PEN Firmware - entropia/tip-toi-reveng GitHub Wiki

WARNING

Always bear in mind that playing with the firmware and related files can lead to a broken pen. Currently might be no way to revive such a pen. You have been warned!

Please see also snowbirdopter for more in-depth information!

Firmware updates

Firmware updates are done by placing .upd files on the pen. There's a file called LanguageInfo.txt (or LanguageInfoMT.txt or LanguageInfo5E.txt... depending on the running firmware) on the pen which is supposed to define the names of the update files that the pen is looking for. The file contains a list like this:

3<0x0d><0x0a>
999 GERMAN Update3202.upd<0x0d><0x0a>
998 FRENCH Update3202_fr.upd<0x0d><0x0a>
997 DUTCH Update3202_nl.upd<0x0d><0x0a>

The first column indicates the language OID code (it is the OID that is used to initialize a new pen to use a specific language. Every new pen is delivered with an activation sheet with a printed field that contains that OID to be read (once) by the pen), the second column is the word the pen is looking for in GME files to match the language of the pen. And the third column is - obviously - the name of the corresponding update file for that language.

For some languages there are (additional) update files that are named differently. In the scripts directory of this project you'll find some scripts that take care of downloading most of the firmwares. Upto now these have been identified/found on the Ravensburger site.

  • for Germany
    • Update3202.upd
    • update3202_dl.upd (not linked on official download page; identical to Update3202.upd)
    • update3202MT.upd (not linked on official download page)
    • update.upd
    • update encrypt normal freq.upd (not linked on official download page; same as the update.upd)
    • Update3203L.upd
  • for France
    • Update3202_fr.upd
    • Update3202MT_fr.upd
  • for Italy
    • Update3202_it.upd
    • Update3202MT_it.upd
  • for the Netherlands
    • Update3202_nl.upd
    • Update3202MT_nl.upd
  • for Belgium (dutch language)
    • Update3202_nl.upd (same as the one from the Netherlands)
    • update encrypt normal freq.upd (which is the same as the german update.upd)
  • for Russia
    • Update3202MT_ru.upd

It is currently unknown what MT in some of the file names refers to (maybe there are different hardware revisions that need a slightly different firmware; current suspicion is that the MT firmware supports Micron Technology flash memory for the 4 GB version of the pen). The 3202 is the short name of the main processor Chomptech ZC3202N. For the newest pens with the audio player or with microphone it is both times the ZC3203L.

URLs

The (current) firmware images can downloaded here, there's no known location for previous firmware files:

Deep links (for 1st generation pen):

Deep links (for 2nd generation pen):

Deep links (for 2nd generation pen with MT chip):

Deep links (for 3rd generation pen with audio player):

(Deep links for tiptoi® CREATE (Update5E.upd...)? ToDo)

.tiptoi.log

There's a hidden file on the pen which indicates the language of the stick. Here is the content of that file:

00000000  41 42 31 32 33 34 35 36  ff ff ff ff ff ff ff ff  |AB123456........|
00000010  4e 30 30 33 38 00 00 00  00 00 ff ff ff ff ff ff  |N0038...........|
00000020  47 45 52 4d 41 4e 00 00  00 00 ff ff ff ff ff ff  |GERMAN..........|
00000030  33 32 30 32 4e 00 00 00  00 00 ff ff ff ff ff ff  |3202N...........|

This file consists of four "lines":

  • the serial number of the pen (has been replaced by AB123456 in this example).
  • firmware version (a string that can be found in the firmware update files as well.) This is updated on every boot of the pen.
  • the language of the pen's firmware
  • the processor name

If you remove the file .tiptoi.log the pen must be activated again using an activation sheet.

