device specified to files/<device>
Bootloader is for Didj only.
Surgeon and Bulk are for LeapPad and Explorer only.
===== CBF Files =====
    cbf_unwrap <file path>
Removes the CBF wrapper and prints a summary.
CBF is used on kernels and surgeon, to wrap a zImage or Image file.
Saves the image file to the same directory the cbf file was in.
If image file already exists will fail.
    cbf_wrap <low|high> <output file name> <input file path>
Creates the CBF wrapped file <output file name> of the <input file path> and prints a summary.
File is saved to current directory.
Kernel should be a zImage or Image file.
Low is standard setting for everything but LeapPad Kernel which is High
    cbf_summary <file path>
Display the CBF wrapper summary.
CBF is used on kernels and surgeon, to wrap a zImage or Image file.
===== UBI/JFFS2 Images =====
    ubi_mount <file.ubi>
Mounts an Explorer erootfs.ubi image to /mnt/ubi_leapfrog
This is a Linux only command.
Will be prompted for password, sudo required for commands.
Unmounts /mnt/ubi_leapfrog
This is a Linux only command.
Will be prompted for password, sudo required for commands.
    ubi_create <erootfs|bulk> <output file name> <input directory path>
Creates an Explorer UBI image <output file name> of the <input directory path>.
File is saved to the current directory.
Caution this image is specifically for the Explorer.
This is a Linux only command.
Will be prompted for password, sudo required for commands.
    jffs2_mount <file_name>.jffs2
Mounts <file_name>.jffs2 image to /mnt/jffs2_leapfrog
This is a Linux only command.
Will be prompted for password, sudo required for commands.
Unmounts /mnt/jffs2_leapfrog
This is a Linux only command.
Will be prompted for password, sudo required for commands.
    jffs2_create <output file name> <input directory path>
Creates an <output file name> image of the <input directory path> 
File is saved in the current directory.
This is a Linux only command.
Will be prompted for password, sudo required for commands.

Revision as of 01:23, 10 August 2013

OpenLFConnect is a Python and sg3_utils command line based replacement application for the LeapFrog LFConnect program and more. For Explorer and LeapPad it can use their dftpdevice to upload firmware. It also manages uploading the surgeon.cbf file for USB boot recovery mode and is capable of enabling ftp/telnet on both devices. For Didj it can mount the USB drive, copy firmware over, and send the eject command that will attempt to start flashing the firmware. There are also extra functions for wrapping and unwrapping CBF files and extracting lf2/lfp packages.

The program deals with firmware/bootloader items. The update functions deal with those exclusively, for updating the offical LeapFrog user interfaces, games, movies, etc. You'll need to use the LFConnect program. Especially if you want those things to run as they should, since there is online functionality that is required for certain features.

WARNING: This program can flash new firmware, has the ability to make and delete, upload and download, files could be destroyed, firmware flashing could go wrong. There is no prompts for second chances. Make sure you understand what you're doing, and use fresh batteries or an A/C adapter during updating.




Windows or Linux compatible

Python 2.6 - No special modules needed. Windows or Linux


  • Included for Windows, common on many Linux distros


  • Most are probably installed on modern mainstream distros

Sync, for flushing disk cache

mtd_utils, For mounting/creating JFFS2 and UBI images.

  • Issues
    • Arch Linux can't use lock/unlock/eject Didj commands there is no SCSI access devices.


LeapFrog Ethernet Driver

  • If LFConnect is installed, or previously was, this is already installed.
  • If not, when it prompts you for a driver, use the Windows update service.

Bonjour For auto device IP discovery

  • If LFConnect is installed, or previously was, this is already installed.


Extract archive or clone git repo to a location of your choice.


If LFConnect is installed you may want to make sure Monitor.exe is disabled, which can be done via Task Manager, before plugging a device in, this is the program that auto starts LFConnect. You can also prevent it from running on boot up, with a registry edit. It will how ever start up again, if your open LFConnect, but until then it remains off, if you delete this entry.


