These are the steps I took to get:

$ adb shell
root@ntx_6sl:/ # id
uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)

Disclaimer

I am not responsible if you brick / ruin your device in any way. Basic computer skills required. Proceed with caution. I cannot be held responsible if anything goes wrong.

Prerequisites

1. We need a patched adbd which runs as root in /tmp/adbd.patched, so follow these steps.

2. I’m working on Ubuntu 21.10 so I’ve to install this package

   sudo apt install abootimg
   

3. It could be a good idea to have a full backup.

Procedure

1. download the right version of your update (for me it’s currently 14.1.0)

   wget https://download.pageplace.de/ereader/14.1.0/alldevices/update.zip
   

   (as a sidenote, you can find the latest tolino update on the Tolino website)

2. extract boot.img

   unzip update.zip boot.img
   

3. unpack boot.img (we need the initial ramdisk initrd.img)

   abootimg -x boot.img
   

4. extract the ramdisk in a directory

   mkdir ramdisk
   zcat initrd.img | ( cd ramdisk/ && cpio -imd )
   

5. modify the ramdisk to enable debug mode, disable secure modes, enable mtp and adb

   cd ramdisk/
   sed -i 's:^ro.secure=1$:ro.secure=0:' default.prop
   sed -i 's:^ro.debuggable=.*$:ro.debuggable=1:' default.prop
   sed -i 's:^persist.sys.usb.config=mass_storage$:persist.sys.usb.config=mtp,adb:' default.prop
   sed -i 's:setprop ro.adb.secure 1:setprop ro.adb.secure 0:' init.rc
   

6. replace adbd with a patched one which runs with root privileges (let’s suppose it’s in /tmp/adbd.patched, see here)

   cat /tmp/adbd.patched > sbin/adbd
   

7. recreate the initrd.img

   # we're still working in ramdisk/ directory
   find . ! -name . | LC_ALL="C" sort | cpio -o -H newc -R +0:+0 | gzip -c > ../initrd.img
   cd ..
   

8. replace the old initrd.img inside boot.img

   abootimg -u boot.img -r initrd.img
   

9. safely temporarily test the new boot.img, type on the pc

   fastboot boot boot.img
   

10. reboot Tolino in fastboot mode, this will temporarily boot the new boot.img

11. test on the pc if adb is running in privileged mode, you should see

    $ adb shell
    root@ntx_6sl:/ # id
    uid=0(root) gid=0(root) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)
    

12. permanently flash the new boot.img, type on the pc

    fastboot flash boot boot.img
    

13. reboot Tolino in fastboot mode and you shoud see

    $ fastboot flash boot boot.img
    < waiting for any device >
    Sending 'boot' (4376 KB)                           OKAY [  0.146s]
    Writing 'boot'                                     OKAY [  0.437s]
    Finished. Total time: 0.601s
    

14. after flashing, reboot

    fastboot reboot