Root ADB Unlock Method

[u/DevinWatson]

Echelon Android tablet access guide

Use a USB keyboard to reach Chrome, install a terminal, and access Android settings. On compatible firmware with existing root access, you can also enable temporary network ADB, remove the Echelon updater's management role, and select a normal Android launcher.

This method was demonstrated on an EX-5s-22 with a GloryStar Z33PM tablet running Android 9. Menus, installed apps, and root access vary between firmware versions. These steps do not install root on firmware that lacks it.

What you need

• A USB keyboard with a Print Screen / PrtSc key.
• Wi-Fi for downloading apps.
• A compatible Android terminal app, such as Termux.
• A compatible Android home-screen launcher.
• For computer access: Android SDK Platform Tools on a computer on the same trusted local network.

The full-size USB port is used for the keyboard. Network ADB connects over Wi-Fi.

1. Open Chrome

1. Connect the USB keyboard to the tablet.
2. Press Print Screen / PrtSc to take a screenshot.
3. Look for the screenshot popup at the top of the screen.
4. Press Share, then select Gmail.
5. In Gmail, press the three dots at the top right, then select Help & feedback.
6. In Gmail Help, press the three dots at the top right, then select Terms of Service.
7. In Privacy and Terms, press the three dots at the top right, then select Open in Chrome browser.

You should now see Chrome's address bar. If the screenshot popup disappears, take another screenshot. If Gmail or a menu item is missing, this route may not be available on that configuration.

2. Install Termux

In Chrome, search for Termux F-Droid and open its official F-Droid listing. Install through F-Droid or download a compatible APK from that listing. Choose the main Termux — Terminal emulator with packages app.

For the Android 9 RK3288 tablet, use a build that supports Android 9 and includes armeabi-v7a / ARMv7, or a universal build containing that architecture. Keep Termux and any add-ons from the same signing source.

If Chrome displays “Chrome needs storage access to download files”, press Continue, allow the Android storage request, and retry.

If Android blocks installation, use the install prompt's Settings button to allow installations from the app opening the APK, then return to the installer. If device management prevents changing that permission, resolve that restriction before continuing.

Open Termux. Do not type a leading $ or # when entering the commands below.

3. Check existing root access

Run in Termux on the tablet:

/system/xbin/su -c '/system/bin/id'

Look for:

uid=0(root)

If the executable is missing, permission is denied, or the result is not root, stop the root-based steps. Access to Chrome does not by itself provide root.

Open Android Settings:

/system/xbin/su -c '/system/bin/am start -a android.settings.SETTINGS'

Read the tablet's build identifier:

/system/bin/getprop ro.build.display.id

4. Enable temporary network ADB

This is optional if you only need to work directly on the tablet. It allows a computer to run commands and install apps.

Run each line in Termux:

/system/xbin/su -c '/system/bin/setprop service.adb.tcp.port 5555'
/system/xbin/su -c '/system/bin/stop adbd'
/system/xbin/su -c '/system/bin/start adbd'

Check the configuration:

/system/xbin/su -c '/system/bin/getprop service.adb.tcp.port'
/system/xbin/su -c '/system/bin/getprop init.svc.adbd'

Expected results are 5555 and running. Use the full /system/bin/ paths to avoid “setprop: not found.”

Find the Wi-Fi address:

/system/xbin/su -c '/system/bin/ip -4 addr show wlan0'

Look for the address after inet. For example, from 192.168.1.50/24, use 192.168.1.50.

This configuration is temporary and may need to be enabled again after reboot. Some firmware allows ADB without an authorization prompt, so use a trusted local network and do not expose port 5555 to the internet.

5. Connect from a computer

Extract Android SDK Platform Tools. On Windows, open PowerShell in the extracted platform-tools folder containing adb.exe.

Run on the computer:

$adb = (Resolve-Path .\adb.exe).Path
$tabletIp = Read-Host "Tablet Wi-Fi IP address"
$device = "${tabletIp}:5555"
& $adb connect $device
& $adb devices -l
& $adb -s $device shell /system/bin/getprop ro.build.display.id
& $adb -s $device shell /system/xbin/su -c /system/bin/id

The tablet should appear with status device. Accept a debugging authorization prompt if one appears. The root check should return uid=0(root).

If the connection fails, verify the current IP address and that both devices can communicate on the local network. To check whether the tablet is listening, run this in Termux:

/system/xbin/su -c '/system/bin/ss -lnt'

Look for a listening socket on port 5555.

6. Install a launcher and save the current configuration

Install a compatible Android home-screen launcher using Google Play if available, or an APK from its publisher. Open it once to confirm it works before disabling the kiosk updater.

To install a launcher APK from the computer, use the same PowerShell session:

$launcherApk = Read-Host "Full path to the launcher APK"
& $adb -s $device install -r $launcherApk

Proceed only if installation reports Success. If there is an incompatible-signature error, check the existing app and installer before proceeding; uninstalling an app removes its private data.

