[Hardware Hacking General] xasmx:
Note that this post is being updated with new information as we figure things out.

This jailbreak should allow you to use the console like a normal Android tablet, install and run any software on it from the Play Store and sideload software as well as run the JRNY app. It does not root the device. We have tested it on Bowflex Velocore, but assume that it will most likely work on other new Bowflex products with an Android tablet that are locked into JRNY. While we believe things are working in general, it has not been extensively tested. We are releasing it early in hopes to get more people interested in improving it.

Follow these instructions at your own risk. Read through all of the instructions before deciding to follow through. Making modification to your device may cause it to stop working. It may also void your warranty.

The instructions were written after we had already jailbroken our bikes, so we didn't really have a way to test that they work exactly as documented on a locked bike. Some experimentation may be needed. Good luck!

Step 1: Reboot.

Step 2: On the Bowflex screen showing the serial number, rapidly tap on upper right corner until a menu appears.

Step 3: Select 'Manufacturing App'.

Step 4: Long press the home button at the back of the screen and wait for Google Assistant to pop up.

Step 5: Type 'settings' to Google assistant and hit enter.

Step 6: In settings, enable ADB debugging from: System - Developer Settings - USB debugging.

Step 7: Look up your ip address from Network settings.

Step 8: Using adb (from Android platform tools) on your Desktop (which needs to be connected to the same network as your Velocore):

adb connect <replace-with-velocore-ip-address-from-step-7>​

adb shell​

touch /sdcard/Pictures/nautilus​

am stopservice com.nautilus.nautiluslauncher/com.nautilus.nautiluslauncher.thirdparty.appmonitor.AppMonitorService​

settings put secure ntls_launcher_preference 0​

settings put secure navigationbar_switch 1​

settings put secure notification_switch 1​

settings put secure statusbar_switch 1​

settings put global ota_disable_automatic_update 1​

Step 9: In settings - apps, force-stop NautilusLauncher.

Step 10: In settings - apps, set Quickstep as the default home app. Otherwise NautilusLauncher will take over when you press the home button and undo the jailbreak.

At this point, a reboot should take you to the Android home screen instead of JRNY. For JRNY to be able to connect to the bike, some of the services in NautilusLauncher need to be running. Unfortunately, starting NautilusLauncher will undo the jailbreak. To get around that, use the following to automatically start NautilusLauncher at startup and perform a jailbreak:

Step 11: Install Tasker (costs $3.50)

Step 12: In Tasker, create a new Profile 'Event - System - Device Boot'. Add the following tasks to the profile:

Task 1: App - Launch App - NautilusLauncher

Task 2: Task - Wait, configuration: 30 seconds

Task 3: Code - ADB Wifi, configuration:

Command:

until appMonitor=$(dumpsys activity services AppMonitorService | grep "(nothing)"); do am stopservice com.nautilus.nautiluslauncher/com.nautilus.nautiluslauncher.thirdparty.appmonitor.AppMonitorService; sleep 1; done;​

settings put secure ntls_launcher_preference 0;​

settings put secure navigationbar_switch 1;​

settings put secure notification_switch 1;​

settings put secure statusbar_switch 1;​

settings put global ota_disable_automatic_update 1;​

settings put system screen_brightness 255;​

At this point one more problem remains. JRNY app has its own screen saver which turns the screen off after five minutes of inactivity. If you have some other app at the foreground, you'll soon notice that your screen turns black and you seemingly can only get forwards by rebooting. To solve this:

Step 13: In Tasker, create a new Profile 'Event - System - Device Boot'. Add the following tasks to the profile:

Task 1: Task - Wait, configuration: 50 ms

Task 2: Display - Display Brightness: 255

Task 3: Task - Goto, configuration: 1

At this point, a reboot takes you to the Android home screen. After a few seconds, Tasker will launch NautilusLauncher and you will be taken to JRNY. Once the tasker wait has finished, a jailbreak is done. Then, you can swipe off JRNY and NautilusLauncher and should be fully jailbroken.

