Skip to content(if available)orjump to list(if available)

Getting the Firmware of a VTech/LeapFrog LeapStart/Magibook

Getting the Firmware of a VTech/LeapFrog LeapStart/Magibook

6 comments

·April 3, 2025
Visit

userbinator

I assume this is some kind of ARM binary, but without any headers or anything I haven't been able to find out exactly what it is.

Hint: ARM (32-bit) non-Thumb opcodes have a very recognisable appearance, i.e. nearly every 4th byte will have E as its high nybble, because most of the instructions can be executed conditionally, and E is the "always" condition.

LelouBil

Hello !

This is my first shot at blogging and at a "real" reverse-engineering project of any kind (outside small binary for school classes) so please tell me all your feedback about anything in there, the length, the technical stuff, the style...

I know it's short but I wanted to publish it right now, as I arrived at a "pausing" point in the process.

And thank you for at least clicking on the discussion page !

kotaKat

It wouldn't surprise me if the book is printed with Anoto dot pattern - LeapFrog has been an Anoto licensee for quite some time.

https://en.wikipedia.org/wiki/Anoto

LelouBil

Yes that's exactly this, the video I link talks about it (in french).

onre

You might consider using this handy thing, also available as a binwalk module, for recognizing the ISA.

https://github.com/airbus-seclab/cpu_rec

LelouBil

Thanks !