yashsingh1/xdaforums huggingface dataset:
[Android General] blakegriplingph:
Lol nice, I see you ported the CX Cubo ROM into the Innotab with no apparent issue. Was it any difficult?
[Android General] ifhi:
Lol never go on boot animation sometime its a trap!. well they both have different partition table and yes i have used some part of cx some drivers and xml files from innotab.
[Android General] seb_131:
Nice job :) Congrats!

The Playstore launches correctly on my Innotab, but there is just this DF- DFERH- 01 error message. I read that it could be due to wrong version, that's why I was thinking it was the issue.

Well, I can't wait to see your tuto now! to understand how you did it.

As the Innotab is used by my child and that I have other Android Tabs, I prefer to keep the OS and the VTech app. But it is a personal preference.
[Android General] ifhi:
i will upload restore backup too if somebody wants to use innotab soft again it will also available for those people
[Android General] ifhi:
Follow instructions with tutorial

https://xdaforums.com/android/general/convert-vtech-innotab-maxx-android-t4060429
[Android General] ConsciousBone:
hello all,

androidtool says that the tablet is in maskrom mode, and i cant leave it or do anything with it,

how do i fix this?
[Android General] c234:
same here. Any time I would try flashing it would just give me an error, and it won't turn on at all. the green light shows up indicating that it is charging but even then it still does not work. how to fix?
[Android General] Nico_FR:
Konami code was found after multiple test, first one was the factory reset. Once found this one, the recovery was pretty easy to guess !!

Rt now, you can install whatever apk you want and run it, as soon as you have a PC to push to foreground the launcher with the provided command.

There are some vtech applications available to do some maintenance/configuration operation, but GUI is not friendly enough to understand the right purpose.

I will not be able to work on it during the week, so if someone else has a Max device, let us know your findings ;)
[Android General] blakegriplingph:
So what you're saying is that the SU binary was there on the device all along? In other words, you don't even need to do much besides the instructions you posted here and on Spiffy, as well as a Superuser tool?
[Android General] Nico_FR:
Yes, SU is already in, as busybox ;)

You can install any APK you want, it's running fine also
[Android General] blakegriplingph:
That's lovely, though I do wonder if Vtech's decision to leave su on the tab by default is a good move on their part on a security standpoint, even if it isn't readily accessible to end-users.

Also, a user at Spiffy wondered how cartridge-based games are loaded and run on the Max. The GeneralPlus SoCs used on lower-end Innotabs are ARM-based, but do cart games run on an emulator, or is there some sort of wrapper used to implement API calls specific to the non-Android Innotabs? The latter seems likely though since the GPL32902's ARMv6 anyway.
[Android General] konna280:
Hi, thanks for the info, I've managed to get Google play store installed, but i can't download anything from there. I'm wondering if the existing download manager needs to be changed or modified, or whether I need to add androids default one alongside it? (or if there's anything else missing?). It loads up fine and I can go through the menus, just get stuck on 'downloading' when I try to get any apps from there. Tried clearing caches and data from play store, rebooting, etc but no change.

I don't know a great deal about all of this, I've been using android and rooting etc for a few years, but everything has been done via instructions on here and using Google.

Has anybody else had any joy on these and gotten any further?
[Android General] Nico_FR:
Did not tried this one. I 'm more focus on understanding the vtech stuff than just getting a standard android tablet ;)

I'm looking at how to add some games entry in the "gameshelf" application. It seems this one is using the "fakeapp.db" located in /data/data/com.vetch.innotab.vpm/databases but it seems to be encrypted.

Now I'm looking for any more app in this chain in order to understand how it is encrypted.

Have you seen also the application named "GGManager" ? Don't know yet how it works and what it should do.

Same for "VPM Activity" and "WMDLService"
[Android General] <stu>:
WMDLService is probably the WishMaker Download Service - what that does exactly I don't know apart from advertise vtech apps to my daughter to make her ask me to buy them.
[Android General] enochian:
Updates. To this on the spiffy site
[Android General] konna280:
If everything can be accessed through the Vtech Desktop UI that would be amazing. I don't plan on using the android launcher if I can help it, as it will keep things simple for my kids and stop them from playing around with things they shouldn't!