Firmware Version String

The firmware version string seems to consist of maximum 10 characters. Current firmwares have five or seven character versions. The all start with one letter followed by a four digit number, some of them have 'MT' appended to the number. Firmwares for ZC3202N based devices show these versions (last check: 2015-02-06)

  • for Germany: "N0038" (20120419)
  • for France: "f0021" (20131120) or "f0023MT" (20131120)
  • for the Netherlands: "h0013" (20130117) or "h0013MT" (20131003)
  • for Italy: "i0010" (20140213) or "i0012MT" (20131203)
  • for Russia: "r0007MT" (20140912)

Clearly the first character corresponds to the language except for the German firmware (Maybe the reason for this is Germany was the first market and they added that naming scheme after the introduction on the German market). The 'N' in the German firmware could refer to the Chomptech processor being called ZC3202N.

For the ZC3201 based devices the current firmware is v136 (last check 2018-11-13).

For the ZC3203L bases devices the current firmware is "2G0042 (for Germany).

You can check the version of an upd file by looking at the end of the file using a hex editor or the "strings" tool on Linux. There a string that looks like "ANYKA_IDRAV2G0042". The right part after "RAV" is the firmware version. "RAV" probably stands for "Ravensburger".

How to switch the language of the pen

  • swap the number in the first column of the desired language with the number of the current language in LanguageInfo.txt (see above). If the file is missing you can create one yourself, see above for the format
  • place the update file of the new language on the pen (the correct filename is to be found in LanguageInfo.txt)
  • boot pen. It will tell you (in the new language) that is updating, then reboot

Since 2021 Ravensburger partly supports language switching (via the Tiptoi Manager) officially now: https://service.ravensburger.de/tiptoi/Fragen_zum_tiptoi_Stift/Spracheinstellungen_des_tiptoi_Stiftes (German)

Modes

The pen can run in several modes:

  • normal operation mode
  • test mode (perform some tests)
  • usb mass storage mode (read/write files from/to the pen)
  • usb storage boot mode (flash firmware)

Test mode

Hold the volume-down button while pressing the power-on button to enter this mode (with the new Player pen you might want to hold the skip-backwards button while pressing the power-on button to do so). The pen must not be connected via USB!

When entering that mode you first hear (in chinese) "Testmode" ("Toshe mo she"), "Start test of program" ("Cashe toshe ton tjio") followed by "Program test pass" ("ton tjio toshe dchin tao") or "Program test fail" ("ton tjio toshe she by"). You can now run some tests by pressing "+". Each press leads to the next test (in the order described here) being started:

  • "Start test of the tip of the pen" ("cashe toshe beat ho") followed by "Test of the tip of the pen passed" ("beat ho toshe dchin tao") or "Communication to the tip of the pen failed" ("beat ho toshe she by")
  • "Start test of encryption procedure" ("cashe toshe dja mee"), afterwards it takes some time where no action is possible, then you'll hear "Encryption procedure test passed" ("dja mee toshe dchang gung") or "Encryption procedure test failed" ("dja mee toshe she by"). This possibly uses the TestFile directory on the pen.
  • plays TestTone/Test1KHz.wav three times.
  • nothing happens any more

Instead of pressing "+" you can also press "-" to start these tests in order:

  • "Start test of UDISK file" ("Cashe toshe upau in dje") followed by "Test of UDISK file passed" ("jon de toshe dchin tao") or "Test of UDISK file failed" ("jon de toshe she by")
  • plays "if you want to hear the manual for that game tip on the info sign on the game plan" (not in chinese but in the language of the pen) in a loop. Sometimes you can leave this mode by pressing "+" and the pen will jump to one of the tests described in the "+" section.

In test mode you cannot change the volume or stop playback of test samples.

