Firmware updates are done by placing .upd files on the pen. There's a file called LanguageInfo.txt or LanguageInfoMT.txt (depending on the running firmware) on the pen which is supposed to define the names of the update files that the pen is looking for. The file contains a list like this:

3<0x0d><0x0a>
999 GERMAN Update3202.upd<0x0d><0x0a>
998 FRENCH Update3202_fr.upd<0x0d><0x0a>
997 DUTCH Update3202_nl.upd<0x0d><0x0a>

The first column indicates the language OID code (it is the OID that is used to initialize a new pen to use a specific language. Every new pen is delivered with an activation sheet with a printed field that contains that OID to be read (once) by the pen), the second column is the word the pen is looking for in GME files to match the language of the pen. And the third column is - obviously - the name of the corresponding update file for that language.

It is currently untested how strict this is and what happens when you feed an update file of a different language to your pen.

For some languages there are (additional) update files that are named differently. In the scripts directory of od this project you'll find some scripts that take care of downloading most of the firmwares. Upto now these have been identified/found on the Ravensburger site.

• for Germany
  • Update3202.upd
  • update3202_dl.upd (not linked on official download page; identical to Update3202.upd)
  • update3202MT.upd (not linked on official download page)
  • update.upd
  • update encrypt normal freq.upd (not linked on official download page; same as the update.upd)
• for France
  • Update3202_fr.upd
  • Update3202MT_fr.upd
• for Italy
  • Update3202_it.upd
  • Update3202MT_it.upd
• for the Netherlands
  • Update3202_nl.upd
  • Update3202MT_nl.upd
• for Belgium (dutch language)
  • Update3202_nl.upd (same as the one from the Netherlands)
  • update encrypt normal freq.upd (which is the same as the german update.upd)
• for Russia
  • Update3202MT_ru.upd

It is currently unknown what MT in some of the file names stands for (maybe there are different hardware revisions that need a slightly different firmware; current suspision is that that MT firmware supports some mote Micron flash chips.). The 3202 is the short name of the main processor Chomptech ZC3202N.

There's a hidden file on the pen which indicates the language of the stick. Here is the content of that file:

00000000  XX XX XX XX XX XX XX XX  ff ff ff ff ff ff ff ff  |XXXXXXXX........|
00000010  4e 30 30 33 38 00 00 00  00 00 ff ff ff ff ff ff  |N0038...........|
00000020  47 45 52 4d 41 4e 00 00  00 00 ff ff ff ff ff ff  |GERMAN..........|
00000030  33 32 30 32 4e 00 00 00  00 00 ff ff ff ff ff ff  |3202N...........|

This file consists of four "lines":

• the serial number of the pen (has been replaced by XX in this example).
• firmware version (a string that can be found in the firmware update files as well.)
• the language of the pen's firmware
• the processor name

If you remove the file .tiptoi.log the pen must be activated again using an activation sheet.

The firmware version string seems to consist of maximum 10 characters. Current firmwares have five or seven character versions. The all start with one letter followed by a four digit number, some of them have 'MT' appended to the number. Firmwares current at 2015-02-06 show these versions:

• for Germany: "N0038" (20120419)
• for France: "f0021" (20131120) or "f0023MT" (20131120)
• for the Netherlands: "h0013" (20130117) or "h0013MT" (20131003)
• for Italy: "i0010" (20140213) or "i0012MT" (20131203)
• for Russia: "r0007MT" (20140912)

Clearly the first letter corresponds to the language except for the German firmware. Maybe this is because Germany was the first market and they introduced that naming scheme after the introduction on the German market. The 'N' in the German firmware could refer to the Chomptech processor being called ZC3202N.

The pen can run in several modes:

• normal operation mode
• test mode (perform some tests)
• usb mass storage mode (read/write files from/to the pen)
• usb storage boot mode (flash firmware)

Hold the volume-down button while pressing the power-on button to enter this mode. The pen must not be connected via USB! In this mode, pressing volume-up and volume-down switches between different testing modes:

• reading the recognized OID in Chinese
• test of the OID circuitry
• play test tone
• perform checksumming on some parts of the firmware and some testfiles

(it would be helpful if someone capable of Chinese could translate the spoken texts)

In test mode you cannot change the volume or stop playback of test samples.

New pens contain two dirs containing some test data (or results?):

5196  1048576 Apr 13  2010 TestFile/Test1.bin
5197  1048576 Apr 13  2010 TestFile/Test2.bin
5198  1048576 Apr 13  2010 TestFile/Test3.bin
5199  1048576 Apr 13  2010 TestFile/Test4.bin
5200  1048576 Apr 13  2010 TestFile/Test5.bin
5201  1048576 Apr 13  2010 TestFile/Test6.bin
5203  1964880 Jan  5  2012 TestTone/Test1KHz.wav

The files in the TestFile dir are 1MB in size. Their format is probably random data but their checksum seems to be contained in the firmware (see below). The .wav file is a test tone sample. If you remove those files they will be gone forever so better backup them. Who knows what they'll be good for in future?

