<![CDATA[Spiffy Hacks - InnoTab]]> https://spiffyhacks.harmonypogo.com/ Tue, 14 Apr 2026 12:09:56 +0000 MyBB <![CDATA[Can you access the InnoTab's internal memory?]]> https://spiffyhacks.harmonypogo.com/thread-1674.html Tue, 10 Nov 2020 02:11:48 +0000 https://spiffyhacks.harmonypogo.com/thread-1674.html


Thanks.]]>


Thanks.]]> <![CDATA[How do I get my Unit EID?]]> https://spiffyhacks.harmonypogo.com/thread-1673.html Mon, 09 Nov 2020 02:58:50 +0000 https://spiffyhacks.harmonypogo.com/thread-1673.html I'm wondering where you can get your Unit EID, I'm looking forward to hacking my InnoTab but I'm not sure where to get your Unit EID]]> I'm wondering where you can get your Unit EID, I'm looking forward to hacking my InnoTab but I'm not sure where to get your Unit EID]]> <![CDATA[SWF pack flash ebooks?]]> https://spiffyhacks.harmonypogo.com/thread-1655.html Tue, 26 May 2020 09:11:30 +0000 https://spiffyhacks.harmonypogo.com/thread-1655.html http://learnenglishkids.britishcouncil.o...ids/files/ ? These were referenced in https://spiffyhacks.harmonypogo.com/thread-1.html
but since then they changed the ebooks from SWF to PDF/MP4/HTML5 so they were lost (but not in webarchive ;-)).
As stated in thread-1 you will need to create the _Run file yourself to make them work..
Code:
Scanning the drive for archives:
1 file, 29695841 bytes (29 MiB)

Listing archive: short_stories_learn_english_kids.zip

  Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2020-05-23 01:18:37 ....A       700185       700185  short-stories-a-dogs-life.swf
2020-05-23 01:28:32 ....A       628157       628157  short-stories-abc-zoo.swf
2020-05-23 01:02:42 ....A      1378234      1377911  short-stories-ali-and-the-magic-carpet-standard_2011_09_21.swf
2020-05-23 01:28:16 ....A       508877       508877  short-stories-angel-look-out.swf
2020-05-23 01:21:53 ....A       716629       716054  short-stories-buzz-and-bobs-big-adventure.swf
2020-05-23 01:27:34 ....A      1240008      1240008  short-stories-circus-escape.swf
2020-05-23 01:27:54 ....A       351292       351292  short-stories-dark-dark-wood.swf
2020-05-23 01:13:04 ....A       567128       567128  short-stories-dinosaur-dig.swf
2020-05-23 01:29:52 ....A       758384       758384  short-stories-eric-the-engine.swf
2020-05-23 01:02:16 ....A       750139       750139  short-stories-goldilocks-and-the-three-bears.swf
2020-05-23 01:22:07 ....A       380498       380498  short-stories-i-couldnt-believe-my-eyes.swf
2020-05-23 01:03:31 ....A       863446       863030  short-stories-jack-and-the-beanstalk.swf
2020-05-23 00:54:46 ....A       531012       531012  short-stories-little-red-riding-hood.swf
2020-05-23 01:30:23 ....A       262611       262095  short-stories-my-favourite-clothes.swf
2020-05-23 01:29:16 ....A       600898       600898  short-stories-my-favourite-day-chinese-new-year_0.swf
2020-05-23 01:30:42 ....A       276040       276040  short-stories-my-favourite-day-eid.swf
2020-05-23 01:18:01 ....A       494807       494807  short-stories-my-secret-team.swf
2020-05-23 01:11:19 ....A      1023343      1022327  short-stories-no-dogs.swf
2020-05-23 01:19:39 ....A      1143830      1143830  short-stories-our-colourful-world-standard_2011_09_21.swf
2020-05-23 01:12:38 ....A       495588       495588  short-stories-pyramids-in-paris.swf
2020-05-23 01:17:21 ....A       504820       504820  short-stories-ratty-robs-a-bank.swf
2020-05-23 01:10:28 ....A       734992       734992  short-stories-santas-little-helper.swf
2020-05-23 01:17:36 ....A       693265       693265  short-stories-spycat.swf
2020-05-23 01:13:56 ....A       756644       756644  short-stories-superhero-high-standard_2011_09_21.swf
2020-05-23 01:25:48 ....A       461993       461993  short-stories-teddys-adventure.swf
2020-05-23 01:04:05 ....A       537901       537901  short-stories-the-animal-shelter.swf
2020-05-23 01:03:02 ....A       413446       413320  short-stories-the-cold-planet.swf
2020-05-23 00:56:32 ....A       568469       568469  short-stories-the-first-marathon.swf
2020-05-23 01:19:51 ....A       481545       480897  short-stories-the-great-race.swf
2020-05-23 01:09:34 ....A       672021       672021  short-stories-the-haunted-house.swf
2020-05-23 01:21:31 ....A       879861       539944  short-stories-the-hungry-dragon_0.swf
2020-05-23 01:18:57 ....A       518115       518115  short-stories-the-lucky-envelope.swf
2020-05-23 01:11:40 ....A       321671       321671  short-stories-the-lucky-seed.swf
2020-05-23 01:10:03 ....A      1499447      1499447  short-stories-the-monster-shopping-trip.swf
2020-05-23 01:12:22 ....A       530094       530094  short-stories-the-mummy.swf
2020-05-23 01:14:18 ....A       643230       643230  short-stories-the-princess-and-the-dragon.swf
2020-05-23 01:29:37 ....A       484663       484663  short-stories-the-story-quinine.swf
2020-05-23 01:10:55 ....A       514317       514317  short-stories-the-treasure-map.swf
2020-05-23 01:25:37 ....A      1074672      1074323  short-stories-the-twins-week-standard_2011_09_21.swf
2020-05-23 01:13:22 ....A       849799       849799  short-stories-the-voyage-of-the-animal-orchestra.swf
2020-05-23 01:47:04 ....A       701821       701821  song-chocolate-cake.swf
2020-05-23 01:46:28 ....A       584947       584880  songs-flying-from-the-sun-to-the-stars.swf
2020-05-23 01:47:31 ....A       718597       718597  songs-old-macdonald.swf
2020-05-23 01:46:17 ....A       611057       611057  songs-over-the-mountains.swf
2020-05-23 01:40:18 ....A       602933       602933  songs-people-work.swf
------------------- ----- ------------ ------------  ------------------------
2020-05-23 01:47:31           30031426     29687473  45 files


