yashsingh1/xdaforums huggingface dataset:
[Android General] blakegriplingph:
I've also signed and uploaded the v1.8.160 firmware for the Academy Edition as well. Took me a long time as my connection here is slow as molasses and I kinda' forgot how to turn a raw ext4 image into a sparsed one lol.
[Android General] junior2050:
Boot Loop

I am having the same issue. I did make a back up before hand. But when I downloaded twrp and tried to go into recovery mode, the EPIC just went into a Boot Loop and I don't know how to get out of it. Tried all button combinations, removed the battery for a minute. If you know how to get out of this, Please Help!
[Android General] blakegriplingph:
OK, you mind if you contact me through Discord so I can better help you with your issue?
[Android General] junior2050:
Sure not a Problem, whats your Addy ?
[Android General] blakegriplingph:
huckleberrypie#1218
[Android General] blakegriplingph:
Just added links to the LeapPad Academy stock ROM in the first post; I'll upload the TWRP image to it asap.
[Android General] blakegriplingph:
Bootloader unlock and TWRP build for Lineage

Finally, here's a proper bootloader unlock for the Epic based on the stock LK and preloader. It's basically the same deal as the stock one that came with the device, except that it removes signature checks both on SP Flash Tool and upon booting.

The stock preloader checks for the presence of a "BFBF" signature which can be generated using an internal MediaTek commandline tool for Linux called "SignTool" whenever you flash something in SPFT, while the LK binary checks if these have been written in seccfg (not sure if it's just seccfg or both on secro and seccfg; someone please correct me on this one) every time the tablet boots. If the boot images' checksums match that of the ones in the signatures, the tablet boots, otherwise it's toast.

I did manage to work around this when I was first working on converting a demo unit to retail by taking advantage of a loophole where /system isn't actively checked for modifications - I modded the demo ROM by replacing apps and frameworks with retail equivalents, then flashed it back to the demo unit using the Write Memory feature in SP Flash Tool. Problem is that it's an inelegant, band-aid approach, and does not address the issue of bootloader security. Along came [MENTION=8132642]diplomatic[/MENTION] who helped with getting signed images to work on this thing all thanks to LeapFrog/Quanta's use of reference signature keys to sign factory ROMs, and it slowly paved the way for more development work to be done on this thing.

You can download them from the attachments below or these links:

https://www.strawberryforum.org/techknow/UYT_engineering_bootloader.zip

https://www.strawberryforum.org/techknow/recovery.img

To flash, fire up SP Flash Tool v5.1744 or later and open the scatter file from the zip after extracting the archive. Flash the preloader first (i.e. make sure only the preloader is ticked in the list), then do the same with uboot. Once that's done you may proceed to flashing TWRP by loading up the recovery image in SP Flash Tool or flashing it via fastboot - power on the Epic in fastboot mode by holding power and volume down until you see a "FASTBOOT MODE" text, then run fastboot flash recovery recovery.img and reboot. You'll only have to flash the unlocked bootloader once; subsequent Lineage/recovery installs should be just like with any other device.
[Android General] TheDeveloperDude95:
I heard there was an discord server for development for this device, any link
[Android General] DrPhant0m:
Update: The leapfrog epic guy has provided me with an update file 1.1.171... Anyone know if I flash this, will it wipe the tablet and the game and app progress will be erased? I have titanium backup, but have gotten mixed results for restoring apps on the epic tablet.

Still need to make sure that purchased apps can be installed after the update. (see issue with INSTALL greyed out below)

Any input? Thanks!

I followed the tutorials to install 1.1.95 on our 3 leapfrog epics to upgrade them to the academy edition.

Presently, there is a system update that we cannot install (I was hesitant, being aware of the dangers of updates on modded OSes). The epic reboots to TWRP, and it fails (I think it's error 7).

Is there a way to install the latest system update?

I wouldn't care, except I suspect not having the latest OS is preventing us from installing any apps in thr app manager. The list of apps we've purchased is there, but "Install" is greyed-out for every one.

I have cleared dalvik and cache in TWRP with no help.

Any other suggestions? My main goal is to install our missing apps.

