Free Your Echelon EX-5s/7s — The Complete Liberation Guide
🙏🏽 Mod's Delete this if redundant...
The Complete Liberation Guide
Turn a locked Echelon Connect EX-5s-22 (and likely EX-5s-10 / EX-7s family) kiosk tablet into a fully open, rooted, wirelessly-accessible Android device — no PIN, no kiosk, no forced updates.
Verified end-to-end on 2026-08-09 against:
- Hardware: Echelon Connect EX-5s-22 (21.5" GloryStar Z33 tablet, Rockchip RK3288W, 4GB RAM, 16GB flash)
- Firmware:
Z33P-JST-180-9.0-21.5-SW3.5-20240308(Android 9, userdebug, test-keys) - App: EchelonFit
2.5.15.0-mounted(versionCode 155), packagecom.viatek.fitnation.echelon_android
Everything below was executed live on a real machine. Nothing here is theory.
What you get when you're done
| Before | After |
|---|---|
| Boots into locked Echelon kiosk | Boots into a normal launcher (Nova) |
| 5-tap PIN gate you can't pass | Gate gone forever |
| Forced update screens | Updater disabled — can never phone home |
| No access to Android | Full Android 9 tablet + root + wireless ADB |
| $1000+ brick if you cancel | A $5 tablet that happens to have a bike attached |
The Echelon app still works. You keep your rides, your subscription, your metrics. It just stops owning the device.
Bought a used Echelon EX-5s-22 for $5. It was stuck in a locked "kiosk" mode asking for a PIN I didn't have. Here's exactly how I got out and turned it into a normal Android tablet + working bike. Everything below is just tapping the screen — no screwdriver, no computer needed for the main trick.
⚠️ ONE RULE BEFORE YOU START: Do NOT let the tablet update, and don't sign into the Echelon app and accept any update. Newer firmware (mid-2025) makes the bike phone home to Echelon just to turn on. If your bike still works offline, protect that.
Step 1 — Get to the hidden menu
- Turn on the bike. Let the Echelon screen load.
- Tap the top-left corner of the screen 5 times, fast (like double-tapping, but 5 times). If nothing happens, also try the bottom-left corner 5 times, and tapping the App Version line 5 times.
- A box pops up asking for an access code.
Step 2 — The code
The code is 354364. Type it in. (This one is built into the app itself, so it works offline.)
This opens a secret Developer Options menu.
Step 3 — Reset the app (this is the trick)
In Developer Options, tap "Reset App (Clears all data)."
This wipes the part that makes it a locked gym bike. The app restarts like a brand-new normal bike. That's the whole trick — you're not "guessing the PIN," you're making the app forget it was ever locked.
Step 4 — Set it up like normal
It'll walk you through setup (language, WiFi, time zone). Just tap through:
- Language: English
- Region: United States
- Time zone: New York (GMT-04:00) for East Coast
If it asks to update the app, hit "Remind Me Later" — never update.
Step 5 — Leave the app and use it as a tablet
Now that it's reset, the corner code works normally:
- Tap the bottom-right corner 5 times fast → enter the code.
About that exit code: this one comes from Echelon's server and changes sometimes. As of now it's 928713 — try that. If it doesn't work, the current one can be looked up. (In the comments I can post how to grab the live code if it's changed.)
Will this work on the newest version?
- Older firmware (before ~mid-2025): YES. The 354364 dev menu + Reset App is there, and the bike works fully offline. This is the best case.
- Newest firmware (mid-2025 and later): the bike part got locked down — Echelon made it check in online just to unlock the bike. The screen unlock (steps above) may still get you into the Android tablet part, but the bike may not run offline anymore. If you're on old firmware, don't update and you'll keep the good version.
What you end up with
- A normal Android tablet (22" touchscreen) — install a launcher (Nova), a browser, whatever.
- The Echelon app still works if you have a subscription — it's just a normal app now, not a lock.
- Bluetooth still talks to the bike, so apps like QZ (qdomyos-zwift) can read it (that's a separate app that lets you use Zwift etc.).
Quick FAQ
The 5-tap does nothing? Tap faster — if you wait too long between taps it resets. Do all 5 in under ~2 seconds.
354364 says "bad code"? You're probably at the wrong prompt. The bottom-right "exit the app" box is a different, server-side code — 354364 only works on the top-left developer box. Reset the app first (Step 3), then the exit box works.
It keeps hiding the back/home buttons? The app hides Android's buttons. Install "VirtualSoftKeys" (free) for a floating home button, or just swipe up from the bottom edge.
Happy to answer questions in the comments. This is your hardware — you should be able to use it.
