Spiffy Hacks - LeapPad 3

LeapPad 3 PCB Photos

Fri, 18 Apr 2025 11:16:35 +0000

Front of PCB

Back of PCB

[Tutorial] UART access on LF3000 devices

Wed, 09 Oct 2024 00:36:44 +0000

WARNING
Do not, under any circumstance, edit the `inittab` file of your device locally on your Windows drive using Windows (CR LF) formatting. This will cause your device to soft-brick until switched back to Unix (LF) formatting.

I. Requirements

sshflash-win
LF3000 Surgeon Kernel from RetroLeap

The Problem with UART on LF3000
When trying to use a UART utility (such as muki's Carter) on an LF3000 device, (like the LeapPad3, Platinum, and numerous others) it will constantly ask for you a password that no one knows yet.
An example of this is:

Code:
Machine ID: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890

Password:

This will keep looping on until you eventually give up. This tutorial shows you how to fix this.

II. Setting Up
Assuming you have already set up the driver necessary and set the static IP... (169.254.8.2, subnet mask 255.255.255.0)

Place the LF3000 surgeon zImage in the same folder as "sshflash-win".

III. Booting Surgeon
In sshflash, type in "3" to just boot surgeon. Then, press "4" for LF3000. Give it a second to do what it needs to do. If it correctly gets a response from the LeapPad, (169.254.8.1) you're good to go.

IV. SSH'ing to your LeapPad
To SSH to your LF3000 device, open a new Terminal/Command Prompt window and type in "ssh root@169.254.8.1". If it asks you about a fingerprint, type "yes".

V. Mounting the LeapPad MMC
First, run "cd /". This will take you to the root directory of the surgeon environment. Don't touch anything just yet, as this isn't the thing you'll be actually modding.

In the root, type in "mount /dev/mmcblk0p3 /roms". This will mount the Base partition in the "roms" folder.

VI. Editing the "inittab"
In the terminal, run "cd roms". Here's the base partition of your LeapPad. Don't touch anything here, either.

Next, run "cd etc". This folder is where the "inittab" file is stored.

To edit the file, run "vi inittab". This opens up a miniature text editor that can be really confusing to use for some people.

VII. Where to edit?
First, you have to put yourself into editor mode. To do this, press I.

Next, find the two lines where it notes:

Code:
#ttyS0::respawn:-/bin/sh

ttyS0::respawn:/usr/bin/password

You'll be commenting out the last line. So, in return, you'll have...

Code:
ttyS0::respawn:-/bin/sh

#ttyS0::respawn:/usr/bin/password

VIII. Commented out, now what?
Once you finished commenting out the last line, press the "ESC" key. This will get you out of editor mode.

To save, type in ":wq" (Write + Quit) and press enter. You should now have been kicked back into the shell. Run "vi inittab" to verify the changes have been saved. Run ":q" to quit out of the editor.

IX. Unmounting the Base MMC
Go ahead and run "cd /". Then, run the command "umount /roms". This will unmount the Base MMC, allowing it to save changes safely.

X. Rebooting

Hold the power button until it turns off, then turn it back on
Run "reboot" in the terminal

Once you can't type anything into the ssh window, or it kicks you out, you're done.

XI. Verifying you did it right
First of all, if your LeapPad is stuck on the LF logo and constantly is printing something out over UART, you did something wrong. Double check the "inittab" file. If you still get the prompt asking you for a password, again, double check "inittab". However, if, you can successfully connect, you're finished.

image.png (Size: 24.51 KB / Downloads: 70)

[Tutorial] Modifying SWF Games

Sun, 30 Oct 2022 01:20:41 +0000

Just incase I vanish again, it might be wise to pass along some info incase anyone else wants to give it a try.

Modifying a Flash game is not that difficult, although some flash games just don't like being modified and most big changes have dramatic effects. Your PC will LIE to you (Flashplayer32_SA will display a working game but your LeapPad may only show a slideshow of the frames.) so transfer over and test it on the LeapPad between big changes

This guide doesn't expect you to already know Adobe Action Script 2.0, I saw it for the first time this week myself and its easy to read, not the most obscure language. Having some logical knowledge (e.g working with IF statements) helps alot however.

