HOW-TO Unlock, Root and get Xposed for Onn 8" Walmart tablet

Search This thread
Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates. Magisk installed just fine and then Riru-Core and EdXposed. I don't know where one would get stock boot.img so I tackled mine by using mtk-su by @diplomatic. Once I got a root shell I used dd to dump boot.img with "dd if=/dev/block/by-name/boot of=/sdcard/boot.img". It looks weird but platform and soc weren't needed. Install Magisk Manager and let it patch stock boot.img. Transfer magisk_patched.img to PC. Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader. Set tablet up again in developer options for adb as unlocking performs factory reset. Reinstall Magisk Manager then use "adb reboot bootloader" again and finally the money shot "fastboot flash boot magisk_patched.img". I'm not sure if it was helpful or needed but I then used "fastboot oem reboot-recovery" and wiped cache partition from stock recovery. After cache wipe completes, reboot system and go to Magisk Manager and check installation and updates then tend to whatever you think necessary. In the Magisk downloads section is Riru-Core and EdXposed which install same as any other module. From there I can confirm Gravitybox works, so far I've enabled the advanced power menu,navbar tweaks changed button color and button glow color and duration, also forced overflow menu. Bloat is very minimal on these with I believe 5 Sam Walton based apps which put up no resistance to pm hide command and later removal. I removed them (and then some) after making a backup with Advanced Tools Pro. Still in the process of finding out what should or shouldn't be removed. I stumbled upon a simply named but quietly complex root app by the name of Disable Application (ROOT) that is worth checking out. And of course fastboot and adb commands above are without the quotation marks. If you pick up any of my bad habits from reading the above, which in turn have any ill effects on your device, I am in no way responsible. In other words, wuzzn't me.

edit: I had this tucked away and easy to miss so here it is.
magisk_patched.img, mt8163_scatter and a few more things
IMG Files pulled from device using dd
I have added a full backup taken with TFM Tool that can be flashed with TFM or individually with fastboot
(Folder emptied by google)

There is an SP Flash Tool backup and tools on @CaffeinePizza 's server here: https://www.nathanbar.net/files/android/
There is also a flashing guide that works very well in post #192 by @CaffeinePizza
 
Last edited:

NFSP G35

Senior Member
Feb 28, 2012
363
213
Wow... I totally entered the wrong commands in fastboot /facepalm
This is really good to know though. @diplomatic was able to help me unlock the bootloader on my 10" Onn tablet via 'other' means... but it's awesome that's not required and thus available to a large audience!

I'll give this a shot on both variants of the 10" (the one with the keyboard actually has slightly different hardware/software)

Also, thanks for drawing my attention here with the mention @diplomatic

I have been trying to build TWRP for this thing, but haven't been successful just yet.
If anyone cares to lend some guidance, I wouldn't turn it down :)
 
Last edited:

DB126

Senior Member
Oct 15, 2013
15,356
10,163
Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates....
...Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader.
Confirmed working (not there was any doubt). Thanks for you excellent post.

---------- Post added at 11:41 PM ---------- Previous post was at 11:36 PM ----------

Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root. ;)
Not necessarily. Your tool has two distinct advantages:
- ability to easily lock and unlock
- preserves contents of data partition

In the absence of TWRP I would be loath to unlock via the stock method unless working with a virgin device. Yes, there are ways to backup/restore contents ofthe data partition outside of a dedicated recovery but I don't have the time or ambition to mess with such clumsy approaches. Your non-destructive unlockbl.sh script makes it easy.
 

NFSP G35

Senior Member
Feb 28, 2012
363
213
Can I get a copy of your TWRP ?

Nevermind, just realized you said both 10" and not 8".

Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://xdaforums.com/android/general/guide-porting-twrp-source-t3843473

You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!)
I also only got it to boot by using dd from mtk-su, for some reason the fastboot flash would take, but wouldn't boot... Furthermore, the tablet won't boot at all with a bad recovery (it will just boot loop) and can kill the battery. I nearly bricked one of mine. So do be careful.
The stock recovery image will flash via fastboot though, just have to make sure to erase first, and make sure you have a decent charge on the battery, otherwise fastboot won't let you flash.
 
Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root. ;)

What is this tool? @diplomatic I need some help with a different device. Huawei MediaPad T3_7. Can't find anyone with support for it to unlock the bootloader via online service. Sigma Key has full support but way to expensive for a hobbiest like myself. It has MTK MT8127 on Android 6.0 and I haven't been able to find a temp root solution or any other support for it. This is the 7th one of these I've owned but 1st one since no official unlock. I still have working TWRP and custom rom I cooked in Superr's Kitchen but no way to use them. Any thoughts on unlocking?
 
  • Like
Reactions: Mycroftski
Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://xdaforums.com/android/general/guide-porting-twrp-source-t3843473

You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!).

Thanks for link,haven't seen that one before.
Is there any particular reason to use mtk-su ? I have Magisk fully operational already. Or do I need to un-root before pulling recovery.img ? Shouldn't matter should it?
 

NFSP G35

Senior Member
Feb 28, 2012
363
213
Oh yeah, I forgot you had Magisk... Shouldn't need mtk-su then if you do from a terminal emulator.
I like using mtk-su so I can do everything from the computer via ADB shell
 
  • Like
Reactions: Mycroftski

diplomatic

Senior Member
Mar 12, 2017
1,410
1,960
Well... I got TWRP to boot... but the screen is portrait and the touch input is landscape :silly:

I really recommend compiling it from source code if you want to have any hope of it working correctly. To rotate the touch input you can try this in your BoardConfig.mk:
Code:
RECOVERY_TOUCHSCREEN_SWAP_XY := true
RECOVERY_TOUCHSCREEN_FLIP_X := true
...or some combination of those 2.

What is this tool? @diplomatic I need some help with a different device. Huawei MediaPad T3_7. Can't find anyone with support for it to unlock the bootloader via online service. Sigma Key has full support but way to expensive for a hobbiest like myself. It has MTK MT8127 on Android 6.0 and I haven't been able to find a temp root solution or any other support for it. This is the 7th one of these I've owned but 1st one since no official unlock. I still have working TWRP and custom rom I cooked in Superr's Kitchen but no way to use them. Any thoughts on unlocking?
Well, you need to get root first to unlock it from Android. And I'm not sure it'll work on the mt8127....
 

DB126

Senior Member
Oct 15, 2013
15,356
10,163
Thanks for link,haven't seen that one before.
Is there any particular reason to use mtk-su ?
Although not directly related I opt for mtk-su for simplicity and portability. No prep required other than changing permissions on the executable.
 
Last edited:

NFSP G35

Senior Member
Feb 28, 2012
363
213
I really recommend compiling it from source code if you want to have any hope of it working correctly. To rotate the touch input you can try this in your BoardConfig.mk:
Code:
RECOVERY_TOUCHSCREEN_SWAP_XY := true
RECOVERY_TOUCHSCREEN_FLIP_X := true
...or some combination of those 2.

Yeah, I saw that in several guides. I fought with compiling from source several times and just can't seem to get it even close to working. It took several tries just to get the build to finish and even then it just boot looped.
Doing a repack was the only thing I could get to boot.
I'd prefer to build from source, but it's kinda overwhelming.
 
Oh yeah, I forgot you had Magisk... Shouldn't need mtk-su then if you do from a terminal emulator.
I like using mtk-su so I can do everything from the computer via ADB shell

Ok cool, just making sure. Not trying to avoid or discount mtk-su, I think it's freakin awesome. But, you can also use adb shell from pc with Magisk. When you get shell and enter su you just have to grant permission for shell when prompted on device.
 

blueberry.sky

Senior Member
Aug 20, 2014
455
168
This is great!
Has anyone searched for a way to hide the walmart nav bar button?
 
