May I interest you in yet another LeapFrog Epic post? :P

EDIT 2: This tutorial is now outdated and will not work on Epic Academy Edition demo units. See this post for an updated method.

EDIT: If you have any inquiries or are getting stuck with updating the ROM, kindly let me know either on the LeapFrog Epic Guy page on Facebook, or on my personal Facebook account.

I've been getting a lot of inquiries lately from parents asking how does one convert a store demo unit to a retail one. Apparently a number of Epics, mine included, were sold on eBay, Craigslist and other classifieds, are programmed with a demo ROM meant for displays on Toys R Us, Best Buy, Fry's or whatever outlet these things are sold.

The real caveat here is this: the boot loader is locked, making straightforward ROM flashing mostly impossible (hence why I wrote an open letter to LF asking if they can provide an unlocked bootloader). Now before you lose hope and say "Oh this is a waste of $50! Why did I even buy this crappy toy?", there is actually a way around this and as what some of those who inquired me can attest, it works well unimpaired.

To back up the old ROM and flash the newly-modified system.img back to the device, you'll need to download SP Flash Tool, the stock firmware image (https://mega.nz/#!Jg1hSRSJ!xRoup9kZ1sSEiTwV5Fw_Jb5dgxBoXlSoxcaOvU1d6CM - password is "epic" sans quotes) and the modded Epic ROM. Load up the original retail ROM's scatter file by clicking Scatter-Loading and opening MT8127_Android_Scatter.txt. You need to do this as Readback and Write Memory options won't work without the stock firmware loaded.


After that, click on the Readback tab. Click Add, then click on the row that shows up. You'll then be prompted where to save your backup.
You'll then be greeted by this window. Region should be set to EMMC_USER, the starting address at 0x0 and the length has to be at 0xC5D00000 as shown here. (ADDENDUM: The readback length should be 0x205E00000; my friends and I came up with an even better conversion method. More details on that later.)
Click on Read Back, and plug the tablet into your PC. A device named "MTK 65xx Preloader..." or something along the lines of it should appear on Device Manager or the notifications area. On Windows 10 this should install on its own, but you may have to download drivers especially on an earlier version of Windows. And now for the fun part - after you have plugged in the Epic, an error message should appear. Don't worry about that, you can safely ignore and dismiss the message, but click on the Read Back button again as soon as possible.
Once that is done you should end up with a ROM_0 image to roll back to in case something goes wrong.

Enable the hidden Write Memory feature in SP Flash Tool by pressing Ctrl+Alt+V. Click Window > Write Memory, then click on the Write Memory tab to bring up the tool. Browse to the modified system.img (system_modded.img) that you've downloaded from MEGA, then make sure Begin Address (HEX) (read: starting address) is at 0x5D00000, and the region is at EMMC_USER.
 

Once that's done, click on the green Write Memory button, then plug your Epic into your PC. You'll get an error as before but just ignore it and click on Write Memory again. If done right you should see the progress bar fill up and thus flash the device. Unplug and plug it in your PC again to see if the battery icon still shows up. If it does, the device should be fine.

Now before you hand over your device to your son or daughter, make sure the tablet is off, then press Power and Volume+ to bring up the recovery menu. Use the volume buttons to highlight an item - in this case, Wipe data/factory reset. Press power to confirm your selection.



Highlight yes, press Power again, then once that's done...


...Reboot your tablet to begin the initial setup process.

Photo of a modded LeapFrog Epic courtesy of Amber Curington

And if done correctly, you should be able to log in and be greeted by this home screen. Congratulations!

To roll back to the old ROM, do the same Write Memory stuff as before, but instead of the modded system image, load up the ROM_0 file you backed up previously, and make sure Begin Address (HEX) (read: starting address) is at 0x0 instead of 0x5D00000.

Here's a more or less technical description of what I did: I used OSFMount and ext2fsd to mount the two system images: one from the demo unit, and the other from retail. Those two were extracted using a hex editor after I ripped it using SP Flash Tool's readback feature (Which, by the way, is a good thing compared to the complicated method used on Allwinner ROMs). After mounting it, I opened up Windows Explorer, then copied files from app, priv-app, and framework folders on the retail system.img to the demo system image. That should work straight away as it is, but you may want to change ro.product.model in build.prop from EPICv1-InStoreDemo to just EPICv1. Also, libPPAD2.so may also need to be changed in /lib for Pet Pad Party to boot.

