Reccomended to me on the comments of a previous thread, I picked up the leapfrog crammer for 10$ at big lots. I’ve seen these all over the discount stores (along with didj’s, which I have one of Claude’s cartridges for and will be porting software sometime soon). For 10$ ogg vorbis support and a touch screen (kind of ..) is a heck of a deal. More info after the jump.
The animation on the games is pretty good, better than I was expecting. The “touch screen” is actually just a 4-way rocker. Pretty fun way to control games, but obscures the screen for no good reason. It takes 3x aaa batteries, no word yet on battery life as they’re still holding a good charge. You can pop off the battery case with a small screwdriver or coin. After which you can pop off the front blue bezel, which exposes 4 small screws holding in the mobo. You pop this out just like an eee mobo (one pin, careful with the ports). Looks like it’s running a samsung-831 firmware, K9G8G08UOB pcbo nand. No transistors between the battery compartment and the mobo, taking straight 4.5v. Plays mp3, wav, and ogg. Another potential rockbox target?
any chance we can get some pictures of the othere side of the board?
Still haven’t been brave enough to pry the screen off, seems to be glued on? Maybe take the heat gun to it?
someone made a blog about this and deleted it or something was that u?
first you plug the crammer in and wait for it to connect on
the leapfrog connect program thing
then you go to
Application DataLeapfrogLeapFrog Connectmnt
go their and keep click on the folders
untill u get to a spot with a bunch of folders
once your their thats all the stuff on the crammer … i dont know what to do with it but yea
they say Finally if you have done everything correcly, you should be able to run the crammer application, run the new update, and have the diagnostic menu be in place of the flashcard app.
My final goal is to have an open source firmware running on the Crammer, sort of like rockbox or uClinux.
but its way to complex for me to do shit with
“What I Have Done WIth the Crammer
Currently the Leapfrog Crammer, has been partly reverse engineered by me. CrammerVerDict.xml holds many secrets. It is located in “C:Documents and SettingsAll UsersApplication DataLeapfrogLeapFrog ConnectUpdates”. The update files are located in “C:Documents and SettingsAll UsersApplication DataLeapfrogLeapFrog ConnectCrammer”, not the “Update” folder. If you read the CrammerVerDict.xml, you can see what the file names correspond to. You should use Wordpad, not Notepad or Internet Explorer. If you open the firmware update file in Winrar, after renaming it with a zip extension, you should be able to extract “Master.DAT” when you have master.dat extracted, you can search for FAT16 in a hex editor like XVI32. A few lines before that you should see “E9″ in the hex editor section. Click on the two digits behind the “E9″, and open the edit menu, and click “delete to cursor”. Then save this as a “img” extension. Finally open WinImage, then go to “File->Open” and navigate to the .img file and open it. You should be able to see the BXC OS filesystem, if you want to go further, extract the DIAGNOSE.EXE to c: then rename and inject it to another EXE like flshcard.exe to replace that app with the diagnostic menu. I will have some pictures attached to show what it looks like. Then delete from cursor while you are selecting the E9, not the one before it in XVI32. create an extra FF in the insert hex window. Then inject the the img file after saving it. and save it as master.dat in another directory. compress this in the same zip file after editing meta.xml to change the version number, in the same directory, and finally rename it to lfp. I take no responsibilty if anything goes wrong with your device, and I will not cover any damages, espically if you follow the steps after here. edit the hosts file to set the update server to 172.0.0.1. To find this, you need wireshark. I don’t want anybody with little experience doing this, so I will not give the hostname, and I have ommited some details above, which should be easy to find. Set up a http server, and copy the proper files into the proper directories, you can find these with wireshark. Then start the http server. Make sure to copy the CrammerVerDict.xml to the proper filename, and edit it to change the version number. Finally if you have done everything correcly, you should be able to run the crammer application, run the new update, and have the diagnostic menu be in place of the flashcard app.