The guide will assume that you're using Windows, if you're not then VM or Wine

Software you will need:

SWF Decompiler - I Use JPEXS Free Flash Decompiler
SWF Player (Optional: For previewing) - I use Adobe Flash Player 32 (StandAlone)
Image Editor (Optional: For Editing Image files within the SWF) - I Use Paint.net

The Problem at Hand

So you've bundled a game, transferred it to the LeapPad and the D-PAD is Unresponsive, Lopsided OR It's a mouse game but for some reason it wants you to press SPACEBAR to begin....
I've seen it, I know the pain.
If you got lucky and the D-PAD IS recognized by the game but 90degree offset that's good.
It's just LeapFrog, by fitting the D-Pad the wrong way and having their games scripted for the new directional's it would make it impossible, difficult, time consuming for someone to get unofficial games working on their system.

Case #1: Ownage - D-PAD Remap

I remember being in awe at Ownage when it first came out so when I stumbled past it again in my mega games download I had to double back and have a play and even though it needs D-PAD+1, as soon as it loaded on my laptop I badly wanted to get it to work on the LeapPad.

I opened it in FFDec and scrolled straight to the "scripts" section where I have found input binds on some other games just by looking for tags such as but that is inefficient and as you can see doesn't always get results.

flash-guide1.png (Size: 61.58 KB / Downloads: 93)

The next way I thought of was the "Text Search" function, I searched for , Left and keyPress but got no results, but the game must be getting it's inputs from somewhere, games don't just happen like that, so I looked up a table of Keyboard codes.. and started getting alot of results.

Just looking at a glimpse of the code, it was obvious why my search turned up blank so I copied the Key.isDown bit to clipboard and scratched my head. Up to now I'd only fixed a game with normal Left & Right -> LeapPad Left & Right and I used the Replace All function which wouldn't work here. (4 directions, they'd mix at some point and you'd replace ALL all of them not just all of them)

flash-guide2.png (Size: 107.89 KB / Downloads: 91)
So we need to replace the input key codes to change which buttons trigger which code, (if we understand the code this would be cake..)
Start with the top search result, click edit. Now you need to remember:

37 "Left" and/or 65 "A" WILL BECOME 40 on the LeapPad
38 "Up" and/or 87 "W" WILL BECOME 37 on the LeapPad
39 "Right" and/or 68 "D" WILL BECOME 38 on the LeapPad
40 "Down" and/or 83 "S" WILL BECOME 39 on the LeapPad
Space 32 Can be Either 85 "U" or 68 "D" (Volume Keys)

flash-guide3.png (Size: 102.13 KB / Downloads: 92)

Work carefully and try not to lose track of what you have changed already, you have to click save each time to save the actionscript source before you can view/edit the next on the search results list and you need to change every instance on every search result.

If you feel like you would lose track of yourself very easily like I did, there is an alternative method,

flash-guide4.png (Size: 102.78 KB / Downloads: 94)

if we first remap the 4 arrow keys to different keys E.G: The Function Key in each row,
we CAN get away with using Replace All, in fact I had 4 boxes open with a different term in each, bare in mind you'll need to do 2 passes with this method and you still need to click edit, replace all x 4 and save for each actionscript on your search results but it is considerably quicker and provided its setup correctly, not prone to human error

First Pass: remap the Controls to the function keys.
Second Pass: remap the Controls to the LeapPad D-Pad.

I also did a 3rd pass for Grenades Spacebar, Ctrl and Shift --> Leappad Volume Down key ("D" 68)

At this point the game is completely mapped to the LeapPad D-PAD + Volume Key and therefore completely playable. I did make a few visual changes (E.G: Removed the keyboard buttons from the start menu sprite) but that will be covered in the next section of the guide.

Case #2: Dora, Mermaid Adventure - Visual Alteration

In this example, I'll walk you through changing a few visual elements, with a little care the same technique can be applied to alter most visual elements within SWF games.

dorabefora.png (Size: 5.47 KB / Downloads: 151)

Some games just LOOK boring...

But they don't have to look so drab:

dorafter.png (Size: 108.54 KB / Downloads: 142)

In reality all I've changed here is the following:

Inserted Background image.
Inserted SF Slapstick "Dora" Font.
Rephrased text labels to be more specific.

So, let's see how we'd do that, First Open Dora.swf in FFDec.

Adding Images.

dora1.png (Size: 21.48 KB / Downloads: 148)

To locate the frame that contains the Start Menu, I'm going to find a start menu button and check it's dependent frames.
Luckily, this SWF only has 2 DefineButton objects so it's easy enough to keep track of which is which and where they will be placed in the game.

Ah Frame 56, Such a drab and dreary place..

dora2.png (Size: 26.88 KB / Downloads: 150)

As you can see, there will only be 4 Objects placed on this frame: 2 Buttons, and 2 Text labels.
The green backdrop is actually solid Background Colour, which can be changed in the "Others>Backgroud Colour" Section.