.txt   contents.txt (Size: 4.43 KB / Downloads: 385) ]]> http://learnenglishkids.britishcouncil.o...ids/files/ ? These were referenced in https://spiffyhacks.harmonypogo.com/thread-1.html
but since then they changed the ebooks from SWF to PDF/MP4/HTML5 so they were lost (but not in webarchive ;-)).
As stated in thread-1 you will need to create the _Run file yourself to make them work..
Code:
Scanning the drive for archives:
1 file, 29695841 bytes (29 MiB)

Listing archive: short_stories_learn_english_kids.zip

  Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2020-05-23 01:18:37 ....A       700185       700185  short-stories-a-dogs-life.swf
2020-05-23 01:28:32 ....A       628157       628157  short-stories-abc-zoo.swf
2020-05-23 01:02:42 ....A      1378234      1377911  short-stories-ali-and-the-magic-carpet-standard_2011_09_21.swf
2020-05-23 01:28:16 ....A       508877       508877  short-stories-angel-look-out.swf
2020-05-23 01:21:53 ....A       716629       716054  short-stories-buzz-and-bobs-big-adventure.swf
2020-05-23 01:27:34 ....A      1240008      1240008  short-stories-circus-escape.swf
2020-05-23 01:27:54 ....A       351292       351292  short-stories-dark-dark-wood.swf
2020-05-23 01:13:04 ....A       567128       567128  short-stories-dinosaur-dig.swf
2020-05-23 01:29:52 ....A       758384       758384  short-stories-eric-the-engine.swf
2020-05-23 01:02:16 ....A       750139       750139  short-stories-goldilocks-and-the-three-bears.swf
2020-05-23 01:22:07 ....A       380498       380498  short-stories-i-couldnt-believe-my-eyes.swf
2020-05-23 01:03:31 ....A       863446       863030  short-stories-jack-and-the-beanstalk.swf
2020-05-23 00:54:46 ....A       531012       531012  short-stories-little-red-riding-hood.swf
2020-05-23 01:30:23 ....A       262611       262095  short-stories-my-favourite-clothes.swf
2020-05-23 01:29:16 ....A       600898       600898  short-stories-my-favourite-day-chinese-new-year_0.swf
2020-05-23 01:30:42 ....A       276040       276040  short-stories-my-favourite-day-eid.swf
2020-05-23 01:18:01 ....A       494807       494807  short-stories-my-secret-team.swf
2020-05-23 01:11:19 ....A      1023343      1022327  short-stories-no-dogs.swf
2020-05-23 01:19:39 ....A      1143830      1143830  short-stories-our-colourful-world-standard_2011_09_21.swf
2020-05-23 01:12:38 ....A       495588       495588  short-stories-pyramids-in-paris.swf
2020-05-23 01:17:21 ....A       504820       504820  short-stories-ratty-robs-a-bank.swf
2020-05-23 01:10:28 ....A       734992       734992  short-stories-santas-little-helper.swf
2020-05-23 01:17:36 ....A       693265       693265  short-stories-spycat.swf
2020-05-23 01:13:56 ....A       756644       756644  short-stories-superhero-high-standard_2011_09_21.swf
2020-05-23 01:25:48 ....A       461993       461993  short-stories-teddys-adventure.swf
2020-05-23 01:04:05 ....A       537901       537901  short-stories-the-animal-shelter.swf
2020-05-23 01:03:02 ....A       413446       413320  short-stories-the-cold-planet.swf
2020-05-23 00:56:32 ....A       568469       568469  short-stories-the-first-marathon.swf
2020-05-23 01:19:51 ....A       481545       480897  short-stories-the-great-race.swf
2020-05-23 01:09:34 ....A       672021       672021  short-stories-the-haunted-house.swf
2020-05-23 01:21:31 ....A       879861       539944  short-stories-the-hungry-dragon_0.swf
2020-05-23 01:18:57 ....A       518115       518115  short-stories-the-lucky-envelope.swf
2020-05-23 01:11:40 ....A       321671       321671  short-stories-the-lucky-seed.swf
2020-05-23 01:10:03 ....A      1499447      1499447  short-stories-the-monster-shopping-trip.swf
2020-05-23 01:12:22 ....A       530094       530094  short-stories-the-mummy.swf
2020-05-23 01:14:18 ....A       643230       643230  short-stories-the-princess-and-the-dragon.swf
2020-05-23 01:29:37 ....A       484663       484663  short-stories-the-story-quinine.swf
2020-05-23 01:10:55 ....A       514317       514317  short-stories-the-treasure-map.swf
2020-05-23 01:25:37 ....A      1074672      1074323  short-stories-the-twins-week-standard_2011_09_21.swf
2020-05-23 01:13:22 ....A       849799       849799  short-stories-the-voyage-of-the-animal-orchestra.swf
2020-05-23 01:47:04 ....A       701821       701821  song-chocolate-cake.swf
2020-05-23 01:46:28 ....A       584947       584880  songs-flying-from-the-sun-to-the-stars.swf
2020-05-23 01:47:31 ....A       718597       718597  songs-old-macdonald.swf
2020-05-23 01:46:17 ....A       611057       611057  songs-over-the-mountains.swf
2020-05-23 01:40:18 ....A       602933       602933  songs-people-work.swf
------------------- ----- ------------ ------------  ------------------------
2020-05-23 01:47:31           30031426     29687473  45 files


.txt   contents.txt (Size: 4.43 KB / Downloads: 385) ]]> <![CDATA[UART bootlog InnoTab/V.Reader]]> https://spiffyhacks.harmonypogo.com/thread-1654.html Fri, 08 May 2020 12:33:41 +0000 https://spiffyhacks.harmonypogo.com/thread-1654.html i couldnt figure out a GND (ground) pad so i have opted for one of GND pins of the cart port ( as the pins of the cartridge port are
similar of Innotab 2+).


