Alright mate, you asked for this.
ROM dump with scatter file:
Code:
https://mega.nz/#!Jg1hSRSJ!xRoup9kZ1sSEiTwV5Fw_Jb5dgxBoXlSoxcaOvU1d6CM
PASS: epicPre-modified ROM:
Code:
https://mega.nz/#!cuhHFYTC!GC6wU1MxDybNX_tU50aMpHbFnb3TjAh5dVaWn_cNj8YThese two ROMS can't be flashed I've tried to flash with different types of powerful flashing softwares. I've also tried the partial flashing but every time I failed. So I am requesting the expert users to upload a fresh ROM again. So that I will be able to flash my dead epic tab. Please try to modify the "sec.ro" or something related in the ROM. That contains the digital signature for the rom. As the ROM is not signed it fails again and again to flash. Or please contact the leapfrog team for a pure official ROM or for the digital signature image. Otherwise try to upload a fresh epic tab's ROM. So that we can solve the problem and close these boring chattings.
Last edited:
The problem is every time we back up the ROM, the digital signature is lost and thus any dump we make is unsigned. There's little we could do atm other than to use the Write Memory feature or contact LeapFrog about it.
I have tried to write the memory. Memory write done but why the tab is not flashing. I mean I have finished the process but my tab is still dead because of bootloader dead. Are there any successfull user who was able to flash the rom via write memory. Please try to backup the rom via Miracle Box. Or try to install ROM Backup, Or Titanium Backup to backup apk to fully backup the rom and upload the rom
I'm afraid there's no Spanish-language option for the Epic as of now. You can work around this by rooting the tablet and installing Locale More or a similar tool, but not all apps would have their UI in Spanish. Tis understandable though as the cost of localising games and other apps to other languages (e.g. voice acting or separate SKUs for different regions) would drive up the device's already expensive price.
Post fresh digitally signed rom for leapfrog epic tab
Hey there i have requested many times to post a fress digitally signed rom for leapfrog epic tab. But no one can't do that. So why the post is for. Delete this post if you can't. You have told to flash the uploaded rom by many theories. But all of those tricks didn't worked.
I have tried writing the rom (write memory) option via sp flash tool. Downloaded all of the roms. And tried flashing. But every time it called for a thing is the digital signature is not present in the "sec.ro" file. So that the rom can't be flashed. On the other hand the rom is not writing via memory writing. It told that it has sucessfully write the rom but nothing is showing in my tab screen. Such as charging, light beeping, logo etc. So it means that the rom hasn't flashed ptoperly. For this i am requesting all of you that if any of you has a alive leapfrog epic tab running properly please try to post a fress rom from your leapfrog epic tab. So that i can flash my tab and can make it alive. Thank you.
Hey there i have requested many times to post a fress digitally signed rom for leapfrog epic tab. But no one can't do that. So why the post is for. Delete this post if you can't. You have told to flash the uploaded rom by many theories. But all of those tricks didn't worked.
I have tried writing the rom (write memory) option via sp flash tool. Downloaded all of the roms. And tried flashing. But every time it called for a thing is the digital signature is not present in the "sec.ro" file. So that the rom can't be flashed. On the other hand the rom is not writing via memory writing. It told that it has sucessfully write the rom but nothing is showing in my tab screen. Such as charging, light beeping, logo etc. So it means that the rom hasn't flashed ptoperly. For this i am requesting all of you that if any of you has a alive leapfrog epic tab running properly please try to post a fress rom from your leapfrog epic tab. So that i can flash my tab and can make it alive. Thank you.
Last edited:
Here's the problem: I can't extract the digital signature off the device regardless of how I rip it. And the reason why your tablet's bricked is that the preloader's hosed, plain and simple. I honestly don't know of anyone else who is willing to devote his time in reverse-engineering the Epic, as this is a niche device for children. Your best bet is to wait and pray that some kind chap would come in and help open the doors to custom ROM development for this thing.