Thanks!
[Android General] WW2021:
Hello, I'm new here, will this TWRP recovery work with the regular LeapFrog Epic? (it's not the Academy edition I'm talking about in this reply)
[Android General] blakegriplingph:
I think so, though you may want to flash the Academy Edition ROM first before flashing TWRP just to make sure.
[Android General] WW2021:
Well I can't seem to find the authorization BFBF signature file for LeapFrog Epic, nor the Signtool stuff for Linux.
[Android General] blakegriplingph:
What do you mean?
[Android General] C4RL0S81:
The hardware is so poor. My daughter loves the apps on it but i wish there was a way to port the epic software to better hardware. is this possible?
[Android General] Notto2:
I used the format option and now it’s not turning on I have tried to re flash the stock rom to no avail
[Android General] vutran4490:
Hi, I got problem with my leappad. It's continous restarting after the Leapfrog logo displaying.

How can I get through it since I cannot do anything?

Thanks for any helps.
[Android General] leon_733:
When I try to flash uboot, SP flash tool gives me this error. Previously I flashed the Academy edition on my regular epic. Then flashed the UYT preloader as said. Is there something I should do differently to make this work?
[Android General] blakegriplingph:
Hmm, that's strange. Did you flash the preloader first and ONLY the preloader?
[Android General] leon_733:
Yes, I followed the same steps on a different computer and had the same result. I assume this isn't a driver issue as SP detects the tablet fine on both PCs.

Previously I flashed a stock Academy edition rom (EPICv2_KOT49H.user.1.1.95.20171215.140555)

First I flashed only preloader from the UYT folder. I powered off the tablet, pressed Download in SP flash tool (with "download only" and only preloader selected. ) Held Volume Up and plugged in the tablet. SP detected it and flashes preloader with a green checkmark. Unpulgged the tablet. Then, I selected only uboot , pressed download, and plugged in the tablet with Volume up pressed. SP detects the tablet, then gives that error. I tried several times and get the same result.

My tablet's back label reads:

Model: 31576

FCC-ID: HFS-UYT

IC: 1787B-UYT
[Android General] blakegriplingph:
I'll have to look into that some time though as I've been busy lately. 'Tis strange you've been getting an issue with the supposedly unlocked bootloader.
[Android General] leon_733:
After several tries, I got uboot to install with SP tool version 5.1532. (green checkmark and no error message) It took battery pulls and unplugging and replugging the USB cable.
[Android General] WW2021:
Replying to @leon_733

Actually, that can cause a brick on the Epic like it did with mine.
[Android General] WW2021:
Also @blakegriplingph, I tried using Signtool, but it for some reason required the IMG_KEY.ini & IMG_CFG.ini files, and IDK where to find those, can you help me?
[Android General] blakegriplingph:
Try this version of SignTool:

https://www.strawberryforum.org/techknow/signtool.zip
[Android General] WW2021:
Hey, I am getting a Segmentation fault error with the UBOOT.bin file I got from the UYT_engineering_bootloader.zip file when I go to sign it with the tool provided, is there a way to fix it?
[Android General] blakegriplingph:
Hmm strange. Not sure why it's segfaulting when you tried to sign that image.

Would you mind if I invite you to the OpenLF Discord server so my friend can better help you regarding this?
[Android General] WW2021:
Sure Mr. Epic Guy. I would like to have help from this.
[Android General] blakegriplingph:
Alright, here's the server link: https://discord.gg/fQxa4Bh
[Android General] xxxxxxafewfwefe:
deleted message
[Android General] xAngel_Deathx:
could i get some help please :(
[Android General] blakegriplingph:
What kind of help?
[Android General] randomguy3356:
deleted
[Android General] randomguy3356:
Can you help me? Every time i try to flash something to the epic in spft it tells me ERROR: S_BROM_DOWNLOAD_DA_FAIL (0x7D4) [H/W] Fail to download DA to baseband chip's internal SRAM! [HINT]: 1. There's an cable communication problem between FlashTool and BootROM. 2. Target might be shutdown unexpectedly or target lost power supply. [ACTION] 1. Try again. 2. Proceed H/W checking in download cable and target side com port. 3. Monitor if power-drop occured in target side. It didn't do anything to my epic.
[Android General] blakegriplingph:
Did you try using a different cable or plugged it in a different port?

And make sure to DO A READBACK of ROM_0 first before flashing!
[Android General] randomguy3356:
Sorry but, im a noob with this stuff, i don't know how to do the readback thingy, it tells me start addres and length in hex. please help. Oh and i did try using another port and another cable, do i ned usb 3.0?
[Android General] blakegriplingph:
No, just a better cable and/or a known working USB port Doesn't matter if it's 2.0 or 3.0. And the guide to read back the ROM can be found here:

And I came in for another LeapFrog Epic post.