.jpg   CART_layout.jpg (Size: 191.36 KB / Downloads: 397)

The testpads are really small  so it isn't easy to solder leads to a USB - TTL Serial Cable .

.jpg   USB_TTL.jpg (Size: 5.47 KB / Downloads: 531)


.jpg   ARM_UART.jpg (Size: 198.15 KB / Downloads: 421)

But finally i could read some bootlog messages:
Code:
Init RTC....Fail
Fail - Timeout
Init RTC....Fail
Fail - Timeout
DDR size: 32MB
SD Port0 Booting Fail - No/Bad Card Insert
NAND Booting (2K-page 4 Address Cycle) Success
Clock Skew
DQSODS 0x1010
CKDQSDS 0x888800
Code Executes at 0x00900000
fsInitFileSyste
[GNAND] GNAND Library Version: V1.02.3
[GNAND] GNAND format version on NAND chip: V1.01
[GNAND] NAND flash chip detected, chip ID is 0x98-0xF1 !
Linux version 2.6.17.14 (root@PST-Linux) (gcc version 4.2.1) #1454 Tue Jul 31 16:20:57 HKT 2012
CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ)
Machine: W55FA93
Memory policy: ECC disabled, Data cache writeback
CPU W55FA93 (id 0x00fa5c30)
Memory policy: ECC disabled, Data cache writeback
CPU W55FA93 (id 0x00fa5c30)
w55fa93_external_clock  = 12 MHz
w55fa93_apll_clock      = 72000 KHz
w55fa93_upll_clock      = 192000 KHz
w55fa93_system_clock    = 192000 KHz
w55fa93_cpu_clock       = 192000 KHz
w55fa93_ahb_clock       = 96000 KHz
w55fa93_apb_clock       = 48000 KHz
CPU0: D VIVT write-back cache
CPU0: I cache: 8192 bytes, associativity 4, 32 byte lines, 64 sets
CPU0: D cache: 8192 bytes, associativity 4, 32 byte lines, 64 sets
Built 1 zonelists
Kernel command line: root=/dev/ram0 console=ttyS1,115200n8 rdinit=/sbin/init mem=32M
PID hash table entries: 256 (order: 8, 1024 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 32MB = 32MB total
Memory: 28892KB available (1208K code, 137K data, 1048K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
SCSI subsystem initialized
register clock device
w55fa93_edma_init
io scheduler noop registered (default)
W55FA93 USB 2.0 Device Driver Initilization Success
w55fa93 Sysmgr driver has been initialized successfully!
w55fa93 BLT driver has been initialized successfully!
---w55fa93fb_init ----w55fa93 frame buffer init
###########w55fa93 frame buffer probe############
check_var(var=c05a5008, info=c05a5000)
Console: switching to colour frame buffer device 60x34
w55fa93 LCD driver has been installed successfully
W55FA93 uart driver has been initialized successfully!
w55fa93-uart.1: w55fa93_serial1 at MMIO 0xb8008100 (irq = 24) is a W55FA93
RAMDISK driver initialized: 8 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
Linux video capture interface: v1.00
mice: PS/2 mouse device common for all mice
input: W55FA93 TouchScreen as /class/input/input0
[KEYPAD_DRV] w55fa93 Keypad driver has been initialized successfully!
w55fa93-rtc w55fa93-rtc: rtc intf: sysfs
w55fa93-rtc w55fa93-rtc: rtc intf: proc
w55fa93-rtc w55fa93-rtc: rtc intf: dev (254:0)
w55fa93-rtc w55fa93-rtc: rtc core: registered w55fa93-rtc as rtc0
Init Nuvoton RTC!
W55FA93 Audio driver has been initialized successfully!
REG_AIC_MECR = 0
REG_AIC_MECR = 0
NET: Registered protocol family 1
NET: Registered protocol family 17
w55fa93-rtc w55fa93-rtc: hctosys: invalid date/time
Freeing init memory: 1048K
init started: BusyBox v1.9.1 (2010-09-09 09:34:19 CST)
========> D+ Low DISSCONNECT PC
179
C_CmdMsg: Sync msgget() succeeded: msqid = 0
C_CmdMsg: Async msgnand: module license 'Proprietary' taints kernel.
gget() succeeded: msqid = 32769
NAND: nand_init!!!!!
FUNC(nand_init) LINE(2119) system_report enabled!
FUNC(nand_init) LINE(2136) enable NAND ALE/CLE/CS0/CS1 pins
FUNC(nand_init) LINE(2156) Init PortA4 and request_irq for nand_debug
FUNC(nand_init) LINE(2195) Enable NAND_CD_IRQ
FUNC(nand_init) LINE(2234) Setup nandcard detect timer
scsi0 : Nuvoton W55FA93 On Board NAND DRIVER!
[GNAND] GNAND Library Version: V1.02.3
fmiSMCheckBootHeader 1
Nand0: uLibStartBlock=33
[GNAND] GNAND format version on NAND chip: V1.01
[GNAND] NAND flash chip detected, chip ID is 0x98-0xf1 !
on board NAND size 120 MB (245760 sectors)
  Vendor: NUVOTON   Model: GNAND DRIVER      Rev: 2.00
  Type:   Direct-Access                      ANSI SCSI revision: 00
SCSI device sda: 245760 512-byte hdwr sectors (126 MB)
sda: Write Protect is off
sda: got wrong page
sda: assuming drive cache: write through
SCSI device sda: 245760 512-byte hdwr sectors (126 MB)
sda: Write Protect is off
sda: got wrong page
sda: assuming drive cache: write through
 sda: sda1 sda2 < sda5 >
sd 0:0:0:0: Attached scsi removable disk sda
W55FA93 SD Card driver has been initialized successfully!
Success to Reserve Free Page from: 0xc1c00000, order:10, pages:1024
W55FA93 DEVMEM driver has been initialized successfully!
boot_script: Change Directory
boot_script: Create Directories
boot_script: Mounting System Menu
full path: /mnt/nand1-1/SystemMenu.bin
Type: 0
Menu data path: /mnt/sysmenu/TitleSystemMenu/MainMenu/MenuData.swf
boot_script: Mounting Resources
boot_script: Run desktopManager
Loading module /usr/gui/tslib/input.so
Loading module /usr/gui/tslib/variance.so
Loading module /usr/gui/tslib/dejitter.so
Loading module /usr/gui/tslib/linear.so
Linear calibration constants: 37459 211 -3819231 -110 26281 -4738218 65536
boot_script: Remove Windows Temporary Files
root:~> KPD: cmd=80046B06
Linux_kernel: set language: 1
KPD: cmd=80046B07
C_CmdMsg: Sync msgget() succeeded: msqid = 0
C_CmdMsg: Async msgget() succeeded: msqid = 32769
 ####################
 Copyright (c) 2009 - 2012 Nuvoton All rights reserved, FL3.1.6 (Apr 26 2011 - 15:51:54)
 ####################
 msgget: msgget succeeded: msqid = 0
msgget: msgget succeeded: msqid = 32769
Total MAX_DYNAMIC_MEM = 18 MB
[auto_scale_up]/[off]
[home_swf_path]/[/mnt/sysmenu/TitleSystemMenu/SystemMenu.swf]
[quality]/[0]
SetQuality: m_quality=0
[full_screen_display]/[off]
[static_max_mem]/[512]
[dynamic_max_mem]/[18000]
[lcm_width]/[480]
[lcm_height]/[272]
[lcm_stride_width]/[480]
[free_mem_safe_ratio]/[80]
SetQuality: m_quality=0
SetQuality: m_quality=0
#### Validation pass
The framebuffer device was opened successfully.
xxddff
00000(31f0a8)
SIInterface::initialize
sec diff :0
1111
sampleRate=0, channels=0, bufferSize=4096
2222
Set Timer Interval=10
open key event1 failed
Loading module /usr/gui/tslib/input.so
Loading module /usr/gui/tslib/variance.so
Loading module /usr/gui/tslib/dejitter.so
Loading module /usr/gui/tslib/linear.so
Linear calibration constants: 37459 211 -3819231 -110 26281 -4738218 65536
new file:/mnt/sysmenu/TitleSystemMenu/SystemMenu.swf
Removing timerssssss
load movie
resulr=8604
<<<
Removing timerssssss
>>>
start movie
Adding timerssssss
Set Timer Interval=10
MemFree = 21580 (KB), buffers = 80 (KB), cached = 5420 (KB), m_maxDynamicMem = 18432000
newFrameInterval=83, Min=2, Max=10
Set Timer Interval=8
StartMovie: m_quality=0
Clear dev frame buffer, ptich=960, height=272
Set Timer Interval=10
Load & start Movie: 310 ms
Load & start Movie:: 3 sec 740 ms
open file "/var/syslibrtc" fails!
open file "/var/SYSLIB_SUS" fails!
PWM value = 501
open file "/var/SYSLIB_BGMF" fails!
open file "/var/SYSLIB_MH" fails!
trace("[FSHelper readFile] Can not open file: /var/SYSLIB_MH for read!")