Why don't you try probing ground and KCOLO to see if you can force it out of limbo? There's a guide somewhere on the web about finding those testpoints especially if they're not silkscreened on the motherboard.
@Warrior1988 mentions that SP Flash Tool v5.1532 works on the device, which is corroborated by a FAQ on Hovatek telling people to use that exact version should they encounter such an error. Problem is even if you do manage to flash it, the device stays dead especially if you previously bricked it before.
There, just posted a link to a working Academy Edition ROM on my original post, version KOT49H.user.1.1.95.20171215.140555. LeapFrog released said firmware last December, though I find it a bit strange that they still stuck to Kitkat even if the MT8127 is perfectly capable of running Lollipop and later. Should also work on the regular edition too, btw.
Special thanks to @diplomatic for schooling me about MTK internals e.g. the bootloader and signed firmware.
Special thanks to @diplomatic for schooling me about MTK internals e.g. the bootloader and signed firmware.
There, just posted a link to a working Academy Edition ROM on my original post, version KOT49H.user.1.1.95.20171215.140555. LeapFrog released said firmware last December, though I find it a bit strange that they still stuck to Kitkat even if the MT8127 is perfectly capable of running Lollipop and later. Should also work on the regular edition too, btw.
Special thanks to @diplomatic for schooling me about MTK internals e.g. the bootloader and signed firmware.
Will this revive it if it's completely dead?
Assuming you have a complete backup of the previous ROM that is. How did you brick it if you don't mind telling?
Unofficial TWRP 3.0.2-0 for Academy Edition
Can be flashed through SP Flash Tool v5.1744 or later using the stock 1.1.95 ROM. Usual precautions of course.
Basic functionality works, e.g. backup, ZIP flash, ADB/MTP and so on. This is by and large a better alternative than using Kingoroot or any of those shady root utilities, not to mention it allows users especially parents to back up stuff from their kids' Epics prior to a factory reset or some other repair job.
Screenshots
More screenshots can be found here: https://imgur.com/a/xgicM
Again special thanks to @diplomatic, @RAMChYLD and some of my other buddies for making this possible, and of course the TeamWin team.
Can be flashed through SP Flash Tool v5.1744 or later using the stock 1.1.95 ROM. Usual precautions of course.
Basic functionality works, e.g. backup, ZIP flash, ADB/MTP and so on. This is by and large a better alternative than using Kingoroot or any of those shady root utilities, not to mention it allows users especially parents to back up stuff from their kids' Epics prior to a factory reset or some other repair job.
Screenshots
More screenshots can be found here: https://imgur.com/a/xgicM
Code:
Device tree: https://github.com/huckleberrypie/device_quanta_narnia/
Recovery image: https://github.com/huckleberrypie/device_quanta_narnia/releases
Last edited:
Is there a key combo to get out of fastboot mode? Let battery drain? My daughter did something to get into fastboot lol
Edit: I opened it up and disconnected the battery for a few seconds. Booted right up.
Edit: I opened it up and disconnected the battery for a few seconds. Booted right up.
Last edited:
Yup, that's what I did as well. Fastboot mode is strangely nerfed on this thing I'm afraid.
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
1Stock firmware for the RK3326 LeapPad
After a month or so of waiting and prodding around, I've managed to dump the stock firmware off the Rockchip revision LeapPad Academy, version EPIC4.user.1.7.2109.312280833:
LeapPad Academy (RK3326) Stock Firmware : VTech Holdings Limited : Free Download, Borrow, and Streaming : Internet Archive
Firmware dumps taken from the LeapFrog LeapPad...archive.orgEPIC4.user.1.7.2109.312280833.7z
drive.google.com
The firmware can be flashed using RKDevTool 2.69 and later. I've only tested boot.img and a Magisk-patched version of it though, so I have no guarantees if this will work on your LeapPad.
