Leapster Explorer: USB Boot

This how-to will explain a bit about the USB booting process of the Leapfrog Explorer and provide a Linux shell script to download the file to the device.

Programs Needed
sg3_utils - Provides the needed sg_raw and sg_verify for Linux

shell script for Linux

command line app for Windows

{optional} wrapper for pager that includes network settings

Terminal app to check progress

Software Needed
surgeon.cbf (found in the LST3-0x00170028-000000 package) or one of your own making, see Issues And Information

SG3-utils needs to be installed

Hardware
DJHI or other means of gaining a UART Console (optional)

On Explorer
To turn on USB Boot mode, with the USB connected hold down the Right and Left Shoulder buttons along with the ? mark button, while holding them down, turn the power on, you should end up seeing a screen showing the LX connected to a PC.

Under Linux
Download the Pager script and save it in a directory, make sure it is set to execute file permissions for your user. From a terminal run

$ sudo ./pager.sh

Where file name is the name of the firmware you want to download to the Explorer. In your terminal window you ran the script in, you should see something like this.

1: Writing bytes:0 -> 16383 to /dev/sdc SCSI Status: Good 2: Writing bytes:16384 -> 32767 to /dev/sdc SCSI Status: Good ... ...  430: Writing bytes:7045120 -> 7061503 to /dev/sdc SCSI Status: Good 431: Writing bytes:7061504 -> 7077887 to /dev/sdc Verifying /dev/sdc

and it will be done. You can check in your UART terminal, and you should see it uncompressing Linux. And you should notice, the Explorer USB Device has now changed from a Mass Storage Driver to a Network Device.

Under Windows
Download the Pager app and extract it, cd to the directory you put it in, from the command prompt.

C:\>pager.exe -f

Where file name is the file you wish to download to the Explorer. You should see some info on the screen about your Explorer along with the \PhysicalDrive it is. You'll see Sending Packet: then Finished! if all went well. If you get a complaint about Explorer not found, try replugging the USB cable, or if you have more than 10 drives hooked to your host, you'll need to compile your own or unplug a few drives, as it only searches the first 10 drives. Also, this has only been tested on XP SP3 Pro.

 Python script to run Pager and set up networking 

This is a wrapper for Pager, that takes the the surgeon.cbf name as an argument, runs Pager with it, then gets the IP address of the Explorer, and creates a route entry for it. You'll need to set the network adapter to have a static IP address, then configure the script for it,its found near the top of the file. You can double click the file to run it, or run it from a command prompt, which will give you the host name of the Explorer, which will be Explorer-.local you can then use that host name in any applications that you use to hook up to the Explorer, like winSCP. This will allow the Explorer to change its address, with out having to configure a new batch script for route.exe or settings in your programs. After starting Explorer with usb hooked up, run the script. Either double click or C:> cellphone.v0.1.py surgeon.cbf



Using Surgeon
Mounting stock Explorer / and /LF/Bulk

Once surgeon.cbf has been booted, you can use the serial console as normal. ./etc/init.d/recovery-mounts start you will find /patient-bulk and /patient-rfs in / which will contain their respective folders and files from the Explorer. You can then do what you need to do with them.

Creating your own usb kernel

In the source code, there is a script called make_cbf.py, this will create a cbf file out of your kernel image, it will also format the file with all the needed parameters to be used with usb boot, magic number and packet size.

Issues And Information
There are a few restrictions known at this moment.

Magic Number:

- "cbf_validate_header: magic wrong: " shows up in the UART Console when downloading.

The downloader on the Explorer does a few checks, CRC and the Magic Number, which is 0x9abcdef0. This must be the first 4 bytes of data the Explorer receives when downloading. So any file you send it, but have those 4 bytes in that order, first thing, if that is a problem, it should be possible to create a magic file, with just those four bytes, then modify the Pager script to work with it. The Explorer only checks for the magic number if the SCSI write(10) being sent to it, has the LBA address of 0x000000, which requires all subsequent writes to be addressed to a different LBA. In pager.sh you can see after the first packet, the LBA is switched to 0x01 for the rest of the transfer.

File Size:

In the source code, there is reference to an 8mb limit, I can't verify why, but I would imagine it has something to do with the available space on the device itself, your mileage may very.

CBF file format "Common Boot Format":

Not much info on this, there is a build script in the sources in /scripts that looks to build the necessary image along with all the needed data.

FTP:

With surgeon.cbf successfully downloaded Explorer out puts this Emerald Base DFTP: Initialize DFTP from what I can tell, at this stage in the Surgeon/Patient recovery process the Explorer is now looking to do some FTP transfers of the /Firmware-Base images. During this process LFConnect unpacks the necessary packages to C:\Documents And Settings\\Temp\Leapfrog and they get transfered over.