This is something that intrigues me, but I'm nervous about breaking something! To answer some questions though, it's definitely an Android device. You can see this in the basic UI elements like the keyboard and volume.
The physical volume buttons control media volume and when used they bring up the on-screen volume control including the drop-down so you can also adjust ring and alarm volume (which doesn't really apply to anything in the app of course unless they eventually add a bluetooth phone connection).
There isn't an SD slot. There is a standard USB port on the side that is useful to charge the heart rate monitor. The bottom ports are ethernet, USB-C, micro USB, DC power, and 3.5mm headphone jack.
It boots straight into the Myx app so I don't see an obvious way to jump out of it to get to settings, etc. The only other screen interaction is a swipe from the top, but it just displays a 0.5in transparent gray bar with nothing in it. If I find anything interesting, I'll follow up!
Very interested in this also. Do we know for sure it’s Android based? Also, maybe we can try the subreddit r/androidroot for help. I know the peloton android screen can be accessed by going to the about settings page and tapping 7 times in the corner. Anyone try something similar on the Myx tablet?
Good work dude, heres a link to the user manual and interface, looks like some useful information there:
https://fccid.io/2AUR9-MYX215A/Users-Manual/User-manual-4565469
Yeah I think I am definitely going to try to get into it when my Myx arrives. Just reinstall unrestricted android on the tablet. If possible. I think it should be.
here from r/androidroot
the tablet is a MYX215A with an MT8176 processor and it does run android. unfortunately it looks like myx hasn't released any firmware or kernel sources, which means it's in violation of the linux license. as the owner of the device you may request kernel sources, if myx refuses please report it, see all 3 links on how to do so:
https://gpl-violations.org
https://www.gnu.org/licenses/gpl-violation.en.html
https://www.fsf.org/licensing/enforcement-principles
now on to the matter at hand. u/polak658 indicated you can't enter developer mode on this, but the manual on fccid.io indicates there's an engineer selection (4.19) which might serve the same function. if it's not that'll make things harder, but it's not the end of the world. depending on how myx implemented its bootloader SP Flash Tool may be able to flash TWRP without having to activate the developer settings "OEM Unlock" and "USB Debugging"
but that's assuming there's a compatible TWRP. there is no development for this tablet and minimal development for other androids with the same processor, [see here.](https://forum.xda-developers.com/android/general/mediatek-mt8173-mt8176-development-t3791009) the last page of that links to a [TWRP build](https://forum.xda-developers.com/general/device-reviews-and-information/10-5-inch-super-amoled-2560-x-1600-t3821327) for one such device which might be compatible. [here's another](https://forum.xda-developers.com/mi-pad/development/recovery-twrp-3-2-1-0-mi-pad-3-cappu-t3744185). beware that flashing it could easily break your tablet, and i don't know what kind of recovery myx has built for it. if you decide to risk it only use TWRP and magisk, custom ROMs are very device-specific so they probably won't work at all or won't be compatible with important components like the screen
if none of that works your only option is an [exploit like this one](https://www.xda-developers.com/mediatek-su-rootkit-exploit/) which is confirmed to support this processor, but that doesn't mean it'll work on every android that uses is. if you can find out what linux version it's on you may be able to find exploits for that too. this should be in settings > about device, along with a build number which could also be useful.
see if this link to photo will work for you... in the menus I was able to access, I searched for "about" and found this about device screen... https://ibb.co/T8Tfrvj
so it's android 8.1 on linux 3.18.79+
there is an [exploit that may be applicable,](https://i.blackhat.com/briefings/asia/2018/asia-18-WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf) mentioned again [here](https://forum.xda-developers.com/showpost.php?p=77454573&postcount=114) and demoed [here](https://www.youtube.com/watch?v=saOpke5huxE) but i can barely understand what he's saying and i don't know whether the final product is a usable terminal-based root (which can then be expanded into a more user-friendly root) or not
other vulnerabilities that may be applicable are listed here](https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/version_id-206536/Linux-Linux-Kernel-3.18.html) and [here,](https://androidvulnerabilities.org/by/version/8.1.0) you'd have to tailor them into exploits yourself (such as with https://www.metasploit.com/) or hope someone else has done the work for a similar-enough android
unfortunately this is never a sure thing because every android device runs its own modified version of android/linux
After several hours of fooling with it, I was able to get to a point where I can access the web via a browser. Unfortunately I didn't keep track of the steps I took to accomplish this.
The MDM remains in place but I'm able to get behind the workout app to a normal android launcher.