LFConnect Disable Auto Start


You'll need to assign the Didj's USB drive a letter as LFConnect will have assigned it a directory mount point instead. The letter you pick doesn't matter, as long as it doesn't conflict with something else. Plug your Didj in and then go to Disk Management, depending on what version of Windows it should be something like:

Administrative Tools > Computer Management > Disk Management

Right click the drive, and select Change Drive Letters and Paths click Add and assign the letter.

It is also recommended to disable any disk caching in the drive's properties on Windows. The Didj drive can become easily corrupted, if you are not careful with it. Disabling disk cache, while it takes longer to transfer files initially, is the safest route.

LeapPad and Explorer

Windows will default to a zeroconfig address, if you like you can just let it do that. But it takes a bit over a minute for it to do it. Static IP will greatly speed up the process.

Plug your device in and turn it on. You should see an icon in the Start Bar about trying to connect, if not go to Network Connections, right click and choose status. Then properties, scroll down to TCP/IP click on its properties, and make sure to set a static IP. Unless your device is set to a non standard IP, it will be on the 169.254. subnet. Windows will actually default to an address on this subnet, it takes a little over a minute from first turn on though, static IP is much faster.

Static IP:
Broadcast Mask:


Extract archive or clone git repo to a location of your choice.

To facilitate not needing to run as root you will need to copy the OpenLFConnect/extras/udev_rules files to /etc/udev/rules.d/ The Mass_Storage rules are for all 3 devices. Didj in normal use and LeapPad, Explorer in USB Boot mode. They create a persistent generic SCSI device name /dev/leapfrog that is set to allow regular users permission to use. The Mass_Storage rules also unlock the Didj on plug in, saving you the need to run OpenLFConnect just to mount it.

Make sure the rule is owned by root:root and set to permission 644.


Other than installing the above mentioned udev rule, there is not a lot to configure. If you like, you could set up a custom mount to enable sync,dirsync options, to be extra secure about disk caching causing corruption. OpenLFConnect runs the sync command on eject, and you should always use safely eject commands to remove the Didj, especially with out having disk caching disabled.

LeapPad and Explorer

Plug your device in and turn it on, then check

System > Preferences > Network Connections

If you see Auto Eth1 open it's properties and go to the IPv4 tab, on the Methods drop down pick Link Local.

If you do not see the Auto Eth1 or something similar, you can copy the udev rules for Net to /etc/udev/rules.d/ This will trigger avahi-autoipd on plug in, and assign an IP address to the interface. This is basically what Network Manager does when set to Link Local.

Make sure the rule is owned by root:root and set to permission 644.


There is basically four types of commands.

OpenLFConnect commands, debug on, set_host_ip, get_mount_point, these are some basic configuration settings used by the base application.

Client commands, dftp_connect, didj_mount, boot_surgeon didj_update, dftp_reboot, these are commands specific to the client that is running, and are checked to make sure their respective client is the currently running client.

Filesystem commands, ls, cd, cat, upload, download, these are your basic filesystem commands, for navigation or basic maintenance.

Utility commands, package_download, cbf_unwrap, jffs2_create_eroots, these commands are there to help facilitate creating updates. Either packaging, or opening up the stock firmware for modification.

Caution, there are no prompts to ask if you are sure. Uploading will over write a directory or file, deleting a directory will remove it regardless if there is anything in it, etc, etc. Also always make sure you are where you think you are, its easy to forget you switched to local or remote, and run a command thinking you are somewhere else. You've been warned, cwdl and cwdr are you're friends, they will tell you where each path is pointed to and pay attention to the prompt prefix.

Getting Started

From a terminal or the command prompt run OpenLFConnect.py this will bring up the python command line. In windows you can also double click on the file.

To get a full list of commands type


For help on a specific command

local>help command

Commands with an option in [] means its optional, commands with an option <> means it is mandatory.

