Stoatworks Labs

BirdDog PLAY Flasher

A factory image onto a decoder, from a browser

In developmentBrowser appJavaScript
BirdDog PLAY Flasher — A factory image onto a decoder, from a browser
The page with a genuine PLAY_1.0.30.img and a .fw package chosen: the nine-entry GPT read off the 2.4 GB image in slices, the package parked for first boot, and no device connected — captured after the beta note caught up with the units that have since been flashed.

What it does

The PLAY Patcher builds a firmware package and hands it to you to upload through the decoder's own web page. That assumes a decoder that still answers. This is the other case: a unit in recovery mode, over USB, with the factory image written to it from a browser tab.

It can also do something the upload path cannot. Rather than flashing the factory image and then installing a package on top of it, it writes the package into the image as it goes and adds a one-shot service that installs it on first boot — so a unit comes up already patched. That is possible because the factory filesystem is unusually simple and the partition holding it is far larger than the image inside it, leaving room to place the package where nothing else will ever touch it.

One thing it deliberately does not do: push a package to a unit over the network. A page served over HTTPS cannot open a plain connection to a device on the local network, so that half was dropped rather than half-built, and the manual procedure is documented instead.

  • Flashes a factory image over WebUSB — no driver on macOS, and a driver swap on Windows
  • Optionally injects a firmware package so the unit self-installs on first boot
  • Writes only the handful of filesystem blocks the injection needs, on a 2.4 GB image
  • Checks the image and the write plan before touching the device

Where it stands

Published as a beta and hosted, because there is nothing to install and nothing to upload — the factory image is read off your own disk. Verified offline against real vendor files: the parsers, the partition table, the write plan, and a filesystem check that accepts the patched image and reads the injected files back. The USB half has since met a real PLAY, on 15 August 2026: the loader push, the re-enumeration wait after it and the read-back verification were each corrected against what the device actually did. What remains unproven is the first-boot install of an injected package — nothing has yet been watched to boot and apply one — and the page says so above the controls.