height=272, width=480
KPD: cmd=80046B04
open file "/mnt/nand1-2/Dict/TitleDictionary.bin" fails!
open file "/mnt/sd/Dict/TitleDictionary.bin" fails!
open file "/mnt/nand2-1/Dict/TitleDictionary.bin" fails!
open directory "/mnt/nand1-2/theme/" fails!
change directory "/mnt/nand1-2/theme/" fails!
trace("Theme not found!")

trace("Loading /mnt/sysmenu/TitleSystemMenu/sysmenu.swf")

trace("System Menu is running!")

KPD: cmd=80046B04
open file "/var/SYSLIB_BGMF" fails!
Initializing Sound
Opening the sound device sampleRate:22050
channels:2, sampleSize:16, sampleRate:22050 fragmentSize = 4096
m_bufferSize = 0x4000
Lock:2
open directory "/mnt/nand1-2/theme/" fails!
change directory "/mnt/nand1-2/theme/" fails!
open directory "/mnt/nand1-2/theme/" fails!
change directory "/mnt/nand1-2/theme/" fails!
open file "/var/SYSLIB_SUS" fails!
trace("A sound completed: 1")

remove "/mnt/nand1-2/CERT/CertStatus.xml" fails!

trace("newCertNum: 0")
The detected NAND chip-ID matches closely to the Toshiba NAND flash chip according to this NAND Flash table


.txt   bootlog_uart.txt (Size: 8.5 KB / Downloads: 388) ]]> i couldnt figure out a GND (ground) pad so i have opted for one of GND pins of the cart port ( as the pins of the cartridge port are
similar of Innotab 2+).


.jpg   CART_layout.jpg (Size: 191.36 KB / Downloads: 397)

The testpads are really small  so it isn't easy to solder leads to a USB - TTL Serial Cable .