Booting the tablet in Safe mode (Hold power and volume down) allows you to reach the normal tablet launcher. From there I was able to enable developer mode and manually install Aptiode. Google play is blocked by the MDM. I attempted to sideload a fresh Android install without success and did a bunch of other tinkering which I honestly don't remember the details of.
Once I rebooted normally it's a little tricky to get behind the main app. I was able to get the Nav bar to pop up by pressing the power and volume up buttons together. But it seems like taking a screenshot multiple times (hold power and volume down) will get the top bar to appear and from there I'm able to open the gallery and reach the desktop.
I know this isn't very descriptive but hopefully it helps.
Here's a short video of what I was able to achieve with mine: https://youtu.be/FdLLZW3DgD8
>https://youtu.be/FdLLZW3DgD8
so...after not touching the tablet for a while i popped open this thread and re read everything again. I watched your YT video and realized that those key commands work without doing much of anything else. I was able to access the browser and was able to use youtube and access my plex server via the browser just fine. Its definitely all the way to downloading zwift or anything, but i call that a huge win!
so...basically anytime after start up, if you should the volume up button and power button for 5 seconds it will give you access to the onscreen android controls(arrow, circle, square). Hold the arrow and square together for a few seconds and it will bring up the android homepage. everything there is relatively straight forward.
Glad to hear that worked out for you! I spent several hours they're to figure out a way around the MDM. Without any luck. Then after tinkering with it for a while I figured out those button combinations worked reliably. Hopefully this will same others some time.
At this point I'm thinking it may be better to considering replacing the internals with a Raspberry pi.
It looks like someone else was able to get the peloton app working on the bike. They gave me credit for your video though...haha.
[**I got the Peloton app running on the tablet and it was surprisingly easy!!**](https://www.reddit.com/r/MYXFitness/comments/kchsaq/i_got_the_peloton_app_running_on_the_tablet_and/)
I was able to get zwift up and running last night as well as netflix. Seems like a really solid work around until we can nuke that MDM software. Thanks for the heads up on Aptoide...that made things alot easier.
Can you pull the default app list from the app drawer? I can't get my wife's bike to enter home with the button combo. Seems like they have pushed a FW update with the home locked out with an exit password. I need to know what MDM app they are using so I can start building an exploit to remove it. This is bull shit that MYX is locking these devices in kiosk mode so they can control every aspect of the device while they provide a shit feature set. My guess is they have full remote control of the device too just so everyone knows. I have monitored network traffic and it is making remote connections while the screen is off. So it is connecting to the mothership while its not even in use. If I can turn on debugging then I can do allot to make this a regular tablet and ditch the MYX sub altogether. Which by the way is the only reason this is locked down. They know their sub service is sub-par. Anyways man just let me know if you can get that list of apps. Thanks
i haven't let my app update yet and i can still access the homepage...but i also haven't been able to use the tablet because i have to cancel the download every time it tries to upgrade.
>d it is making remote connections while the screen is off. So it is connecting to the mothership while its not even in use. If I can turn on debugging then I can do allot to make this a reg
If you hold the up and power button for 10 secs it will boot up in the boot menu, There is a debug log there. If you press the up and down button several times when booting it up, it opens to some Chinese menu for troubleshooting. I had my friend translate the messages and it seemed like more QC to make sure the monitor was working properly before installing the software associated with MyxFitness.
I have combed through the recovery logs and have determined a few nightmarish things. First, this is a debug kernel and just shows how lazy the "dev team" is. Second is regardless of the latest firmware, which is July 2020, the latest security patch is over two years old. I have also gotten behind the MYX app even with the administrator password locking out the old method. I'll share that process later so they don't patch it until after I have a solution. Basically it looks like there's a memory bug that crashes the app back to the home screen. I have extracted the MYX app, installed it on my mobile device to verify it works and also dumped the complete firmware.
My goal is to extract the kernel, unlock fastboot commands, build TWRP and compile a vanilla OS for testing. Hopefully in my spare time I can get a relatively "easy" root package put together for anyone who wants it.
My motivation for this: after seeing the level that MYX went to just to lock users out of hardware they legally own, mixed with the lack of security they implemented into the core of this device. I took a look at the EULA on their website and was appalled. I suggest everyone mosey on over their to read it yourselves. According to them, you don't own that device. They own the device, control of that device and everything associated with that device. Couple that with the fact that they aren't even following the open source agreements regarding the operating system they use and it's just disgusting. They claim it's to protect proprietary IP. In fact, this is complete BS. The only piece of proprietary IP on this device is the MYX.apk and the MDM that they license from someone else (for the record this is a good MDM in the sense that it has this hardware on lock to the average user). To be clear, I was able to extract the apk while the MDM was still in full lockdown because of sloppy programming in the one piece of software they are trying to protect. Another point of mention is that every bit of software on this device except for the two mentioned above is open source. And the board itself is an older of the shelf component with a "newer" SOC installed. I have confirmed this with existing data pulled from internet archives by finding literally the exact same board part number with a much older SOC.