The main reasons for myself wanting to 'hack' the tablet are:

1. To get more free apps (preferably via play store, and have them in the game shelf if we can)

2. To allow the use of certain services such as cbeebies iplayer (URLs differ greatly from original website address when attempting to play programmes, so access is blocked unless you add every single programme address to approved websites)

3. To improve performance of the device

So, finding a way to allow external downloads to work (im also getting 'failed to start download' message in chrome browser), getting around the approved websites issue whilst still keeping browsing safe, and adding 1 or 2 apps to run in the background that'll keep things running smoothly are the current goals.

---------- Post added at 10:36 AM ---------- Previous post was at 10:28 AM ----------

WMDLService looks interesting. I tried pressing a couple of buttons but nothing happened! GGManager must be to do with the gift gallery, so maybe the service that gets the gifts (stickers) from the parent app to the kid connect app.
[Android General] <stu>:
Amazon app store seems to work ok, tho I had to sideload it to get it on.

So far I have just added CBeebies Playtime and Sidebar Lite (again sideloaded) to access it.

I deleted the fakeapp.db, but it just removed everything from GameShelf, Ebooks and the installed cartridge needing downloading again. However, it downloaded all the missing apps again and after a few minutes they were all back in GameShelf and Ebooks. It seems the fakeapp.db is synced with the vtech servers, so it may not be so easy to add extra items to it.

I think with sidebar pro it should be ok to lock the items on the sidebar which means you can control what is accessed, but it is not under the control of the time restrictions, so not ideal.

I think perhaps the way forward is to look at modifying ITMDesktop to add an extra gameshelf, or just add extra apps there. It would need a way to control what is added tho.

However it is big step forward.
[Android General] konna280:
Yeah I tried amazon app store shortly after posting, and the app downloads games fine, so there doesn't seem to be any restrictions to external downloads.
[Android General] enochian:
Is the original. Ui. Just a apk. That starts instead of the android launcher if so to change the game shelf you'd have to modify the code inside the app its self. Is there a way to issue adb commands from the tablet its self like make a button or a button combo press to switch between vtech and android launcher
[Android General] konna280:
Yes it is an apk. Sidebar lite has the option to add the android launcher in the sidebars menu, instead of having to give the adb command every time to bring it to foreground.
[Android General] enochian:
Trying. To. Weigh my options here. This is my 3 year old daughters. I like how the vtech launcher. Dosent allow them to accidental. Buy something. Is there a way to disable clicking on. Play store or other app stores. And have away for the parent to access the. store. Id rather her using actual android apps. Since the games cost so much. Id like her to be able to access both.
[Android General] <stu>:
I got this tablet specifically because the games and apps are curated, and have educational content. I mean what can you learn from candy crush saga or angry birds? Those games are just for wasting time. Additionally I don't want to spend hours finding decent educational games for my girls, so I got this.

I would like to add one or 2 other non-vtech games (such as cbeebies playtime). They should have made it possible to do so without hacking it, but there you go.
[Android General] enochian:
Android has a lot of good free educational games like doc mcstuffins. Minni mouse strayberry shortcake etc. She had the mobogo2. But that stoped reading games so when this came into work for only 38. Bucks i grabed it hoping it had the play store so shed stop using my tablet lol
[Android General] blakegriplingph:
Well, if someone here's up to porting and modifying the ITM launcher, it'll be golden.
[Android General] enochian:
Or instsll abother kid lsuncjer
[Android General] enochian:
Can you do a recap. In one post. How to get adb plus eery thing you've mentioned so far
[Android General] enochian:
Thank you. Ill try this as soon as i get the time
[Android General] enochian:
Do I have to download the UK firmware. (I'm in the us). I'm not able to download because the only internet I can use right now is from my phone the download failed twice and put me over my data cap. So if there was a way to do this without downloading the large firmware. That would be great.
[Android General] konna280:
No US firmware should be fine. If you can get into the recovery screen by holding the keys mentioned in an earlier post then you don't need the update file.
[Android General] crossmanbx:
Warning, don t flash the ROM you downloaded and put into sd card if your firmware is NOT UK or US !!!

I've done a mistake.

