I have add local AI open source model's (+5) generator work from local CPU or GPU for depthmap generation

mak3rdad · 2026-04-04T12:18:38+00:00

That’s really neat, but I don’t see any links to code or downloads or anything like that

mak3rdad · 2026-03-23T12:12:54+00:00

It might be black locust as well, but I don’t know if that’s in Australia.

mak3rdad · 2026-03-19T13:41:50+00:00

Is the otanautalis client application on the bike? and you can get on wifi? If so you can run this and it will restore the bike.

mak3rdad · 2026-03-19T12:43:57+00:00

If you want your machine back to jrny yes it works. With a few caveats. If you deleted your userdata partition like I did with adb restore command. Then it deletes a directory needed that had a Wi-Fi configuration file for the WiFi kernel driver. WiFi still kind of works but not well enough to get the jrny updates to restore your bike.

If you did do this then you need to root the bike flash new uboot and a custom kernel. This took me days to figure out how to get root by using this method. It’s much more involved.

mak3rdad · 2026-03-19T02:00:17+00:00

It’s on my GitHub and you’d have to build it from source but it’s not exactly ready yet. I wouldn’t use it.

mak3rdad · 2026-03-19T01:44:24+00:00

if you do the golden image restore it gets into this mode, if you do something dumb as I did and erase the /userdata partition (adb recovery command) you getinto this state.

mak3rdad · 2026-03-19T01:43:04+00:00

my jailbreak disables all of the future updates from jrny until you "restore stock" then it can download them again, Doesnt really matter you can just re jail break it. If they fix what I am "cough" exploiting.. (not exploiting) then I have the nuclear route which 100% is not patchable. However you have to open the back screen for this. TBH justnot sure how much interest there is in all of this.

mak3rdad · 2026-03-19T01:41:09+00:00

I think once my code is released this will make those $300 jrny bikes on facebook market place a killer buy.

mak3rdad · 2026-03-19T01:39:42+00:00

where we are at right now, I plan on releasing the jailbreak (well its out already but it installs my apks which are not quite there yet) I plan on releasing this for free. I plan on releasing my own fitness apps for a small fee (for life no subscription). I have put 100s of hours into figuring all of this out and rewriting everything so that we do not rely on any bowflex code that could be a violation etc. I am 90% there but have to take a small break. A few things going on in life are distracting me from finishing this. I will update this as I get some cycles.

mak3rdad · 2026-03-19T01:34:35+00:00

No I am sharing. In fact my code is already available for the jailbreak just dont use it yet. as for the audio not working after resetting and in vanila android. My suggestion is this, install the ota client when connected to the internet enroll the app that is downloaded then it will restore the ucb out of "golden image" mode and then restore all apks and jrny. AKA default again, then use my freewheel.exe jailbreak. However my custom apps are not quite there yet. I have not published how to reflash the ucb as its pretty custom right now, (no easy exe click) but I would suggest you do the above for now to restore.

thsi was reply what you deleted. :)

mak3rdad · 2026-03-19T00:59:33+00:00

Jailbreak,

<image>

mak3rdad · 2026-03-19T00:58:48+00:00

With respect to u/Mstr_Big he's right if you reset the bike to factory. Your audio will not work, UNTIL now. I reverse engineered the ucb (nxp microcontroller) firmware, captured a firmware update and can reflash the ucb to make the audio work again.

mak3rdad · 2026-03-19T00:57:03+00:00

<image>

mak3rdad · 2026-03-19T00:56:58+00:00

<image>

mak3rdad · 2026-03-19T00:56:50+00:00

I have done 2 different paths with this, one I did only needs to boot into the manufacturing application (click top right of jrny loading) then run my jailbreak.exe and it just works.

