C1750 treadmill, was able to drop into android launcher, install f store, dropbear. After being able to ssh into the treadmill I found the mediatek soc they use has an exploit app to get a root shell. Further decompiling of the ifit app apk shows it’s written in c#/mono, sending bytes to a usb device for treadmill control. I ran out of patience trying to intercept writes with strace and just went back to running.