When the tests are run the pen is unresponsive for some time (it even cannot be powered off). Just wait some time and it will come back to normal. The test results will be written in to a file called Prodtest.txt. It will be recreated everytime the test is run. It starts with the byte 0x01 followed by one or more lines with the test results. Every line always ends in 0x0d 0x0a (Carriage Return and Linefeed). Content:

<0x01>The Program File's checksum=0X62fa5e0<0x0d><0x0a>
The Test1.bin File's checksum=0X51df7b1,checksum right!<0x0d><0x0a>
The Test2.bin File's checksum=0X57f5ac9,checksum right!<0x0d><0x0a>
The Test3.bin File's checksum=0X5aade57,checksum right!<0x0d><0x0a>
The Test4.bin File's checksum=0X51b659a,checksum right!<0x0d><0x0a>
The Test5.bin File's checksum=0X5447108,checksum right!<0x0d><0x0a>
The Test6.bin File's checksum=0X52c1349,checksum right!<0x0d><0x0a>

If you remove the TestFile directory it changes to:

<0x01>The Program File's checksum=0X62fa5e0<0x0d><0x0a>
The Test1.bin File is not exist!<0x0d><0x0a>
The Test2.bin File is not exist!<0x0d><0x0a>
The Test3.bin File is not exist!<0x0d><0x0a>
The Test4.bin File is not exist!<0x0d><0x0a>
The Test5.bin File is not exist!<0x0d><0x0a>
The Test6.bin File is not exist!<0x0d><0x0a>

And if you modify one of the files in the TestFile directory the pen detects that:

<0x01>The Program File's checksum=0X62fa5e0<0x0d><0x0a>
The Test1.bin File's checksum=0X51df60f,checksum wrong!<0x0d><0x0a>
The Test2.bin File's checksum=0X57f5ac9,checksum right!<0x0d><0x0a>
The Test3.bin File's checksum=0X5aade57,checksum right!<0x0d><0x0a>
The Test4.bin File's checksum=0X51b659a,checksum right!<0x0d><0x0a>
The Test5.bin File's checksum=0X5447108,checksum right!<0x0d><0x0a>
The Test6.bin File's checksum=0X52c1349,checksum right!<0x0d><0x0a>

(the first byte of the file remains at 0x01)

So obviously the checksums of the testfiles are contained in the firmware.

Supported:
OGG, MP3 (with a stereo sound quality at the headphone jack comparable to an MP3 player!)

Not supported:
AAC/MP4

The pen shows up with this data when plugged into a Linux PC and can be used just like an external USB stick:

usb 2-1: new high-speed USB device number 12 using ehci-pci
usb 2-1: New USB device found, idVendor=2546, idProduct=e301
usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 2-1: Product: tiptoi
usb 2-1: Manufacturer: tiptoi
usb 2-1: SerialNumber: USB 2.0
usb-storage 2-1:1.0: USB Mass Storage device detected
scsi12 : usb-storage 2-1:1.0
scsi 12:0:0:0: Direct-Access     Tiptoi   ZC3202N          V1.0 PQ: 0 ANSI: 2
sd 12:0:0:0: Attached scsi generic sg3 type 0
sd 12:0:0:0: [sdd] 3608576 512-byte logical blocks: (1.84 GB/1.72 GiB)
sd 12:0:0:0: [sdd] Write Protect is off
sd 12:0:0:0: [sdd] Mode Sense: 0b 00 00 08
sd 12:0:0:0: [sdd] No Caching mode page found
sd 12:0:0:0: [sdd] Assuming drive cache: write through
sd 12:0:0:0: [sdd] No Caching mode page found
sd 12:0:0:0: [sdd] Assuming drive cache: write through
sdd:
sd 12:0:0:0: [sdd] No Caching mode page found
sd 12:0:0:0: [sdd] Assuming drive cache: write through
sd 12:0:0:0: [sdd] Attached SCSI removable disk

This mode should (to be confirmed) allow to write a new firmware by the Anyka Burn Tool.
It's triggered by connecting GPIO13 for example via a 1 kOhm resistor to ground during start-up. This can be easily done by connecting the pads in the marked area via a 1 kOhm resistor. A direct connection may work too but this has not been tested yet.
(To be confirmed:) As these two pads are aligned with the two small holes in the battery compartment, it's not even necessary to open the pen to open the USB storage boot mode. The downside: a foil protects the two pads to be accessed from the outside. With a slight modification of this foil, access via the two holes should be possible.

The pen has USB PID 038D and VID 04D6 in USB Storage Boot Mode and is recognized by the computer like this:

(Technical detail: the string "Snowbird2_Massboot>" and some other bytes are sent via GPIO13 in UART protocol immediately after start-up)

The steps in one by one:

1. Wait a few seconds after the last shut-down
2. Connect the pen via USB to the PC
3. Bridge GPIO13 and GND with a 1 kOhm resistor
4. Switch the pen on and remove the resistor as soon as the PC has detected the pen
5. Now the pen should be in the USB Mass Storage Mode and the PC announce that a new device was found

Unfortunately there seem to exist different types of Tiptois and the steps above will only work if your pen does not automatically start up (even without batteries!) when connected by USB. If it does, the way to enter the Storage Boot Mode is currently unknown.

The USB Storage Boot Mode can be left by restarting the pen.