yashsingh1/xdaforums huggingface dataset:
[Android General] blakegriplingph:
Is anyone here (especially [MENTION=7656538]epic__fail[/MENTION] who has a rooted Epic) willing to test if unlocking the bootloader via fastboot does anything to seccfg? Need to do a hex editor comparison, y'know.

I am tempted to flash a blank seccfg partition to the tab but I'm worried that would mess my Epic even further.
[Android General] RAMChYLD:
Okay, if anyone can help us out, we'd gladly appreciate it.

So far Blake and I managed to get MTKDroidTools to recognize the Epic. We've managed to create a scatter for the device. We now need to get SPFT to do a readback.

Problem is, SPFT keeps dying after 10 seconds with a S_BROM_DOWNLOAD_DA_FAIL (0x7D4). Already tried three different cables, already tried three different ports.

Funny thing is Blake did manage to get a readback to work with his Epic.

So I'm wondering, is it a problem with my Epic having been updated? Or is it simply because SPFT hates the computer?
[Android General] bovirus:
[MENTION=543591]RAMChYLD[/MENTION]

Disconnect the device from teh PC

Switch off the device.

Install All-In-On Mediatek USB driver 5.1632 aas administrator- https://mega.nz/#!uQo1XDDI!EF0V4Tr5LgQvXuPAOSrcegtByZqrZt0tGtZe_8RZLms

Reboot the PC.

Download latest USB Flashtool here: https://mega.nz/#!bA5D3LDS!vJDy9P3xFI-PDBfyhLEc5QhNK2n5QyWdSedIag3LTy0

Download the ROM here: http://www.needrom.com/download/leapfrog-epic-v1-stock-rom/

Extract from the ROM only the scatter

Or get the scatter (attached to the post)

Get the info from scatter of starting address of USRDATA (0x106300000).

Run Flashtool.

Load the scatter.

Select Readback tab in Falshtool.

Add ROM, select ROM0 file on desktop.

Double click on the line just added and setup as lenght the start address of USRDATA (0x106300000) and confirm.

Now selecT DOWNLOAD in Readback tab.

After few seconds connect the device (switched off) to the PC an waut until the end of processo.
[Android General] blakegriplingph:
OK, if anyone is up to the task of hacking preloader.bin and secro, we'd gladly appreciate it. There seems to be no way to flash custom dumps unless we either pressure LeapFrog to provide a signed SPFT package, or hack our way through.
[Android General] bovirus:
[MENTION=4092918]blakegriplingph[/MENTION]

Copuld post more detail about not enable to flash the ROM?

Which are the defects?

Can you enable USB debug on the device?

Could you detect by MTKDroid?

Thanks.
[Android General] blakegriplingph:
Bricked one of my Epics royally as I couldn't get to show the MT65xx Preloader on Device Manager. I can still somehow flash it through SP Flash Tools (as the device is being detected instead as "USB Serial Device"), but it seems as though I need a way to force the preloader to show up.
[Android General] curtgordon:
Leapfrog

Sorry if this message goes twice. I am not sure if the first attempt was successful

I think it needs to be restored or something. We did a hard reset and it no longer loads the Kids section. Nothing shows on the screen after the reset.
[Android General] blakegriplingph:
You did a hard reset through recovery, right? And then the screen went blank afterwards upon booting?

Does the Epic boot splash still show up? Restoring may be a bit of a stretch for now as we're still working on getting unsigned ROM dumps to work; anything else just results in SP Flash Tool rejecting them scatter images.
[Android General] blakegriplingph:
Thought I'd mention [MENTION=7237874]NepoRood[/MENTION] and [MENTION=7182821]Bogram[/MENTION] given their experience with the MT8127. I hope they don't mind, but since they know a thing or two about the platform, I bet it wouldn't hurt to ask.

The bootloader definitely needs hacking, but it would be something of a holy grail if a kind lad or lass would leak the signed scatter package for us.
[Android General] curtgordon:
Epic Splash

Yes the Epic Splash shows up but when it gets to the setup screen, i get this blank screen with only the time and battery icon at the top right corner.
[Android General] blakegriplingph:
Something must be broken with recovery then, assuming you did the reset right. Try clearing the cache partition through the recovery menu. If that fails, LeapFrog support might be the place to go.
[Android General] curtgordon:
Will do that. Thanks again
[Android General] blakegriplingph:
Let me know how it goes, alright?
[Android General] NepoRood:
I don't mind being mentioned, lol

