LeapFrog Epic

It's a LeapPad tablet, now with Android technology. Also, those games cost a ton.

Epic.

Unused Videos#

A bunch of MP4/3GP test videos were left dormant within KidLauncher.apk in /system/priv-app. They appear to be test or placeholder content, with two of them being a crudely-done music video for the song "Most Beautiful Girl" by Flight of the Conchords, most likely by either LeapFrog employees or the studio that was contracted to develop the Epic's user interface.

• Demo.mp4
• DemoH264.mp4

Revisional Differences#

Hardware#

To do: There exists a sub-variant of the second-generation LeapPad Academy internally referred to as MIPI. We need a firmware dump of it for comparison with the other sub-variant as firmware for the latter will not work on the former.

• On September 2015, the original Leapfrog Epic was released. It has a MediaTek MT8127 clocked at 1.3 GHz, and runs a customised Android 4.4 "KitKat" distribution. This hardware revision would be re-released as the Epic Academy Edition and LeapPad Academy with updated firmware and silicone bumpers.
• On August 2021, the second-generation LeapPad Academy was released, which features a slightly faster clock speed (1.5 GHz), a new Rockchip RK3326 system-on-chip as well as Android 10. The switch to a newer system-on-chip also made it compatible with Google's Project Treble, allowing generic system images (GSI) to be booted thus effectively converting it into an ordinary Android tablet.² Two sub-variants of the RK3326 model exist: one of them came with a touch panel with ten-point multitouch as well as a newer LCD screen with a wider pixel aspect ratio, while another had a different LCD module. Firmware for both models do not appear to be mutually compatible.

Demo vs. Retail#

To do: There are application stubs on the demo unit meant for demonstration purposes. It would be prudent to document most if not all of them. The preloader/bootloader also appears to be an earlier build as well.

The ROM used for store demo units has a smaller partition allocated to user data, around 4GB, unlike retail units which come with 9GB user-accessible storage. Contrary to what LeapFrog wants its users to believe, it is possible to convert a demo unit to a retail one using a dump of the ROM extracted from said demo device, a scatter file from a retail Epic, and a signed retail ROM.

- partition_index: SYS19
  partition_name: ANDROID
  file_name: system.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x5D00000
  physical_start_addr: 0x5D00000
  partition_size: 0x200100000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS20
  partition_name: CACHE
  file_name: cache.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x205E00000
  physical_start_addr: 0x205E00000
  partition_size: 0x40000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS21
  partition_name: USRDATA
  file_name: data.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x245E00000
  physical_start_addr: 0x245E00000
  partition_size: 0x13ED00000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS19
  partition_name: ANDROID
  file_name: system.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x5D00000
  physical_start_addr: 0x5D00000
  partition_size: 0xC0000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS20
  partition_name: CACHE
  file_name: cache.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0xC5D00000
  physical_start_addr: 0xC5D00000
  partition_size: 0x40000000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

- partition_index: SYS21
  partition_name: USRDATA
  file_name: data.img
  is_download: true
  type: EXT4_IMG
  linear_start_addr: 0x105D00000
  physical_start_addr: 0x105D00000
  partition_size: 0x28A300000
  region: EMMC_USER
  storage: HW_STORAGE_EMMC
  boundary_check: true
  is_reserved: false
  operation_type: UPDATE
  reserve: 0x00

Parent Mode Master Key#

Starting from Version 1.8.xx of the Academy Edition ROM and v1.9.88 of the regular Epic, the master key to open Parent Mode, 4-1-9-[backspace]-2-7, has been removed. The only other way to reset an Epic, short of phoning LeapFrog customer service, is to boot into Recovery Mode and use the Wipe Data option.

References#