May I interest you in yet another LeapFrog Epic post? :P

EDIT: If you have any inquiries or are getting stuck with updating the ROM, kindly let me know either on the LeapFrog Epic Guy page on Facebook, or on my personal Facebook account.

I've been getting a lot of inquiries lately from parents asking how does one convert a store demo unit to a retail one. Apparently a number of Epics, mine included, were sold on eBay, Craigslist and other classifieds, are programmed with a demo ROM meant for displays on Toys R Us, Best Buy, Fry's or whatever outlet these things are sold.

The real caveat here is this: the boot loader is locked, making straightforward ROM flashing mostly impossible (hence why I wrote an open letter to LF asking if they can provide an unlocked bootloader). Now before you lose hope and say "Oh this is a waste of $50! Why did I even buy this crappy toy?", there is actually a way around this and as what some of those who inquired me can attest, it works well unimpaired.

To back up the old ROM and flash the newly-modified system.img back to the device, you'll need to download SP Flash Tool, the stock firmware image (said image can be found on this post) and the modded Epic ROM. Load up the original retail ROM's scatter file by clicking Scatter-Loading and opening MT8127_Android_Scatter.txt. You need to do this as Readback and Write Memory options won't work without the stock firmware loaded.


After that, click on the Readback tab. Click Add, then click on the row that shows up. You'll then be prompted where to save your backup.
You'll then be greeted by this window. Region should be set to EMMC_USER, the starting address at 0x0 and the length has to be at 0xC5D00000 as shown here.
Click on Read Back, and plug the tablet into your PC. A device named "MTK 65xx Preloader..." or something along the lines of it should appear on Device Manager or the notifications area. On Windows 10 this should install on its own, but you may have to download drivers especially on an earlier version of Windows. And now for the fun part - after you have plugged in the Epic, an error message should appear. Don't worry about that, you can safely ignore and dismiss the message, but click on the Read Back button again as soon as possible.
Once that is done you should end up with a ROM_0 image to roll back to in case something goes wrong.

Enable the hidden Write Memory feature in SP Flash Tool by pressing Ctrl+Alt+V. Click Window > Write Memory, then click on the Write Memory tab to bring up the tool. Browse to the modified system.img (system_modded.img) that you've downloaded from MEGA, then make sure Begin Address (HEX) (read: starting address) is at 0x5D00000, and the region is at EMMC_USER.
 

Once that's done, click on the green Write Memory button, then plug your Epic into your PC. You'll get an error as before but just ignore it and click on Write Memory again. If done right you should see the progress bar fill up and thus flash the device. Unplug and plug it in your PC again to see if the battery icon still shows up. If it does, the device should be fine.

Now before you hand over your device to your son or daughter, make sure the tablet is off, then press Power and Volume+ to bring up the recovery menu. Use the volume buttons to highlight an item - in this case, Wipe data/factory reset. Press power to confirm your selection.



Highlight yes, press Power again, then once that's done...


...Reboot your tablet to begin the initial setup process.

Photo of a modded LeapFrog Epic courtesy of Amber Curington

And if done correctly, you should be able to log in and be greeted by this home screen. Congratulations!

To roll back to the old ROM, do the same Write Memory stuff as before, but instead of the modded system image, load up the ROM_0 file you backed up previously, and make sure Begin Address (HEX) (read: starting address) is at 0x0 instead of 0x5D00000.

Here's a more or less technical description of what I did: I used OSFMount and ext2fsd to mount the two system images: one from the demo unit, and the other from retail. Those two were extracted using a hex editor after I ripped it using SP Flash Tool's readback feature (Which, by the way, is a good thing compared to the complicated method used on Allwinner ROMs). After mounting it, I opened up Windows Explorer, then copied files from app, priv-app, and framework folders on the retail system.img to the demo system image. That should work straight away as it is, but you may want to change ro.product.model in build.prop from EPICv1-InStoreDemo to just EPICv1. Also, libPPAD2.so may also need to be changed in /lib for Pet Pad Party to boot.

As what pretty much every geek or technician out there would say, make sure to perform a backup of your files first, in this case, the stock ROM image. Sorry if this blog post is quite a mouthful and contains a lot of technical info most parents would barely even understand, but just remember to be careful, and don't panic, things should be just fine if you do it at your own pace. ;) I've had a number of mums do it successfully on their children's Epics, so why worry?

Comments

Christian said…
Hi,
Please help me with this process. I have a DEMO unit.
Thanks
Huckleberry Pie said…
Sure, no problem with that. Do you have an account which I could contact you with?
Rob Estey said…
Can you help me out? I can download the ROM on my demo unit but SP flash will not allow me to write the Modded file. It indicates invalid address @ 0X5D00000.
Huckleberry Pie said…
Are you sure you loaded the scatter file properly? I've had someone comment on my LeapFrog Epic Guy Facebook page about a similar address issue.
Rob Estey said…
Everything looks correct as per your guide. Readback does work but write does not.
Huckleberry Pie said…
Strange... You tried the latest SP Flash Tool build?
http://spflashtools.com/windows/sp-flash-tool-v5-1728

Also, can you send me the error message screenshot as well?
Odincubus said…
I am having an issue as well. I'd first like to say thanks for this guide, as it's been extremely helpful. I have followed all directions but after I perform the last factory reset step, my epic constantly reboots at the initial start page. The farthest I can get is the country selection before it reboots again. Any help with this would be much appreciated. My nephews are driving me crazy to get this epic working.
Huckleberry Pie said…
I presume you did the backup step, right? Flash ROM_0 back to the tab by doing the same thing in Write Memory, except that the starting address is at 0x0 and the region is EMMC_USER. See if it boots back to demo mode then make sure you are flashing the modded system image.

If you are still running to any problems please let me know or better yet message me on my Facebook account.
Huckleberry Pie said…
And are you sure it is indeed a demo unit and not the one with the lock code?
Huckleberry Pie said…
@Odincubus Seems like you flashed the wrong ROM then. It should be system_modded.img, not the one from the stock ROM. That accounts for why your Epic kept on boot looping.

Popular posts from this blog

Macintosh in a pinch: Sierra on a Pentium G3258/ASUS H81M-D

Stock ROM for Galaxy S7/G930FD MT6580 clone (Z6U030; 512MB RAM/8GB ROM)

LeapFrog Epic part 1: The hidden Lock Screen.