I'm not sure what I can do for a device that I don't own, but happy to help if I can. Has anyone tried to hack the lk.bin file, using Bograms script? Do you even have a lk.bin file? That was the key to us unlocking the boot loader on the RCA tablets...
[Android General] blakegriplingph:
Yeah we tried that to no avail, as it wasn't able to detect the parts in need of patching.
[Android General] NepoRood:
Ok, thought it worth asking first :D

I'm going to download the firmware now, and see what I can see
[Android General] blakegriplingph:
Sure thing mate, take your time. :)

My friend and I will be dumping the ROM off his Epic ASAP if that helps. And I was thinking maybe getting a cheap Epic off eBay or having [MENTION=3925770]StarbuxMcCloud[/MENTION] send a spare unit to you would help, if he doesn't mind. Not that I'm having you do all the dirty work though, it's that having the actual device at hand would be better.
[Android General] RAMChYLD:
We're starting now, not sure how far we'll get this time. Switched to a different computer and hopefully this time it'll work. [MENTION=4092918]blakegriplingph[/MENTION] is studying the scatter one last time and taking a look at the environment (we switched from my desktop PC to a laptop, hoping that the different chipset on the laptop would help) before we plug in my Epic and do the dump.
[Android General] RAMChYLD:
Ok, after numerous failed attempts, we managed to get SPFT to play nice and do a readback from my Epic. Pretty happy that we managed to grab the system.img, but according to [MENTION=4092918]blakegriplingph[/MENTION] we are still missing the preloader. We need to work out how to rip that now.
[Android General] Warrior1988:
Can someone send me the boot and recovery imgs I'll see what I can do.
[Android General] NepoRood:
You guys following This guide?
[Android General] curtgordon:
Sure ^_^
[Android General] blakegriplingph:
Yup. Preloader resides in a different region so we need to dump it separately.
[Android General] blakegriplingph:
Alright, here are the boot and recovery images in case you guys are interested in prodding with them. :D

EDIT: Decided to sideload a few apps from the Epic system.img to my other tab out of boredom, and surprisingly some of them run fine as user apps; others would flat-out crash but Notepad and Calendar work to an extent before crashing:

Additional screenshots can be found in this album: http://imgur.com/a/VvmLA

I presume the Kid Launcher can be ported somehow, though it certainly calls for a few other dependencies besides Unity.
[Android General] RAMChYLD:
A number of apps in the Epic rely on several services, for example rewards services, because some games in the Epic grants you additional stickers and stuff for completing a round of the game. I reckon they crashed because they can't connect to the required services- for example to figure out which rewards you've unlocked.
[Android General] blakegriplingph:
That's likely to be the case. A quick logcat should shed light on them exceptions. Also of note are the UI layouts as these are coded specifically for 1024x600, 160 DPI screens, so porting these to other platforms may require a bit of hacking to account for higher resolutions or differing DPI configs.
[Android General] blakegriplingph:
Any ideas on the preloader hack? I'm itching to port TWRP to this tab if it wasn't for that locked PL.
[Android General] blakegriplingph:
Aight, here are the files in need of TLC, i.e. the preloader, lk, sec_ro and seccfg, in case someone's interested in taking a good look at it. I'll upload RAM's full ROM dump soon when I have the time.

And yes I tried the dump we got off RAMCHYLD's Epic just now, but still no dice as I am still getting that dreaded 6045 error. So we definitely need that bootloader hacked to get unsigned images to work.
[Android General] RAMChYLD:
Well, since you asked nicely, I'll do the upload. I've created a Mega account and am in the midst of repacking the image's 7z file to include the preloader, MD5 and SHA1 sums.

Will update you guys once I'm done.
[Android General] blakegriplingph:
Didn't mean to inconvenience you and all, but thanks for the aid. :D

We still have a long way to go though - preloader's still locked up and there's definitely a need to have it fixed for good.
[Android General] RAMChYLD:
I'm sure someone would be able to work that one out soon enough.

Anyway, here's the link to the image:

https://mega.nz/#!Jg1hSRSJ!xRoup9kZ1sSEiTwV5Fw_Jb5dgxBoXlSoxcaOvU1d6CM

EDIT: Scatter: https://mega.nz/#!xpVgHLYL!efy1-C-2_8FLIyt2PeyphT1iYiy-xHc46euRgNk_nZ4

the password is "epic".

