Leapster Explorer: USB Boot

This how-to will explain a bit about the USB booting process of the Leapfrog Explorer and provide a Linux shell script to download the file to the device.

Programs Needed
sg3_utils - Provides the needed sg_raw and sg_verify

Terminal app to check progress

Software Needed
shell script surgeon.cbf (found in the LST3-0x00170028-000000 package) or one of your own making, see Issues And Information

SG3-utils needs to be installed

Hardware
DJHI or other means of gaining a UART Console (optional)

On Explorer
To turn on USB Boot mode, with the USB connected hold down the Right and Left Shoulder buttons along with the ? mark button, while holding them down, turn the power on, you should end up seeing a screen showing the LX connected to a PC.

Under Linux
Download the Pager script and save it in a directory, make sure it is set to execute file permissions for your user. From a terminal run

$ sudo ./pager.sh

Where file name is the name of the firmware you want to download to the Explorer. In your terminal window you ran the script in, you should see something like this.

1: Writing bytes:0 -> 16383 to /dev/sdc SCSI Status: Good 2: Writing bytes:16384 -> 32767 to /dev/sdc SCSI Status: Good ... ...  430: Writing bytes:7045120 -> 7061503 to /dev/sdc SCSI Status: Good 431: Writing bytes:7061504 -> 7077887 to /dev/sdc Verifying /dev/sdc

and it will be done. You can check in your UART terminal, and you should see it uncompressing Linux. And you should notice, the Explorer USB Device has now changed from a Mass Storage Driver to a Network Device.

Issues And Information
There are a few restrictions known at this moment.

Magic Number:

- "cbf_validate_header: magic wrong: " shows up in the UART Console when downloading.

The downloader on the Explorer does a few checks, CRC and the Magic Number, which is 0x9abcdef0. This must be the first 4 bytes of data the Explorer receives when downloading. So any file you send it, but have those 4 bytes in that order, first thing, if that is a problem, it should be possible to create a magic file, with just those four bytes, then modify the Pager script to work with it. The Explorer only checks for the magic number if the SCSI write(10) being sent to it, has the LBA address of 0x000000, which requires all subsequent writes to be addressed to a different LBA. In pager.sh you can see after the first packet, the LBA is switched to 0x01 for the rest of the transfer.

File Size:

In the source code, there is reference to an 8mb limit, I can't verify why, but I would imagine it has something to do with the available space on the device itself, your mileage may very.

CBF file format "Common Boot Format":

Not much info on this, there is a build script in the sources in /scripts that looks to build the necessary image along with all the needed data.

FTP:

With surgeon.cbf successfully downloaded Explorer out puts this Emerald Base DFTP: Initialize DFTP from what I can tell, at this stage in the Surgeon/Patient recovery process the Explorer is now looking to do some FTP transfers of the /Firmware-Base images. During this process LFConnect unpacks the necessary packages to C:\Documents And Settings\\Temp\Leapfrog and they get transfered over.