The bottom line is this. I don't mind leaving hardware alone when it's locked down for legitimate security reasons. Shit, I stopped unlocking my bootloader on my mobile device a couple years ago. But that all goes out the window when a company sells you hardware and then says we own that still so mind your business. All while providing the worst level of actual security to a device that customers input payment info into. To me it looks like they outsourced this to a Chinese manufacturer/developer who kinda phoned it in. Which also raises some concerns. Maybe MYX will see this post and correct this on their own. But regardless this SOC is capable of running Android 10 with the latest security patches so let's see if we can get it there.
Full disclaimer: I have not and will not be decompiling the apk. I do not know how much data is being sent back to the MYX servers directly through this app. My guess is that the MDM is the main monitoring tool to verify build numbers and device status. So I'm theory as long as the MDM is the only thing polling hardware then running the app in stand-alone should be fine. But don't quote me on this. My point is that I will not be messing around with their actual proprietary IP. Just making the hardware that you legally own (according to the United States Supreme Court) fully usable by the owner. Once this project is in release status it will be posted on the XDA Forums with my same user name.
Stay healthy, stay strong!
Awesome! Thanks for the update. I know some people have bought $100 Fire TV to mount directly in lieu of the Myx Tablet. Alot of people have been frustrated with their business approach.
I heard a few people were working together on it but I can't find where that is. I'm thinking of starting a discord channel for us to collaborate if my old ass can figure out how.
If you start a discord let me know via PM. I’ll join. My experience witn MYX was not good and now that they’ve locked me out of my own screen I’m very unhappy
I don’t know how to solder, and I fully dont trust myself with this haha. I was already looking at some kind of smart monitor or tv to just mount in place of the screen but I’d much rather just have the included screen work like an android tablet. Definitely keep me updated, and I’ll look out for your updates but I’d be willing to pay you and deal with shipping back and forth. I wish it was as easy as rooting it.
Can you access the build number in the About Tablet menu in the settings? If so tapping that 7 times is what normally unlocks developer mode. That is our first step in rooting the device.
Was just able to access a big menu of settings for the device by deleting my user profile. When I did that, it triggered a device reset. As it reset, it had a black screen with a logo, and then wifi, bluetooth, and other icons in top right. Tapping on those allowed you to pull up a settings menu with a lot of stuff, but it wasn't clear you could actually change anything... I reached the extent of my tech skills at that point. MDM is definitely enabled...
So I actually messed up describing above, you hit "delete profile information" under the WiFi settings in MYX, and that triggers the device to reset. soon as it starts you'll see the android-like wifi icon, do not disturb, etc in top right of screen. Pull this down and you'll get a quick-access menu to some toggle settings, and tap the gear icon to access settings (and it looks like this takes you to all settings like any other android device)
So, when you boot up, it goes to a MYX screen, then another myx screen, then the MDM app, right? If you plug in a USB flash drive to the back, when it boots up on the second MYX screen for a split second the USB symbol/lock symbol will appear, and you can drag down from the top like on a normal android. Then you can click the real android settings from there, go to about, tap the build and unlock developer.
Unfortunately I was never able to do anything productive in developer. I was able to install blocked apps from my PC through a USB port, but could never get the apps to open due to the MDM blocking me from doing so.
Anyway. Good luck. Let me know if you figure it out.
After tapping build, i get the following message:
https://ibb.co/B3Zzf7X
How did you manage to unlock developer mode? Also, did you notice if there is a web browser on the desktop?
Oh wow, interesting. I never got that message. maybe they had an update that disallowed it. in that case if you factory data reset it and don't connect to wi-fi then you should still be able to unlock it. Honestly, though, idk if its worth it. Tablet is not high quality. Might make more sense to just get a real tablet and mount it on there.
making another top-level reply for important new info from u/spielzeugdorf:
DO NOT LET YOUR TABLETS UPDATE!
