May I interest you in yet another LeapFrog Epic post? :P

EDIT 2: This tutorial is now outdated and will not work on Epic Academy Edition demo units. See this post for an updated method.

EDIT: If you have any inquiries or are getting stuck with updating the ROM, kindly let me know either on the LeapFrog Epic Guy page on Facebook, or on my personal Facebook account.

I've been getting a lot of inquiries lately from parents asking how does one convert a store demo unit to a retail one. Apparently a number of Epics, mine included, were sold on eBay, Craigslist and other classifieds, are programmed with a demo ROM meant for displays on Toys R Us, Best Buy, Fry's or whatever outlet these things are sold.

The real caveat here is this: the boot loader is locked, making straightforward ROM flashing mostly impossible (hence why I wrote an open letter to LF asking if they can provide an unlocked bootloader). Now before you lose hope and say "Oh this is a waste of $50! Why did I even buy this crappy toy?", there is actually a way around this and as what some of those who inquired me can attest, it works well unimpaired.

To back up the old ROM and flash the newly-modified system.img back to the device, you'll need to download SP Flash Tool, the stock firmware image (https://mega.nz/#!Jg1hSRSJ!xRoup9kZ1sSEiTwV5Fw_Jb5dgxBoXlSoxcaOvU1d6CM - password is "epic" sans quotes) and the modded Epic ROM. Load up the original retail ROM's scatter file by clicking Scatter-Loading and opening MT8127_Android_Scatter.txt. You need to do this as Readback and Write Memory options won't work without the stock firmware loaded.

After that, click on the Readback tab. Click Add, then click on the row that shows up. You'll then be prompted where to save your backup.

You'll then be greeted by this window. Region should be set to EMMC_USER, the starting address at 0x0 and the length has to be at 0xC5D00000 as shown here. (ADDENDUM: The readback length should be 0x205E00000; my friends and I came up with an even better conversion method. More details on that later.)

Click on Read Back, and plug the tablet into your PC. A device named "MTK 65xx Preloader..." or something along the lines of it should appear on Device Manager or the notifications area. On Windows 10 this should install on its own, but you may have to download drivers especially on an earlier version of Windows. And now for the fun part - after you have plugged in the Epic, an error message should appear. Don't worry about that, you can safely ignore and dismiss the message, but click on the Read Back button again as soon as possible.

Once that is done you should end up with a ROM_0 image to roll back to in case something goes wrong.

Enable the hidden Write Memory feature in SP Flash Tool by pressing Ctrl+Alt+V. Click Window > Write Memory, then click on the Write Memory tab to bring up the tool. Browse to the modified system.img (system_modded.img) that you've downloaded from MEGA, then make sure Begin Address (HEX) (read: starting address) is at 0x5D00000, and the region is at EMMC_USER.

 

Once that's done, click on the green Write Memory button, then plug your Epic into your PC. You'll get an error as before but just ignore it and click on Write Memory again. If done right you should see the progress bar fill up and thus flash the device. Unplug and plug it in your PC again to see if the battery icon still shows up. If it does, the device should be fine.

Now before you hand over your device to your son or daughter, make sure the tablet is off, then press Power and Volume+ to bring up the recovery menu. Use the volume buttons to highlight an item - in this case, Wipe data/factory reset. Press power to confirm your selection.

Highlight yes, press Power again, then once that's done...

...Reboot your tablet to begin the initial setup process.

Photo of a modded LeapFrog Epic courtesy of Amber Curington

And if done correctly, you should be able to log in and be greeted by this home screen. Congratulations!

To roll back to the old ROM, do the same Write Memory stuff as before, but instead of the modded system image, load up the ROM_0 file you backed up previously, and make sure Begin Address (HEX) (read: starting address) is at 0x0 instead of 0x5D00000.

Here's a more or less technical description of what I did: I used OSFMount and ext2fsd to mount the two system images: one from the demo unit, and the other from retail. Those two were extracted using a hex editor after I ripped it using SP Flash Tool's readback feature (Which, by the way, is a good thing compared to the complicated method used on Allwinner ROMs). After mounting it, I opened up Windows Explorer, then copied files from app, priv-app, and framework folders on the retail system.img to the demo system image. That should work straight away as it is, but you may want to change ro.product.model in build.prop from EPICv1-InStoreDemo to just EPICv1. Also, libPPAD2.so may also need to be changed in /lib for Pet Pad Party to boot.

As what pretty much every geek or technician out there would say, make sure to perform a backup of your files first, in this case, the stock ROM image. Sorry if this blog post is quite a mouthful and contains a lot of technical info most parents would barely even understand, but just remember to be careful, and don't panic, things should be just fine if you do it at your own pace. ;) I've had a number of mums do it successfully on their children's Epics, so why worry?