Leapster Explorer: USB Boot

From eLinux.org
Revision as of 01:58, 27 October 2011 by Peter Huewe (talk | contribs)
Jump to: navigation, search


The Leapster Explorer's Emerald-Boot contains a feature that allows for a recovery mode, called Surgeon. When put into this mode and connected to LFConnect, it will upload and install a new firmware to your device. The programs provided here, replace LFConnect and will allow you to send a kernel or firmware of your choosing.

Programs Needed

sg3_utils - Provides the needed sg_raw and sg_verify for Linux

OpenLX Pager (Linux or Windows)

Software Needed

surgeon.cbf (found in the LST3-0x00170028-000000 package)


Console Access

On Explorer

Connect the device to the host PC.

Hold down Right and Left Shoulder buttons and ? Button.

Turn the device on, you can let go of the buttons and you should see download screen.

Under Linux

Download the Pager script and save it in a directory, make sure it is set to execute file permissions for your user. From a terminal run

 $ sudo ./pager.sh surgeon.cbf
 1: Writing bytes:0 -> 16383 to /dev/sdc
 SCSI Status: Good 
 2: Writing bytes:16384 -> 32767 to /dev/sdc
 SCSI Status: Good 
 430: Writing bytes:7045120 -> 7061503 to /dev/sdc
 SCSI Status: Good 
 431: Writing bytes:7061504 -> 7077887 to /dev/sdc
 Verifying /dev/sdc

and it will be done. You can check in your UART terminal, and you should see it uncompressing Linux. And you should notice, the Explorer USB Device has now changed from a Mass Storage Driver to a Network Device.

Under Windows

Download the Pager app and extract it, cd to the directory you put it in, from the command prompt.

 C:\>pager.exe -f surgeon.cbf

Where file name is the file you wish to download to the Explorer. You should see some info on the screen about your Explorer along with the \PhysicalDrive it is. You'll see Sending Packet: then Finished! if all went well. If you get a complaint about Explorer not found, try replugging the USB cable, or if you have more than 10 drives hooked to your host, you'll need to compile your own or unplug a few drives, as it only searches the first 10 drives.


This is a wrapper for Pager, that takes the the surgeon.cbf name as an argument, runs Pager with it, then gets the IP address of the Explorer, and creates a route entry for it. You'll need to get devices' IP address, then configure the script for that particular IP check Windows Networking for more information. Then run:

 C:> cellphone.v0.1.py surgeon.cbf

Using Surgeon

Mounting stock Explorer / and /LF/Bulk

Once surgeon.cbf has been booted, you can use the serial console as normal. This script mounts /patient-bulk and /patient-rfs which are the Explorers normal partitions.

 ./etc/init.d/recovery-mounts start


There are a few restrictions known at this moment.

Magic Number:

- "cbf_validate_header: magic wrong: <hex number>" shows up in the UART Console when downloading.

The downloader on the Explorer does a few checks, CRC and the Magic Number, which is 0x9abcdef0. This must be the first 4 bytes of data the Explorer receives when downloading. So any file you send it, but have those 4 bytes in that order, first thing. This can easily be accomplished using the scripts/make_cbf.py on your file.

The Explorer only checks for the magic number if the SCSI write(10) being sent to it, has the LBA address of 0x000000, which requires all subsequent writes to be addressed to a different LBA. In pager.sh you can see after the first packet, the LBA is switched to 0x01 for the rest of the transfer.

File Size:

There is an 8mb size limit on the file you send.

CBF file format "Common Boot Format":


Once Surgeon has been loaded, executed, and finishes booting, it starts up a DFTP server. As best that can be told, this is a Distributed FTP protocol, that allows for push or pull type transfers. This is not standard FTP nor has any DFTP specific servers been found that are compatible.