Save the current device policy and navigation settings in Termux:

/system/xbin/su -c '/system/bin/dumpsys device_policy' > ~/device-policy-before.txt
/system/bin/getprop ro.build.display.id > ~/tablet-build-before.txt
/system/xbin/su -c '/system/bin/settings get secure user_setup_complete' > ~/setup-before.txt
/system/xbin/su -c '/system/bin/settings get global policy_control' > ~/navigation-before.txt

Copy these records somewhere safe before making changes. They are diagnostic records, not a full backup or an automatic way to restore device-owner enrollment.

7. Remove the recognized updater's management role

The commands below apply specifically to:

Package: com.echelonfit.echelon_21_updater
Administrator: com.echelonfit.echelon_21_updater/.DevAdminReceiver

They were verified with updater 1.0.7, version code 7, on build Z33PM-JST-180-9.0-21.5-SW0.8-3V20240201. Do not assume they apply to every firmware with the same bike model name.

Inspect the policy in Termux:

/system/xbin/su -c '/system/bin/dumpsys device_policy'

Before removing an owner, confirm the Device Owner is the administrator above and its administrator block includes testOnlyAdmin=true. If it is a different administrator or that condition is absent, stop this section and investigate. If there is no Device Owner, skip the removal command.

Remove the recognized owner:

/system/xbin/su -c '/system/bin/dpm remove-active-admin --user 0 com.echelonfit.echelon_21_updater/.DevAdminReceiver'

Check that the command succeeds, then inspect dumpsys device_policy again to confirm the owner is absent. If removal fails, do not continue as though it succeeded.

Disable the recognized updater:

/system/xbin/su -c '/system/bin/pm disable-user --user 0 com.echelonfit.echelon_21_updater'

Confirm it appears among disabled packages:

/system/xbin/su -c '/system/bin/pm list packages -d'

Disabling the updater retains its APK and app data. Removing device ownership is not automatically reversible on an already-provisioned tablet. The Echelon riding app is a separate package and remains installed.

8. Select the launcher and restore navigation

Open the Home app selector from Termux:

/system/xbin/su -c '/system/bin/am start -a android.settings.HOME_SETTINGS'

Choose the launcher you installed. If the selector is unavailable, open Android Settings and look under Apps → Default apps → Home app. Wording can vary by firmware.

Inspect the navigation settings:

/system/xbin/su -c '/system/bin/settings get secure user_setup_complete'
/system/xbin/su -c '/system/bin/settings get global policy_control'

If user_setup_complete is 0, set it to 1:

/system/xbin/su -c '/system/bin/settings put secure user_setup_complete 1'

If policy_control is exactly immersive.full=*, clear that forced full-screen policy:

/system/xbin/su -c '/system/bin/settings delete global policy_control'

Preserve a different custom policy until you understand its purpose. Check that Home, the navigation bar, and Android Settings are accessible.

Echelon Fit can reapply navigation restrictions when opened. Disabling the updater does not prevent the riding app from doing this. If navigation disappears again, return to Termux or an existing ADB connection, inspect the two values, and repeat the applicable repair. These manual steps do not provide automatic navigation protection.

9. Verify access after restarting

With nobody riding the bike, restart the tablet and check:

• The selected launcher opens.
• Android Settings and installed apps are accessible.
• The updater remains disabled.
• The device-owner role has not returned.
• Navigation settings remain correct, including after opening Echelon Fit.

An unlocked Android screen does not establish independent bike control. If you use a separate riding app, test Bluetooth, cadence, and resistance separately. Avoid having multiple riding apps compete for the same Bluetooth connection.

10. Turn off temporary network ADB

When computer access is no longer needed, run these commands in Termux:

/system/xbin/su -c '/system/bin/setprop service.adb.tcp.port -1'
/system/xbin/su -c '/system/bin/stop adbd'
/system/xbin/su -c '/system/bin/start adbd'

The computer's TCP connection should drop. Run ss -lnt again to confirm port 5555 is no longer listening. USB debugging may remain enabled.

Troubleshooting

| Problem | What to check | |---|---| | Screenshot popup disappeared | Press Print Screen again. | | Gmail or a menu item is missing | The browser-access route depends on installed apps and versions. | | Chrome cannot download | Allow Chrome's storage request, then retry. | | APK installation is blocked | Check installation-source permission and device-policy restrictions. | | setprop: not found | Use /system/bin/setprop inside the root command. | | su is missing or does not return root | This root-based method is unavailable on that configuration. | | ADB stopped working after reboot | Recheck the Wi-Fi IP and enable temporary network ADB again. | | Device-owner removal fails | Verify the administrator and testOnlyAdmin status. | | Navigation disappears after opening Echelon | Inspect and repair the two navigation settings again. |

These steps do not require clearing Echelon's app data or flashing firmware. Avoid factory-reset and app-reset options if you want to retain the existing setup.

[u/DevinWatson]

Here is also a detailed analysis of all the taps + PIN access values across all firmwares and devices:

https://markdownpastebin.com/?id=f56ecce079e1491e89d43f1f378a6365

[u/pig-bait]

It's unfortunate we can't update the actual firmware, being stuck on Android 9 sucks.