459
edits
LeapFrog Epic: Difference between revisions
→Rockchip hardware revision (EPICv4; 2021)
| Line 100: | Line 100: | ||
===Rockchip hardware revision (EPICv4; 2021)=== | ===Rockchip hardware revision (EPICv4; 2021)=== | ||
LeapFrog also quietly released a hardware revision of the Epic circa 2021, replacing the MT8127 with a Rockchip RK3326. While this allowed LeapFrog to upgrade the included operating system to Android 10, it also means that the change in hardware rendered most hacks designed for the original Epic obsolete. | LeapFrog also [https://fccid.io/G2R-6022 quietly released a hardware revision] of the Epic circa 2021, replacing the MT8127 with a Rockchip RK3326. While this allowed LeapFrog to upgrade the included operating system to Android 10, it also means that the change in hardware rendered most hacks designed for the original Epic obsolete. | ||
VTech did their homework with the device and locked out most if not all entry points for hacking, such as ADB and development settings. Bizarrely enough they also dropped Bluetooth, replacing the wireless module with an obscure AltoBeam ATBM6011 wireless LAN controller. Ripping the firmware may also prove to be a challenge as the uboot binary that came with the device came with a deterrent which corrupts the dumped images past a certain point. To be fair this is hardly even unique to LeapFrog as the implementation by Rockchip themselves [https://gitlab.com/pgwipeout/u-boot-rockchip/-/blob/1b01cf5590f8d0b2270ffff5a656e38c5e3930ee/cmd/rockusb.c#L28 has this] until the [https://gitlab.com/pgwipeout/u-boot-rockchip/-/blob/6336d2324985831ed766031f91d410d0e587dbc8/cmd/rockusb.c latest commit]. It may be possible to patch out the offending instructions from the uboot binary though. Fortunately, it is possible to unbrick the LeapPad by forcing it to run in MASKROM mode through shorting two conveniently-located test points on the logic board just beside the eMMC chip; this however assumes that you have a ROM backup at hand. | VTech did their homework with the device and locked out most if not all entry points for hacking, such as ADB and development settings. Bizarrely enough they also dropped Bluetooth, replacing the wireless module with an obscure AltoBeam ATBM6011 wireless LAN controller. Ripping the firmware may also prove to be a challenge as the uboot binary that came with the device came with a deterrent which corrupts the dumped images past a certain point. To be fair this is hardly even unique to LeapFrog as the implementation by Rockchip themselves [https://gitlab.com/pgwipeout/u-boot-rockchip/-/blob/1b01cf5590f8d0b2270ffff5a656e38c5e3930ee/cmd/rockusb.c#L28 has this] until the [https://gitlab.com/pgwipeout/u-boot-rockchip/-/blob/6336d2324985831ed766031f91d410d0e587dbc8/cmd/rockusb.c latest commit]. It may be possible to patch out the offending instructions from the uboot binary though. Fortunately, it is possible to unbrick the LeapPad by forcing it to run in MASKROM mode through shorting two conveniently-located test points on the logic board just beside the eMMC chip; this however assumes that you have a ROM backup at hand. | ||
| Line 108: | Line 108: | ||
File:RK3326 LeapPad.jpg|The LeapPad in action. | File:RK3326 LeapPad.jpg|The LeapPad in action. | ||
File:RK3326 LeapPad internals.jpg|Internals | File:RK3326 LeapPad internals.jpg|Internals | ||
File:LeapPad Academy Treble compatibility.jpg|Good luck trying to boot a GSI on it tho. | |||
File:ATBM 6011.jpg|AltoBeam ATBM6011 wireless LAN module | File:ATBM 6011.jpg|AltoBeam ATBM6011 wireless LAN module | ||
File:RK3326 LeapPad MASKROM testpoints.jpg|Short those two pins beside the eMMC chip to boot into MASKROM mode. | File:RK3326 LeapPad MASKROM testpoints.jpg|Short those two pins beside the eMMC chip to boot into MASKROM mode. | ||
</gallery> | </gallery> | ||
[[Category:Android]] | [[Category:Android]] | ||