I have also included two uboot images in the package: the stock factory uboot based on the latest available OTA update, and a hacked one with the anti-dump code patched out. Make sure to flash back to stock uboot in case LeapFrog issues a new OTA update! Mad props to @pseudolobster and @RedScorpioXDA for the uboot hack discovery and imgRePackerRK, respectively, without which would make this effort impossible. -
3The first custom ROM for the Epic is now live! See this thread for details.
So a friend of mine got his hands on one of these, and since he asked me about flashing Gapps into the device, I was wondering if any one of you guys have been doing something just as "epic" for this children's tablet. And yes, I started this thread as a sort-of sequel/follow-up to the VTech Innotab Max thread I posted a year ago.
TECH SPECS:
Display: 7-inch capacitive touchscreen with TN LCD display
Resolution: 1024x600
Operating System: Based on Android 4.4 (modified, of course)
Processor: Quad-core, 1.3 GHz (reported by CPU-Z as MediaTek MT8127)
Memory: 1GB RAM
Storage: 16GB; 9GB available for /sdcard partition
Micro SD Card Slot: Yes, expandable up to 32GB
Camera - Rear: 2MP
Camera - Front: 2MP
Audio: 3.5mm stereo jack with microphone
Wireless: Wi-Fi 802.11 b/g/n
Bluetooth: Bluetooth 4.0
Battery Type: Rechargeable lithium-ion
Battery Life: 6+ hours; results will vary based on usage and settings
Port: Micro USB
Sensor(s): Accelerometer
Much to my disappointment, LeapFrog didn't equip the tablet with a GPS module, and despite the potential privacy issues that may arise with including one, it could be legitimately used for certain applications like tracking the device or your son or daughter in case he/she gets lost. The usual backdoor leading to Developer Options is also disabled for some reason, though it can still be accessed through third-party utilities such as this. And maybe it's just my modded Epic, but beaming stuff from another device to an Epic using ShareIT appears to suffer from connection issues, i.e. the device is detected but the sender is unable to connect to it; a workaround for this would be sending a file or two from the Epic and then having the sender do the same from his/her device.
APKs from outside sources can be installed either through ADB or by downloading it on your device and installing as usual, not to mention that there's a semi-hidden feature (tucked away under the Parental Controls panel) that allows for the Amazon AppStore to be loaded. As for rooting, Kingoroot should do the trick from what I've read here, but you can manually install SuperSU on it if you prefer the more established root access app. ADB-wise, the latest debug and fastboot binaries should work on the device from what I can attest.
Oh, and here's a link to the Antutu test results:
http://our.antutu.net/api/?action=v5&act=benchmark&id=54239552
CPU-Z report:
Kernel sources:
Mad props to RAMChYLD for volunteering to have the sources mailed to him, as I'm reluctant to have them mail the goods to me no thanks to the rather abysmal postal service here in my place.Code:https://www.dropbox.com/s/vo6u4s6b3shjrhb/epic.iso?dl=0 https://github.com/huckleberrypie/android_kernel_quanta_narnia
Pre-rooted ROM dump courtesy of @epic__fail; This can only be flashed with an unlocked bootloader.
Code:http://www.needrom.com/download/leapfrog-epic-v1-stock-rom/
Note that while the unsigned ROMs cannot be flashed directly using SP Flash Tool, you can get around this by using the hidden Write Memory option. A quick guide on how to do that can be found on page 12.
Signed ROM dumps. Can be flashed directly using SP Flash Tool v5.1744. Make sure to perform a full backup of the tablet before flashing!
Code:Epic Academy Edition: v1.1.95: https://androidfilehost.com/?fid=6006931924117902657 v1.8.160: https://androidfilehost.com/?fid=6006931924117908682 v1.8.804: https://androidfilehost.com/?fid=4349826312261819358 LeapPad Academy: v1.1.171: https://androidfilehost.com/?fid=4349826312261738402
P.S.: If you're getting a signature error upon flashing, try unticking SEC_RO and then try again.
