i have paid 2000 rmb to the team who crack it.
successfully upgraded to 25hz
this is how it works:
they have a genuine 25hz one, read out the EPCS4N fpga config flash,
flash other device with the same S/N code rom.
then, they send me the android folder, so that first time it connect to my phone,
the app dont need to go online to download the factory calibration bin file, and use the calibration file for the device that 25hz rom came from.
========
now i only have a logic analyzer,
i sniff out the epcs4n's traffic (3ch),
but dont know how to encapsulate the raw logic file to flashable altera file.......