EDIT: Replaced download link with a fixed version as the previous one had a seemingly-intact yet broken boot.img that works fine at first ...

huckleberrypie57.blogspot.com
[Android General] randomguy3356:
Nope, dosen't work with another cable. Any tips?
[Android General] randomguy3356:
Im reading the info of the download mode and it says something about bb chip reset, what is that?
[Android General] blakegriplingph:
Ignore that. Just try it on another computer.
[Android General] randomguy3356:
Ok i'll tell you if anything happens
[Android General] randomguy3356:
Sorry for the insanely late reply, I managed to flash preloader but uboot gives me a signature error. Do I have to use signtool?

UPDATE: Fixed, I now have TWRP!
[Android General] blakegriplingph:
What were you trying to do anyway? The partition list doesn't appear to be complete.
[Android General] randomguy3356:
I was trying to flash uboot. Anyways, thank you very much for your hard work 😇
[Android General] blakegriplingph:
In order to unlock the bootloader? Or to flash the whole ROM?
[Android General] randomguy3356:
I was trying to unlock the bootloader.

Anyways, do you know how to root this LineageOS? And is there any other custom ROM?
[Android General] blakegriplingph:
Flash the preloader first, then flash uboot afterwards. Unfortunately I haven't had the time to continue with the Lineage project tho.
[Android General] randomguy3356:
Do you happen to have a stock SPFT flashable ROM?And how do I root this version of LineageOS
[Android General] blakegriplingph:
You mean the stock ROM? Try this one:

EPICv2_KOT49H.user.1.1.95.20171215.140555-v2.7z | by huckleberrypie for Epic

Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.

androidfilehost.com

Did you make a full backup of the ROM_0 as per the guide I put up on my blog tho?
[Android General] blakegriplingph:
So apparently LeapFrog quietly released a new revision of the Epic/LeapPad Academy, internally referred to as EPIC4:

http://lfcdownload.leapfrog.com/epic/en/NarniaSystemUpdateVersions_epic4.json

I did a quick DL of one of the OTA packages and they have a reference to rkloader.bin, indicating that they did switch over to a RockChip RK3326 system-on-chip for some reason.

EDIT: Confirmed by a friend of mine who sent me a picture of the new-revision LeapPad's logic board:

The FCC listing for it also shows the new board and Rockchip SOC: https://fccid.io/G2R-6022
[Android General] TripleLLLGaming:
hi, i'm new here and also pretty stupid, too. so, i got sp flash tool, and i loaded the scatter file. i haven't flashed the preloader yet, nor any other roms or firmware. does my leapfrog epic have to be turned on and in the recovery mode menu for it to flash software while it's connected via usb cable? or does it have to be off while connected via usb cable? thank you. ;-;

(sorry for the potential necropost)
[Android General] randomguy3356:
For me, it worked while the epic was off.
[Android General] TripleLLLGaming:
ah, ok. thank you ^_^

also, should the preloader take long to download? and should i format the system before flashing the preloader? (i'm wondering cuz i have data on it already)
[Android General] randomguy3356:
I think you shouldn't format, and it shouldn't take more than 2 or 3 minutes.
[Android General] blakegriplingph:
No, DON'T format your system. Not unless you made a complete readback of your device's EMMC which tbh you should do before you mess with anything.
[Android General] TripleLLLGaming:
ok, thanks! you saved me a lot of time lol

btw, can you help me with making a backup of the emmc? i've never really fiddled with rooting android stuff before, but i DO have the contents of the system memory on my computer. will that suffice or will i have to do something different to backup the emmc?
[Android General] TripleLLLGaming:
huh. last night i waited like 40 minutes and nothing happened. i loaded everything up correctly (to my knowledge) in sp flash tool, and i have my epic connected via usb to my laptop. what am i doing wrong, i'm kind of a noob at android stuff ;-;