Official flashable ZIP files:
The above ZIPs are incremental patches used to update an existing system to a newer build; I couldn't seem to dig up a full system image, let alone a scatter file, for a bricked or bootlooping Epic to be restored back to factory condition though, but still I'm keeping this as a reference in case any one of you guys is interested in downloading them manually.Code:Regular: http://lfcdownload.leapfrog.com/epic/en/KOT49H.user.1.0.124.20150709.140831-to-KOT49H.user.1.5.45.20160310.231145.zip http://lfcdownload.leapfrog.com/epic/en/KOT49H.user.1.1.146.20150825.120621-to-KOT49H.user.1.5.45.20160310.231145.zip http://lfcdownload.leapfrog.com/epic/en/KOT49H.user.1.2.90.20150924.150837-to-KOT49H.user.1.5.45.20160310.231145.zip http://lfcdownload.leapfrog.com/epic/en/KOT49H.user.1.3.27.20151026.144847-to-KOT49H.user.1.5.45.20160310.231145.zip Academy Edition: Latest Version: "KOT49H.user.1.1.95.20171215.140555" KOT49H.user.1.1.52.20170522.123745 URL: http://lfcdownload.leapfrog.com/epic/en/v2/KOT49H.user.1.1.52.20170522.123745_to_KOT49H.user.1.1.95.20171215.140555.zip Patch notes: This is an incremental update from KOT49H.user.1.1.52.20170522.123745 to KOT49H.user.1.1.95.20171215.140555 KOT49H.user.1.1.62.20170627.010228 URL: http://lfcdownload.leapfrog.com/epic/en/v2/KOT49H.user.1.1.62.20170627.010228_to_KOT49H.user.1.1.95.20171215.140555.zip Patch notes: This is an incremental update from KOT49H.user.1.1.62.20170627.010228 to KOT49H.user.1.1.95.20171215.140555 KOT49H.user.1.1.64.20170704.010259 URL: http://lfcdownload.leapfrog.com/epic/en/v2/KOT49H.user.1.1.64.20170704.010259_to_KOT49H.user.1.1.95.20171215.140555.zip Patch notes: This is an incremental update from KOT49H.user.1.1.64.20170704.010259 to KOT49H.user.1.1.95.20171215.140555 KOT49H.user.1.1.66.20170712.151925 URL: http://lfcdownload.leapfrog.com/epic/en/v2/KOT49H.user.1.1.66.20170712.151925_to_KOT49H.user.1.1.95.20171215.140555.zip Patch notes: This is an incremental update from KOT49H.user.1.1.66.20170712.151925 to KOT49H.user.1.1.95.20171215.140555 JSON files for the updater: Regular: http://lfcdownload.leapfrog.com/epic/en/NarniaSystemUpdateVersions1.json Academy: http://lfcdownload.leapfrog.com/epic/en/NarniaSystemUpdateVersions_epic2.json LeapPad Academy: http://lfcdownload.leapfrog.com/epic/en/NarniaSystemUpdateVersions_epic3.json Apparently "KOT49H.user.1.1.99.20150807.173011" is unique to demo units, hence why there weren't any updates available for my device when I ran the OTA utility.
Demo-to-retail conversion tutorial
A tutorial on how to convert a store demo unit into a fully-functional Epic can be found here:
https://huckleberrypie57.blogspot.com/2018/12/and-i-came-in-for-another-leapfrog-epic.html
Custom ROMs
Unofficial LineageOS 14.1 by mac2612, blakegriplingph and kai2000: https://xdaforums.com/android/development/rom-lineageos-14-1-leapfrog-epic-t41613113Okay, got a reply. Go into the parent screen to bring up the pin entry, then enter 4 1 9. Now, when your cursor is in the last textbox, hit the backspace and enter 2 7. Apparently this is a hidden backdoor that Leapfrog puts into the system for cases like these (ie improper returns).
I've tested it, entering 4 1 2 7 upfront doesn't work. It has to be 4 1 9 <backspace> 2 7.