Basic Commands

The basics are very similar to the Linux command line, and when first started, you will be able to navigate around the local filesystem. Some examples.

This changes the directory

local>cd files/LX

This lists a directory's contents.

local>ls files/Didj

Make a directory.

local>mkdir NewDir

This deletes a directory

local>rmdir NewDir/

Remote/Local Locations

Once a remote client is running, you can navigate both the local and remote filesystems. On Didj, remote just means it starts at the mounting point as technically they are both local.

This means you are on the host computer and the commands will take action on it.

local> command arg

This indicates you are about to run a command on the device.

remote> command arg

Change to remote device


Change to local from remote


The current directory is maintained on an individual basis. So you can switch between remote and local, and you will not loose your place. If a remote client is disconnected the remote path will be reset, but local will stay. The cwdl and cwdr commands Current Working Directory Local and Current Working Directory Remote respectively, can be used to check what that path is, regardless of the command lines current location.

The are a few exceptions to how remote/local works, Upload/Download commands don't care, as Upload wants a local path to upload to the current remote directory, and Download wants a remote path, to the current local directory, the location is taken care of behind the scenes. This is also true of certain client commands, such as the update features where only a local path will ever be needed. And of course, anything that does not use a path in its operation, such as listing device information, unmounting, etc.

Download takes a remote path argument to a file, and will download it to the current local directory.

Upload takes a local path argument to a file, and will upload it to the current remote directory.

Set the remote directory to where the file you want to download resides in, switch back to local and navigate to where you want to save it. Then download.

remote>cd etc/
local>cd LX/temp
local>download vsftpd.conf

Set your remote directory to where you want the file to be put, then upload a local file using the path argument.

remote>cd ../etc/avahi/
remote>upload ../../user/scripts/avahi-autoipd.action


The Didj is different than the LeapPad or Explorer in that it is not a networking enabled device. Once you mount the Didj, you will be given a remote prompt, in reality you are still on the local filesystem, you can still use all the same commands if you like however. The Didj client has a few specific commands, all prefixed with didj_.

The first thing you should do with your Didj, is back up the entire drive that gets mounted, archive it, and keep it somewhere safe. It will be needed if your Didj ever says it "needs repair."

A word of caution to prevent "needs repair" issues. Always make sure to safely eject the device, to allow the host OS to commit the changes. If you just pull the plug, it can cause data corruption.

Didj Command List

Filesystem Command List


Once Didj is plugged in and turned on, start the client and connect.

Mounted on /dev/Didj

This will obtain the location the Didj is mounted on. You should see a new window pop up with the contents, or it show up in your file browser, depending on the OS used. For general purpose looking around, its far easier to use the OS's file browser. But if you would like to run an update of the firmware or bootloader, OpenLFConnect can make it rather painless.

Send the eject command, to be gentle with your Didj or start firmware update.




Didj is by far the easiest to mess up while updating, or transferring any files for that matter. Be sure you never pull the power or turn it off, before files have been synced/disk cache written. A partial write in the directory makes it 99.9% certain of file corruption, as fdsk is ran on boot, if it finds anything wrong, it panics. Which generally means formatting and replacing all the files.

Caution: Use and A/C adapter, or fresh batteries, a power outage during this will ruin your update, and could leave your device in need of repair.

More Information on firmware updating.

OpenLFConnect tries to make formatting your updates as easy as possible.