New pens have two dirs containing some test data (or results?):

5196  1048576 Apr 13  2010 TestFile/Test1.bin
5197  1048576 Apr 13  2010 TestFile/Test2.bin
5198  1048576 Apr 13  2010 TestFile/Test3.bin
5199  1048576 Apr 13  2010 TestFile/Test4.bin
5200  1048576 Apr 13  2010 TestFile/Test5.bin
5201  1048576 Apr 13  2010 TestFile/Test6.bin
5203  1964880 Jan  5  2012 TestTone/Test1KHz.wav

The files in the TestFile dir are 1MB in size. Their format looks at first like random data but all 6 files show a very similar statistical distribution:

When the tests are run the pen is unresponsive for some time (it cannot even be powered off). Just wait some time and it will come back to normal. The test results will be written in to a file called Prodtest.txt. It will be recreated every time the test is run. It starts with the byte 0x01 followed by one or more lines with the test results. Every line always ends in 0x0d 0x0a (Carriage Return and Linefeed). Content:

<0x01>The Program File's checksum=0X62fa5e0<0x0d><0x0a>
The Test1.bin File's checksum=0X51df7b1,checksum right!<0x0d><0x0a>
The Test2.bin File's checksum=0X57f5ac9,checksum right!<0x0d><0x0a>
The Test3.bin File's checksum=0X5aade57,checksum right!<0x0d><0x0a>
The Test4.bin File's checksum=0X51b659a,checksum right!<0x0d><0x0a>
The Test5.bin File's checksum=0X5447108,checksum right!<0x0d><0x0a>
The Test6.bin File's checksum=0X52c1349,checksum right!<0x0d><0x0a>

If you remove the TestFile directory it changes to:

<0x01>The Program File's checksum=0X62fa5e0<0x0d><0x0a>
The Test1.bin File is not exist!<0x0d><0x0a>
The Test2.bin File is not exist!<0x0d><0x0a>
The Test3.bin File is not exist!<0x0d><0x0a>
The Test4.bin File is not exist!<0x0d><0x0a>
The Test5.bin File is not exist!<0x0d><0x0a>
The Test6.bin File is not exist!<0x0d><0x0a>

And if you modify one of the files in the TestFile directory the pen detects that:

<0x01>The Program File's checksum=0X62fa5e0<0x0d><0x0a>
The Test1.bin File's checksum=0X51df60f,checksum wrong!<0x0d><0x0a>
The Test2.bin File's checksum=0X57f5ac9,checksum right!<0x0d><0x0a>
The Test3.bin File's checksum=0X5aade57,checksum right!<0x0d><0x0a>
The Test4.bin File's checksum=0X51b659a,checksum right!<0x0d><0x0a>
The Test5.bin File's checksum=0X5447108,checksum right!<0x0d><0x0a>
The Test6.bin File's checksum=0X52c1349,checksum right!<0x0d><0x0a>

(the first byte of the file remains at 0x01)

So obviously the checksums-32 of the testfiles are contained in the firmware.

The .wav file is a test tone sample. If you remove those files they will be gone forever so better backup them. Who knows what they'll be good for in future?

Audio formats

Supported:
WAV, OGG, MP3 (with a stereo sound quality at the headphone jack comparable to an MP3 player!)

Not supported:
AAC/MP4

USB Mass Storage Mode (standard)

The pen shows up with this data when plugged into a Linux PC and can be used just like an external USB stick:

usb 2-1: new high-speed USB device number 12 using ehci-pci
usb 2-1: New USB device found, idVendor=2546, idProduct=e301
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: tiptoi
usb 2-1: Manufacturer: tiptoi
usb 2-1: SerialNumber: USB 2.0
usb-storage 2-1:1.0: USB Mass Storage device detected
scsi12 : usb-storage 2-1:1.0
scsi 12:0:0:0: Direct-Access     Tiptoi   ZC3202N          V1.0 PQ: 0 ANSI: 2
sd 12:0:0:0: Attached scsi generic sg3 type 0
sd 12:0:0:0: [sdd] 3608576 512-byte logical blocks: (1.84 GB/1.72 GiB)
sd 12:0:0:0: [sdd] Write Protect is off
sd 12:0:0:0: [sdd] Mode Sense: 0b 00 00 08
sd 12:0:0:0: [sdd] No Caching mode page found
sd 12:0:0:0: [sdd] Assuming drive cache: write through
sd 12:0:0:0: [sdd] No Caching mode page found
sd 12:0:0:0: [sdd] Assuming drive cache: write through
sdd:
sd 12:0:0:0: [sdd] No Caching mode page found
sd 12:0:0:0: [sdd] Assuming drive cache: write through
sd 12:0:0:0: [sdd] Attached SCSI removable disk

USB Storage Boot Mode (firmware flashing)

Please see also Hardware Details section!