I flashed an english firmware over the french one (cause i wanted entering recovery), and now my storio max is half in french, half in english.

Do you know where i can dl a french firmware ? It seems that the french vtech site doesn't contain it.

Thank you !
[Android General] konna280:
I've updated the post to avoid any further issues.

Try this to see if it will factory reset and return to original firmware -

1. Fully power off the storio MAX

2. Hold down the ? button and left+up buttons together and turn on the storio MAX.

3. Release and repress the ? button and left+up buttons together as soon as it powers on.

4. Let the factory reset process take place

*Apparently it takes about 2-3 minutes to reset

5. You should be back to the initial login page and be prompted to update the date and time.
[Android General] crossmanbx:
Thank you for your answer.

I've already done a factory reset but no good news.

System is in french but at least 3 apps are in english (written and spoken) : Magical beans, the drawing app, and the navigator.

Firmware comes from 6.2PSYC (totally french) to 6.2PSWV.

So, if anyone know where to download 6.2PSYC .............
[Android General] hemo87:
I seem to have bricked my daughters innotab... Can't get past vtech logo now, factory reset has no effect and can't reinstall firmware.

I do have adb access.

Will upload logcat shortly if anyone can help before my wife kills me!
[Android General] konna280:
[MENTION=6167460]hemo87[/MENTION] Have you deleted any files from the device? I had a similar problem where it wouldn't get any further than the innotab boot sequence with one of mine when I accidentally deleted a couple of apps that I thought I had pushed over, but were actually part of the innotabs firmware. Luckily I used the other innotab to copy and push it back over!

I used this page to find out what needed to be kept on there - http://blog.burrowsapps.com/2014/03/what-android-apps-are-safe-to-remove.html

If you can't recall deleting anything you shouldn't have, when did it decide not to boot up?
[Android General] hemo87:
Nope, not that I know of, I did pull some files to luck at them, but I just used the pull command so they're still there.

I'll pull the whole system later tonight and post it here and someone can have a quick scan through and see if there's anything missing..
[Android General] <stu>:
There is a firmware update available for the UK models: http://contentcdn.vtechda.com/Data/...26CF6.S54D1C228.20150204-145649.C61EAECA.ugdy

Not sure that I want to update in case I lose adb access.
[Android General] konna280:
I would imagine it'd be bug fixes if anything, but wouldn't risk updating just yet. It'd be nice if we could get into the file to have a look at it, but I haven't found anything that can get into the .ugdy format yet.
[Android General] konna280:
Just installed the new UK firmware update (thanks to [MENTION=1754135]<stu>[/MENTION] for letting us know), and everything is still intact that I pushed over except su. Just went through steps 1-4 in the guide I posted earlier and it's all up and running again.

It definitely seems more stable, im not seeing any of the innotab apps crashing when going between them (the main culprits before being My Magic Beanstalk and Kid Connect)

Any updates on anyone elses progress with things? I mistakingly decided to put Minion Rush on both my kids innotabs a few days ago, aaaaand thats pretty much all they've been playing ever since...! So that'll be coming off soon for something a bit more educational.
[Android General] <stu>:
Thanks for letting us know - I have just applied the update and everything is working fine, but as you say you have to be careful what you install.
[Android General] konna280:
I've just found an app on the play store called Screen Time Parental Control, which can give you more control over what they play and for how long. Might give that a shot.
[Android General] r_carter15:
Innotab UI

Hi,

It seems from reading this thread that the Innotab UI sits onto of android? Does this mean that it might be possible to copy the Innotab UI to a standard android tablet?

I would love to be able to get all my daughters inotab games to run on my galaxy tab 3......

thanks
[Android General] konna280:
[MENTION=6440857]r_carter15[/MENTION] I should imagine it is possible, yes. It all depends on what you want to achieve though really, and how much time you're willing to spend on it to get it working the way you want it to. Could be as simple as pushing a few apks over onto the tabs existing firmware, to having to use an external device to adb commands over to get into the innotab UI while still having a fully functional tablet for normal use, or even installing something like Multirom, and having a modified tab firmware installed with all the innotab system UI and apps, alongside the current galaxy tab firmware (2 ROMS installed at the same time).
[Android General] Toug:
Somebody found the link to the french firmware?