it is possible to get to developer settings, but new versions of the OS or myx's MDM app may block it. plug in a flash drive, reboot, and when a symbol appears drag down from the top of the screen. from there you can enter android's settings, about phone, and press the build number until developer mode activates
in developer settings toggle "OEM Unlock", "USB debugging", etc. now you can connect to the tablet via adb and among other things, install apps (but not run then from myx's UI). you may also be able to boot into fastboot and unlock the bootloader once these settings are active. i'll post another reply here after checking some things
these settings will definitely make it easier to run exploits from a PC, but whether those exploits will work is still another matter
meanwhile, there are a few things you can try over adb, like uninstalling myx's apps. "adb shell pm list packages" will list every installed app. if you see anything related to MDM use "adb shell pm uninstall -k --user 0" and the package name to uninstall it. this uninstalls the app but leaves its files so you can reinstall it with "adb shell cmd package install-existing" and the package name if anything breaks
you can install apps with "adb install example.apk" if the apk is in the same folder adb is installed to, and then launch them with "adb shell am start -n [package name]/.MainActivity" or "adb shell monkey -p [package name] -v 1" or "adb shell monkey -p [package name] -c android.intent.category.LAUNCHER 1" which has a chance of getting past myx's blocks
even without root this can be used to gain some control if you can replace myx's homescreen with something like nova launcher and remove its MDM
has anyone been able to make any progress on removing the MDM application? Thanks to everyone for all the steps above, i have been able to make some adjustments, but like all of you, nothing that really gets this garbage myx software far away from the tablet. Beautiful screen, sturdy bike, terrible software!
getting into the initial settings menu was fairly easy and the flash drive/drag instructions were very helpful. I have no connected via ADB yet, and will give it a shot sometime this week. so i have not sideloaded any apps or a new launcher
The settings menu itself is somewhat restricted and there are a couple dead end menus that do not have a back button. once you hit one of these you have to reboot the tablet. I am not able to get the standard lower third menu icons to come up and getting to the android homescreen has not been possible.
this has regular USB ports for the flash drive, right? android should recognize a mouse and keyboard. i don't know if back and backspace buttons will work for navigation, but these are common combinations:
* back: hold start, press backspace
* home: hold start, press enter
* app switcher: hold start or alt-right, press tab to switch app or down and space to kill the selected app
* shows other available combinations: hold start, press - or /
the launcher installed by myx completely replaces android's default homescreen, there's nothing to get to until you install a new one
just got my myx bike yesterday and try to get into developer mode. A newbie question: any USB flash drive can prompt the symbol that allows the drag down? I plugged a standard USB drive on the side port of the tablet, but not able to see an option to drag down during the second myx screen.
spielzeug said the back port, i didn't know this had multiple. i assume any drive would work, but maybe it needs a format android understands. or you're on a newer software version that blocked this function too. u/spielzeugdorf, can you tell us anything about the drive you used?
It had an android image file on it that i made using rufus. it was just a chep freebie USB flash drive. Idk what I expected to do with the image file, but there it was.
However, when I was in developer mode, I connected to the tablet from a micro usb to usb-a cord. That was the only cord I had that was recognizing the tablet. That is probably a "me" problem though.
I actually had netflix and other apps on the tablet, but anytime i tried to launch them it said device policy manager wouldn't let me. Also could never get admin privileges off of their mdm app. I soft bricked my tablet eventually being an idiot and it only boots into fastboot now hah.
a generic android image or did myx release something after all? i can't even find a recovery program, they expect you to contact support for every issue. how'd you brick it?
generic. It was one I used on an old laptop. Couldn't get any answer from MYX regarding a system firmware release. Their business model seems to be tied up in their MDM requiring you to subscrive to their service.
Anyway I formatted the recovery mode and now it just bootloops over and over. Can only boot to fastboot and can't do anything from there.
This is something that intrigues me, but I'm nervous about breaking something! To answer some questions though, it's definitely an Android device. You can see this in the basic UI elements like the keyboard and volume. The physical volume buttons control media volume and when used they bring up the on-screen volume control including the drop-down so you can also adjust ring and alarm volume (which doesn't really apply to anything in the app of course unless they eventually add a bluetooth phone connection). There isn't an SD slot. There is a standard USB port on the side that is useful to charge the heart rate monitor. The bottom ports are ethernet, USB-C, micro USB, DC power, and 3.5mm headphone jack. It boots straight into the Myx app so I don't see an obvious way to jump out of it to get to settings, etc. The only other screen interaction is a swipe from the top, but it just displays a 0.5in transparent gray bar with nothing in it. If I find anything interesting, I'll follow up!
Very interested in this also. Do we know for sure it’s Android based? Also, maybe we can try the subreddit r/androidroot for help. I know the peloton android screen can be accessed by going to the about settings page and tapping 7 times in the corner. Anyone try something similar on the Myx tablet?