My final goal is to have an open source firmware running on the Crammer, sort of like rockbox or uClinux.”
i found a way to put your own wav file in a spanish flash card set its pretty easy
you go to the leapfrog connect program and make a spanish flash card set and get rid of all the other spanish flash card sets on the crammer then go to
C:Documents and SettingsAll UsersApplication DataLeapfrogLeapFrog Connectmnt(some long number)crammerflashcardscustomaudio
then copy the name of the wav file already their usualy spt and a number after it then delete the wav file the put the wav file you want in the folder and rename it the name of the old wav file and thats it instead of haveing the spanish person talking it plays what ever wav file you put in their … not that theirs any point to it but yea
so if you wanted to put rockbox or uclinux or something on it you could put it in
C:Documents and SettingsAll UsersApplication DataLeapfrogLeapFrog Connectmnt(some long number)crammer
but im not good at that stuff so yea but you can change around what ever you want in their
Hey ZoneMad96,
Very cool info! I had not seen that page, nor did I know about the debug interface. Very neat, I’ll be sure to try that out shortly. Great find!
I didn’t know that anybody wanted to do the same thing as me. I created the blog. I am currently 13 years old. there are actually 3 different partitions in the crammer firmware. The leapfrog connect startup files partition, the firmware partition, and the mnt partition that zonemad was talking about. If you go into computer management, scroll down to disk management, click on that, then you should be able to see the leapfrog crammer disk partition, right click on it, and click change the mount points. Then you can mount it as a drive instead of that long directory. So far, I have seen no way to access the internal partition without rewriting the firmware. If you want, I could send you a diagnostic enabled firmware image. You would still have to copy it to the right location, and start a web server. Another strange thing, is the executable type. It is a portable executable, sort of like windows ce arm, but the crammer seems to be running dos, probably modified rom-dos. If you want to contact me, my email is cbalke@charter.net
Hey Calvin,
The great thing about the internet is that there’s always somebody interested
That’s great info, thanks for posting it up for us! I’m had no idea it was running a type of dos, that’ll make generating executables interesting. Thanks!
All,
it seems that the crammer runs PocketPC 2003 arm4 with some specific library developed for the crammer board. Did any one tried the crammer executables on a pocketPC 2003 arm4?
Hey speedsthatbeat,
That’s quite an interesting suggestion! Does anyone have a ppc2003 device to test with? Perhaps there’s an emulator that would suffice? A mystery! Great find!
Hunter,
I tried without success with emulator for WM 5 that you can find here http://www.microsoft.com/downloads/details.aspx?FamilyID=A120E012-CA31-4BE9-A3BF-B9BF4F64CE72&displaylang=en but I probably i have not set it up correctly because other applications that should have worked did not.
If you look inside the crammer binaries you find a lot of references to PocketPC 2003 so I guess the crammer is running some form of Wince 3 Arm and the hw specifics are handled by the sdklib.dll that you find in the firmware in the directory system following the instructions above.
In addition someone figured out what are the .dat files/ (i.e. music.dat quiz.dat)?
Hey speedsthatbeat,,
Now we’re getting somewhere. I recall I had an old jornada that ran winCE 3.0 arm as well. Actually that’s the jornada that played nintendo vs iteself for a year straight. I’ll see if I can dig out my old visual studio 6 install and try and compile something
Let me know if you figure out how to decode those .dat files, I have not looked at they yet. Fun stuff!
All,
here is more info about the crammer hw and the os.
HW
The Crammer is based on a Nuvoton W55pA71 that is an ARM7-TDMI running @ 81MHz. You can find more detailed specs just googling for W55pA71.
It is possible to put the crammer in diagnostic mode pressing the reset and the enter button (top right) together and powering up the unit.
OS: the os seems to be a flavor of wince. The appications are wince 32 console (all the binaries are potrable executable) while the key libraries sdklib.dll and krnllib.dll are for a wince32 4.2 (pocketpc2003)(gui) arm subsystem.
Applications: when executed in a pocketpc 2003 environment the application starts but does not show any output. The dll menioned have been moved to the windows directory to be found by the application.
I had to reboot the wince device afterwards os caution is advised.
Hey speedsthatbeat,
Excellent info! Now we’ve got all sorts of fun stuff to try! Thanks for the post!
The sdklib.dll and krnllib.dll have processor svc calls, so it won’t be compatible in another kernel. I know this, because I opened the dll up in IDA disassembler, and I read the instruction set for the arm architecture.
Nuvoton might be able to give me the source code, but I can’t distribute it. I can’t distribute the datasheet either as far as I know. I want to avoid any legal trouble.
