Leapster Explorer: USB Boot
The Leapster Explorer's Emerald-Boot contains a feature that allows for a recovery mode, called Surgeon. When put into this mode and connected to LFConnect, it will upload and install a new firmware to your device. The programs provided here, replace LFConnect and will allow you to send a kernel or firmware of your choosing.
sg3_utils - Provides the needed sg_raw and sg_verify for Linux
OpenLX Pager (Linux or Windows)
surgeon.cbf (found in the LST3-0x00170028-000000 package)
- Or you can Modify a Kernel for USB Boot
Connect the device to the host PC.
Hold down Right and Left Shoulder buttons and ? Button.
Turn the device on, you can let go of the buttons and you should see download screen.
Download the Pager script and save it in a directory, make sure it is set to execute file permissions for your user. From a terminal run
$ sudo ./pager.sh surgeon.cbf 1: Writing bytes:0 -> 16383 to /dev/sdc SCSI Status: Good 2: Writing bytes:16384 -> 32767 to /dev/sdc SCSI Status: Good ... ... 430: Writing bytes:7045120 -> 7061503 to /dev/sdc SCSI Status: Good 431: Writing bytes:7061504 -> 7077887 to /dev/sdc Verifying /dev/sdc
and it will be done. You can check in your UART terminal, and you should see it uncompressing Linux. And you should notice, the Explorer USB Device has now changed from a Mass Storage Driver to a Network Device.
Download the Pager app and extract it, cd to the directory you put it in, from the command prompt.
C:\>pager.exe -f surgeon.cbf
Where file name is the file you wish to download to the Explorer. You should see some info on the screen about your Explorer along with the \PhysicalDrive it is. You'll see Sending Packet: then Finished! if all went well. If you get a complaint about Explorer not found, try replugging the USB cable, or if you have more than 10 drives hooked to your host, you'll need to compile your own or unplug a few drives, as it only searches the first 10 drives.
This is a wrapper for Pager, that takes the the surgeon.cbf name as an argument, runs Pager with it, then gets the IP address of the Explorer, and creates a route entry for it. You'll need to get devices' IP address, then configure the script for that particular IP check Windows Networking for more information. Then run:
C:> cellphone.v0.1.py surgeon.cbf
Mounting stock Explorer / and /LF/Bulk
Once surgeon.cbf has been booted, you can use the serial console as normal. This script mounts /patient-bulk and /patient-rfs which are the Explorers normal partitions.
There are a few restrictions known at this moment.
- "cbf_validate_header: magic wrong: <hex number>" shows up in the UART Console when downloading.
The downloader on the Explorer does a few checks, CRC and the Magic Number, which is 0x9abcdef0. This must be the first 4 bytes of data the Explorer receives when downloading. So any file you send it, but have those 4 bytes in that order, first thing. This can easily be accomplished using the scripts/make_cbf.py on your file.
The Explorer only checks for the magic number if the SCSI write(10) being sent to it, has the LBA address of 0x000000, which requires all subsequent writes to be addressed to a different LBA. In pager.sh you can see after the first packet, the LBA is switched to 0x01 for the rest of the transfer.
There is an 8mb size limit on the file you send.
CBF file format "Common Boot Format":
Once Surgeon has been loaded, executed, and finishes booting, it starts up a DFTP server. As best that can be told, this is a Distributed FTP protocol, that allows for push or pull type transfers. This is not standard FTP nor has any DFTP specific servers been found that are compatible.