As for doing a factory reset, well, It's a catch 22 situation- to get into the settings screen, you need to enter the password first - they actually modified the settings app. If you don't have the password, well, you're SOL unless you call Leapfrog support, who will probably give you this code anyway. If the ADB interface is up, you could probably do it from there, but I'm not sure if it is.2Demo unit conversion to retail/backup tutorial
Alright, here are some screenshots taken off my recently-converted ex-store unit:
And a picture of a frog video being played because I was bored:
As for converting a demo ROM to retail, you'll need to have SP Flash Tool, MediaTek USB VCOM Drivers, a hex editor such as HxD, Ext2FSD, Notepad++, and some patience.
First you'll have to make a backup of your current ROM, by using the readback feature of SPFT. Download RAMCHYLD's ROM on the first page, load up the scatter file, and tick only the preloader. On the readback tab, press add, then double-click on the table below. You'll be asked where to save the resulting backup, then click save. You'll then be greeted by this window:
Length has to be at 0xC5D00000, and the starting address should be at 0x0. Hit OK, then click Read Back. Start Device Manager, then take a look at Other Devices or the Ports (COM & LPT) category. You'll need to be quick with this one, as you'll have to install the VCOM drivers - tutorials for that can be found here and here.
If done correctly, you may see an error message due to a connection error of some sort. You may safely ignore it - just click the read back button again and it should dump the contents of your device which should take some eight to ten minutes. If you want, you can back up the preloader as well, by doing the same thing as before, but with the settings changed to EMMC_BOOT_1 as the region and the length to 0x40000. Be careful with the preloader though, I bricked one of my demo Epics as I overwrote it with another one by accident.
Now that the ROM_0 part is done, load it up using a hex editor such as HxD, or use a MediaTek-specific ROM splitter tool. In my case, I just selected blocks 0x5D00000 to 0xC5CFFFFF in order to extract system.img. Install Ext2FSD, then use a tool such as OSFMount to mount them images as a writable partition. Load both the system.img from RAMCHYLD's ROM and the one from the demo unit, then open those two drives in Explorer.
Delete the /app, /priv-app, /framework and /vendor folders from the demo ROM, then copy the equivalent ones from the retail ROM. You'll also have to replace build.prop with this: http://pastebin.com/VDqv8b2k. libPPAD2.so also needs to be replaced with the one from the retail ROM; otherwise you'd end up with Pet Pad Party crashing to the home screen.
Once that is done, you'll have to use write memory to copy the edited ROM to your device. Open SP Flash Tool again, then press Ctrl+Alt+V. Click on Window, and then tick Write Memory. On the aforementioned tab, make sure that the starting address is 0x5D00000, and the region to EMMC_USER. Now load the modded system.img, then write it back to your tablet. Again this will take ten minutes, but if done correctly, you should get a working retail unit instead of a semi-functional store display tablet.
Sorry if my tutorial is a bit convoluted, but don't worry, I'll revise it soon especially when my friends and I would come up with something better.2Good news: RAMChYLD just got his hands on the source tarball, and as such he gave me a link to the ISO containing the kernel sources, ripped off the disc LeapFrog mailed to him recently:
Said link to the sources can be found on the first post, in case you guys are interested.2Unofficial TWRP 3.0.2-0 for Academy Edition
Can be flashed through SP Flash Tool v5.1744 or later using the stock 1.1.95 ROM. Usual precautions of course.
Basic functionality works, e.g. backup, ZIP flash, ADB/MTP and so on. This is by and large a better alternative than using Kingoroot or any of those shady root utilities, not to mention it allows users especially parents to back up stuff from their kids' Epics prior to a factory reset or some other repair job.
Screenshots
More screenshots can be found here: https://imgur.com/a/xgicM
Again special thanks to @diplomatic, @RAMChYLD and some of my other buddies for making this possible, and of course the TeamWin team.Code:Device tree: https://github.com/huckleberrypie/device_quanta_narnia/ Recovery image: https://github.com/huckleberrypie/device_quanta_narnia/releases