Firmware when running the didj_update, or didj_update_firmware commands it will first search the current directory, for the firmware-LF_LF1000 that the LeapFrog update comes in, if it finds it, it will update your Didj with its contents. If it can't find that particular directory, it will search the current directory for files with names matching 'erootfs' and 'kernel'. This means you could have custom-kernel.bin and erootfs-custom.jffs2 and it will pick those up for updating. It will then created the md5 files and firmware-LF_LF1000 directory on the Didj to place your files in. So you do not have to worry about creating the necessary support files and directory. One thing to mention, the update must include an erootfs.jffs2 and kernel.bin file, OpenLFConnect will fail if not both are not found, as Didj would refuse to update, if only one was available. There is a couple rules to follow, so OpenLFConnect does not pick the wrong update, do not keep your files in a directory with a firmware-LF_LF1000/ directory, as it will search that and use the files in it instead, and only have one set of update files in the directory, as it will cause issues if more than one is found.

Bootloader is almost exactly the same as firmware, with one difference, you can choose a specific lightning-boot.bin file to upload, as this is the only file required for a bootloader update. If you do not specify the file, giving only a directory, the same search pattern takes place as above, except for bootstrap-LF_LF1000 as the directory. This also creates the necessary support files for the update, directory, and md5 file.

Update both with change to directory.

local>cd /Didj


Update both.


Update Firmware using the parent path.

local>didj_update_firmware Didj/

Update Bootloader with path to a file.

local>didj_update_bootloader Didj/my-bootloader/lightning-boot.bin

It will take a second for the command prompt to come back after the files have transferred and eject command sent. Once ejected the Didj screen should change, it will say "Learning new tricks" Then "Disconnect Now". Once you do it will shutdown. Turn it back on and plug it in. run:


This removes the update files to prevent unwanted firmware flashes if the eject command is sent again. If everything went okay your files will have been flashed to the Didj and you can now use it.

Needs Repair

This section is part warning, part remedy. With disk caching enabled, it is fairly easy to corrupt the Didj's drive. When ever possible, use safely remove options, which will flush the disk cache before removing. The Didj, when in good status, seems to hold up on the eject command until everything is synced, especially on Windows, for Linux OpenLFConnect will run the sync command prior to issuing the eject.

Needs Repairs and Download Failed

To fix it you'll first need your backup copy of the disks contents,Base/ Data/ and ProgramFiles/ at the very minimum Base/ is required, Data/ holds your user profile type stuff, ProgramFiles/ is for JetPackHeros. Then format the drive with FAT, when done copy over your backups then safely eject it, preferably use didj_eject. Most of the time this has worked for me in fixing any issue that arises.

If you want the be all to end all access for such issues check out serial console. In console if you just can't get anything going, cause it "brazenly refuses to mount /dev/mtdblock9" rmmod g_file_storage this disables usb storage and takes out the /flags/needs_repair that won't go away, as it is set by the usb driver.


Always use safely remove, if you've uploaded data, especially with a Linux host PC as data corruption seems far more likely. On a Linux host, OpenLFConnect will run the sync command, before ejecting. Its actually a fairly good idea to use the didj_eject command each time. Windows, XP at least, seems more friendly in these regards, as didj_eject will hold up until files are written. It is still highly recommended to disable disk cache in Windows aka Quick Removal. As for Linux, mounting with the sync option is a good idea also. But getting this to work with automounting can be problematic. Manually running sync, safely removing, or running didj_eject should all take care of it.

LeapPad and Explorer

LeapPad and Explorer are both network connected and use the same DFTPdevice, as does both versions of Surgeon. There are a few client specific commands available, but mostly it is much like a basic ftp client. All DFTP commands are prefixed with dftp_.

DFTP Command List

Filesystem Command List


There are a few things worth doing with OpenLFConnect and your Explorer. You can send a surgeon.cbf file, or any kernel and or initramfs you want to test that has been converted to CBF Commands, Information. You can run firmware updates, there is a convenience function for enabling ftp, or you can use it like a basic ftp browser.

Once the device is turned on and plugged in.

Connect to it.

prints device info...

Disconnect, device can be reconnected to with out unplugging or restarting application.