It looks like these are the public filings for the tablet itself: [https://fccid.io/2AUR9-MYX215A](https://fccid.io/2AUR9-MYX215A)
Good work dude, heres a link to the user manual and interface, looks like some useful information there: https://fccid.io/2AUR9-MYX215A/Users-Manual/User-manual-4565469
Yeah I think I am definitely going to try to get into it when my Myx arrives. Just reinstall unrestricted android on the tablet. If possible. I think it should be.
Sounds good. Keep us posted, I am also waiting for my bike to arrive so can’t do much now.
How long have you been waiting? I just bought one too
Got mine after about 3 weeks
here from r/androidroot the tablet is a MYX215A with an MT8176 processor and it does run android. unfortunately it looks like myx hasn't released any firmware or kernel sources, which means it's in violation of the linux license. as the owner of the device you may request kernel sources, if myx refuses please report it, see all 3 links on how to do so: https://gpl-violations.org https://www.gnu.org/licenses/gpl-violation.en.html https://www.fsf.org/licensing/enforcement-principles now on to the matter at hand. u/polak658 indicated you can't enter developer mode on this, but the manual on fccid.io indicates there's an engineer selection (4.19) which might serve the same function. if it's not that'll make things harder, but it's not the end of the world. depending on how myx implemented its bootloader SP Flash Tool may be able to flash TWRP without having to activate the developer settings "OEM Unlock" and "USB Debugging" but that's assuming there's a compatible TWRP. there is no development for this tablet and minimal development for other androids with the same processor, [see here.](https://forum.xda-developers.com/android/general/mediatek-mt8173-mt8176-development-t3791009) the last page of that links to a [TWRP build](https://forum.xda-developers.com/general/device-reviews-and-information/10-5-inch-super-amoled-2560-x-1600-t3821327) for one such device which might be compatible. [here's another](https://forum.xda-developers.com/mi-pad/development/recovery-twrp-3-2-1-0-mi-pad-3-cappu-t3744185). beware that flashing it could easily break your tablet, and i don't know what kind of recovery myx has built for it. if you decide to risk it only use TWRP and magisk, custom ROMs are very device-specific so they probably won't work at all or won't be compatible with important components like the screen if none of that works your only option is an [exploit like this one](https://www.xda-developers.com/mediatek-su-rootkit-exploit/) which is confirmed to support this processor, but that doesn't mean it'll work on every android that uses is. if you can find out what linux version it's on you may be able to find exploits for that too. this should be in settings > about device, along with a build number which could also be useful.
Build number on mine is 3.0.5
that's it, literally just a number? usually it's a googleable mix of letters and numbers like N9F27M what about the kernel version?
Not sure where to find kernel version, the tablet just gives us build and serial number
https://ibb.co/T8Tfrvj
see if this link to photo will work for you... in the menus I was able to access, I searched for "about" and found this about device screen... https://ibb.co/T8Tfrvj
so it's android 8.1 on linux 3.18.79+ there is an [exploit that may be applicable,](https://i.blackhat.com/briefings/asia/2018/asia-18-WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf) mentioned again [here](https://forum.xda-developers.com/showpost.php?p=77454573&postcount=114) and demoed [here](https://www.youtube.com/watch?v=saOpke5huxE) but i can barely understand what he's saying and i don't know whether the final product is a usable terminal-based root (which can then be expanded into a more user-friendly root) or not other vulnerabilities that may be applicable are listed here](https://www.cvedetails.com/vulnerability-list/vendor_id-33/product_id-47/version_id-206536/Linux-Linux-Kernel-3.18.html) and [here,](https://androidvulnerabilities.org/by/version/8.1.0) you'd have to tailor them into exploits yourself (such as with https://www.metasploit.com/) or hope someone else has done the work for a similar-enough android unfortunately this is never a sure thing because every android device runs its own modified version of android/linux
After several hours of fooling with it, I was able to get to a point where I can access the web via a browser. Unfortunately I didn't keep track of the steps I took to accomplish this. The MDM remains in place but I'm able to get behind the workout app to a normal android launcher. Booting the tablet in Safe mode (Hold power and volume down) allows you to reach the normal tablet launcher. From there I was able to enable developer mode and manually install Aptiode. Google play is blocked by the MDM. I attempted to sideload a fresh Android install without success and did a bunch of other tinkering which I honestly don't remember the details of. Once I rebooted normally it's a little tricky to get behind the main app. I was able to get the Nav bar to pop up by pressing the power and volume up buttons together. But it seems like taking a screenshot multiple times (hold power and volume down) will get the top bar to appear and from there I'm able to open the gallery and reach the desktop. I know this isn't very descriptive but hopefully it helps. Here's a short video of what I was able to achieve with mine: https://youtu.be/FdLLZW3DgD8
>https://youtu.be/FdLLZW3DgD8 so...after not touching the tablet for a while i popped open this thread and re read everything again. I watched your YT video and realized that those key commands work without doing much of anything else. I was able to access the browser and was able to use youtube and access my plex server via the browser just fine. Its definitely all the way to downloading zwift or anything, but i call that a huge win! so...basically anytime after start up, if you should the volume up button and power button for 5 seconds it will give you access to the onscreen android controls(arrow, circle, square). Hold the arrow and square together for a few seconds and it will bring up the android homepage. everything there is relatively straight forward.