Hope someone would be able to patch the preloader so [MENTION=4092918]blakegriplingph[/MENTION] can install this on his Epic.
[Android General] blakegriplingph:
And on everyone else's Epics for that matter. ;)
[Android General] blakegriplingph:
OK, can anyone with a rooted Epic boot to fastboot mode and post the getvar output here? I'd like to see if "fastboot oem unlock" works for this device.
[Android General] blakegriplingph:
Bump. Anyone else willing to help?
[Android General] bovirus:
[MENTION=4092918]blakegriplingph[/MENTION]

Could you plwase explain with details what's the problem of preloader?

If you want you can reflash the ROM without touch the preloader partition and avoid problem regarding preloader.
[Android General] Warrior1988:
I'm stuck in fastboot mode my pc can't detect my device I'm not sure if I have correct drivers or what. Adb devices shows no device.
[Android General] blakegriplingph:
You sure it's in fastboot mode? There should be an ADB/Fastboot pack somewhere here on XDA which you can use. If you managed to get your PC to be detected, can you see if fastboot getvar all works, or better yet, fastboot oem unlock?
[Android General] bovirus:
[MENTION=4092918]blakegriplingph[/MENTION]

Could you pelase add in first post info about

- How to unlock/lock the bootloader

- How to check the bootloader status (locked/unlocked)

---------- Post added at 01:37 PM ---------- Previous post was at 01:12 PM ----------

@@RAMChYLD

In your flashtool backuper therae two missing items

- Flashtool scatter

- When your make ROM split with ROM Backup Splitter you ahve to select also the yellow icon to make preloader patch for MTKDroid and copy the file in MTKDroid compatibility folder.
[Android General] RAMChYLD:
[MENTION=637263]bovirus[/MENTION] got it. I'll schedule a remote with [MENTION=4092918]blakegriplingph[/MENTION] and revisit the project as soon as I get home this evening.
[Android General] blakegriplingph:
Hmm, I know this doesn't outright solve the preloader debacle, but is there anyone who has an Epic running on an older firmware version? Would like to see if this trick works as I couldn't find the base URLs on the FOTA client:

http://www.droid-life.com/2014/06/05/download-nexus-ota-url-file/
[Android General] RAMChYLD:
[MENTION=637263]bovirus[/MENTION] I went through the steps [MENTION=4092918]blakegriplingph[/MENTION] and I took again and realized something. We didn't use ROM Backup Splitter, but instead we used MTK Droid Tools itself to split the ROM. Should we use that instead of MTK Droid Tools this time?

As for the scatter, I've uploaded it separately so people can download it to dump their own Epic without needing to download the entire 1.1GB package. I've updated my original post with a link to the Scatter.
[Android General] bovirus:
[MENTION=543591]RAMChYLD[/MENTION]

If you can, please use MTKDroid (that it's the preferable solution).

Flashtool Readback + ROM Backup splitter is an alternative to MTKDroid when MTKDroid didn't work.
[Android General] RAMChYLD:
[MENTION=637263]bovirus[/MENTION] understood. I'll try ROM Backup Splitter next. MTKDroid did work in that the files were successfully split up, but the resulting image cannot be flashed back according to [MENTION=4092918]blakegriplingph[/MENTION]. Blake thinks it's because the preloader is locked and the files have lost their digital signature during the readback.
[Android General] blakegriplingph:
I know I may have said this earlier, but the splitter job's besides finding a test subject with an Epic running on an older ROM for us to capture OTA URLs. I need a zip to see if it can be used to convert a demo unit to a retail one.
[Android General] blakegriplingph:
Just stumbled upon a build.prop flag called "ro.in_store_demo" on a system image dump taken off a demo unit. Perhaps setting it to 0 would do the trick, but can anyone lead me to a backdoor or two to enable ADB and thus be able to temp root such units?
[Android General] blakegriplingph:
ATTN [MENTION=8008238]cristihutch[/MENTION] and a few others: My friends and I may come up with a way to convert existing demo units into retail, but that requires some research and testing. I've stumbled upon an interesting build.prop flag as seen on my previous post, and if I'm right, an exploit or two might do the trick for it to be kicked out of demo mode.

If that wouldn't suffice, any Epic owner here with an older ROM version might want to PM me so we can retrieve OTA zips off Leapfrog's website to be able to flash a retail ROM on a demo unit.

EDIT: Seems like ro.in_store_demo=0 does nothing, as the ROM that came with store units is a bespoke variant. Hacking the demo system image with applications and frameworks from the retail one should do the trick.
[Android General] RAMChYLD:
Well, you might be able to mount the image in Linux. Should also be able to force writeable. Yeah. Worth a shot.
[Android General] blakegriplingph:
I thought of that, though messing around with the hex editor didn't cause any issues.