.jpg   USB_TTL.jpg (Size: 5.47 KB / Downloads: 531)


.jpg   ARM_UART.jpg (Size: 198.15 KB / Downloads: 421)

But finally i could read some bootlog messages:
Code:
Init RTC....Fail
Fail - Timeout
Init RTC....Fail
Fail - Timeout
DDR size: 32MB
SD Port0 Booting Fail - No/Bad Card Insert
NAND Booting (2K-page 4 Address Cycle) Success
Clock Skew
DQSODS 0x1010
CKDQSDS 0x888800
Code Executes at 0x00900000
fsInitFileSyste
[GNAND] GNAND Library Version: V1.02.3
[GNAND] GNAND format version on NAND chip: V1.01
[GNAND] NAND flash chip detected, chip ID is 0x98-0xF1 !
Linux version 2.6.17.14 (root@PST-Linux) (gcc version 4.2.1) #1454 Tue Jul 31 16:20:57 HKT 2012
CPU: ARM926EJ-Sid(wb) [41069265] revision 5 (ARMv5TEJ)
Machine: W55FA93
Memory policy: ECC disabled, Data cache writeback
CPU W55FA93 (id 0x00fa5c30)
Memory policy: ECC disabled, Data cache writeback
CPU W55FA93 (id 0x00fa5c30)
w55fa93_external_clock  = 12 MHz
w55fa93_apll_clock      = 72000 KHz
w55fa93_upll_clock      = 192000 KHz
w55fa93_system_clock    = 192000 KHz
w55fa93_cpu_clock       = 192000 KHz
w55fa93_ahb_clock       = 96000 KHz
w55fa93_apb_clock       = 48000 KHz
CPU0: D VIVT write-back cache
CPU0: I cache: 8192 bytes, associativity 4, 32 byte lines, 64 sets
CPU0: D cache: 8192 bytes, associativity 4, 32 byte lines, 64 sets
Built 1 zonelists
Kernel command line: root=/dev/ram0 console=ttyS1,115200n8 rdinit=/sbin/init mem=32M
PID hash table entries: 256 (order: 8, 1024 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 32MB = 32MB total
Memory: 28892KB available (1208K code, 137K data, 1048K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
SCSI subsystem initialized
register clock device
w55fa93_edma_init
io scheduler noop registered (default)
W55FA93 USB 2.0 Device Driver Initilization Success
w55fa93 Sysmgr driver has been initialized successfully!
w55fa93 BLT driver has been initialized successfully!
---w55fa93fb_init ----w55fa93 frame buffer init
###########w55fa93 frame buffer probe############
check_var(var=c05a5008, info=c05a5000)
Console: switching to colour frame buffer device 60x34
w55fa93 LCD driver has been installed successfully
W55FA93 uart driver has been initialized successfully!
w55fa93-uart.1: w55fa93_serial1 at MMIO 0xb8008100 (irq = 24) is a W55FA93
RAMDISK driver initialized: 8 RAM disks of 8192K size 1024 blocksize
loop: loaded (max 8 devices)
Linux video capture interface: v1.00
mice: PS/2 mouse device common for all mice
input: W55FA93 TouchScreen as /class/input/input0
[KEYPAD_DRV] w55fa93 Keypad driver has been initialized successfully!
w55fa93-rtc w55fa93-rtc: rtc intf: sysfs
w55fa93-rtc w55fa93-rtc: rtc intf: proc
w55fa93-rtc w55fa93-rtc: rtc intf: dev (254:0)
w55fa93-rtc w55fa93-rtc: rtc core: registered w55fa93-rtc as rtc0
Init Nuvoton RTC!
W55FA93 Audio driver has been initialized successfully!
REG_AIC_MECR = 0
REG_AIC_MECR = 0
NET: Registered protocol family 1
NET: Registered protocol family 17
w55fa93-rtc w55fa93-rtc: hctosys: invalid date/time
Freeing init memory: 1048K
init started: BusyBox v1.9.1 (2010-09-09 09:34:19 CST)
========> D+ Low DISSCONNECT PC
179
C_CmdMsg: Sync msgget() succeeded: msqid = 0
C_CmdMsg: Async msgnand: module license 'Proprietary' taints kernel.
gget() succeeded: msqid = 32769
NAND: nand_init!!!!!
FUNC(nand_init) LINE(2119) system_report enabled!
FUNC(nand_init) LINE(2136) enable NAND ALE/CLE/CS0/CS1 pins
FUNC(nand_init) LINE(2156) Init PortA4 and request_irq for nand_debug
FUNC(nand_init) LINE(2195) Enable NAND_CD_IRQ
FUNC(nand_init) LINE(2234) Setup nandcard detect timer
scsi0 : Nuvoton W55FA93 On Board NAND DRIVER!
[GNAND] GNAND Library Version: V1.02.3
fmiSMCheckBootHeader 1
Nand0: uLibStartBlock=33
[GNAND] GNAND format version on NAND chip: V1.01
[GNAND] NAND flash chip detected, chip ID is 0x98-0xf1 !
on board NAND size 120 MB (245760 sectors)
  Vendor: NUVOTON   Model: GNAND DRIVER      Rev: 2.00
  Type:   Direct-Access                      ANSI SCSI revision: 00
SCSI device sda: 245760 512-byte hdwr sectors (126 MB)
sda: Write Protect is off
sda: got wrong page
sda: assuming drive cache: write through
SCSI device sda: 245760 512-byte hdwr sectors (126 MB)
sda: Write Protect is off
sda: got wrong page
sda: assuming drive cache: write through
 sda: sda1 sda2 < sda5 >
sd 0:0:0:0: Attached scsi removable disk sda
W55FA93 SD Card driver has been initialized successfully!
Success to Reserve Free Page from: 0xc1c00000, order:10, pages:1024
W55FA93 DEVMEM driver has been initialized successfully!
boot_script: Change Directory
boot_script: Create Directories
boot_script: Mounting System Menu
full path: /mnt/nand1-1/SystemMenu.bin
Type: 0
Menu data path: /mnt/sysmenu/TitleSystemMenu/MainMenu/MenuData.swf
boot_script: Mounting Resources
boot_script: Run desktopManager
Loading module /usr/gui/tslib/input.so
Loading module /usr/gui/tslib/variance.so
Loading module /usr/gui/tslib/dejitter.so
Loading module /usr/gui/tslib/linear.so
Linear calibration constants: 37459 211 -3819231 -110 26281 -4738218 65536
boot_script: Remove Windows Temporary Files
root:~> KPD: cmd=80046B06
Linux_kernel: set language: 1
KPD: cmd=80046B07
C_CmdMsg: Sync msgget() succeeded: msqid = 0
C_CmdMsg: Async msgget() succeeded: msqid = 32769
 ####################
 Copyright (c) 2009 - 2012 Nuvoton All rights reserved, FL3.1.6 (Apr 26 2011 - 15:51:54)
 ####################
 msgget: msgget succeeded: msqid = 0
msgget: msgget succeeded: msqid = 32769
Total MAX_DYNAMIC_MEM = 18 MB
[auto_scale_up]/[off]
[home_swf_path]/[/mnt/sysmenu/TitleSystemMenu/SystemMenu.swf]
[quality]/[0]
SetQuality: m_quality=0
[full_screen_display]/[off]
[static_max_mem]/[512]
[dynamic_max_mem]/[18000]
[lcm_width]/[480]
[lcm_height]/[272]
[lcm_stride_width]/[480]
[free_mem_safe_ratio]/[80]
SetQuality: m_quality=0
SetQuality: m_quality=0
#### Validation pass
The framebuffer device was opened successfully.
xxddff
00000(31f0a8)
SIInterface::initialize
sec diff :0
1111
sampleRate=0, channels=0, bufferSize=4096
2222
Set Timer Interval=10
open key event1 failed
Loading module /usr/gui/tslib/input.so
Loading module /usr/gui/tslib/variance.so
Loading module /usr/gui/tslib/dejitter.so
Loading module /usr/gui/tslib/linear.so
Linear calibration constants: 37459 211 -3819231 -110 26281 -4738218 65536
new file:/mnt/sysmenu/TitleSystemMenu/SystemMenu.swf
Removing timerssssss
load movie
resulr=8604
<<<
Removing timerssssss
>>>
start movie
Adding timerssssss
Set Timer Interval=10
MemFree = 21580 (KB), buffers = 80 (KB), cached = 5420 (KB), m_maxDynamicMem = 18432000
newFrameInterval=83, Min=2, Max=10
Set Timer Interval=8
StartMovie: m_quality=0
Clear dev frame buffer, ptich=960, height=272
Set Timer Interval=10
Load & start Movie: 310 ms
Load & start Movie:: 3 sec 740 ms
open file "/var/syslibrtc" fails!
open file "/var/SYSLIB_SUS" fails!
PWM value = 501
open file "/var/SYSLIB_BGMF" fails!
open file "/var/SYSLIB_MH" fails!
trace("[FSHelper readFile] Can not open file: /var/SYSLIB_MH for read!")