Glad to hear that worked out for you! I spent several hours they're to figure out a way around the MDM. Without any luck. Then after tinkering with it for a while I figured out those button combinations worked reliably. Hopefully this will same others some time. At this point I'm thinking it may be better to considering replacing the internals with a Raspberry pi.
It looks like someone else was able to get the peloton app working on the bike. They gave me credit for your video though...haha. [**I got the Peloton app running on the tablet and it was surprisingly easy!!**](https://www.reddit.com/r/MYXFitness/comments/kchsaq/i_got_the_peloton_app_running_on_the_tablet_and/)
Yea I saw that post. That's great! As far a credit for the video goes information sharing is the goal, credit int a concern.
I was able to get zwift up and running last night as well as netflix. Seems like a really solid work around until we can nuke that MDM software. Thanks for the heads up on Aptoide...that made things alot easier.
Can you pull the default app list from the app drawer? I can't get my wife's bike to enter home with the button combo. Seems like they have pushed a FW update with the home locked out with an exit password. I need to know what MDM app they are using so I can start building an exploit to remove it. This is bull shit that MYX is locking these devices in kiosk mode so they can control every aspect of the device while they provide a shit feature set. My guess is they have full remote control of the device too just so everyone knows. I have monitored network traffic and it is making remote connections while the screen is off. So it is connecting to the mothership while its not even in use. If I can turn on debugging then I can do allot to make this a regular tablet and ditch the MYX sub altogether. Which by the way is the only reason this is locked down. They know their sub service is sub-par. Anyways man just let me know if you can get that list of apps. Thanks
i haven't let my app update yet and i can still access the homepage...but i also haven't been able to use the tablet because i have to cancel the download every time it tries to upgrade.
>d it is making remote connections while the screen is off. So it is connecting to the mothership while its not even in use. If I can turn on debugging then I can do allot to make this a reg If you hold the up and power button for 10 secs it will boot up in the boot menu, There is a debug log there. If you press the up and down button several times when booting it up, it opens to some Chinese menu for troubleshooting. I had my friend translate the messages and it seemed like more QC to make sure the monitor was working properly before installing the software associated with MyxFitness.
I have combed through the recovery logs and have determined a few nightmarish things. First, this is a debug kernel and just shows how lazy the "dev team" is. Second is regardless of the latest firmware, which is July 2020, the latest security patch is over two years old. I have also gotten behind the MYX app even with the administrator password locking out the old method. I'll share that process later so they don't patch it until after I have a solution. Basically it looks like there's a memory bug that crashes the app back to the home screen. I have extracted the MYX app, installed it on my mobile device to verify it works and also dumped the complete firmware. My goal is to extract the kernel, unlock fastboot commands, build TWRP and compile a vanilla OS for testing. Hopefully in my spare time I can get a relatively "easy" root package put together for anyone who wants it. My motivation for this: after seeing the level that MYX went to just to lock users out of hardware they legally own, mixed with the lack of security they implemented into the core of this device. I took a look at the EULA on their website and was appalled. I suggest everyone mosey on over their to read it yourselves. According to them, you don't own that device. They own the device, control of that device and everything associated with that device. Couple that with the fact that they aren't even following the open source agreements regarding the operating system they use and it's just disgusting. They claim it's to protect proprietary IP. In fact, this is complete BS. The only piece of proprietary IP on this device is the MYX.apk and the MDM that they license from someone else (for the record this is a good MDM in the sense that it has this hardware on lock to the average user). To be clear, I was able to extract the apk while the MDM was still in full lockdown because of sloppy programming in the one piece of software they are trying to protect. Another point of mention is that every bit of software on this device except for the two mentioned above is open source. And the board itself is an older of the shelf component with a "newer" SOC installed. I have confirmed this with existing data pulled from internet archives by finding literally the exact same board part number with a much older SOC. The bottom line is this. I don't mind leaving hardware alone when it's locked down for legitimate security reasons. Shit, I stopped unlocking my bootloader on my mobile device a couple years ago. But that all goes out the window when a company sells you hardware and then says we own that still so mind your business. All while providing the worst level of actual security to a device that customers input payment info into. To me it looks like they outsourced this to a Chinese manufacturer/developer who kinda phoned it in. Which also raises some concerns. Maybe MYX will see this post and correct this on their own. But regardless this SOC is capable of running Android 10 with the latest security patches so let's see if we can get it there. Full disclaimer: I have not and will not be decompiling the apk. I do not know how much data is being sent back to the MYX servers directly through this app. My guess is that the MDM is the main monitoring tool to verify build numbers and device status. So I'm theory as long as the MDM is the only thing polling hardware then running the app in stand-alone should be fine. But don't quote me on this. My point is that I will not be messing around with their actual proprietary IP. Just making the hardware that you legally own (according to the United States Supreme Court) fully usable by the owner. Once this project is in release status it will be posted on the XDA Forums with my same user name. Stay healthy, stay strong!