This mode does (confirmed!) allow to write a new firmware by the Anyka Burn Tool.

It is initiated if GPIO13 is connected during start-up to ground. This can be easily done by connecting the pads in the marked area via a 1 kOhm resistor. A direct connection may work too but might maybe damage the pen.

As these two pads on the PCB are aligned with the two small holes in the battery compartment, it's not even necessary to open the pen to enter USB storage boot mode. The downside: a foil protects in older versions of the pen the two pads from outside access. With a slight modification of this foil, access via the two holes should be possible. For version B6 (4 GB) this workaround is not necessary because the foil has a cutout at right place.

The pen has USB PID 038D and VID 04D6 in USB Storage Boot Mode and is recognized by the computer like this:

(Technical detail: the string "Snowbird2_Massboot>" and some other bytes are sent via GPIO13 in UART protocol with 38400 bps immediately after start-up)

The steps one by one (method 1, tested with B6 model):

  1. Remove the batteries and wait 10 secs (to be sure that the pen is in a defined state).
  2. Insert the batteries but do not press the power button.
  3. Launch Burntool.exe (v3.0.18) and import the .upd file (ex: Update3202MT_fr.upd [if the pen has flash memory from Micron Technologies] or Update3202_fr.upd [if the pen has flash memory from other suppliers]).
  4. Bridge GPIO13 and GND with a ~1 kOhm resistor
  5. Push and hold the power button while the resistor is still in place. Now the pen should be in the USB Storage Boot Mode and you can remove the resistor. If done correctly, you don't hear the chime sound (because the TT is not executing the TT software from the flash memory).
  6. Connect the pen by USB to the PC and keep the power button pressed all the time (otherwise the pen turns itself off again).
  7. Burntool detects the pen as ready and automatically starts the flash process after a short time.
  8. After the 100% mark has been reached (in between 30 secs and 2 mins), you can release the power button and disconnect the pen from USB.

After restarting the pen, you should have a pen as new and functional.

The steps one by one (method 2, for B5 models, maybe method 1 works too):

  1. Remove the batteries
  2. Insert the batteries
  3. Connect the pen via USB to the PC
  4. Bridge GPIO13 and GND with a ~1 kOhm (820 Ohm also works) resistor
  5. Push the power button and remove the resistor after about 2 seconds. Now the pen should be in the USB Mass Storage Mode and the PC announce that a new device was found

For the ZC3201 bases devices this procedure will not work. These pens do automatically start up (even without batteries!) when connected by USB. The way to enter the Storage Boot Mode should then be this (no power button involved):

The steps in one by one (method 3, for A4 models)

  1. Insert batteries
  2. Turn on Tiptoi
  3. Turn off Tiptoi
  4. Wait for ~10s
  5. Connect the pen via USB to the PC
  6. Bridge GPIO13 and GND with a ~1 kOhm (820 Ohm also works) resistor

The USB Storage Boot Mode can be left by restarting the pen.

About actually flashing with burntool user "clean31" reported this on github:

[..] after importing the upd file and check the update and the udisk options, you must connect the tiptoi with usb then hold the power button and maintain the resistor between GPIO13 and GND during all process.

(see https://github.com/entropia/tip-toi-reveng/issues/144#issuecomment-541413723 for possible updates).

⚠️ **GitHub.com Fallback** ⚠️