(here's a picture of my epic tablet and sp flashtool setup)
[Android General] randomguy3356:
Check if it actually begins downloading, if not, I remember that it would not begin, but there was a specific SPF version that was mentioned here that worked for me it's SP flash tool version 5.1532.
[Android General] TripleLLLGaming:
ah, ok. i'll try that and see if it works

also, when it does download, does the progress bar move? or does that only occur while flashing? cuz im pretty sure it's not downloading but i wanna make sure
[Android General] TripleLLLGaming:
alright, so i've gotten 5.1532, and set up everything the same way, and it still doesn't download
[Android General] lost Sheep:
Pleas help my leapfrog wont turn on after flashing some mods
[Android General] randomguy3356:
What kind of mods?
[Android General] randomguy3356:
maybe try another usb cable or pc
[Android General] blakegriplingph:
Did you perform a ROM_0 backup first before doing anything?
[Android General] TripleLLLGaming:
alright
[Android General] blakegriplingph:
OK, I finally got my hands on the second-gen LeapPad Academy unit, and here are my findings:

Linus was right about the lack of Bluetooth as the wireless chip (which is a very obscure AltoBeam ATBM6011) was indeed only capable of wifi. Maybe VTech just threw in an existing Android TV box design and called it a day, or maybe they decided nobody cares about BT and used said wireless module to save costs, idk.

Treble is also supported, but given how VTech dummied out the ability to enable developer options and thus access ADB and fastboot I doubt this would be something of a walk in the park unless someone with far more skills than I have steps in.

The ability to set the lockscreen is still there, and they also sort of enabled android.software.home_screen which was disabled on the previous model. However, the option to set the default launcher is greyed out and since I am unable to have ADB access in order to disable both kids and parents' launchers, this is a pain to deal with.

Dumping the ROM is also out of the question, at least for now. A number of Rockchip devices have read-protection in uboot which deters people from making a readback of the device's firmware. This could be circumvented but I don't know of anyone else who owns an RK3326 LeapPad for testing purposes as I'm too chicken to risk bricking mine.

And here are some pics of the device in action:

The new revision is otherwise cosmetically identical, so cases for previous models should work fine.

Never heard of that chip before.

And here's the Treble Check app telling me I should be able to boot into a GSI.
[Android General] blakegriplingph:
So I managed to brick the RK3326 model for a while, i.e. no signs of life, no nothing. However since we're dealing with a Rockchip device here, it is still possible to force the tab into MASKROM mode which can be invoked with this:

Bridge the two points as shown using a pair of tweezers (ignore the UART points; I just marked them as such for illustration's sake), then while holding on to them tweezers plug the device into your PC and open RKDevTool. Load up the config files and the loader binary, then flash the stock partition files back to your device, in my case uboot.img. A little persuasion later and I managed to get the LeapPad back up and running:

Here's hoping VTech/LF won't end up removing those testpoints in subsequent board revisions tho lel.

Given the recent incident I am calling off on trying to rip the firmware until there's someone who also has the same model and is able to look into this better. It may be possible to patch uboot directly without unpacking it as the binary isn't apparently compressed, but I am too chicken to try that one out right now. Last thing I want to end up is getting anxious over $60 worth of a used kids tablet getting bricked just after a few days of abuse.
[Android General] blakegriplingph:
I was also able to get the Rockchip LeapPad to boot from an SD card by flashing a random RK3326 .img file to it using SDDiskTool. Of couse the tablet did not display anything as it was made for a different LCD controller, but I was able to at least get it to detect as an MTP device on my PC which seems to be a sign that the tablet did boot up somewhat.

If anything, this should make my life easier with getting custom firmware to boot on the Rockchip model, and even more so if we get our hands on the kernel sources.
[Android General] randomguy3356:
Do you know where I can find a non-academy edition rom?
[Android General] blakegriplingph:
Both the regular and Academy edition ROMs are essentially the same deal, hence why I didn't even bother uploading updated builds of the regular edition ROM.
[Android General] randomguy3356:
ok
[Android General] randomguy3356:
also, do you know how can i replace leapfrog apps (settings, calc, camera, gallery, etc) without manually changing every apk?
[Android General] blakegriplingph:
Not that I am aware of, short of making a completely custom ROM.
[Android General] blakegriplingph:
Stock firmware for the RK3326 LeapPad

After a month or so of waiting and prodding around, I've managed to dump the stock firmware off the Rockchip revision LeapPad Academy, version EPIC4.user.1.7.2109.312280833:

LeapPad Academy (RK3326) Stock Firmware : VTech Holdings Limited : Free Download, Borrow, and Streaming : Internet Archive

Firmware dumps taken from the LeapFrog LeapPad Academy stock ROM, specifically the Rockchip RK3326 hardware revision.I've included two versions of uboot.img on...

archive.org

EPIC4.user.1.7.2109.312280833.7z

drive.google.com

EPIC4.user.1.7.2109.312280833.7z | by huckleberrypie for Epic

Download GApps, Roms, Kernels, Themes, Firmware, and more. Free file hosting for all Android developers.

www.androidfilehost.com

The firmware can be flashed using RKDevTool 2.69 and later. I've only tested this on my unit which is a regular model instead of the so-called "MIPI" variant, so I have no guarantees if this will work on your LeapPad.