Notice, DEPTH, an object with depth:1 is covered by an object with depth:2 and so forth.. This button needs to be raised as we'll need to use Depth:1 for our background image.

Right Click "PlaceObject2 (476)"> Raw Edit
Find the Depth property
change it's value to 2

The Frame won't change in it's appearance but if you have done it correctly both buttons will still be visible once we've finished adding our background image, let's do that now.

Scroll up to the Shapes section and Right Click Shapes> Add Tag> DefineShape2Tag, your new blank Shape will be at the bottom of the Shapes section, in this case it's DefineShape2(480)
Right Click DefineShape2(480)> Replace and Update Bounds... Choose your desired Background Image and it will be imported as DefineShape2(480). (I would export one of the other large background images, erase the image and keep the canvas size for my background, that way I don't have to deal with resolution and scaling.)

Next to add a new PlaceObject2 tag to Frame 56 (or earlier frames if there are loading screens before the menu)
Right Click> Frame 56> Add Tag>PlaceObject2Tag... Your new blank PlaceObject2 Tag will be at the bottom of frame 56.
It doesn't contain ANY information right now so it doesn't actually place a visible object yet. But it's there..
Right Click "PlaceObject2 ()" > Raw Edit

placeFlagHasCharacter=TRUE
depth=1
characterID=480

And just like that, your background image should be visible. If you find you've lost the button for Part 1, check if you changed the DEPTH=2 and also check Frame 56> PlaceObject2 (476) as I've had PlaceObject tags disappear when I Add a new Tag sometimes.

Changing Texts.

Changing text is easy, usually each DefineText(#) will already contain the text it will display on screen, so simply scroll through the texts until you find the string you wish to change and change it. If you're adding length to the string you may need to increase the "xmax" so all text is displayed.(If multiline = 1 you may need to increase "ymax" also)

Some DefineText tags are dynamic, they usually have a variablename property, if you Search (Ctrl+F) for the variablename, you will find any occasion it is referenced or set and you can change what text is shown that way.

On occasion (Neopets) you will find a game that retrieves it's text(s) from another service (E.G: for Translations) these games will mostly display: blank text areas, NaN, undefined etc.. and simply editing the DefineText Tag isn't enough as they are set again during runtime.

I generally delete the scripts>lang, scripts>translator and scripts>core>lang

This will prevent 9/10 text(s) from being rewritten at runtime, then its just a case of working out what each text area SHOULD say and editing each DefineText tag to match(You can find out which DefineText is placed on a given frame by pausing FFDec and mouse over the DefineText, its ID is displayed in the status bar overhead.

Inserting New Font(s)

Inserting a font is very straightforward, but to optimize you SWF and save space, you only need to add the characters you're going to use, Example the title logo will only need the few characters that make up the name, menu's can get away with as few characters as g,o,b,a,c,k,n,e,x,t.

Most games will already do something like this, they may contain 1 full font((including varying symbols) especially if they have text input boxes), but for the 2 or 3 fancy fonts, they'll only have the few characters that are in use, we can add more if we already have the same font installed on our system, simply type the characters you want to add (Be CaSe SeNsIbLe.), specify Bold, Italics, etc. and click Ok.

dora3.png (Size: 33.31 KB / Downloads: 150)

To add a new font, Right Click Fonts> Add Tag> DefineFont2. Your new blank font is at the bottom of the Font section, Add your characters just as we did above, note you CAN mix fonts.. Lets say you want these numbers with those capital letters on a times new roman base...

You can do that too just add the characters from one font, then select the other font from the drop down and add the rest.

See changing text was easy, well as easy as the programmer makes it.

Case #3 - AS3, The Mother of ALL Cheat Codes

Now I took it at face value, when I read from 2 different sources that the LeapPad Supports flash up to ActionScript 2.0 and hadn't really looked much more into it, as there are thousands of games written in AS2, until today when I didn't realise the game I had loaded was written in AS3.

rider.png (Size: 2.16 KB / Downloads: 128)
Freerider 2 and the way it showed me the way, upon loading Freerider on the LeapPad I noticed half of the left menu was off screen, all of the right menu was inaccessible BUT the D-PAD was already mapped perfectly.

So I broke out JPEXs FFDec and had a look to see if I could change anything, first I noticed these empty black bars on the menus which were caused by simply skipping menu entries, I moved them up so they run sequentially.

rider1.png (Size: 131.78 KB / Downloads: 89)

But as I scrolled through the code I noticed something about scaling:

Code:
     Stage.scaleMode = "noScale";

Now I'm not an idiot but even a programmer can see that's EXACTLY what we're looking for, it doesn't matter if the screen is too big or too small, if this setting is present we can possibly make a HUGE difference. I didn't know the correct constant to use so I looked it up over at help.adobe and that presented me with 3 alternatives:

EXACT_FIT : String = "exactFit"

[static] Specifies that the entire application be visible in the specified area without trying to preserve the original aspect ratio.