Reboot the device and/or disconnect.(depends what you're running Surgeon, Explorer, LeapPad, as to if it reboots or not)


Starting FTP, Telnet and SSHD

When normally booted, FTP and Telnet are not running, while they will be if surgeon is running. SSHD is never enabled, but can be. These use the dftp RUN command, to upload a shell script, these can be found in files/Scripts/. All three will have the same log in.


After establishing a connection.



remote>dftp_ftp start
Ran script.
FTP start


remote>dftp_ftp stop
Ran script.
FTP stop



remote>dftp_telnet start
Ran script.
Telnet start


remote>dftp_telnet stop
Ran script.
Telnet stop


This will require patching the sshd_config file, to allow empty passwords. This is not a critical file to your device running normally.

Ran script.
sshd_config patched for empty passwords.


remote>dftp_sshd start
Ran script.
SSHD start


remote>dftp_sshd stop
Ran script.
SSHD start

On Linux you can install the service-discovery-applet which will automatically pick up the FTP and SSHD server announcing themselves. Look in Places>Network. In Windows it should show up in any Bonjour apps that display services.

USB Booting

There is a special mode called USB Boot mode, which can accept a Surgeon.cbf file. Both Explorer and LeapPad have it. You can access this mode using dftp_reboot_usbmode, or on the Explorer through holding both shoulder buttons and the ? while turning it on. As for LeapPad a hardware method is not known.

There are two versions of surgeon, one for LeapPad and one for Explorer. The DFTPdevice on the LeapPad version is better, disconnects do not reboot the device. As far as functionality, updating seems to work just as well also.

More Information

Put the device in USB boot mode.

OpenLFConnect with device connected and running normally.


Button presses.

Explorer hold both shoulder buttons and the ? button, while turning it on.

LeapPad Not sure.

Download Surgeon if you do not have it.

local>cd LX/
local>package_download explorer surgeon

Extract package file

local>package_extract LX_surgeon.
cd Surgeon

Boot surgeon file. This will take about 30 seconds or so to return.

boot_surgeon surgeon.cbf

You can then connect to the DFTP server surgeon sets up.

 ...device info...


Update is determined by if fuse-flasher on LeapPad has created the /LF/fuse directory, if so, it tries a Fuse (LeapPad) style update if not a standard DFTP (Explorer) style. This allows you to run the LeapPad surgeon during updates also, as it will not create the fuse folder, falling back to a regular DFTP style update.

Caution: Use and A/C adapter, or fresh batteries, a power outage during this will ruin your update, and could leave your device in need of repair.

Update Files

dftp_update first looks for the official firmware directories in the directory specified, firmware/ (LeapPad) Firmware-Base/ (Explorer). Failing that, it looks for the files it would normally find inside those directories. If those are not found, it tries to match a list of keywords to the files in the current directory.

LeapPad: nfs, kernel, mbr2G, FIRST_Lpad
Explorer erootfs, kernel, FIRST

The first files it finds to match those, it will attempt to upload while translating to the proper path and file names.It is best to not have multiples, as its not guaranteed which one will be selected. Also any CBF file will be checked for a valid magic number and length before any upload takes place.

You may also specify a single file to upload, and it will translate it for you.

Boot Surgeon.cbf

You will also need a surgeon.cbf file, this will be sent to the device while its in USB boot mode, and establishes the necessary systems for the flashing process.

Once you got your firmware ready, put the device in USB boot mode and boot surgeon:

local>boot_surgeon /path/to/Explorer/surgeon.cbf

Run Update

Connect to the device


It will take a few for the device to boot up, you will then have the command line back. And can start flashing your files.

remote>dftp_update /files/Explorer/Firmware-Base

Once done uploading reboot the device.


You can now unplug the USB cord, or otherwise let it boot normally. You can connect again if you like, and browse around too.

Explorer File Names These file names must be prefixed as they are, as the name has significance to the flashing process. The first number is the NAND address in decimal to flash to, and the second is the size of the partition in packets, which the packet size is 131072. Check Explorer technical information for the partitions numbers.