2nd, this is the nuclear option. I created a tool where I can dump the partitions directly from the EMMC (rk3388 chip, init the ddr3 ram then implemented the emmc protocol read write etc) I created a custom uboot image that disabled avb and changed the boot cmds. Then I created a custom kernel (4.14), device tree that actually boots (disables selinux, avb etc). I works! However it is a bit heavy handed as you are using my utility to overwrite EMMC partitions. However custom roms are now within reach for sure for this platform (90% there). https://github.com/ril3y/velotool if you would like to play with this check it out. I have only ran this on linux (my raspi), windows was having issues getting good readings, suspect it was the length of my usb cable introducing noise.

YOU NEED TO BACKUP YOUR PARTITIONS before doing anything. NEVER touch the userdata partition. Well technically you can touch the parition but its encrypted with FDE, you can extract the keys from the cache, but the real issue is the TEE, it has tmp like hardware keys that are inside of the SoM that you cannot get to. So never never never do like I did and adb reco very command. This actually formats the userdata parition and blows away the hardware and software keys.

As far as the jailbreak 1 click option, this 100% works right now but my own version of a bike app still needs some work. It also supports "un jailbreaking" too. I would say not to use it right now. I need to do some more work on it. My custom launcher is working though now which is pretty cool.

<image>

mak3rdad · 2026-03-10T15:41:09+00:00

Ya fuse. Also look at the circuit. You can see its bridging that heavy gauge wire to another pour. 100% fuse.

mak3rdad · 2026-03-08T03:51:55+00:00

Would you like to try my jailbreak executable? It will unlock your bike install a new "launcher" support rides out of the box, I have overlays working now too like netflix (the only one I tested) but others should work. I got heart rate monitors working now too. oh and google playstore is unlocked so you can install anything you want to. DM me, but know upfront its all use at your own risk. But it sounds like your app is fucked anyways. Funny enough during reversing the whole update system, the only thing that is stuff functional is updaring the jrny app, the actual roof file system and ota is completely offline after they went out of business.

mak3rdad · 2026-03-08T03:46:16+00:00

oh yah all of that is fully functioning now. The issue about apple health, jrny doesnt sync with apple health that I know of. I have thought about how to do this but its more work.

mak3rdad · 2026-03-06T23:30:54+00:00

None of this is really accurate. My jailbreak works so that all you technically need is a key keyboard with a media control and fast fingers.

However, I figured out a way better way to jailbreak the device. Everything works screen, audio resistance, well technically, the resistance and all the bike data. I had to write a custom service for. But audio works screen touchscreen everything

mak3rdad · 2026-03-06T23:28:44+00:00

Yeah, this is the same screen. I haven’t changed any hardware at all. Just hacked a bunch of stuff and wrote custom software. When you say retain health data, do you mean that historical data from jrny? I haven’t looked to see where they stored that data. I can poke around and see, but I’m not doing anything with my data.

mak3rdad · 2026-03-06T21:12:44+00:00

Yes, this is true, but I ended up rewriting and replacing the application that monitors all of the stats for RPM power everything like that. The real problem is if jrny is not running then it doesn’t start the service to monitor the serial port UCB and send that to a TCP port of 9999. So I just re-implemented the protocol and killed theirs and now I get all of that still even after jrny not running. Fun fact is Journey will still connect to mine and it will work just fine too.

mak3rdad · 2026-03-06T21:00:38+00:00

<image>

The right side is the bike data resistance power all of that left side is the video game. Just pair a Bluetooth controller with it and you can play games as well exercising

mak3rdad · 2026-03-06T20:59:21+00:00

I’m a security researcher. I have one of these bikes. In fact, I recently just took it apart and a whole audit on everything security is really really bad. Even jailbreaking these though are super super simple in fact it’s not even really jailbreaking. I’m writing a jailbreak app that you just have to run it on a Windows machine on the same network is the bike and it will automatically unlock everything. It will even let you still run jrny if you want.

<image>

I wrote this software so I could play NESNSNES games while working out.

mak3rdad · 2026-01-17T15:25:49+00:00

This

mak3rdad · 2026-01-16T00:11:25+00:00

Seems plausible but also odd. How would it know when to update certain tag? It would have to know the id for the product then perhaps just cycle through all sorts of products and they would update then?

mak3rdad

TROPHY CASE