NO_BORDER : String = "noBorder"

[static] Specifies that the entire application fill the specified area, without distortion but possibly with some cropping, while maintaining the original aspect ratio of the application.

SHOW_ALL : String = "showAll"

[static] Specifies that the entire application be visible in the specified area without distortion while maintaining the original aspect ratio of the application.

NO_SCALE : String = "noScale"
[static] Specifies that the size of the application be fixed, so that it remains unchanged even as the size of the player window changes.

I went with exactFit for this one as when I tried it with showAll the screen had vertical borders pushing the menus into the middle of the screen, I think it looks great, gets a bit weird if you're doing flips you can see the rider stretch width-ways slightly as he rotates but an absolute classic of a game, barely workable with the LeapPad touchscreen so I've pre-pasted the code for Halfpipe into the Load Map textbox so you don't have to draw your own track and balls if you don't want to.

Enjoy!

dubloon-disaster_fixed_for_PC.rar (Size: 290.28 KB / Downloads: 90)

FreeRider2.rar (Size: 68.17 KB / Downloads: 78)

Ripping Cartridge Games To Enternal Computer for File Extraction

Sat, 05 Feb 2022 10:17:42 +0000

I want to extract cartridge data to my computer for file extraction. I assume they would be related to flash, so I could use something to extract the assets/music. Is there any way to do this, I guess through FTP and Dev mode, but I don't want to go too far into the command line if possible, as I don't want to screw it up

Backing up stubborn cartridges

Fri, 27 Dec 2019 01:58:33 +0000

Out of a dozen cartridges there was only 1 cartridge that I could not backup with a simple "cp" or "tar".
While the game would load the overlay with buttons was not loading making it unplayable.

The only work around I found, was to trick the system in thinking the physical cartridge was actually in the leappad.
It is probably best to run "df -h" first, to ensure "/LF/Bulk" has sufficient space to hold the contents of "/LF/Cart".

Create an ISO image of the cart

Code:
dd if=/dev/mtdblock3 of=/LF/Bulk/fakecart.iso

in /LF/Bulk create a file such as "S99fakecart" and chmod 755 the file

Code:
mount /LF/Bulk/fakecart.iso /LF/Cart

cnotify 3

modify /etc/init.d/rcS and at the very end of the file add to following

Code:
/LF/Bulk/S99fakecart

reboot the device without the cartridge, and you will notice the bottom right icon shows that the cartridge is inserted and should be fully playable.

You can still insert other cartridges and they will play fine. Upon removing the cartridge, it will go back to the fakecart image, so no functionality loss.

While you could simply add the contents of S99fakecart directly in the rcS file instead of calling the S99 file. I chose this method in case there where multiple carts to switch from. I thought it would be easier to simply replace the S99 file with the other cart.iso names.

I hope people find this useful.

enable developer mode directly from the leappad

Fri, 27 Dec 2019 01:50:52 +0000

First I would like to thank "Deak Phreak" and "Joshtech" for all the great information on spiffyhacks.

I found myself constantly enabling and disabling developer mode for various reasons and I wanted to save some time so I created this script.
It will enable developer mode by holding the "up" arrow when booting the leappad.
It will disable developer mode by holding the "down" arrow when booting the leappad. (in case I forgot to rm /flags/developer)
I also included a feature to reinstall backed up games after connecting with wifi, by holding the "right" arrow.

in /etc/init.d create a file called "devmode"

Code:
#!/bin/sh

case "$1" in

    start)

    if [ "`read_button left`" == "pressed" ] ; then        # up button holding it landscape

       if [ ! -e /flags/developer ]; then

            /bin/touch /flags/developer

            reboot

       fi

    fi

    if [ "`read_button right`" == "pressed" ] ; then    # down button holding in landscape

       if [ -e /flags/developer ]; then

            /bin/rm /flags/developer

            reboot

       fi

    fi

        if [ "`read_button up`" == "pressed" ] ; then        # right button holding in landscape

        /bin/sh /install.sh

            exit

        fi

    exit

    ;;

   stop)

    exit

    ;;

   *)

    echo "Usage: /etc/init.d/devmode {start|stop}"

    exit 1

    ;;

esac

exit 0

modify the file /etc/init.d/rcS by adding the following line at the very end of the file.