Note that Bowflex pushes software updates to the bike automatically. It's possible that future updates will stop this jailbreak from working. To try to prevent this, we have uninstalled the nautilus_ota_client app as well as set the 'ota_disable_automatic_update' setting above. We haven't confirmed that these are effective to preventing updates. If you decide to uninstall the app and use the setting, consider the following:

You may not receive new updates to the software of the bike anymore.

In case you later decide that you want to get updates again, make sure to backup the apk before uninstalling!.

----------

Troubleshooting:

If your console takes a long time to boot, the jailbreak may try to execute too early. Try to increase the wait time.

Sometimes the launcher seems to restart itself before the jailbreak is completed. You might still get jailbroken on the second start, but if not, just reboot and try again.

Sometimes when escaping JRNY after the jailbreak, the background might show the Bowflex image. Not sure if it actually effects anything, but just in case, you can just reboot and try again.

Some people seem to have trouble with an automated jailbreak using the device boot Tasker profile (step 12). If you are experiencing this, a more manual approach might work better for you:

Remove the profile from step 12.

Instead, create a profile 'Event - Hardware - Volume Long Press'.

Add task 'Code - ADB Wifi' with the commands from the initial instructions.

Save.

Now, when you reboot, it'll take you to the Android home screen. Then, start the 'NautilusLauncher' app, which will take you to JRNY. Once in JRNY, long press the 'volume up' button behind the screen to manually perform the unlock.

Some people have had problem with step 10 (set Quickstep as default home app). You can try rebooting all the way to JRNY, then doing 'adb shell am stopservice com.nautilus.nautiluslauncher/com.nautilus.nautiluslauncher.thirdparty.appmonitor.AppMonitorService'. Then swiping up and going to settings, force-stopping NautilusLauncher and then setting Quickstep as the default home launcher app.

If the unlock doesn't work after the Tasker automation, you should still be able to connect using adb and execute the commands on adb shell to perform the unlock manually after which you can then edit your Tasker profile.

To view the bike data (burn rate, resistance) with 3rd party applications (full screen):

Start a JRNY workout with entertainment feature available. Manual workout under programs works well.

Choose any of the entertainment app options (ie Netflix) and start workout.

Swipe entertainment app to the side and open the 3rd party application you'd like to use

Use Peloton app (or other apps (with Zwift, use the workout with Zwift program instead)) while showing cadence, resistance and heart rate (split-screen):

Start JRNY app

Go back to the home screen.

Start Peloton app

Swipe up to the side-by-side app selector.

Long press the Peloton icon and select split-screen. This splits the screen to left and right, with left part running Peloton.

Click JRNY app on the right part of screen.

Adjust the screen divider so that Peloton app takes 2/3rds of the screen.

Select programs - work out with Peloton on JRNY and click start workout.

Select your program in the peloton app.

You can have your heart rate monitor synced either to the Peloton app or the JRNY app via the normal heart rate monitor options of the apps.

To get Zwift working on the bike:

Install xapk manager from https://apkfab.com/xapk-manager/com.apkfab.installer/download

Download zwift from https://m.apkpure.com/zwift/com.zwift.zwiftgame

Install

To run, start JRNY and have the workout with Zwift program running. After that switch to Zwift and it'll see the data from the bike.

It looks like getting the bike to send data to Zwift is a bit trickier than I originally thought. Sometimes it's easy to get the link to work. Other times, not so much. Figuring out how you can use Zwift consistently still needs some more work.

The bike console is a bit underpowered for Zwift graphics, so also experimenting with remote desktop type apps to have Zwift running on a laptop while the screen is shown on the bike console with smoother graphics. So far have had some good results with cast receiver / chrome cast. But it is only one way, so while you can see the screen, you can't control it.