Thanks
[Android General] Nico_FR:
Did not look for it yet.

But I had time to reverse a bit more :

OK, I had access to the tab for a couple of hours, so here are my new findings.

If you are running windows do:

adb logcat | find "eid"

with your tablet already plugged in.

Start ExploraPark, and you should soon receive some lines of logs with your EID (same as with preivous Innotab devices)

This EID will be usefull to edit database, as database are encrypted !

I've reversed some code, and the encryption engine is SQLCipher, which is supported by http://www.sqlabs.com/sqlitemanager.php

The DB password is the USB PID: 1668 followed by your EID (so quite a long password to type !)

Then, you can grab a copy of the db called fakeapp.db, located in:

/data/data/com.vtech.innotab.vpm/databases/fakeapp.db

Start SQLiteManaged, and open the DB. It will prompt for a password. You are now in !

I have not tested yet which fields are mandatory in "downloaded_cartridge" table. You will see that the known *.bin files are mentionned there in the "url" field.

Does any of you have some cartridge to check the behavior ?
[Android General] enochian:
Any thing new. Im holding off on doing this
[Android General] micky3936:
having a little trouble

my daughters innotab was updated recently and when i tried the update to enter recovery method , although i got into recovery i couldn't enter su as it reported su not found (i used a command prompt with admin rights and used all the files from the links provided.

strangely when i rebooted the tab and tried again to get into recovery the tablet now totally skips the update process and boots normally

does anyone know if i can push apk's to the tablet for example su any other way.

thank you for reading
[Android General] Nico_FR:
If you do not have adb, short answer is NO

By the way, you should avoid using the update process to enter recovery. On my side, the method I have listed is working every time I need to go to recovery. Have you tried this one ?
[Android General] enochian:
which way? ^^^^^^^^
[Android General] Nico_FR:
This one : http://xdaforums.com/showpost.php?p=58255842&postcount=18

Note that it seems there is a variant to go in, as described on spiffy:

http://spiffyhacks.com/thread-485-post-3066.html#pid3066
[Android General] hemo87:
OK, I finally managed to get this to work.

I couldn't enter the recovery mode before.

I tried to do it via update and it did work but it was stuck in update mode.

I was able to enter recovery by using

Up & left (d-pad) vol up and power button (3 seconds)

Then followed instructions as usual.
[Android General] wazza_1980:
cannot ADB in recovery mode?

Hello,

When I access the Innotab via recovery mode I cannot ADB but when I try using the firmware method I can ADB can anyone help? I would be ok using the firmware method but it will not let me enter su when i go into shell it advises su not found.

When in recovery mode windows will not recognise the modified android driver but in firmware mode it does?
[Android General] hemo87:
I wouldn't recommend it, as I got stuck in recovery when I tried.

Are you sure you are in recovery? The screen will flash black (twice I believe) then appear as its off.

Make sure you try both methods to enter recovery, with either context key or volume up.

The latest update still worked for me so unsure why you wouldn't be able to get su access.
[Android General] konna280:
[MENTION=1142265]Nico_FR[/MENTION], I've got a Disney Planes cartridge I can use if you still need to check activity?
[Android General] Nico_FR:
Yes !! Can you logcat and post the result there ?

Should be interesting to get it from the insertion until the start of the app

---------- Post added at 09:06 PM ---------- Previous post was at 09:03 PM ----------

I've added this alternate to the original post:

http://xdaforums.com/showpost.php?p=58255842&postcount=18
[Android General] konna280:
deleted
[Android General] Nico_FR:
Thanks

Can you start logcat while starting the cartridge game ?
[Android General] konna280:
I had kept it running up until the cartridge was loading the game!

I have found though that when the game is 1st run, it installs itself onto the innotab. Once you access the android launcher it will be in the app drawer as an apk, and will run without the need for the cartridge to be inserted. So the cartridge is then only used to bring up a link to the apk from within the original innotabs UI.
[Android General] Nico_FR:
Yes, this is what I have found also.

Now I'm more working on how the cartridge content is wrapped to an android app. First installation logcat would be interesting to grab some usefull information.

......