Managed to get even further and got the retail system.img to work. Well, sort of. It does boot and run, but after a few seconds to a minute, the device hangs and restarts probably due to changes in the kernel as the /system partition is from a later build. I'm thinking maybe someone with an Epic running on a 2015 ROM (KOT49H.user.1.1.99.20150807.173011) build would be kind enough to send a dump or something for comparison's sake.

EDIT: Modifying the system image works, as I managed to get this thing to run with apps and framework off a 2016 retail ROM [MENTION=543591]RAMChYLD[/MENTION] dumped copied to a demo system image I extracted off my Epic. And yes I posted this on the very same Epic I'm messing around with. Took us over a month to pull this off but it is very much worth it. I am not done with this yet though: research still has to be done with the bootloader as it would not accept kernels/recoveries/whatever other than the ones it was built alongside with, hence why I took on the experiment of frankensteining /system for the time being until a better solution is found.
[Android General] blakegriplingph:
Demo unit conversion to retail/backup tutorial

Alright, here are some screenshots taken off my recently-converted ex-store unit:

And a picture of a frog video being played because I was bored:

As for converting a demo ROM to retail, you'll need to have SP Flash Tool, MediaTek USB VCOM Drivers, a hex editor such as HxD, Ext2FSD, Notepad++, and some patience.

First you'll have to make a backup of your current ROM, by using the readback feature of SPFT. Download RAMCHYLD's ROM on the first page, load up the scatter file, and tick only the preloader. On the readback tab, press add, then double-click on the table below. You'll be asked where to save the resulting backup, then click save. You'll then be greeted by this window:

Length has to be at 0xC5D00000, and the starting address should be at 0x0. Hit OK, then click Read Back. Start Device Manager, then take a look at Other Devices or the Ports (COM & LPT) category. You'll need to be quick with this one, as you'll have to install the VCOM drivers - tutorials for that can be found here and here.

If done correctly, you may see an error message due to a connection error of some sort. You may safely ignore it - just click the read back button again and it should dump the contents of your device which should take some eight to ten minutes. If you want, you can back up the preloader as well, by doing the same thing as before, but with the settings changed to EMMC_BOOT_1 as the region and the length to 0x40000. Be careful with the preloader though, I bricked one of my demo Epics as I overwrote it with another one by accident.

Now that the ROM_0 part is done, load it up using a hex editor such as HxD, or use a MediaTek-specific ROM splitter tool. In my case, I just selected blocks 0x5D00000 to 0xC5CFFFFF in order to extract system.img. Install Ext2FSD, then use a tool such as OSFMount to mount them images as a writable partition. Load both the system.img from RAMCHYLD's ROM and the one from the demo unit, then open those two drives in Explorer.

Delete the /app, /priv-app, /framework and /vendor folders from the demo ROM, then copy the equivalent ones from the retail ROM. You'll also have to replace build.prop with this: http://pastebin.com/VDqv8b2k. libPPAD2.so also needs to be replaced with the one from the retail ROM; otherwise you'd end up with Pet Pad Party crashing to the home screen.

Once that is done, you'll have to use write memory to copy the edited ROM to your device. Open SP Flash Tool again, then press Ctrl+Alt+V. Click on Window, and then tick Write Memory. On the aforementioned tab, make sure that the starting address is 0x5D00000, and the region to EMMC_USER. Now load the modded system.img, then write it back to your tablet. Again this will take ten minutes, but if done correctly, you should get a working retail unit instead of a semi-functional store display tablet.

Sorry if my tutorial is a bit convoluted, but don't worry, I'll revise it soon especially when my friends and I would come up with something better. ;)
[Android General] RAMChYLD:
I should add that if you're consistently getting a read error 10 seconds into the read process when dumping your ROM, holding down the volume up button actually does work.

Our next plan of action is to try to sniff out an OTA update package and intercept it, and then dissect it to see what's inside. Not sure how to get about this, I'm certainly not going to buy a new Epic just to run a sniffer. Especially since a new iPad holds higher priority at the moment (blame Penguin Interactive, they won't release an app I need on Android, and the last two versions of the app dropped support for my 6-year-old iPad 4) , and like in The Philippines. the price of the Epic is really expensive over here.

PS: I think it'd be okay to post your frankenstein ROM for download for those who just want to quickly get it working. Of course, it isn't perfect, but at least they'd be able to make it tick until we find a better way.
[Android General] blakegriplingph:
Yeah I might upload my frankenstein ROM soon, though of course it would be more than elegant if a signed stock image would be acquired somehow.

