Jailbreaking your NordicTrack treadmill

I grew tired of using my NordicTrack in manual mode within the iFit software, simply doing a 400mtr manual workout. I grew tired of the nagging interface asking me to subscribe. I wanted more.

I wanted to be able to have different interfaces, a 400 m loop track along with a visual path for saved routes. Along with this I wanted automatic deck movement based on a route, a coach that talked to me and yes for me, I wanted Home Assistant integration. Thankfully the NordicTrack runs an Android console. Once you know that, you can start to think about how to replace what software is on there talking to the actual motor board hardware.

So with Claude Code (and Claude Design) alongside me, we set about first jailbreaking the device, then working out what the motor board says over its serial link, and finally writing a replacement console app to bring it all together. The decoded protocol is written up in the repo.

What you’re actually changing

The software on the tablet and nothing else. The beauty is that the motor controller, the belt, the deck and the incline motor stay exactly as they were, and critically, the safety key remains active, directly controlling the board. On these machines the console is an Android tablet that talks to a separate motor board over a USB serial link, and that board is the one with the safety-critical job.

This also means this entire thing is reversible. A factory reset from the console’s own recovery puts the manufacturer’s software back.

Will it work on your treadmill?

Well, maybe. It works on my model, and it should work on yours if it matches the table below. It may well work on other machines too. Give it a try, and if (like me) you aren’t a super proficient coder, use Claude Code (or OpenAI Codex) to help: once you’ve got ADB sorted (see below) it can talk directly to the treadmill and install and debug things for you.

Other Gen 6 NordicTrack and ProForm consoles on the same FitPro board are likely to work, because the serial protocol looks like a family rather than a single model. However, at the time of writing, nobody else has tested any other machines and I’m not buying more just to test this.

Gaining access

The full step-by-step is here in the install guide, but here’s the gist of it.

Factory reset the console first. We need to ensure we are starting fresh. Locate your ‘reset button’ (typically a little hole with a button at the bottom, which you press with a needle or SIM tool). On my machine it’s on the top edge. On others it’s on the left edge, or behind the tablet screen. Simply hold the pinhole reset button while you switch the treadmill on at the power switch, and wait for the recovery screen. It takes five to ten minutes and resets all software and settings to factory fresh. Once done, stay off Wi-Fi until you’ve dealt with the iFit software.

Get into privileged mode. This one can take a few tries. What we are aiming for is the administrator/privilege/God mode that most devices have. This is designed to allow a technician to get access to the Android system under the iFit App. On the iFit welcome screen, tap a blank area ten times (I find the area around the Welcome text worked for me), then wait around seven seconds and then tap the same spot ten more times. It seems weird and it took me a few tries to get this right. You will see a “challenge code” interface pop up. You get the matching response code either by ringing NordicTrack support (this is what a technician would do) and asking for one, or from a third-party response-code calculator. Enter it, and the console drops you on a normal Android apps screen.

Stop iFit locking you back out. Right, now we need to stop iFit taking over. Two apps matter: iFit Admin (com.ifit.eru) and iFit the interface (com.ifit.standalone). For each we need to stop them running (disable them), and for the Admin one take away its permissions to ‘display over other apps’ and ‘modify system settings’. Because it’s a system app, you can’t uninstall it. You can force stop iFit itself or uninstall it, as it won’t be needed any more.

Turn on ADB over Wi-Fi. Right, things are much more standard Android from here. We want to enable ADB which is how our laptop (or coding agent) will communicate with the treadmill over Wi-Fi (btw: if your device happens to expose the USB connection, you can do much of this with a direct USB cable plugged in). In order to turn on ADB, we need Developer Settings, so let’s enable that. In Settings, then About tablet, tap the build number seven times. This will turn on Developer Mode. After about four taps the console starts counting down the remaining taps and confirms on the seventh. Then back up one menu to find Developer options, and in there switch on USB debugging, then go and join your Wi-Fi network, and read the console’s IP address back off the About screen.

At this point you can either test that ADB comes back after a power cycle, or risk it and push on. For me Wi-Fi ADB is my only route in, and it’s never missed a beat once I nailed the steps above.

Time to replace the interface with STRIDE. The GitHub repo includes much of what you need, and if I’m honest at this point, I’d open up a Claude Code console, point it at the GitHub repo, tell it the IP address of the treadmill and say something like “Using ADB connect to this treadmill, follow this GitHub repo and install STRIDE on my treadmill”. It should just follow the tools and get it set up for you.

What you get

STRIDE, an open source Android app replacement for the treadmill’s own screen. The belt and the incline work with no login, no subscription and no internet (you can connect it to Home Assistant if you like). Guided walks drive the deck through a hill profile. There are five different interfaces to pick from in settings.

Everything is configured on the treadmill’s own screen. There are no config files to edit and no rebuild to do when you change your mind about warm-up length.

If you run Home Assistant, put your MQTT broker details into the console’s settings and a Treadmill device appears with speed, incline, distance, elapsed time, pulse, calories, mode and workout, plus a device per person as they walk. The console publishes its own MQTT discovery, so nothing gets installed on the Home Assistant side and there’s no custom component to accept. Build whatever dashboard you like from the entities.

None of that is required. It’s all optional. The console is designed to work standalone, with no broker, no network and no phone. Having said that, in the future I’ll release a three-part toolset allowing you to connect STRIDE + Home Assistant + an iOS app. The iOS app syncs your Apple Health data to your phone and allows you to convert routes you’ve taken during a workout (e.g. your favourite hill track in the neighbourhood) to guided routes to replay on your treadmill (think: deck moves to replicate the workout as close as it can automatically). With Home Assistant, health data and AI, you can have a coach that talks to you from your treadmill.

Before you start

This is very much use at your own risk. After all, a treadmill is a physical device that can and does move! The good news is your safety key is physical hardware that cuts the motor directly. Also, when building STRIDE, I decided it can drive the incline but SPEED is only ever suggested (other than auto start-up, which is an option you can turn off, and which is capped at 3 km/h). You, the user, are the one who drives the speed.

It’s open source, so go for it

All of it is on GitHub under Apache-2.0. Use it, contribute to it, fork it and take it somewhere I wouldn’t have. You can change it, ship it and even sell it without asking me, there’s no CLA to sign, and you keep the copyright on anything you write.

A few things worth knowing if you want to poke at it:

• The FitPro protocol is decoded and written down. If you’re on a different machine, start there. It’s the part that took the longest and it’s the most reusable thing in the repo.
• You don’t need a treadmill to work on the interfaces. All five are plain HTML and each one opens standalone in a desktop browser with fake data behind it, so you can redesign a screen on a laptop on the train.
• CONTRIBUTING.md covers getting set up, and the rules I’d ask you to keep if you’re changing anything that moves the belt.

The one thing I’d really like back is what board your treadmill has, working or not. There’s an issue template for it. I can’t build a list of known-good machines from a sample of one, and I’m not buying more treadmills to try.