Last edited:

Pix12

Senior Member
Dec 20, 2015
328
34
Wait, if it has Treble support, is it possible to flash an Android Q GSI whenever it comes out?
 

nl3142

Senior Member
Jun 11, 2011
168
26
Yeah, I was going to mention that.
But here's the guide I used... If it worked on the 10, it should work on the 8...
https://xdaforums.com/android/general/guide-porting-twrp-source-t3843473

You'll just need to use mtk-su to pull your stock recovery image (***Make sure you save it!!!)
I also only got it to boot by using dd from mtk-su, for some reason the fastboot flash would take, but wouldn't boot... Furthermore, the tablet won't boot at all with a bad recovery (it will just boot loop) and can kill the battery. I nearly bricked one of mine. So do be careful.
The stock recovery image will flash via fastboot though, just have to make sure to erase first, and make sure you have a decent charge on the battery, otherwise fastboot won't let you flash.

Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates. Magisk installed just fine and then Riru-Core and EdXposed. I don't know where one would get stock boot.img so I tackled mine by using mtk-su by @diplomatic. Once I got a root shell I used dd to dump boot.img with "dd if=/dev/block/by-name/boot of=/sdcard/boot.img". It looks weird but platform and soc weren't needed. Install Magisk Manager and let it patch stock boot.img. Transfer magisk_patched.img to PC. Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader. Set tablet up again in developer options for adb as unlocking performs factory reset. Reinstall Magisk Manager then use "adb reboot bootloader" again and finally the money shot "fastboot flash boot magisk_patched.img". I'm not sure if it was helpful or needed but I then used "fastboot oem reboot-recovery" and wiped cache partition from stock recovery. After cache wipe completes, reboot system and go to Magisk Manager and check installation and updates then tend to whatever you think necessary. In the Magisk downloads section is Riru-Core and EdXposed which install same as any other module. From there I can confirm Gravitybox works, so far I've enabled the advanced power menu,navbar tweaks changed button color and button glow color and duration, also forced overflow menu. Bloat is very minimal on these with I believe 5 Sam Walton based apps which put up no resistance to pm hide command and later removal. I removed them (and then some) after making a backup with Advanced Tools Pro. Still in the process of finding out what should or shouldn't be removed. I stumbled upon a simply named but quietly complex root app by the name of Disable Application (ROOT) that is worth checking out. And of course fastboot and adb commands above are without the quotation marks. If you pick up any of my bad habits from reading the above, which in turn have any ill effects on your device, I am in no way responsible. In other words, wuzzn't me.

How do you get to fastboot mode? When I tried it with the one in the store I managed to get it to the menu where you can choose recovery, bootloader/fastboot, or normal boot but it just froze after choosing fastboot. Which I thought meant that they removed fastboot entirely like some other tablets do.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 13
    Hard to find much on or about these $64.00 tablets from Walmart, so I thought I would throw this out there. The bootloader is unlockable and it has project treble support. Support is A-only, no seamless updates. Magisk installed just fine and then Riru-Core and EdXposed. I don't know where one would get stock boot.img so I tackled mine by using mtk-su by @diplomatic. Once I got a root shell I used dd to dump boot.img with "dd if=/dev/block/by-name/boot of=/sdcard/boot.img". It looks weird but platform and soc weren't needed. Install Magisk Manager and let it patch stock boot.img. Transfer magisk_patched.img to PC. Tablet connected to PC use "adb reboot bootloader" once in fastboot mode use "fastboot flashing unlock" and follow on-screen prompts to unlock bootloader. Set tablet up again in developer options for adb as unlocking performs factory reset. Reinstall Magisk Manager then use "adb reboot bootloader" again and finally the money shot "fastboot flash boot magisk_patched.img". I'm not sure if it was helpful or needed but I then used "fastboot oem reboot-recovery" and wiped cache partition from stock recovery. After cache wipe completes, reboot system and go to Magisk Manager and check installation and updates then tend to whatever you think necessary. In the Magisk downloads section is Riru-Core and EdXposed which install same as any other module. From there I can confirm Gravitybox works, so far I've enabled the advanced power menu,navbar tweaks changed button color and button glow color and duration, also forced overflow menu. Bloat is very minimal on these with I believe 5 Sam Walton based apps which put up no resistance to pm hide command and later removal. I removed them (and then some) after making a backup with Advanced Tools Pro. Still in the process of finding out what should or shouldn't be removed. I stumbled upon a simply named but quietly complex root app by the name of Disable Application (ROOT) that is worth checking out. And of course fastboot and adb commands above are without the quotation marks. If you pick up any of my bad habits from reading the above, which in turn have any ill effects on your device, I am in no way responsible. In other words, wuzzn't me.