Bootloader also needs to be worked on as well, assuming LF isn't up to spilling the beans on the preloader binary.
[Android General] blakegriplingph:
So uh, has anyone got further with trying out Google Services on this device? Tried sideloading the necessary APKs, and while applications dependent on Google frameworks seem to run happily, e.g. Asphalt Nitro and YouTube, Google Play Services flat-out crashes every so often, rendering Play Store unusable. I am thinking of rooting the device to see if moving said frameworks to /system would work, but I ain't that arsed to shove in SuperSU yet.

Also, is there a way to knock a device out of USB Serial Device mode besides shorting testpoints? I made the mistake of flashing the preloader prior to being able to mod the ROM on my other Epic, and now I am unable to get it to boot.
[Android General] blakegriplingph:
OK, so I've decided to mess around with the microG framework, my goal being to get at least the Play Store to run. With the latest build, the latest Play Store build on APK Mirror runs up to a certain extent, i.e. browse and search for apps; downloading or upgrading an app results in the following crash:

java.lang.SecurityException: Invalid value for is_public_api: null

...which can be remedied by moving Play Store to /system/priv-app. Sure, that would do the trick, but it's moot as you can just install/flash Gapps to it anyway. But while it's a bit of a stretch that isn't my goal as parents wouldn't want to risk bricking their kids' Epics due to a botched root job, hence the need for a userspace-based solution.

However, if I use [MENTION=6001224]cobalt232[/MENTION]'s modded Play Store as per his suggestion, I am able to get even further, but applications don't install after being downloaded.
[Android General] blakegriplingph:
Also of note is that attempting to install third-party launchers/home screens would result in this logcat message:

W/PackageManager( 629): Unable to install "com.teslacoilsw.launcher") as Home Launcher because we do NOT support feature: android.software.home_screen

Can this be overridden so the default Kids Launcher can be replaced with something else? I bet this, along with the hidden recent apps button, can be re-enabled through an Xposed module, right?
[Android General] tierzastarrw:
Massive noob here. I'm slightly technologically inclined but not to the extent that most of the people on here are, so I need some help.

I got a leapfrog epic for my son a couple weeks ago and downloaded some apps from his old tablet onto here. I am now getting an alert saying the memory is full, so I go grab a mini sd card and pop it in, only to find out the leapfrog only lets you use the card for files but not apps. If anyone could find a work around, that would be awesome.
[Android General] blakegriplingph:
Not to mention that the SD card is locked from write access with third-party applications, which can be fixed with this. Are you able to do a backup of your Epic's ROM? The methods used to work around the issue require root so we don't want to take any chances.

There's this Xposed module which lets you move OBBs to the SD card, e.g. you have Asphalt 8 or GTA San Andreas and you'd like to move the asset OBBs to the SD to give way to more apps. I am not sure about the apps themselves as the AOSP application manager is neutered to the point that even clearing the cache or data is greyed out, but for now you can move the OBBs from your son's apps to a more convenient location.

EDIT: Since parents have been asking as to whether YT Kids can be installed, I thought I'd upload a pre-patched version of it without the Google services dependencies. You can patch it manually using [MENTION=6001224]cobalt232[/MENTION]'s Play Services Patcher, but not everyone is savvy enough to do so, so here it is:

http://www90.zippyshare.com/v/Gxep4Jc0/file.html

Proof:

[YOUTUBE]eEj1XMLlBKA[/YOUTUBE]
[Android General] blakegriplingph:
Been trying to get the custom recovery to compile, but for some reason I couldn't order a lunch combo properly, so to speak. I based the TWRP stuff from [MENTION=7237874]NepoRood[/MENTION]'s repo as his was apparently the only MT8127-based recovery source tree I encountered so far.
[Android General] NepoRood:
What you got going wrong, exactly? Share your error and I'll try to help...
[Android General] blakegriplingph:
I end up with this:

SyntaxError: invalid syntax
build/core/product_config.mk:222: *** Can not locate config makefile for product "cm_EPICv1". Stop.

** Don't have a product spec for: 'cm_EPICv1'
** Do you have the right repo manifest?

Already tried renaming a few things to no avail. :/ Here's the repo I'm using if it helps:

https://github.com/huckleberrypie/device_LeapFrog_EPICv1
[Android General] NepoRood:
Your "AndroidProducts.mk" should contain your cm file ref, then add the rest of the info to your device make file. I've gotta get in the bed now, I have work early tomorrow. If you can't line it out, I'll send you a PR tomorrow...