LeapFrog Pollux Platform: Surgeon

From eLinux.org
Jump to: navigation, search

Surgeon is a special initramfs USB Bootable firmware designed for the LeapPad Explorer and Leapster Explorer, that is used during the firmware updating process. Emerald Boot is required for USB Booting, which comes stock with both LeapPad and Explorer. The Didj can be modified to run Emerald-Boot also, but requires some work.


Surgeon is wrapped in a CBF layer. Inside is a basic gzip compressed zImage with an initramfs that includes all of the programs necessary to run the basic Linux and updating software.

Once in USB boot mode, either with LFConnect or with out the surgeon.cbf file can be sent to the device, where it is loaded by Emerald Boot and executed.

This will start the DFTP Device which is basically a modified FTP server. You can use OpenLFConnect to exploit various functionality of the server. Using the update command the kernel, erootfs and bulk firmwares can be flashed to NAND. You can also mount the already installed firmware partitions, if you need to fix an issue that can not be done during normal booting. Do remember Surgeon is completely temporary, anything you modifying with in Surgeon, will not remain after a reboot, which can make it an excellent means of non-destructive testing.


Device Language File kernel_load kernel_jump compressed initramfs Size Limit DFTP Version
LeapPad English Surgeon.cbf 0x00010000 0x00010000 True True 8MB Memory Limited 1.12
Explorer English Surgeon.cbf 0x00008000 0x00008000 True True 8MB Memory Limited 1.12
Explorer French Surgeon.cbf 0x00008000 0x00008000 True True 8MB Memory Limited 1.8



Set Up Build Environment

Kernel Configuration

Software Needed


Kernel Sources LeapPad or Explorer RootFS

* Build your own
* Use OpenLFConnect to extract one from Surgeon


The easiest way is to use OpenLFConnect, and extract one from a factory Surgeon file. These commands will download the Surgeon package, extract it, then extract the initramfs(rootfs) to <current dir>/rootfs.lx/

package_download LX surgeon
package_extract LX_surgeon<version>.lfp
surgeon_extract_rootfs lx surgeon.cbf

This will


Nothing out of the ordinary here, there is a supplied config file for surgeon, and just need SURGEONFS on the command line to point to your rootfs.

make lf1000_ts_surgeon_defconfig
SURGEONFS=/path/to/your/rootfs ./install.sh

In either <lf_sources>/linux-2.6/arch/arm/boot/ or <lf_sources>/target/tftp you'll find a zImage file of roughly 5.8mb depending on LeapPad or Explorer sources.

Next using OpenLFConnect again, the file needs to be wrapped in CBF. High(0x00010000) or Low(0x00008000) memory is according to your device, check the versions chart.

cbf_wrap high surgeon.cbf path/to/zImage

Didj Patches

Didj Surgeon Patch

These patches take care of a few minor adjustments with the RootFS and Kernel to allow Surgeon to work as normal with Emerald Boot on the Didj. Complied version included.


Set the device in USB Boot mode, with cord connected. Again with OpenLFConnect boot surgeon.

surgeon_boot /path/to/surgeon.cbf

Once the command line returns, your device should be booting up. You can then connect to the DFTP if you like thru OpenLFConnect


You should get a summary of data, and you can now play around with Surgeon.