This is now OK, I have been able to reproduce a download sequence, and I have the logcat regarding the wrapping.
[Android General] konna280:
Right ok, I'll get on it tommorow and post the results. I need to keep an eye on this thread a bit more!
[Android General] konna280:
I'm struggling to uninstall the game fully, i tried going through apps and uninstalling it that way, but when i put the cartridge in and tried loading it, a message immediately popped up saying something along the lines of "Your cartridge is installed and ready to play, please click the icon to play the game".

If i try clicking it again it just gives the same message, but doesn't go any further. I had a good look through all the folders in root browser and couldn't find anything else that needed deleting, tried rebooting but still no luck. Any ideas?
[Android General] Nico_FR:
Yes ;)

This may be stored in the fakeapp.db file. First, you can make a backup of this file, delete it and then reboot. Wait few minutes after startup, the tab should rebuild it automatically.
[Android General] konna280:
I cant find the fakeapp.db file to delete it! Just looked on both the innotabs and its nowhere to be found. Where is it meant to be located?
[Android General] Nico_FR:
I don't have the tab there, but you can search for it.

open adb shell on the tab, and you can use busybox:

type:

busybox find . -name "fakeapp.db"

You will get full path to the file
[Android General] TheMorlince:
Well, now I'm disappointed. Just got this in the mail and was looking forward to having a decent kids tablet with the added ability of installing other android games as well. Now it looks as though I might be returning this. I don't have the time to modify this as needed, nor do I want to worry about starting the android launcher just so she can play 'unofficial' apps that I have already purchased on her existing tablet.
[Android General] Nico_FR:
DB is there:

/data/data/com.vtech.innotab.vpm/databases/
[Android General] konna280:
I tried changing the standard keyboard as the nasty blue and yellow was irritating me, but its since changed back to default again and i'm not sure why?

[MENTION=1142265]Nico_FR[/MENTION] i've messaged the logcat output to you, I keep finding things in there that i'm sure I shouldn't be sharing with the world (mac addresses etc). I have found a few things in there that may be of use, let me know if it helps.
[Android General] wolverine_2k:
Have you got the pink one? I couldn't get UP + LEFT + CONTEXT + POWER to do anything at all.

I'm leaving mine plugged into the laptop, the charger comes on and then I try the UP + LEFT + VOL UP + POWER and the laptop recognises it as "Class for rockusb devices" with no ADB Access. I had your problem with the lack of SU using the other method.

I'll give it another try tonight, was getting quite frustrated with it last night!
[Android General] hemo87:
Yes mines pink.

Is the driver showing as installed properly in device manager?
[Android General] wolverine_2k:
Yeah it shows up as "Rockusb Device" under a top level of "Class for rockusb device" instead of ADB. Think I might have to try another laptop or something!

EDIT. Just uninstalled the Rockusb driver and now it works fine. Duh!

So it seems like all the cartridges are converted to android apps and they run without the cartridge when run via the android UI.

I assume it just needs the cartridge for some pauper security. I think the best hack would have to be the GameShelf to recognise other installed apps and also the cartridges installed as games within there.
[Android General] wolverine_2k:
Ok so I managed to install an app and got it to show up in the Games section on the Innotab UI and the game works perfectly fine too.

The game that I installed was SUPER WHY via the Amazon Appstore that I had installed on the device.

I edited the fakeapp.db and put in a new line and just tried to copy as much of the information as possible from another game in there and pushed the updated fakeapps.db to the device.

I rebooted the device and my app has appeared. The icon isn't too great but I'm sure someone with some programming knowledge should be able to find an easier way to automate this.

Here's the row I inserted into the table. The MD5's I copied from another which was just all 0's and the last bunch of numbers have to be exactly that or they don't appear on the device. I got the file size by doing an ADB pull which tells you the exact size of the apk in bytes:

https://drive.google.com/file/d/0B4ph0jGJMvHEbXhiVWZjWlRFSlk/view?usp=sharing

And this is how it looks on the device. Would love for someone to figure out how to change the icon, most kids play apps/games based on the icon and not the wording...

https://drive.google.com/file/d/0B4ph0jGJMvHESi1fZHU1OGhTQm8/view?usp=sharing