NORDICTRACK ELITE 9500 PRO Treadmill w/ 10" Android Tablet

Search This thread

ftsur

Senior Member
Jan 28, 2014
50
2
I got in. Turned on USB debugging... Can load apps but sadly Netflix won't run. Maybe root? Need to extract the iFit apps just in case.

Sent from my Moto Z (2) using Tapatalk

Great thread, thanks to everyone for all the info!
@chuck1026, how did you get in to settings?? I am able to get to the background like you show in your pic, but can't get any further. I would LOVE to know how you did it!

Thanks!
 

chuck1026

Senior Member
Sep 15, 2013
96
10
Syracuse
Great thread, thanks to everyone for all the info!

@chuck1026, how did you get in to settings?? I am able to get to the background like you show in your pic, but can't get any further. I would LOVE to know how you did it!

Thanks!
Power up the treadmill and immediately swipe up from the bottom center of the screen. The Lollipop icons will appear. If if it tries to open swipe it off to the right. Resume your mission to get to settings to change USB debugging and then security to allow unknown sources.

Sent from my Moto Z (2) using Tapatalk
 

RyeBrye

Member
Oct 30, 2008
49
6
So it turns out on the newest ones there's a very easy easy to get into it.

Go to the settings mode, go to maintenance - then in the spot below the options there is a bunch of grey space.

Tap the same spot 10 times.
Wait 5-7 seconds
Tap the same spot 10 more times.

It will then pop up that "privileged mode is enabled"

When you enable it, you can drag down from the top and get access to the menu bar and go into android settings. You can also swipe up from the bottom and get to the default apps - it has a browser, camera, ifit admin, and the ifit cardio.

USB debugging was already enabled for me as was unknown sources - I'm not sure if that's because I activated privileged mode or not.

You can pair Bluetooth devices with it from the settings - I think it only works to send OUT sounds - it would be nice if you could connect audio to it via Bluetooth (they added that in the latest models, mind still just has aux in)

Sent from my Pixel 2 XL using Tapatalk
 

RyeBrye

Member
Oct 30, 2008
49
6
Ok, it gets _even better_

after running nmap on my device's IP address, I saw it had 3 ports opened... 5009, 5555, 5000...

On a hunch, I decided to check if 5555 was setup for ADB in tcp mode... turns out it is.

`adb connect #.#.#.#:5555` (where the #'s are the IP address) works like a charm.

then `adb shell` - comes back with a _root shell_

`|root@byt_t_crv2:/ # `

I'm sure 5555 was open before I did the tapping-on-the-window thing, so it looks like these things _ship_ with TCP ADB enabled into a root shell for you.
 

michaelF86

New member
Apr 16, 2019
2
1
This worked on my x22i commercial and was able to enter privileged mode. When I was trying to install Zwift from the Google Play store the treadmill restarted. Anyone know what can be done from here as far as "jailbreaking" goes?

Also in the settings it shows ethernet, does this thing have an RJ45 hiding under the plastic shell somewhere? Would be nice to hardwire it to the router.

Cheers,
Michael
 
  • Like
Reactions: BRANDENDEUCE

chuck1026

Senior Member
Sep 15, 2013
96
10
Syracuse
This worked on my x22i commercial and was able to enter privileged mode. When I was trying to install Zwift from the Google Play store the treadmill restarted. Anyone know what can be done from here as far as "jailbreaking" goes?

Also in the settings it shows ethernet, does this thing have an RJ45 hiding under the plastic shell somewhere? Would be nice to hardwire it to the router.

Cheers,
Michael
I have a 2018 2950 commercial and can't get a USB to Ethernet adapter to work.

Sent from my moto z3 using Tapatalk
 

michaelF86

New member
Apr 16, 2019
2
1
I have a 2018 2950 commercial and can't get a USB to Ethernet adapter to work.

Sent from my moto z3 using Tapatalk

same on my 2018 x22i, the transmit and receive lights are active but doesn't seem to actually connect. Halfway tempted to take the screws out of the console and see if there's a hidden ethernet adapter somewhere.
 

txotx

New member
May 28, 2019
1
1
Howdy,
I have a brand new x22i and apparently they still only connect to 2.4GHz wifi networks (ugh). I live in the middle of Manhattan where that frequency is flooded with a lot of interference, so I'm struggling with video buffering for the cloud-based workouts. If anyone has figured out how to increase the speed (or even better hardwire the tread -- any luck with USB-to-ethernet?), I'd love to hear about it.
Cheers!
 
  • Like
Reactions: chuck1026

DaiC1

Senior Member
This worked on my x22i commercial and was able to enter privileged mode. When I was trying to install Zwift from the Google Play store the treadmill restarted. Anyone know what can be done from here as far as "jailbreaking" goes?

Also in the settings it shows ethernet, does this thing have an RJ45 hiding under the plastic shell somewhere? Would be nice to hardwire it to the router.

Cheers,
Michael

Yea its a shame that development of this halted I was hoping to install the Less Mills app on the S22i.
 