I have also included two uboot images in the package: the stock factory uboot based on the latest available OTA update, and a hacked one with the anti-dump code patched out. Make sure to flash back to stock uboot in case LeapFrog issues a new OTA update! Mad props to @pseudolobster and @RedScorpioXDA for the uboot hack discovery and imgRePackerRK, respectively, without which would make this effort impossible.
[Android General] blakegriplingph:
Aight, Magisk sort of works, and I was able to get alternative launchers to work without the default launchers interfering; the problem with Magisk is that wifi spazzes out and complains about something regarding HALs in logcat.

I was also able to boot into fastboot mode too. ;)
[Android General] blakegriplingph:
Android 14 GSI works more or less fine on the Rockchip model lel:

Most basic functionality works including camera and wifi, but performance and battery life leave a whole lot to be desired.
[Android General] rejul:
no
[Android General] rejul:
[ROCKCHIP] SOC TOOL KIT (NEW RKDEVTOOL KIT)

I Came across this new toolkit for RK chipsets It seems more better than RKDEVTOOL Support RK dev Mini/pico board

xdaforums.com
[Android General] rejul:
[removed]
[Android General] Rortiz2:
You basically used OUR sources to build TWRP. It boots, but it's not fully stable hence why we haven't released it yet. I suggest you delete that ZIP.​
[Android General] rejul:
Sure , for this I used the some source from git (which was fully open to use) , that was because after I made my own device tree but found more neat one (which i now came to realise it was yours) . So I want somebody to test it. My Original device was "Gener8" tab (I lost that one) , Apologise if my intention got misunderstood.
[Android General] rejul:
If I had known you are the original author , I would ask for advice to rectifying twrp for my own device (which now is useless) but to my surprise to find an exact similar to my device tree (but more neat) , since I believe we both generated it from "SebaUbuntu's TWRP device tree generator"
[Android General] blakegriplingph:
Regardless the tree isn't ready for prime time yet. It would have been great if you had a private group of testers evaluate it rather than have the thing run loose or something.
[Android General] rejul:
That is understandable. Personally , I thought I was doing that , by posting in this forum with people who willing test it out (clearly indicated ) and even enquired about current progress of twrp but got a negative ans, that was the reason I posted. But I won't Gone claim "OUR" source , since neither Android source , device source, twrp source are truly your's and we both know how TWRP (this one really made -currently). Since we used same process to make , both of twrp would be same . It would be exact duplicate , Only pending was final clean up in Device flags to make to look good or arranged . so when i found this tree ..just say it saved me some time . Even if you never uploaded , I would have gone done that with my tree , which would result opposite situation.
[Android General] blakegriplingph:
OK, fair enough.
[Android General] blakegriplingph:
OK, so quick PSA:

Apparently the ROM dump I made will NOT work on certain board revisions of the LeapPad Academy. If you have a board that looks like this:

DO NOT FLASH the ROM I dumped as this appears to be the "MIPI" hardware variant. I am not sure as to why VTech did this, but from what I can deduce this may be the ones with the same LCD type as the earlier MediaTek revision. @kingkwahli flashed my ROM dump onto his unit and ended up in a (currently) unrecoverable brick.
[Android General] kingkwahli:
can confirm lol
[Android General] Rortiz2:
Duplicate.
[Android General] Rortiz2:
I'm well aware that Android is open source, and I mentioned that it was our source because I checked the ramdisk and everything, including the device name/codename (even the brand), was 1:1 with our trees (and no, we haven’t used SebaUbuntu’s TWRP generator). What bothers me is that you posted that image in several threads without even crediting us. I have no problem with people building TWRP using these sources, but if you're going to share it (be it for testing purposes or something else), please at least credit us and post links to the source tree.​
[Android General] rejul:
Apologises, As I said that wan't my intention even if i used mine, it would look same.