LeapFrog Pollux Platform: DFTPdevice

Work in progress, just jotting down notes currently.

DFTPdevice is an FTP like server that runs on both the Explorer and LeapPad. For these devices, this is what OpenLFConnect connects to them with.

DFTP Device
Connecting.

Open port 5000 send ETH command Open port 5001

When device starts up port 5000 is open, once you make a connection, you need to send the ETH command. Then port 5001 opens up.

5000 is the port you send commands to.

5001 is the port you read the responses from.

DFTP Command List
The command list is fairly undocumented, there is a few listed in the sources, but most will be discovered by other means, like using Wireshark. This is the list so far.

All commands must have a trailing 0x00 attached. In python it would look something like. socket.send('LIST /path/to\x00')

In OpenLFConnect there is a special command send. It allows you to send any command you like, the 0x00 is appended for you, otherwise its all raw read/write. Obviously STOR and RETR won't work with it, but the rest you can play around with. remote>send LIST /path/to

Some commands are Surgeon only.

Surgeon Only DFTP Version 1.12

GETS MFG_LOCALE Returns:

MFG_LOCALE=""

SETS MOUNTPATIENT=2 or 0 Returns:

200 OK

Action: 2 mounts patient-rfs 0 ?

GETS METAINFS Returns:

METAINFS=/tmp/metainfs

Universal

ETH 1383

Action: Something with establishing a connection.

must be sent before opening the second port.

LIST /path/to Returns:

list	200 OK

STAT /path/to Returns:

D 00000000 755 root:root

200 OK

Notes: Seems to not always work as expected.

INFO Returns:

PACKETSIZE=131072

VERSION=1.12

200 OK

GETS BATTERYLEVEL Returns:

BATTERYLEVEL=

200 OK

GETS BATTERYSTATUS Returns:

BATTERYSTATUS=1

200 OK

STOR /path/to Action: Initiate file upload. Next: Send file data till EOF then send 101 EOF. Device responds with a lot of 100 ACK: (Seems to be last amount of len(data) received.)

101 EOF Returns:

200 OK

Action: Ends STOR data transfer

Notes:Must flush recv buffer first

RETR /path/to

Action: Downloads file.

Next: Read socket buffer for data and send back 100 ACK: (Seems to be last amount of len(data) received.)

Ends: When 101 EOF is received.

RM /path/to Returns:

200 OK

Action: Removes file

RMD  Returns:

200 OK

Action:Removes directory

IPKG Action:?

Notes:Found listed in source code, does something with firmware.

SIZE /path/to Returns:

a number, that doesn't seem to make sense

SETS DATETIME=20120126083030 Returns:

200 OK

Action: Sets time.

GETS DATETIME Returns:

DATETIME=20120126083014''' 200 OK

GETS TOTALSPACE Returns:

TOTALSPACE=397307904

200 OK

GETS FREESPACE Returns:

FREESPACE=265678848

GETS SERIAL Returns:

SERIAL="XXXXXXXXXXXXXXXXXXXXX"

Untested

RUN

Action: Runs shell script

Next: Send data then 101 EOF

Note: Make sure to remove any \r line ends will cause an error otherwise.

GETS SCRIPT_RUNNING Returns:

SCRIPT_RUNNING=0

200 OK

Note: seems to return nothing just after script is ran

Reboot Sequences
Disconnect sequence

NOOP

DCON

Reboot after update or in general

RSET

NOOP

DCON

Reboot to usb mode

UPD8

NOOP

DCON