Why this works (the 30-second version)
Echelon's tablet ROM is a userdebug build signed with public test-keys, and it ships:
- Pre-rooted —
/system/xbin/suis setuid,daemonsuis running. - ADB on by default —
persist.sys.usb.config=mtp,adb, andro.adb.secure=0means no "Allow USB debugging?" dialog ever. - A hardcoded developer code —
354364— buried in the app. - An unauthenticated exit-code API —
api.echelonfit.com/v1/exit-code— encrypted with a key that's hardcoded in the app. - The updater as a
testOnlyAdminDevice Owner — which Android lets you strip with one command.
Troubleshooting
- "Bad code" on 354364: wrong app build → use the ADB bypass (Phase 2). You never needed the menu.
- Exit prompt rejects the global code: the app is still bound to a commercial account → do Phase 1 step 5 (Reset App) first.
- 5-tap does nothing: tapping too slowly. Each tap must be <800ms after the last. Listen for the beep.
pm disable-user→ "protected package": remove Device Owner first (Phase 3b step 1).- Tablet boot-loops into Echelon after all this: the launcher default didn't stick — re-run Phase 3b step 3 and confirm with
get-default-launcher. - Lost the IP after router shuffle: pin the tablet's MAC in your router's DHCP, or
nmap -p 5555 192.168.0.0/24. - Only the Back button works; Home (circle) and Recents (square) are dead: this ROM blocks the HOME/RECENTS keys at the framework level (kiosk hardening). No setting re-enables them. Fix = install a floating nav app that sends intents instead of keys — see the "Navigation buttons" note in Phase 5.
Brief your AI — copy-paste this to your assistant
If you're working with an AI (Cline, Copilot, ChatGPT, whatever), don't describe the problem from scratch. Paste this block and it will know exactly what to do:
>I have an Echelon Connect EX-5s-22 (GloryStar Z33 tablet, Rockchip RK3288W, Android 9). It's locked in Echelon's kiosk. I want to turn it into a normal Android tablet I fully control. Here's what I know works — please walk me through it and run the ADB commands for me once I give you access: 1. The ROM is userdebug + test-keys, ships pre-rooted (/system/xbin/su), ADB is on by default with no auth prompt (ro.adb.secure=0). 2. There's a hidden dev menu: 5 fast taps on the top-left corner of the app's More screen → enter 354364 → "Reset App (Clears all data)" to drop the commercial/gym binding. 3. The kiosk is enforced by com.echelonfit.echelon_21_updater, a Device Owner with testOnlyAdmin=true — strippable via adb shell su -c 'dpm remove-active-admin com.echelonfit.echelon_21_updater/.DevAdminReceiver', then pm disable-user --user 0 com.echelonfit.echelon_21_updater, then set a real launcher as HOME. 4. The corner "exit" prompt validates against a live unauthenticated API: GET https://api.echelonfit.com/v1/exit-code, AES-256-CBC decrypted with a hardcoded app key. 5. I do NOT want to flash firmware or factory reset — just defang the kiosk and keep the Echelon app working as a normal app. Start by checking if ADB can reach the tablet, and take it from there.
That one paragraph hands any competent AI the full attack plan — the entry points, the exact package/component names, and the constraint (no flashing, keep the app working).
What to actually ask your AI to do, step by step
If you'd rather drive it interactively, these are the requests that map to real progress — in order:
- "Check if the ROM is pre-rooted and ADB is open." → Have it run
adb devices,adb shell id,adb shell su -c id. Ifsureturnsuid=0(root), you've already won half the battle. - "Find the kiosk/updater package and whether it holds Device Owner." →
adb shell dumpsys device_policy | grep -i ownerandadb shell pm list packages | grep -i updater. - "Strip Device Owner and disable the updater." → the two commands in Phase 3b.
- "Set my launcher as default HOME." → Phase 3b step 3.
- "Make wireless ADB survive reboots." → Phase 4.
- "Verify with a reboot." → confirm it boots to your launcher, not the kiosk.
The AI doesn't need to discover any of this — it's all confirmed. It just needs ADB access and these commands.
What NOT to ask your AI to do
- ❌ "Find the PIN in the APK/firmware" — it isn't there on commercial units; you'll burn an hour. (Asking it to find the method is fine; asking for a static PIN is a dead end.)
- ❌ "Flash a newer Android / GSI" as a first step — unnecessary for liberation, adds brick risk. Only pursue this after you're free, and only if a specific app demands it.
- ❌ "Root it" — it's already rooted. Asking to root wastes effort on a solved problem.
- ❌ "Factory reset to clear the lock" — re-enrolls you into the commercial/MDM state and doesn't help.