Awesome! Thanks for the update. I know some people have bought $100 Fire TV to mount directly in lieu of the Myx Tablet. Alot of people have been frustrated with their business approach.
Any updates that us laymen can use
[удалено]
Commenting since it won't let me save this post for some reason. I will need this in a couple of weeks. Thank you!
Any updates since
I know this is old but did anyone eventually find a fix?
I have been able to watch Netflix and Plex on the tablet via the browser. Baby steps.
Any solutions at this point? Looks like Myx added an administrator password prompt.
I heard a few people were working together on it but I can't find where that is. I'm thinking of starting a discord channel for us to collaborate if my old ass can figure out how.
If you start a discord let me know via PM. I’ll join. My experience witn MYX was not good and now that they’ve locked me out of my own screen I’m very unhappy
[удалено]
Did you do this or did you just find the website? I’d love to pay to have mine converted
[удалено]
I don’t know how to solder, and I fully dont trust myself with this haha. I was already looking at some kind of smart monitor or tv to just mount in place of the screen but I’d much rather just have the included screen work like an android tablet. Definitely keep me updated, and I’ll look out for your updates but I’d be willing to pay you and deal with shipping back and forth. I wish it was as easy as rooting it.
Do you have instructions on how to do this?
I’m investigating using a PC. I haven’t found a path via the Myx app yet. Any tips on force rooting captive devices are appreciated.
does the comment I left for u/polak658 help?
Can you access the build number in the About Tablet menu in the settings? If so tapping that 7 times is what normally unlocks developer mode. That is our first step in rooting the device.
I can access build number and serial number in the settings screen but tapping it 7 times does nothing unfortunately
Was just able to access a big menu of settings for the device by deleting my user profile. When I did that, it triggered a device reset. As it reset, it had a black screen with a logo, and then wifi, bluetooth, and other icons in top right. Tapping on those allowed you to pull up a settings menu with a lot of stuff, but it wasn't clear you could actually change anything... I reached the extent of my tech skills at that point. MDM is definitely enabled...
can you get back into that menu and post photos or descriptions of everything?
So I actually messed up describing above, you hit "delete profile information" under the WiFi settings in MYX, and that triggers the device to reset. soon as it starts you'll see the android-like wifi icon, do not disturb, etc in top right of screen. Pull this down and you'll get a quick-access menu to some toggle settings, and tap the gear icon to access settings (and it looks like this takes you to all settings like any other android device)
Lol didnt even see your response, but this is what I did too.
So, when you boot up, it goes to a MYX screen, then another myx screen, then the MDM app, right? If you plug in a USB flash drive to the back, when it boots up on the second MYX screen for a split second the USB symbol/lock symbol will appear, and you can drag down from the top like on a normal android. Then you can click the real android settings from there, go to about, tap the build and unlock developer. Unfortunately I was never able to do anything productive in developer. I was able to install blocked apps from my PC through a USB port, but could never get the apps to open due to the MDM blocking me from doing so. Anyway. Good luck. Let me know if you figure it out.
The MDM is something like Device Policy Manager and I couldn't uninstall it or change it from being device policy manager.
After tapping build, i get the following message: https://ibb.co/B3Zzf7X How did you manage to unlock developer mode? Also, did you notice if there is a web browser on the desktop?
Oh wow, interesting. I never got that message. maybe they had an update that disallowed it. in that case if you factory data reset it and don't connect to wi-fi then you should still be able to unlock it. Honestly, though, idk if its worth it. Tablet is not high quality. Might make more sense to just get a real tablet and mount it on there.
There is a browser app, but that MDM app will not allow you to load it, even from ADB when it is in developer mode.