  • Like
Reactions: BRANDENDEUCE

guyfromSF

New member
Jun 6, 2019
2
1
How do i go about rooting this tablet? I followed your steps and got into privileged mode. Before i do any changes, want to backup the ROM. But somehow cant seem to root it. Have tried kingoroot and lots of other software, but cant seem to get through. I cant seem to get the adb connect working either... Any ideas?


Ok, it gets _even better_

after running nmap on my device's IP address, I saw it had 3 ports opened... 5009, 5555, 5000...

On a hunch, I decided to check if 5555 was setup for ADB in tcp mode... turns out it is.

`adb connect #.#.#.#:5555` (where the #'s are the IP address) works like a charm.

then `adb shell` - comes back with a _root shell_

`|root@byt_t_crv2:/ # `

I'm sure 5555 was open before I did the tapping-on-the-window thing, so it looks like these things _ship_ with TCP ADB enabled into a root shell for you.
 

chuck1026

Senior Member
Sep 15, 2013
96
10
Syracuse
Nice to see this alive again. Has anyone found an Ethernet Port by opening up the tablet? The 2.4GHz WiFi is really a problem for cloud workouts. Also, the HDMI port doesn't seem to work either.

Sent from my moto z3 using Tapatalk
 

guyfromSF

New member
Jun 6, 2019
2
1
I didn't have to open the tablet. The ethernet port is at the back of the tablet and it works. So does the hdmi port. Both work once you get pprivileged mode. I was also able to root the device using Kingroot via PC.

Now need to take a backup of the firmware and modify the elliptical tablet to use on Proform Tour de France bike using Zwift or Peleton app. That way theZwift or Peleton app can control the bike.


Nice to see this alive again. Has anyone found an Ethernet Port by opening up the tablet? The 2.4GHz WiFi is really a problem for cloud workouts. Also, the HDMI port doesn't seem to work either.

Sent from my moto z3 using Tapatalk
 
  • Like
Reactions: chuck1026

chuck1026

Senior Member
Sep 15, 2013
96
10
Syracuse
I didn't have to open the tablet. The ethernet port is at the back of the tablet and it works. So does the hdmi port. Both work once you get pprivileged mode. I was also able to root the device using Kingroot via PC.



Now need to take a backup of the firmware and modify the elliptical tablet to use on Proform Tour de France bike using Zwift or Peleton app. That way theZwift or Peleton app can control the bike.
Looking at my 22 inch tablet.... No Ethernet Port on the external visible areas. I do see HDMI. I do have privileged mode enabled but still HDMI isn't working. I've tried with a known good cable.

Sent from my moto z3 using Tapatalk
 

chuck1026

Senior Member
Sep 15, 2013
96
10
Syracuse
Hello all... I need some help with rooting my 22 inch console on my 2017 Nordictrack 2950 Commercial. Has anyone done so and unlocked the USB so it can support a USB to ethernet dongle? That is my goal because my neighbor(s) - example - one has like 10 2.4GHz cameras and routers for some reason and he has crippled my treadmill - even with me moving the wifi access point directly next to the console! HELP!!!
 

kzoojason76

Member
Jan 9, 2008
18
4
Hello everyone!! My wife and I just purchased the 2019 Commercial 1750. We would like to mirror the display to a larger TV. I was able to access "privileged mode" and get into the settings for Cast. However, for some reason, it won't detect the Chromecast that we have attached to the TV. I was thinking about sideloading the Google Home app to see if that would be able to see it.

Any thoughts?
 

chuck1026

Senior Member
Sep 15, 2013
96
10
Syracuse
Hello everyone!! My wife and I just purchased the 2019 Commercial 1750. We would like to mirror the display to a larger TV. I was able to access "privileged mode" and get into the settings for Cast. However, for some reason, it won't detect the Chromecast that we have attached to the TV. I was thinking about sideloading the Google Home app to see if that would be able to see it.

Any thoughts?

My 2017 2950 has a HDMI out that doesn't work... I need to try one more time with a shorter HDMI cable...

As for casting, I haven't tried but I like the concept. I do have privileged mode enabled... I think there's something more to casting that may still be locked out without root? Wish I knew more but I nearly bricked the treadmill a while back playing around with the OS.....
 

Top Liked Posts

  • There are no posts matching your filters.
  • 4
    So it turns out on the newest ones there's a very easy easy to get into it.

    Go to the settings mode, go to maintenance - then in the spot below the options there is a bunch of grey space.

    Tap the same spot 10 times.
    Wait 5-7 seconds
    Tap the same spot 10 more times.

    It will then pop up that "privileged mode is enabled"

    When you enable it, you can drag down from the top and get access to the menu bar and go into android settings. You can also swipe up from the bottom and get to the default apps - it has a browser, camera, ifit admin, and the ifit cardio.

    USB debugging was already enabled for me as was unknown sources - I'm not sure if that's because I activated privileged mode or not.