    edit: I had this tucked away and easy to miss so here it is.
    magisk_patched.img, mt8163_scatter and a few more things
    IMG Files pulled from device using dd
    I have added a full backup taken with TFM Tool that can be flashed with TFM or individually with fastboot
    (Folder emptied by google)

    There is an SP Flash Tool backup and tools on @CaffeinePizza 's server here: https://www.nathanbar.net/files/android/
    There is also a flashing guide that works very well in post #192 by @CaffeinePizza
    6
    Quote:
    Originally Posted by NFSP G35
    Quote:
    Originally Posted by NFSP G35

    May we please have a forum for the Onn line of tablets available at Walmart?
    There are a 3 models with easily unlocked bootloaders, and treble support
    ONA19TB007 - 10.1" screen, with docking keyboard.
    ONA19TB003 - 10.1" screen without docking keyboard.
    ONA19TB002 - 8" screen
    All have Android Pie, Mediatek MT8163 SOC, 2GB RAM, 16Gb storage.
    Additionally, there is a 7" model, which has only 1 Gb RAM, but not much is known about it yet.

    Most of the discussion around these tablets is in this thread, but it's beginning to get to be too much going on in a single thread.
    https://xdaforums.com/gen...lmart-t3945284


    @NFSP G35 what I got was this,

    Well technically it wasn't getting enough posting/views to get a forum but I have compromised and given it a single "General" forum. At least it will allow ew threads to be made in a single place:
    https://xdaforums.com/walmart-onn-tablets
    Mike

    I looked for new device forum request and missed it somehow. I'm surprised in a way that we got what we did. When I couldn't find correct place to post I sent my request via pm to Mike Channon. He was pretty cool I think , for giving us the real-estate that he did, but I don't think I'll try that again. Just thought I'd drop a note, cuz if you stay signed in like I do most of the time you won't know it moved.
    5
    Wait, so the bootloader is unlockable via fastboot? My intel indicated otherwise (probably due to wrong commands being tried). @NFSP G35, @DB126, @pbeamtn will want to hear about this. Thanks. That means there isn't much need for an unlock tool that runs from Android root. ;)
    5
    Just uploaded my TWRP 3.3.1 for the ONA19TB002 and ONA19TB003. Check it out. :cool:
    4
    I used FX file explorer as root (mounting / as RW) and was unable to get rid of any of the bloatware, additionally, using mtk-su from adb shell would not permit me to remove the bloatware either with the 'pm uninstall com.mid.kubedemo' I can uninstall on user 0 but darnit... I do not want this junk consuming space! I also want to get rid of:

    Chrome - Calendar - Drive - Duo - Gmail - Play Movies/tv - Play Music

    Are those safe to delete? What is the best way to COMPLETELY uninstall this bloat and free space for applications I will really use? Thanks in advance =D

    Update: I followed this tutorial, I will try changing perms and getting rid of the resilient wallmart apps... the items are missing from the app drawer but magisk debloater still says they are there... <facepalm>
    As a general caution don't get caught up in obcession over minutiae. Most of the 'bloat' you describe is located in the system vs user partition. Probably not going to use the relatively small amount space freed up anyhow. Freeze unwanted apps and move on, potentially avoiding downstream headaches.