Hello There, Guest! Register
Enjoy our site and services? You may donate to help fund server and domain costs. Donate Here for special benefits. You have donated $

Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
LeapTV questions
Hi All!

I have been debating on purchasing a console for my 3 year old, and finally came to the conclusion that she just isn't ready for one. We have a 27" touchscreen HP that she took over and plays ABC mouse on it constantly, and I am a gamer myself, so naturally I wanted to get her on something early to help her learn. She loves ABC mouse and is basically a little sponge....

After deciding NOT to get a console, I stumbled upon LeapTV and it's marked down holiday price. The quality of the camera scanner and the fact it places the kids IN the game REALLY caught my eye, but the price tag on each game is a slight deterrence.

I am an avid fan of Jailbreaking devices and getting them to do my bidding, and finding this forum directly after discovering the LeapTV was like a godsend. So, I have a few questions for you guys pertaining to the system and jailbreaking, if you don't mind me asking Smile

1: I see the device comes with an SD in it. Can I buy a bigger one to install more games?
2: Can I find someplace else to procure these games and push them to the device with the LeapFrog Manager I saw in other threads?
3: Once jailbroken, are these devices stable enough and locked down enough on the user side so my kid can't get into anything she shouldn't be able to?

That's all for now, and I will edit or post more questions if I think of them. Thanks everyone, I appreciate all feedback Smile
Hi sheeeeeeets,

1) The leaptv has 16gbs of internal storage if memory serves me correct. Unfortunately this isn't upgradeable.

2) This is a tough one. We don't support piracy on this forum. But, that wasn't really the question. In saying that, it's not impossible XD.

3) Right now all that is public is how to enable shell and ftp access. This will give you the ability to modify the system as you see fit, providing you know what you are doing. As for the system being stable and locked down. Yes. The systems functionality remains the same.

If you have any more questions feel free to ask.

Kind regards,
Thanks for the quick response Josh. After reading around quite a bit more, I see that Piracy is not permitted, and fully understand. I might wait until more becomes available for LeapTV before taking the plunge, but this forum has some VERY nifty tools to tweak any Leap purchase my family decides to make in the near future Smile
No probs Smile. Welcome to spiffy hacks!
Do you have any kids, and/or alot of hands on experience with the LeapTV? Can you do anything particularly useful via jailbreaking the LeapTV?
Josh has been busy working with the LeapTV and more info will show up as it becomes available. Mick also has one and has been playing around with it.
There isn't really anything "locked down" on the leap tv.
Everything runs as root.
The cartridges are just sd cards formatted with EXT4 linux filesystem, and plain non encrypted files on them, and superglued in a plastic housing.

This opens up the possibility for running your own code from a sd card without any modifications.

I was going to have a go at porting doom or scummVM.

Here is a test that I did with a normal SD card and a piece of cardboard.

I've had some luck with the LeapTV so far, having attached a serial console to the 4-pin header inside the device.  This gives me access to the system before telnet comes up but unfortunately u-boot seems to be ignoring any attempt to stop or pause boot.

I also did a look at the strings in the NOR flash to determine if u-boot does anything beyond scanning the internal emmc.  As it turns out, it does. :-D

I did however use an inexpensive game cart as a holder for an 8G microSD.  After doing a similar partition layout to the internal EMMC and copying the partitions over netcat to the SD on my pc,  I noticed while attempting to boot the card that the firmware was looking for a file named 'factory-cart' during startup, so I created a simple file with that name.  Here's the result:  It's not perfect since the factory cart is expected to have the NOR files present, but I'm happy it didn't undo my changes to the internal root FS. ;-)

DDR 666, 1% spread

Second Boot by Nexell Co. : Built on Oct  7 2014 16:22:17
PLL0: 984000000   PLL1: 655500000   PLL2: 800000000   PLL3: 666000000

Divider0 PLL: 0 CPU:984000000   CPU BUS:246000000
Divider1 PLL: 2 BCLK:400000000   PCLK:200000000
Divider2 PLL: 3 MDCLK:666000000   MCLK:666000000
MBCLK:333000000   MPCLK:166500000
Divider3 PLL: 2 G3D BCLK:400000000
Divider4 PLL: 1 MPEG BCLK:327750000   MPEG PCLK:163875000