Code:
nice /etc/init.d/devmode start;

to reinstall backed up games after connecting with wifi by holding the right arrow, create a file in "/" called "install.sh" and chmod 755 the file.
In this file, simply lfpkg2 each directory that is needed for the backed up games. (as it appears they are only removed from the database and not the file system)
example:

Code:
lfpkg2 /LF/Bulk/ProgramFiles/MULT-0x002D001A-000302/meta.inf

lfpkg2 /LF/Bulk/ProgramFiles/MULT-0x002B005A-000204/meta.inf

That is it. I hope people will find this useful.

ffmpeg cache folder not found

Sat, 31 Aug 2019 00:55:14 +0000

Hi,
I am attempting to convert a video with LeapPad Manager onto the leapPad 3. The manager gave the error "ffmpeg cache folder not found" in the status indicator at the bottom.

Worth noting is that it asks me if I would like ffmpeg to be downloaded automatically every time, but the ffmpeg.7z is in the cache folder. So I assume it isn't set up correctly? Attempting to un7zip the ffmpeg.7z doesn't work, 7zip errors out.

Where should I go from here, with this installing of ffmpeg? Apologies if this is an obvious question, I've been reading for a good hour at this point and decided to give up and make a post.

Cheers!

Leap Pad Manager Software

Mon, 08 Jan 2018 18:30:41 +0000

Does anyone have a copy they could share? Ive scoured the web and cannot find a working link.

Leap Pad 3 problems!

Wed, 27 Dec 2017 19:28:23 +0000

Hey there I was wondering if anyone is able to tell me if the unit is bricked or can be fixed.

I get error 58, 51B and 21.

when i plug the laptop in it gets recognized but after it syncs it crashed leap connect and disconnects.
when i do a hard reset i get error 51B telling me that i dont have the software to restore the leap pad.
And on various other occasion i get messages stating that the leappad is not connected.

I have turned all antiviruses and firewalls off, reinstalled and deleted software numerous times. Any help is great as long as it kicks back in.

Edit : I got this problem fixed.

Problem on leappad 3X

Tue, 25 Oct 2016 12:06:11 +0000

hi Deak!

thx for your awesome application !
I recently upgrade the leappad of my daughter from a 2 to 3X. I upload video and the first time she look video there are no pb. But the second time, she has no image and only sound ... she must restart the 3X for see video again. and that each time she see video ...

Do you know this problem ? Do you know how to avoid it ?

thx a lot !

LeapPad Manager Problems

Wed, 06 Apr 2016 18:34:56 +0000

I purchased a used LeapPad3, reset the information and account preferences to my account and to my sons name. Downloaded Connect and the Manager from here. I successfully uploaded a couple videos, but since then I haven't been able to get the LeaPad3 to connect to the manager. It is fully charged, I'm running the program as an administrator, uac is off, its on its own cord, it is recognized by my laptop. When I go through the manager and click connect, it comes up with a red error box saying the following:

See the end of this message for details on invoking
just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************
System.IO.FileNotFoundException: Could not load file or assembly 'SCSI, Version=1.0.0.0, Culture=neutral, PublicKeyToken=2acb7f1f9a0ada3c' or one of its dependencies. The system cannot find the file specified.
File name: 'SCSI, Version=1.0.0.0, Culture=neutral, PublicKeyToken=2acb7f1f9a0ada3c'
at LFConnect.dftp..ctor()
at LFConnect.Form1.btnConnect_Click(Object sender, EventArgs e)
at System.Windows.Forms.ToolStripItem.RaiseEvent(Object key, EventArgs e)
at System.Windows.Forms.ToolStripMenuItem.OnClick(EventArgs e)
at System.Windows.Forms.ToolStripItem.HandleClick(EventArgs e)
at System.Windows.Forms.ToolStripItem.HandleMouseUp(MouseEventArgs e)
at System.Windows.Forms.ToolStripItem.FireEventInteractive(EventArgs e, ToolStripItemEventType met)
at System.Windows.Forms.ToolStripItem.FireEvent(EventArgs e, ToolStripItemEventType met)
at System.Windows.Forms.ToolStrip.OnMouseUp(MouseEventArgs mea)
at System.Windows.Forms.ToolStripDropDown.OnMouseUp(MouseEventArgs mea)
at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ScrollableControl.WndProc(Message& m)
at System.Windows.Forms.ToolStrip.WndProc(Message& m)
at System.Windows.Forms.ToolStripDropDown.WndProc(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

WRN: Assembly binding logging is turned OFF.

I am not a programmer nor do I have a huge amount of knowledge as to what this all means, but I can follow directions well. Any help would be greatly appreciated!