----------

Some random notes for anyone interested in helping and improving the jailbreak:

Before starting to hack around, I strongly recommend that you back up all of the custom nautilus software apks so that you have some way of reinstalling them later if required.

adb via usb

If you open the back of the screen, there is a micro usb slot on the motherboard that can used to connect adb.

As you can connect adb via wifi, not sure if this is really needed for anything.

adb reboot recovery

Reboots, takes you to a screen saying 'erasing' and in the end you end up on a standard android tablet setup screen with all custom software (including the bowflex software) erased.

adb reboot bootloader (my personal experience with this):

Rebooted, got to the 'powered by android' screen, but seemed to be stuck there.

Tried a bunch of key presses at the back of the screen. With some of them pressed, the console playd a sound effect, but wasn't able to get forwards from the screen.

For a while thought that i had bricked the console. Unplugged it for half an hour and when i came back and plugged it back it, it booted again.

factory reset

Unplug the bike.

Hold the top button (which looks like a disk/arrow).

Plug back in.

Release the button once you see a while box blip that says applying golden image.

NOTE: I wasn't able to get this to work after erasing the device with 'adb reboot recovery', which probably means that it only works as long as NautilusLauncher is installed.

serial port

The bike connects to the console via a serial port. The device entry for it is /dev/ttyS4.

Only system/root has access to the device, which is why we need NautilusLauncher running to get JRNY to connect to the bike.

NautilusLauncher has a service called SerialPortService, which basically forwards input and output from and to the serial port to tcp:9999.

JRNY app connects to the serial port via the tcp port.

It might be interesting to make an app that connects to tcp:9999 to listen to the bike, e.g. for a custom HUD.

JRNY

Doesn't require system privileges unlike the other bowflex apps.

You can unpack the apk, make changes to it (such as disabling the screen saver and connecting to a different tcp port to connect to the bike), repack and sign it with our own key and have it successfully installed and ran. While the bike connectivity works after doing this, the app seems to have problems, e.g. if trying to bring up the overlay or start with workout with zwift program. Hoping that these can be fixed over time.

"/sdcard/Pictures/nautilus"

The existance of this file controls if NautilusLauncher disables adb debugging upon startup.

modifying JRNY

unpack: apktool d Bowflex_base.apk

...make changes...

repack: apktool b Bowflex_base -o Bowflex_edited.apk

create your own signing key: keytool -genkey -v -keystore my-apk-hack-key.keystore -keyalg RSA -keysize 2048 -validity 10000

sign the modified apk: jarsigner -verbose -sigalg MD5withRSA -digestalg SHA1 -keystore my-apk-hack-key.keystore Bowflex_edited.apk mykey

disable JRNY screen saver by modifying JRNY apk:

edit smali/com/nautilus/bowflex/managers/ScreenDimmingManager.smali

change 'getDimmingEnabled' method to:

.method public static final synthetic access$getDimmingEnabled$p(Lcom/nautilus/bowflex/managers/ScreenDimmingManager;)Z

.locals 0

const/4 p0, 0x0

return p0

.end method

over-the-air updates

Bowflex pushes new updates to the console. It's possible that one of these future updates will cause this jailbreak to stop working.

To prevent that, we have uninstalled the nautilus_ota_client app, as well use the setting 'settings put global ota_disable_automatic_update 1'.

We haven't really looked into the updating process, so not completely sure that the above will actually prevent them.

In future, we are hoping to be able to pull the updated apks from somewhere and perform the updates manually. Meanwhile, you can just keep using the current versions of the software.

There is a file that (we assume) contains the credentials for the ota updates. This may be helpful in pulling the updated apks / firmware manually in future: /sdcard/Nautilus/redbend/Credentials.txt

secret menus

In the Bowflex screen showing the serial number

Rapidly click on top right corner to bring up their super secret menu.

Rapidly click on top left corner to bring up the current firmware version number.

Rapidly click on bottom left corner to bring up their secret menu.

In the jrny app login screen:

Rapidly click on top right corner to bring up their advanced features menu.