As what pretty much every geek or technician out there would say, make sure to perform a backup of your files first, in this case, the stock ROM image. Sorry if this blog post is quite a mouthful and contains a lot of technical info most parents would barely even understand, but just remember to be careful, and don't panic, things should be just fine if you do it at your own pace. ;) I've had a number of mums do it successfully on their children's Epics, so why worry?

Comments

Christian said…
Hi,
Please help me with this process. I have a DEMO unit.
Thanks
Christian said…
Hi,
Please help me with this process. I have a DEMO unit.
Thanks
Huckleberry Pie said…
Sure, no problem with that. Do you have an account which I could contact you with?
Unknown said…
Do you mind helping me? I can download the ROM but when I try to write to address to 0X5D00000 SP flash indicates that it is an invalid address.
Unknown said…
Can you help me out? I can download the ROM on my demo unit but SP flash will not allow me to write the Modded file. It indicates invalid address @ 0X5D00000.
Huckleberry Pie said…
Are you sure you loaded the scatter file properly? I've had someone comment on my LeapFrog Epic Guy Facebook page about a similar address issue.
Unknown said…
Everything looks correct as per your guide. Readback does work but write does not.
Huckleberry Pie said…
Strange... You tried the latest SP Flash Tool build?
http://spflashtools.com/windows/sp-flash-tool-v5-1728

Also, can you send me the error message screenshot as well?
Odincubus said…
I am having an issue as well. I'd first like to say thanks for this guide, as it's been extremely helpful. I have followed all directions but after I perform the last factory reset step, my epic constantly reboots at the initial start page. The farthest I can get is the country selection before it reboots again. Any help with this would be much appreciated. My nephews are driving me crazy to get this epic working.
Huckleberry Pie said…
I presume you did the backup step, right? Flash ROM_0 back to the tab by doing the same thing in Write Memory, except that the starting address is at 0x0 and the region is EMMC_USER. See if it boots back to demo mode then make sure you are flashing the modded system image.

If you are still running to any problems please let me know or better yet message me on my Facebook account.
Huckleberry Pie said…
And are you sure it is indeed a demo unit and not the one with the lock code?
Huckleberry Pie said…
@Odincubus Seems like you flashed the wrong ROM then. It should be system_modded.img, not the one from the stock ROM. That accounts for why your Epic kept on boot looping.
Unknown said…
Win 10 x64
1) disable driver signing.
2) install drivers
3) hit read memory or write
4) hold power and volume up to get it to switch into Serial mode
5) watch it do its thing.

6) thank the person who wrote this. I now can retain my super hero status with my 5yo.
Unknown said…
Win 10 x64
1) disable driver signing.
2) install drivers
3) hit read memory or write
4) hold power and volume up to get it to switch into Serial mode
5) watch it do its thing.

6) thank the person who wrote this. I now can retain my super hero status with my 5yo.
Huckleberry Pie said…
@Richard Sperry In fact, you don't even have to install the MTK serial drivers at all, at least with Windows 10. Windows simply downloads and installs the drivers upon plugging in the device, to which you may have to plug it in again for SP Flash Tool to recognise it.

And by the way, I have a much better method of converting the device to retail. Mind if I PM you about this, as it allows you to receive official updates and essentially turns the Epic into a *proper* retail unit than a hacked ex-demo model running a frankenstein ROM?
Huckleberry Pie said…
@seudonimo Press read memory or write, then hold Volume up whilst plugging it into the computer. Do this correctly and the tablet should be detected as a Mediatek USB Serial port.
vncvbwwr said…
Hi, Do you have a copy of the Android Scatter file? I followed all the steps in this helpful guide but I don't think I have the correct scatter file because I get an error message when I try to write. Readback works but write does not.
Amaya Grace said…
Thank you so much for your help getting my Leapfrog Epic demo tablet all better. My friends son is going to enjoy this a lot. He was able to call me on Facebook and walk me through all the steps on this page that I was having problems with. We had a great conversation while we waited for some of the steps. He and his gang on helpers who do stuff like this for us for free are a blessing. I'll be sending some funds his way as a thank you for his time and work. Highly recommend.
Huckleberry Pie said…
@Amaya Grace - 'Tis quite an honour helping you out. :)
José Manuel said…
Hi!! How can I do this process in an EPIC academy?

Popular posts from this blog

LeapFrog Epic part 1: The hidden Lock Screen.

Macintosh in a pinch: Sierra on a Pentium G3258/ASUS H81M-D

And I came in for another LeapFrog Epic post.