height=272, width=480
KPD: cmd=80046B04
open file "/mnt/nand1-2/Dict/TitleDictionary.bin" fails!
open file "/mnt/sd/Dict/TitleDictionary.bin" fails!
open file "/mnt/nand2-1/Dict/TitleDictionary.bin" fails!
open directory "/mnt/nand1-2/theme/" fails!
change directory "/mnt/nand1-2/theme/" fails!
trace("Theme not found!")

trace("Loading /mnt/sysmenu/TitleSystemMenu/sysmenu.swf")

trace("System Menu is running!")

KPD: cmd=80046B04
open file "/var/SYSLIB_BGMF" fails!
Initializing Sound
Opening the sound device sampleRate:22050
channels:2, sampleSize:16, sampleRate:22050 fragmentSize = 4096
m_bufferSize = 0x4000
Lock:2
open directory "/mnt/nand1-2/theme/" fails!
change directory "/mnt/nand1-2/theme/" fails!
open directory "/mnt/nand1-2/theme/" fails!
change directory "/mnt/nand1-2/theme/" fails!
open file "/var/SYSLIB_SUS" fails!
trace("A sound completed: 1")

remove "/mnt/nand1-2/CERT/CertStatus.xml" fails!

trace("newCertNum: 0")
The detected NAND chip-ID matches closely to the Toshiba NAND flash chip according to this NAND Flash table


.txt   bootlog_uart.txt (Size: 8.5 KB / Downloads: 388) ]]> <![CDATA[Teardown pictures InnoTab/V.Reader]]> https://spiffyhacks.harmonypogo.com/thread-1653.html Wed, 22 Apr 2020 11:27:22 +0000 https://spiffyhacks.harmonypogo.com/thread-1653.html
.jpg   innotab_inside01.jpg (Size: 39.88 KB / Downloads: 415)
.jpg   innotab_inside02.jpg (Size: 28.35 KB / Downloads: 382)
.jpg   innotab_inside03.jpg (Size: 50.84 KB / Downloads: 462)
.jpg   innotab_inside04.jpg (Size: 48.18 KB / Downloads: 434)

You can clearly see the connector for the innotab 1 cartridges (only the plastic shell casing is different from the versions 2+)
and finally the CPU which is ARM based from the Nuvoton company, and the flashmemory is supplied by Toshiba.
I guess with a ARM disassembler we can hack further into the binaries...]]>
.jpg   innotab_inside01.jpg (Size: 39.88 KB / Downloads: 415)
.jpg   innotab_inside02.jpg (Size: 28.35 KB / Downloads: 382)
.jpg   innotab_inside03.jpg (Size: 50.84 KB / Downloads: 462)
.jpg   innotab_inside04.jpg (Size: 48.18 KB / Downloads: 434)