DDR3 POR Init Start

## pNxDrex_reg->DIRECTCMD[MR2] : 0x00020220
## pNxDrex_reg->DIRECTCMD[MR3] : 0x00030000
## pNxDrex_reg->DIRECTCMD[MR1] : 0x00010006
## pNxDrex_reg->DIRECTCMD[MR0] : 0x00001D1C
## READ/GATE Level ##

Searching write delay value......
lane average positive min:45 negative min:13 margin: 32  adj: 16
lane average positive min:42 negative min:15 margin: 27  adj: 13
lane average positive min:43 negative min:16 margin: 27  adj: 13
lane average positive min:41 negative min:17 margin: 24  adj: 12
read  delay value is 0x12121212
write delay value is 0x0C0D0D10

## AXI BUS ##

## PNxDDRphy_reg->PHY_CON[4] : 0x12121212
## PNxDDRphy_reg->PHY_CON[6] : 0x0C0D0D10
## PNxDDRphy_reg->PHY_CON[13] : 0x00009207
## PNxDDRphy_reg->PHY_CON[16] : 0x0E400304

DDR3 Init Done!
Board_ID        : 0x00000448
SPI Load Address: 0x40C00000
SPI Load Size   : 0x0007A000
DDR3 SelfRefresh exit Done!
WakeUpStatus reg: 0x00000001
Suspend Signature is different
Read Signature :0x00000010
Restoring ALIVESCRATCH: 0x00000010
FCS Verify Succeeded
Image Loading Done!
Launch to 0x40C00000

U-Boot 2013.01.01 (Oct 07 2014 - 16:25:34)

PLL : [0] =  984000000, [1] =  655500000, [2] =  800000000, [3] =  666000000
PLLSETREG[0] : 0x1019ec01  ( SS_EN =    0  P =    6  M =  492  S =    1 )
PLLSETREG[1] : 0x1011b502  ( SS_EN =    0  P =    4  M =  437  S =    2 )
PLLSETREG[2] : 0x100cc801  ( SS_EN =    0  P =    3  M =  200  S =    1 )
PLLSETREG[3] : 0x5010de01  ( SS_EN =    1  P =    4  M =  222  S =    1 )
PLLSETREG_SSCG[2] : 0x00000000  ( K =    0  MFR =    0  MRR =    0  SEL_PF =    0 )
PLLSETREG_SSCG[3] : 0x0000055c  ( K =    0  MFR =    5  MRR =   23  SEL_PF =    0 )
PLL0: CPU FCLK =  984000000, HCLK = 246000000
PLL2: BUS BCLK =  400000000, PCLK = 200000000
PLL3: MEM MCLK =  666000000, DCLK = 666000000, BCLK = 333000000, PCLK = 166500000
PLL2: G3D BCLK =  400000000
PLL1: MPG BCLK =  327750000, PCLK = 163875000
nxp_soc_rsc_reset: id=20
nx-i2c.0:   260416 Hz [pclk=200000000, src=256, scale=3]
nxp_soc_rsc_reset: id=21
nx-i2c.1:   260416 Hz [pclk=200000000, src=256, scale=3]
I2C: ready
DRAM:  256 MiB
Heap = 0x43fff000~0x45000000
Code = 0x40c00000~0x40c89b2c
GLD  = 0x40bfff80
GLBD = 0x40bfff60
SP   = 0x40bfff60,0x40bfff48(CURR)
PC   = 0x40c0ba28
TAGS = 0x40000100
MACH = [4330]  
*** Warning - bad CRC, using default environment

drv_lcd_init: power = 0x00000001
drv_lcd_init: skipping HDMI init -- "COLD boot"
In:    serial
Out:   serial
Err:   serial
 cartridge_is_present(): yes
reading factory_cart
3350312 bytes read in 290 ms (11 MiB/s)
reading surgeon-kernel.cbf
12021248 bytes read in 8 ms (1.4 GiB/s)
cbf_init ram_base=40000000
INHEADER cbf_common: buf=42000000 len=00b76e00 need=00000018 where=40c575e8 Memcpy=00000018 suggest=40c57600
INDATA cbf_common: buf=42000018 len=00b76de8 need=00b76d64 where=40008000 Memcpy=00b76d64 suggest=40b7ed64
INTAIL cbf_common: buf=42b76d7c len=00000084 need=00000004 where=40c57600 Memcpy=00000004 suggest=40c57604
DONE boot_surgeon_kernel_cbf: cbf_process_chunk returned successfully!