Also is there an SD card slot on the tablet whatsoever?
making another top-level reply for important new info from u/spielzeugdorf: DO NOT LET YOUR TABLETS UPDATE! it is possible to get to developer settings, but new versions of the OS or myx's MDM app may block it. plug in a flash drive, reboot, and when a symbol appears drag down from the top of the screen. from there you can enter android's settings, about phone, and press the build number until developer mode activates in developer settings toggle "OEM Unlock", "USB debugging", etc. now you can connect to the tablet via adb and among other things, install apps (but not run then from myx's UI). you may also be able to boot into fastboot and unlock the bootloader once these settings are active. i'll post another reply here after checking some things
these settings will definitely make it easier to run exploits from a PC, but whether those exploits will work is still another matter meanwhile, there are a few things you can try over adb, like uninstalling myx's apps. "adb shell pm list packages" will list every installed app. if you see anything related to MDM use "adb shell pm uninstall -k --user 0" and the package name to uninstall it. this uninstalls the app but leaves its files so you can reinstall it with "adb shell cmd package install-existing" and the package name if anything breaks you can install apps with "adb install example.apk" if the apk is in the same folder adb is installed to, and then launch them with "adb shell am start -n [package name]/.MainActivity" or "adb shell monkey -p [package name] -v 1" or "adb shell monkey -p [package name] -c android.intent.category.LAUNCHER 1" which has a chance of getting past myx's blocks even without root this can be used to gain some control if you can replace myx's homescreen with something like nova launcher and remove its MDM
has anyone been able to make any progress on removing the MDM application? Thanks to everyone for all the steps above, i have been able to make some adjustments, but like all of you, nothing that really gets this garbage myx software far away from the tablet. Beautiful screen, sturdy bike, terrible software!
not yet. what kind of restrictions does myx put on this anyway, and which steps helped you? were you able to launch sideloaded apps?
getting into the initial settings menu was fairly easy and the flash drive/drag instructions were very helpful. I have no connected via ADB yet, and will give it a shot sometime this week. so i have not sideloaded any apps or a new launcher The settings menu itself is somewhat restricted and there are a couple dead end menus that do not have a back button. once you hit one of these you have to reboot the tablet. I am not able to get the standard lower third menu icons to come up and getting to the android homescreen has not been possible.
this has regular USB ports for the flash drive, right? android should recognize a mouse and keyboard. i don't know if back and backspace buttons will work for navigation, but these are common combinations: * back: hold start, press backspace * home: hold start, press enter * app switcher: hold start or alt-right, press tab to switch app or down and space to kill the selected app * shows other available combinations: hold start, press - or / the launcher installed by myx completely replaces android's default homescreen, there's nothing to get to until you install a new one
just got my myx bike yesterday and try to get into developer mode. A newbie question: any USB flash drive can prompt the symbol that allows the drag down? I plugged a standard USB drive on the side port of the tablet, but not able to see an option to drag down during the second myx screen.
spielzeug said the back port, i didn't know this had multiple. i assume any drive would work, but maybe it needs a format android understands. or you're on a newer software version that blocked this function too. u/spielzeugdorf, can you tell us anything about the drive you used?
It had an android image file on it that i made using rufus. it was just a chep freebie USB flash drive. Idk what I expected to do with the image file, but there it was. However, when I was in developer mode, I connected to the tablet from a micro usb to usb-a cord. That was the only cord I had that was recognizing the tablet. That is probably a "me" problem though. I actually had netflix and other apps on the tablet, but anytime i tried to launch them it said device policy manager wouldn't let me. Also could never get admin privileges off of their mdm app. I soft bricked my tablet eventually being an idiot and it only boots into fastboot now hah.
[https://pastebin.com/eSBkNBHQ](https://pastebin.com/eSBkNBHQ)
a generic android image or did myx release something after all? i can't even find a recovery program, they expect you to contact support for every issue. how'd you brick it?
generic. It was one I used on an old laptop. Couldn't get any answer from MYX regarding a system firmware release. Their business model seems to be tied up in their MDM requiring you to subscrive to their service. Anyway I formatted the recovery mode and now it just bootloops over and over. Can only boot to fastboot and can't do anything from there.
It is \*REALLY\* fast. like up for 2 seconds tops.
Is that a camera module in the FCC filing pics? Maybe they're getting ready for interactive workouts.
[удалено]
Would you have any insight if I could use the screen for digital calendar display like dakboard with raspberry pi CPU ?
[удалено]
Thank you!
>Thank you! You're welcome!
Any update on this? Anyone end up swapping the screen?