You can clearly see the connector for the innotab 1 cartridges (only the plastic shell casing is different from the versions 2+)
and finally the CPU which is ARM based from the Nuvoton company, and the flashmemory is supplied by Toshiba.
I guess with a ARM disassembler we can hack further into the binaries...]]> <![CDATA[French Storio, help requested]]> https://spiffyhacks.harmonypogo.com/thread-1190.html Sun, 23 Dec 2018 03:21:43 +0000 https://spiffyhacks.harmonypogo.com/thread-1190.html
I've just bought (second hand, obviously) a french Storio for my daughter, but I can't get any custom app to work.
My Sd card looks like this : 

I:.VTech \ _vtech_pa_thumbnails_ \ nand_49__45__50_ \ Pictures \.... 
I: Books \ Title_31D32B92238FDD08923876DD327ED273_58_115605_000_032_V002
I: VTech \Music - Pictures - Video


No LLN folder, no Innopad.db. So I can't do much.
I've seen that 4 years ago, in the thread "It is a possible Firmware for Storio 1 Spanish", Deak Phreak answered to somebody with the same error : "You need to have an actual SD card, you can't use the internal system", which seems to have fixed his issue. 

Unfortunately, this is really the content of my sdcard (taken from my storio and plugged to my computer, or directly read from the plugged storio).

I also found a FR-freRecoverCardTool to hard reset the Storio and inserted a formatted sdcard afterwards. No change at all. When using Explor@ Park to copy pictures to my sdcard, it creates the I: "VTech \Music - Pictures - Video" structure. I've also tried to buy a Book, which has been transferred to a newly created "\Books folder". But still no LLN folder.

Just want to add that I'm a engineer/software developer, so I kind of understand what I'm talking about (which doesn't mean I never make errors Smile).
If somebody could help me, I'd be very grateful Smile]]>
I've just bought (second hand, obviously) a french Storio for my daughter, but I can't get any custom app to work.
My Sd card looks like this : 

I:.VTech \ _vtech_pa_thumbnails_ \ nand_49__45__50_ \ Pictures \.... 
I: Books \ Title_31D32B92238FDD08923876DD327ED273_58_115605_000_032_V002
I: VTech \Music - Pictures - Video


No LLN folder, no Innopad.db. So I can't do much.
I've seen that 4 years ago, in the thread "It is a possible Firmware for Storio 1 Spanish", Deak Phreak answered to somebody with the same error : "You need to have an actual SD card, you can't use the internal system", which seems to have fixed his issue. 

Unfortunately, this is really the content of my sdcard (taken from my storio and plugged to my computer, or directly read from the plugged storio).

I also found a FR-freRecoverCardTool to hard reset the Storio and inserted a formatted sdcard afterwards. No change at all. When using Explor@ Park to copy pictures to my sdcard, it creates the I: "VTech \Music - Pictures - Video" structure. I've also tried to buy a Book, which has been transferred to a newly created "\Books folder". But still no LLN folder.

Just want to add that I'm a engineer/software developer, so I kind of understand what I'm talking about (which doesn't mean I never make errors Smile).
If somebody could help me, I'd be very grateful Smile]]> <![CDATA[Kidzoom cam and watch program]]> https://spiffyhacks.harmonypogo.com/thread-1153.html Sat, 31 Mar 2018 19:33:52 +0000 https://spiffyhacks.harmonypogo.com/thread-1153.html <![CDATA[Firmware please]]> https://spiffyhacks.harmonypogo.com/thread-1059.html Mon, 13 Feb 2017 00:24:20 +0000 https://spiffyhacks.harmonypogo.com/thread-1059.html hello  im looking for the firmware for a us innotab 1 so i can flash it. the links dont work anymore can someone  pm it to me or a cloud drive please.]]> hello  im looking for the firmware for a us innotab 1 so i can flash it. the links dont work anymore can someone  pm it to me or a cloud drive please.]]> <![CDATA[Innotab/Storio eMMC boot]]> https://spiffyhacks.harmonypogo.com/thread-1048.html Wed, 28 Dec 2016 19:41:01 +0000 https://spiffyhacks.harmonypogo.com/thread-1048.html
I'd like to boot my sorio from SDcard instead of the internal eMMC. Here are some outputs I got:

Storio 3 without eMMC and without SDCARD:

Code:
iROM v3 Entry A400-S160 MHz



SPI Boot...(ID: 0x00) Fail

Nand Boot...NF_NON_SHARE->Fail

SDC/eMMC Boot...cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x1304

Fail

cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x1304

usb_reset()

usb_initial()

USB/ICE Service Entry

With a prepared SDcard I receive this:

Code:
iROM v3 Entry A400-S160 MHz



SPI Boot...(ID: 0x00) Fail

Nand Boot...NF_NON_SHARE->Fail

SDC/eMMC Boot...cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x1304

Fail

BootWell BtHdr ID:0

0x92004000 = 0x00000952

0x92004008 = 0x08000010

0x9200400C = 0x0000030D

0x92004010 = 0x080B1833

0x92004014 = 0x4D832000

0x9200401C = 0x04080432

0x92004024 = 0x00660044

0x92004028 = 0x28282F2F

0x92005010 = 0x00000403

delay:512 Loop ...Finished

0x90005004 = 0xEC722E83

0x9000505C = 0x073232B4

0x90005104 = 0x1F800003

0x920050A0 = 0x00000098

0x93007004 = 0x41993A18

0x93007044 = 0x0500012D

0x9300E2B8 = 0x002E0200

0x9301F020 = 0x00000C02

0x9301F02C = 0x00000003

0x9301F038 = 0x00000FFF

delay:1 ms ...Finished

BootWell BtLdr ID:0



VERSION2013

###### eMMC_BL1 (Jul 17 2013 11:08:47) ######

pBoardVersion(0xB1007F78) = 0xB4B4B4B4, pBootFlag(0xB1007F7C) = 0xA55A7887

Cmd = 0x7007, SD_STATUS = 0x1304

### ERROR: the sd1 MBR's tag not match!

Cmd = 0x1008, SD_STATUS = 0x304

Cmd = 0x1037, SD_STATUS = 0x304

Cmd = 0x3001, SD_STATUS = 0x1304

###### sd card 0 no insert, or init failed! ######

sd/emmc init failed

>>>POWER OFF<<<

The problem seems to be hat the MBR's tag not match.
Is anybody able to post his helpful comment here?]]>
I'd like to boot my sorio from SDcard instead of the internal eMMC. Here are some outputs I got:

Storio 3 without eMMC and without SDCARD:

Code:
iROM v3 Entry A400-S160 MHz



SPI Boot...(ID: 0x00) Fail

Nand Boot...NF_NON_SHARE->Fail

SDC/eMMC Boot...cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x1304

Fail

cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x1304

usb_reset()

usb_initial()

USB/ICE Service Entry

With a prepared SDcard I receive this:

Code:
iROM v3 Entry A400-S160 MHz



SPI Boot...(ID: 0x00) Fail

Nand Boot...NF_NON_SHARE->Fail

SDC/eMMC Boot...cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x304

cmd SD_STATUS = 0x1304

Fail

BootWell BtHdr ID:0

0x92004000 = 0x00000952

0x92004008 = 0x08000010

0x9200400C = 0x0000030D

0x92004010 = 0x080B1833

0x92004014 = 0x4D832000

0x9200401C = 0x04080432

0x92004024 = 0x00660044

0x92004028 = 0x28282F2F

0x92005010 = 0x00000403

delay:512 Loop ...Finished

0x90005004 = 0xEC722E83

0x9000505C = 0x073232B4

0x90005104 = 0x1F800003

0x920050A0 = 0x00000098

0x93007004 = 0x41993A18

0x93007044 = 0x0500012D

0x9300E2B8 = 0x002E0200

0x9301F020 = 0x00000C02

0x9301F02C = 0x00000003

0x9301F038 = 0x00000FFF

delay:1 ms ...Finished

BootWell BtLdr ID:0



VERSION2013

###### eMMC_BL1 (Jul 17 2013 11:08:47) ######

pBoardVersion(0xB1007F78) = 0xB4B4B4B4, pBootFlag(0xB1007F7C) = 0xA55A7887

Cmd = 0x7007, SD_STATUS = 0x1304

### ERROR: the sd1 MBR's tag not match!

Cmd = 0x1008, SD_STATUS = 0x304

Cmd = 0x1037, SD_STATUS = 0x304

Cmd = 0x3001, SD_STATUS = 0x1304

###### sd card 0 no insert, or init failed! ######

sd/emmc init failed

>>>POWER OFF<<<

The problem seems to be hat the MBR's tag not match.
Is anybody able to post his helpful comment here?]]> <![CDATA[Innotab firmware help please]]> https://spiffyhacks.harmonypogo.com/thread-881.html Sun, 24 Jan 2016 09:53:26 +0000 https://spiffyhacks.harmonypogo.com/thread-881.html
just joined the community and had a go at running the innotab 1 firmware patch. Used a good SD card and followed all the instructions in the FAQ. When i click execute the file runs and then seems to pause halfway through the last line is "finished backup existing mtdblock1" then it just hangs there and doesn't reset or anything. What should I do next?

Thanks for your help

JC]]>
just joined the community and had a go at running the innotab 1 firmware patch. Used a good SD card and followed all the instructions in the FAQ. When i click execute the file runs and then seems to pause halfway through the last line is "finished backup existing mtdblock1" then it just hangs there and doesn't reset or anything. What should I do next?

Thanks for your help

JC]]> <![CDATA[InnoTab 1 Firmware U.S]]> https://spiffyhacks.harmonypogo.com/thread-353.html Sun, 16 Nov 2014 00:07:00 +0000 https://spiffyhacks.harmonypogo.com/thread-353.html
New to the site I was just wondering does anyone have a working link to the innotab 1 firmware v10.21205 the old link is no longer working.
thanks in advance for you help. Just browsing through this site and it is awesome I will be donating to keep the site alive keep up the great work!]]>
New to the site I was just wondering does anyone have a working link to the innotab 1 firmware v10.21205 the old link is no longer working.
thanks in advance for you help. Just browsing through this site and it is awesome I will be donating to keep the site alive keep up the great work!]]> <![CDATA[German Firmware Dump]]> https://spiffyhacks.harmonypogo.com/thread-199.html Sun, 13 Apr 2014 20:49:49 +0000 https://spiffyhacks.harmonypogo.com/thread-199.html <![CDATA[It is a possible Firmware for Storio 1 Spanish]]> https://spiffyhacks.harmonypogo.com/thread-185.html Mon, 03 Mar 2014 15:08:58 +0000 https://spiffyhacks.harmonypogo.com/thread-185.html
bad english sorry.]]>
bad english sorry.]]> <![CDATA[Firmware]]> https://spiffyhacks.harmonypogo.com/thread-4.html Wed, 18 Dec 2013 17:30:26 +0000 https://spiffyhacks.harmonypogo.com/thread-4.html !! USE AT YOUR OWN RISK !! - We are not responsible for damage done to the InnoTab by using anything posted here.

By downloading these files, you agree to use this to make backups of games you already purchased or to use custom homebrew apps. We do not support piracy and you agree to these terms for using this firmware.

InnoTab 1

USA
v10.21205 - By is0mick

UK
v10.21205 - By is0mick]]> !! USE AT YOUR OWN RISK !! - We are not responsible for damage done to the InnoTab by using anything posted here.

By downloading these files, you agree to use this to make backups of games you already purchased or to use custom homebrew apps. We do not support piracy and you agree to these terms for using this firmware.

InnoTab 1

USA
v10.21205 - By is0mick

UK
v10.21205 - By is0mick]]>