    You can pair Bluetooth devices with it from the settings - I think it only works to send OUT sounds - it would be nice if you could connect audio to it via Bluetooth (they added that in the latest models, mind still just has aux in)

    Sent from my Pixel 2 XL using Tapatalk
    2
    Ok, it gets _even better_

    after running nmap on my device's IP address, I saw it had 3 ports opened... 5009, 5555, 5000...

    On a hunch, I decided to check if 5555 was setup for ADB in tcp mode... turns out it is.

    `adb connect #.#.#.#:5555` (where the #'s are the IP address) works like a charm.

    then `adb shell` - comes back with a _root shell_

    `|root@byt_t_crv2:/ # `

    I'm sure 5555 was open before I did the tapping-on-the-window thing, so it looks like these things _ship_ with TCP ADB enabled into a root shell for you.
    2
    Got me a brand new NordicTrack Elliptical Commercial 14.9 (NTEL71517). Followed instructions, installed Smart Taskbar. Big thanks to whomever discovered this hack! Currently looking to tweak some of the built-in workout routines. Looks like they're all hosted on s3.amazonaws.com. I am guessing, however, that they should be downloaded/cached somewhere locally, as I cannot imagine one needs an internet connection to do one's workout. Any idea where these might be hosted locally?

    Anyway, thank you all for your pioneering work! Someone should post a quick tutorial in the OP with steps on how to hack this machine. Here's a beginning:
    1. Turn on machine.
    2. Once you see ANDROID appear in the center of the screen, hold the menu button pressed ("the dashes button that is between the home and back buttons on the console") until you see "Unable to load widget" on the screen. This launches safe mode, hence bypasses the loading of the iFit application that steals focus.
    3. Go to settings, and enable side loading.
    4. Launch browser and download Smart Taskbar (or plug in a USB dongle containing the Smart Taskbar apk file to the USB port).
    5. Install Smart Taskbar.
    6. Reboot after installing Smart Taskbar.
    7. Allow normal boot up, no safe mode required. You'll notice the trademark Smart Taskbar arrow on the screen. Launch Smart Taskbar. You're in. Feel free to kill the iFit process to restore Android desktop.
    8. Next: root (how?) + install apps to USB dongle (how?). Someone else, please detail these steps.

    Many thanks again!
    2
    Sorry for resurrecting a zombie thread but I just wanted to say thanks.

    My brand new X9i incline trainer is a whole lot more fun now. I got the Smart task bar installed. I just got Kindle up and running which was my primary reason for doing this. Next, maybe gapps to get Google music to stream? And maybe Nexflix and Amazon Video so wifey can watch her shows. More tinkering tomorrow.

    Thanks guys!
    2
    I bought a Freemotion 770 treadmill last week and upon setting it up, I came to realize that I can't access the Android desktop. I called ICON Fitness, (they own Nordic Trac, Freemotion and a plethora of other names), and after the rude customer "service" monkey registers my new machine, I ask her about how I can get to the desktop. She tells me to tap on the "gears" to change what I need to change. I again, tell her I'm trying to access the desktop. She tells me that I need to sign up for an ifit account before I can access the android desktop. :silly:

    I start asking her how registering with an ifit account will allow me to get to the desktop. She of course has no clear answer. Again, tell her that I am trying to NOT use ifit and this is why I'm trying to stop it from loading (a little lie, but eh).

    Then she tells me to "hit the little globe". I was surprised at how she knew I had a globe on my desk, but I hit it. It flew across the computer desk and I said "ok, I hit the globe, now what?"... silence on her end. I then said "What does the "globe" have to do with the android desktop? That's just the web browser... silence... She then tells me she has to put me on hold.

    She comes back a few minutes later and AGAIN, she tries to tell me to "hit the gears if I want to calibrate the incline"... HUH? Once I realized I was getting nowhere, I finally asked her if she was in the retarded section of the call center. I then told her I wanted to speak with a supervisor. She tells me that I would have to call back. I asked her "Why, doesn't the retarded CS section you're in have a supervisor?"

    We go a few more rounds and she finally tells me "There is no way to do that". I told her to forget it, I'll just find the info on the Internet. She tells me that she will note the serial number and void the warranty because I told her I was going to modify the treadmill. I told her to go right on ahead, I actually happen to have a good friend who is a Consumer Product attorney in Utah (These clowns are based out of Logan UT). I then bid her a good day and sincerely hoped she would do something to improve her brain cell count because as it stood, it was quite low. It seemed to be less than my 5 brain cells.

    Anyways, now I've got it rooted and installed smart task bar. I can now access the Android Desktop through the Smart task bar app. Thanks to the people who suggested the apps.

    adsbar - Alan, install the z4root and task bar app mentioned on page 2 while in safe mode. Then, reboot the treadmill and let it load ifit. You will notice a little arrow on the side on the screen. Tap it and viola! you will see your app menu. I haven't played with it much past that aside from verifying root and installing Root Explorer.

    What a useless story that contributes nothing to the thread, but shows us all that you think you are pretty tough because you can call someone that didn't understand the intricacies of hacking Android a retard. I hope no one ever treats you the same way you treated this person. Let me be the first to say I am not impressed.