Quite interesting, but we understand all about legal trouble. GL
Calvin,
is there anything at higher level that you can share? The crammer seems a nice platform to play with…
You could also ask them for the source code and the datasheet. I have not received the source code yet. I Think that Erik, the person who I was emailing, thought that I wanted Besta’s source code. I just sent another email. It supports ECOS, the open source embedded os. They already have a bootloader. Since the only part of the board that I can access is the flash IC, I am planning on making it so anybody could short two pins to put it in a special recovery mode.
Calvin,
great. Can you send me in an email the contact person?
thanks
just wondering any more progress?
Not from my end
i have a pic of the other side of the board theirs 4 clips holding the screen on like the kind of clips that hold a remote battery cover all i did was stick a mini flat head screw driver in between it and pryed it on both sides and came right up i got a pic im gonna upload to photo bucket in a sec
heres the pic pretty good for a closeout $50 camera from target =P
http://s431.photobucket.com/albums/qq37/zonemad96/?action=view¤t=PICT0001.jpg
if anyone wants i can take a pic of the other side to
Nice Pics! Would you use a heat gun to pull that large black pad off?
not to sound stupid but what black pad the circle thing???
honestly i dont know a dam thing when it comes to circut boards and hardware
Ya that’s what I was referring to, it looks like it’s glued on there quite well.
yea i tried to get it off but theirs no way in hell im going to be able to i dont own a heat gun so yea i tryed to pry it of but theirs no way i could but like i said its easy as hell to get the screen up so if you want to try you shouldnt have any problem
theirs 4 clips if lift the screen up kinda of gently you should be able to see them and one you do take and push on one with a screw driver and with the clip next to it and it sould come right off the ribon cable for the screen is on the end where the usb port anyway unless theirs something under that black pad imortant then i think theirs pretty much nothing on that side of the board other than the winbond chip which i would assume is ram considering thats all the seem to produce
http://www.winbond.com.tw/hq/enu/
btw does big lots still have this thing i have only been in their 1 other time since i brought it back in jan/feb
OFF TOPIC: btw one more thing (sorry for leaveing so many crappy comments) but did you hear about the augen gentouch its a $ 180 android tablet at kmart $150 if you have the rain check for when its on sale anyway i been waiting to pick one up it looks like it would be a cool thing to mess around with
Hey Zonemad96,
I haven’t seen one at big lots in a while, but I did pick one up at the Marshalls here in LA about 6 months ago. I have seen the gentouch, I believe you can get one for about 80$ on dealextreme right now? Still waiting on one that lets you use froyo or connect to the app store. You’ll have to let me know if you end up getting on. Good luck! Thanks for all the good info!
game mod have all the money or what ever else you want
you will need to have folder options set to show hidden folders to do this
C:Documents and SettingsAll UsersApplication DataLeapfrogLeapFrog Connectmnt(some long number)crammersystemreg then right click and hit edit on either wheeler or domino to change game settings
you can edit some of the other files to change the settings on the crammer as well
their are alot of other files you can edit but none of them seem to be imporatiant im gonna mess aroud with it some see if theirs anything intresting i can do to it
you can do a few things with xml too
go to C:Documents and SettingsAll UsersApplication DataLeapfrogLeapFrog ConnectMnt00C000100036B21CrammerMusic and edit the file artists with what ever xml code you want alot of them dont work tho
after that then go on your crammer and click on music then artist and you should see it you can do it with some of the other xml files to
make sure you back up the original code for the file you change
one code that works well is the food menu from http://www.w3schools.com/XML/xml_examples.asp
you can change the text on it to so you could make it what ever choices and info you want you could change the text in the code to make like a geocry list or some other list so that could be helpful for something
Hey Zonemad96, that’s good info. Haven’t seen this posted up before, good find!
Hi, I know this post is now very old, but wanted to let you know that the black blob on the PCB is a COB packaged IC, probably the processor. It’s used in large product runs to save costs, by not paying for packaging of an IC. Maybe you can dissolve it off with acid if you really want to see!: http://webcache.googleusercontent.com/search?q=cache:http://travisgoodspeed.blogspot.com/2009/06/cold-labless-hno3-decapping-procedure.html
I have just bought one of these on ebay… seems like fun to play with. Thinking to try and put some kind of other embedded OS on and make it into a USB drive that can let the user view most of its content (view text files, listen to music..). Did anyone get any further with the hacking?
Hey Munchausen,
Good info! I gave mine away in one of the hackaways a few years back, and the last I heard was from ZoneMad96 back in 2010. Best of luck!