Starting kernel ...

Booting Linux on physical CPU 0
Linux version 3.4.24 (glasgow2@emdlfwbuild03) (gcc version 4.5.4 20120305 (prerelease) (GCC) ) #1

(removed normal kernel startup messages)

init started: BusyBox v1.19.4 (2014-10-04 01:08:08 PDT)
starting pid 703, tty '': '/etc/init.d/rcS'
mount: mounting none on /dev/pts failed: No such file or directory
mknod: /dev/i2c-0: File exists
mmc1: new high speed SDHC card at address 1234
mmcblk1: mmc1:1234 SA08G 7.28 GiB
mmcblk1: p1 p2 p3
mmc2: card claims to support voltages below the defined range. These will be ignored.
eth%d: status ep1in, 8 bytes period 11
mmc2: queuing unknown CIS tuple 0x91 (3 bytes)
mmc2: new high speed SDIO card at address 0001
eth0: register 'asix' at usb-nxp4330-ehci-1, ASIX AX88772C USB 2.0 Ethernet, 00:0e:c6:87:72:01
/bin/sh: /etc/mdev/usb.sh: not found
/bin/sh: /etc/mdev/usb.sh: not found
/bin/sh: /etc/mdev/usb.sh: not found
tar: Removing leading `/' from member names
cat: can't open '/sys/devices/platform/lfp100-chip/pmic_revision': No such file or directory
cat: can't open '/sys/devices/platform/lf1000-gpio/boot_image': No such file or directory
boot_image= cat: can't open '/sys/devices/platform/lf1000-gpio/boot_source': No such file or directory
boot_source= cat: can't open '/sys/devices/platform/lf1000-gpio/panic': No such file or directory
panic= cat: can't open '/sys/devices/platform/lf1000-gpio/power': No such file or directory
power= cat: can't open '/sys/devices/platform/lf1000-gpio/request': No such file or directory
request= cat: can't open '/sys/devices/platform/lf1000-gpio/shutdown': No such file or directory
shutdown= cat: can't open '/sys/devices/platform/lf1000-alvgpio/scratchpad': No such file or directory
REQUEST=cat: can't open '/sys/devices/platform/lf1000-gpio/request': No such file or directory
cat: can't open '/sys/devices/platform/lf1000-gpio/request': No such file or directory
: Unknown
g_mass_storage gadget: controller 'dwc_otg_pcd' not recognized
g_mass_storage gadget: Mass Storage Function, version: 2009/09/11
g_mass_storage gadget: Number of LUNs=1
lun0: LUN: file: /LF/fuse/dftp
g_mass_storage gadget: Mass Storage Gadget, version: 2009/09/11
g_mass_storage gadget: g_mass_storage ready
Resume from soft disconnect
Using Buffer DMA mode
Periodic Transfer Interrupt Enhancement - disabled
Multiprocessor Interrupt Enhancement - disabled
Loaded g_mass_storage driver
FACTORY recovery mode
starting pid 773, tty '/dev/ttyS0': '-/bin/sh'
~ # eth0: rxqlen 0 --> 5
eth0: ax88772c - Link status is: 0
Mounted Factory Cartridge successfully
Starting to flash FW...
nor_write_addr_threshold set to 0x0
While trying to open NORBoot/u-boot.bin: No such file or directory
NORBoot flashing error
Waiting for power button to poweroff...
eth0: ax88772c - Link status is: 1

The surgeon software cowardly refuses to continue since it can't find the NORBoot files.  There's a shell hidden there as usual, overwritten by the debug output from the factory-restore script.

Note also that the system does start up from COLD boot instead of powering down and waiting for the power button to be pressed.

For everyone's reference I noticed that the LeapTV appears unable to write to the cartrdige's SD card while booted from the internal EMMC due to DMA timeouts, but has no trouble doing so while booted from the surgeon's initrd.

Elinux.org has some good info on the surgeon boot as well as the .cbf file format from the older systems.  I'll work later on seeing if I can get a more useful system put on the cartridge by building a custom surgeon CBF, possibly allowing an entire custom system to be run without disturbing the internal EMMC.


Forum Jump: