New generation 3 Onn tablets are now available

Search This thread

Renate

Recognized Contributor / Inactive Recognized Dev
I had my Onn8 Gen1 as navigation tablet.
I had always just glued a microphone adapter to the case of the Onn8.
I got tired of waiting for the glue to set and how brittle it was and that it fell off easily.
This time I pop-rivetted an Atlas Sound AD-11BE microphone flange to the back.
The flange normally takes an 8-32 screw but a 5/32" pop-rivet works perfectly.
5/32" is a bit rarer than 1/8" or 3/16".
Yes, the rivets are far too long but I didn't have a great selection.
First of all, there is nothing as flush as a rivet (unless you countersink a flathead and I don't like that on really thin materials anyway).
With the battery out there is plenty of room. I have the mount as high as it can go without being over the motherboard.
That means the center of the mount is 3" from the top.
I brought out the USB connector, speaker and WiFi antenna.
I don't like the USB out the bottom, it's too likely to get hit by my knee.

Sadly learned lesson: Be careful mating the case after opening that you mate the button side first or else you'll rip the cheesy membrane switches.
The power button still works but volume up is dead. No problem, I usually use the SWC controls anyway.
 

Attachments

  • rivetonn.jpg
    rivetonn.jpg
    141.7 KB · Views: 26

Renate

Recognized Contributor / Inactive Recognized Dev
I can't speak to the difference between Onn8 Gen2 vs Gen3, but upgrading from Gen1 to Gen3 is a big jump.
I use this as a navigation tablet using Bluetooth steering wheel controls.
With the Gen1 you push a button to swap apps and it goes, "lemme see, ah, ok".
With the Gen3 it's literally like a video switcher the screen is instantly replaced with the other app.
Turning off animation is important, but I had it off before too.

Sort of unrelated: I use Firefox as a browser (some systems are on a local server).
The old "fennec" Firefox supported intents where you could go to a URL on a specific tab.
This was very helpful when switching back and forth to prevent having 100 tabs.
The last I checked, the next generation "fenix" Firefox did not support Intents with specific tabs.
Code:
      Intent intent = new Intent();
      intent.setPackage("org.mozilla.firefox");
      intent.setAction(Intent.ACTION_VIEW);
      intent.setData(Uri.parse(link));
      intent.putExtra(Browser.EXTRA_APPLICATION_ID, "MyTab");
      intent.setFlags(Intent.FLAG_ACTIVITY_NEW_TASK|Intent.FLAG_ACTIVITY_NO_ANIMATION);
      startActivity(intent);
Three years and counting: https://github.com/mozilla-mobile/fenix/issues/4106

Edit: Maybe I should make this another thread.
The intent to reuse the same tab works fine, but it was still showing animation when I switched to Firefox,
The thing is, (Fennec) Firefox has two main Activities:
The first, "LauncherActivity" has a few intent-filters so it is what gets activated by an intent.
The second, "BrowserApp" has no intent-filters and is only internally activated by the first.
So, in normal usage LauncherActivity looks at the intent and URL and if it's normal it dispatches it to BrowserApp and finishes.
Apparently it's the Activity finishing that causes this animation.
So I took all the intent-filters off the first Activity and transferred them to the second Activity.
Now it works without animation.
Undoubtedly the LauncherActivity does something but I don't need whatever feature it does.
 
Last edited:

Renate

Recognized Contributor / Inactive Recognized Dev
An update on my problem with the volume up button which I killed.
The actual little metal dome that does the clicky part of the volume up button has gone to Nowhere Land.
There is the reset button (the 4th button) that I don't really need.
I picked off the little metal dome, stuck it to a piece of electrical tape, trimmed it down and stuck it where the volume up was.
It works great, same protrusion, same clicky feel.
If I need reset, there is a hole there which is centered over the center contact. I could ground that with a pin.
 

Renate

Recognized Contributor / Inactive Recognized Dev
Not a lot of action here. Oh, well.

The Onn8 Gen2 has the speaker port out the back, the Gen3 has the speaker out the bottom edge.
The speaker and the GPS antenna are one and the speaker is fed off the little USB board.
That kind of makes things messy. Eventually I'll get a GPS ceramic patch antenna with a uFL connector.
I want to mount a 2" speaker (scavenged from a cheap portable Bluetooth speaker) on my dashboard so it points directly at me.
I didn't want to pick off the connection off the little USB board. There are test points on the mother board.
They are teensy-tiny, so I took my little speaker cord, spliced it to some 30 AWG solid wire to make the connection.
I'll put a human-sized two pin connector outside the case to connect to the dashboard speaker.

Edit: It's verified, the speaker gets a proper mono mix.
 

Attachments

  • spkr1.jpg
    spkr1.jpg
    142.4 KB · Views: 20
Last edited:

Renate

Recognized Contributor / Inactive Recognized Dev
I bought this cheesy Bluetooth speaker to gut for the speaker inside. Mini speaker
I figured if the case itself is 3" then maybe the actual speaker is close to 2" (the size of the hole in my dashboard).
It's actually 1.5" diameter. It's loud enough if you were in a quiet place, but not loud enough with the engine going.
I'll have to find a bigger speaker.

Edit: I bought a Family Dollar "Glo" Bluetooth speaker for $5.
It's truly a "gutless wonder", but at least the speaker is 2" diameter.
The hole in my dashboard is that size so I just hot glued it in.
 
Last edited:

Renate

Recognized Contributor / Inactive Recognized Dev
So my next project was integrating external GPS.
I have a MIKROE GNSS 7 Click with an active antenna on my server.
It's a great little GPS, has all 4 systems and always has over 20 satellites used for calculation.
I looked at the stock Linux gpsd daemon, but that seems to serve using JSON, which I guess is better than raw NMEA.

I like to keep the airwaves clear so I'm using multicast UDP of a 56 bytes frame of binary info.
I have a little Windows program to monitor it on my desktop.
I have yet to write the Service to run on the Walmart tablet.
So I wrote the Service and it runs fine. There is some strangeness with it not starting on BOOT_COMPLETED. I'll look into that.

It's kind of convenient though. If you've every used Google Maps (or any other location thing) you'll have noticed if you switch away from maps or switch off the device it takes a bit of time to get a fresh fix when you switch back/turn it back on. With external GPS coming in it has a fix immediately.
And I can get rid of the little GPS antenna on the tablet.

Oh, I rooted it with Magisk. It seemed the easiest way to set ro.allow.mock.location to 1
You also have to select your app in Developer Options for Mock Location.

FWIW: I've not had luck with fastboot boot whatever.img
It works fine with fastboot flash boot whatever.img, then fastboot reset
 
Last edited:

Renate

Recognized Contributor / Inactive Recognized Dev
If you do a "battery-ectomy" you'll need to convince your device that it's not running out of charge.
I've found that the easiest way is to run this command. (The middle line is just one-time prep.)
Code:
$ su
# echo -n 1 > /data/local/tmp/one
# cp /data/local/tmp/one /sys/devices/platform/battery/FG_daemon_disable
This disables the interrupts on the "fuel gauge" (FG) which is part of the "power management IC" (PMIC).
You can put that last line in a Magisk module in service.sh
One small change is that the screen does not go on automatically when you plug/unplug the USB cable.
 
Last edited:

tonismo

Member
Dec 8, 2014
18
0
Does
I've been having fun with this.

I used bkerler's MTKClient to pull the boot image. https://github.com/bkerler/mtkclient
It's easier to do this in Linux, I used a spare Raspberry Pi.
Save your data plan (if you have one), don't use the GUI version and don't just "pip install -r requirements.txt".
Use requirements.txt as a guide and just pip install them when the program complains.

If you wanted you could let Magisk take over from there.

I've pulled the kallsyms out of the kernel and made a few mods to the code.
I put in an "empty" vbmeta too.
Code:
100071483:/ # getenforce
Permissive
Can you share the modified boot img and vbmeta img for the 100071483? I am having trouble trying to pull boot img
 

tonismo

Member
Dec 8, 2014
18
0
Oh. I had to get around to snarfing a copy off my device...
This is magisk'ed for 100071483
You don't need vbmeta. If you want you can throw in an empty vbmeta.
Thank you so much!I flashed it and now the tablet turns off after showing the boot logo. Is there any ways to fix this?
 

tonismo

Member
Dec 8, 2014
18
0
Well I was able to reboot into fastboot flash it again but no luck. Do you happen to have TWRP for this tablet too?
 

Renate

Recognized Contributor / Inactive Recognized Dev
Everything boots up fine but now the Wifi wont turn on lol
Hmm, could be a version mismatch between kernel and system?
Code:
$ getprop|grep finger
onn/100071483/100071483:11/RP1A.200720.011/1645855200:user/release-keys

I've had a problem with mine. There's an 84.31MB "security update". I can download it but it gets a "verification error" and doesn't proceed. Then it complains that it still has an update.
The verification error happens when I press "Restart now" after the download. I must have downloaded that 84.31 MB a dozen times (in the past and today).
I reinstalled the stock boot and tried to update but it does the same thing. I reinstalled the stock vbmeta and tried to update but it does the same thing.
 
Last edited:

tonismo

Member
Dec 8, 2014
18
0
Hmm, could be a version mismatch between kernel and system?
Code:
$ getprop|grep finger
onn/100071483/100071483:11/RP1A.200720.011/1645855200:user/release-keys

I've had a problem with mine. There's an 84.31MB "security update". I can download it but it gets a "verification error" and doesn't proceed. Then it complains that it still has an update.
The verification error happens when I press "Restart now" after the download. I must have downloaded that 84.31 MB a dozen times (in the past and today).
I reinstalled the stock boot and tried to update but it does the same thing. I reinstalled the stock vbmeta and tried to update but it does the same thing.
mine shows 11/RP1A.200720.011/1656423915:user
Do you think you can capture the OTA update and manually update it through recovery?
 

Renate

Recognized Contributor / Inactive Recognized Dev
I restored to stock, hit factory refresh in recovery, it started clean.
I entered WiFi details, then it wanted to install the same damn 84.31 MB.
It loaded it and failed, then rebooted, loaded it and failed...

Ok, it checks the boot image before updating. I finally got:
Code:
onn/100071483/100071483:11/RP1A.200720.011/1656423915:user/release-keys
Now I'm going to catch the stock boot. You can magisk that yourself. You'll need the original if updates come through.
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Finally, can the full roms be pulled and reflash with SP flash tool, like the 1st gens can be, or do you use something entirely different. In addition, do you pull the rom with dd or by some other means?
    I used bkerler's Python MTK client to pull the boot image. I was working on a native Windows version but I didn't finish it and never got back to it.

    I did get the security OTA finally installed. I put the original boot image back in, installed the update, then Magisk-ed it again.

    As I said, for me, using it as a car navigation tablet with Bluetooth steering wheel controls, the critical benchmark for me is how fast it switches between apps when I push a button. The Gen 3 blew away the Gen 1 that I was using.

    I am using GPS over UDP over WiFi. It works fine except for Google occassionally pestering me to turn Google's WiFi location on.

    For my steering wheel controls of brightness/volume I have a little key injector daemon. I was fighting with SE Linux, but I went off to other things. Whenever it reboots I just adb in, setenforce 0, access the injector, setenforce 1. It works until the next reboot. I'm still working on that one.

    Oh, if I haven't mentioned it:
    Code:
    cp /data/local/tmp/one /sys/devices/platform/battery/FG_daemon_disable
    Where "one" is the character "1" makes your battery always at 50%.
    This is the only way I've seen to keep things working with a wired supply instead of a battery.
  • 2
    It seems that these are being rolled out. I've noticed a few stores with pickup available on the black and purple.
    I'll try to pick one up this morning and do a teardown.
    2
    So, here it is. I haven't even powered it up yet. Shown with the main "tin can" removed.

    Interesting to note, the test points are labelled well, there is a reset TP.
    The 20 pin at the bottom is the USB Type C and the speaker.
    The 30 pin is the IPS LCD.
    You can see from the USB test points at the bottom (DP, DM) that this is USB 2.0
    Interesting, at the top there is an unpopulated micro USB 2.0 connector. (Is that a separate interface?)
    Lots of test points, maybe UART on that 6 pin or JTAG?

    Edit: Interesting. I plug it in and it shows for a few seconds 0e8d/2000 Media Tek PreLoader
    Yes, but the one you want is 0e8d/0003 which is the actual boot ROM
    Ah, ok, there are 4 buttons, VolUp, VolDn, Power, Reset. 3 buttons and a hole for Reset.
    Android "Go Edition" Android 11
    Build number x 7 for Developer mode, System > Advanced > Developer > OEM unlock, ADB enable
    There is accelerometer/auto-rotate but no compass. Compass is good to keep Google Maps from spinning when you're stopped.
    It uses a super (dynamic) partition and has FRP.
    Code:
    ITEMS -> /dev/block/mmcblk0p7
    boot -> /dev/block/mmcblk0p15
    boot_para -> /dev/block/mmcblk0p2
    cache -> /dev/block/mmcblk0p33
    cam_vpu1 -> /dev/block/mmcblk0p3
    cam_vpu2 -> /dev/block/mmcblk0p4
    cam_vpu3 -> /dev/block/mmcblk0p5
    dkb -> /dev/block/mmcblk0p25
    dtbo -> /dev/block/mmcblk0p19
    expdb -> /dev/block/mmcblk0p20
    frp -> /dev/block/mmcblk0p21
    kb -> /dev/block/mmcblk0p24
    lk -> /dev/block/mmcblk0p13
    lk2 -> /dev/block/mmcblk0p14
    logo -> /dev/block/mmcblk0p18
    md_udc -> /dev/block/mmcblk0p31
    metadata -> /dev/block/mmcblk0p26
    mmcblk0 -> /dev/block/mmcblk0
    mmcblk0boot0 -> /dev/block/mmcblk0boot0
    mmcblk0boot1 -> /dev/block/mmcblk0boot1
    mmcblk0rpmb -> /dev/block/mmcblk0rpmb
    nvcfg -> /dev/block/mmcblk0p11
    nvdata -> /dev/block/mmcblk0p27
    nvram -> /dev/block/mmcblk0p6
    para -> /dev/block/mmcblk0p17
    persist -> /dev/block/mmcblk0p10
    proinfo -> /dev/block/mmcblk0p1
    protect1 -> /dev/block/mmcblk0p8
    protect2 -> /dev/block/mmcblk0p9
    recovery -> /dev/block/mmcblk0p16
    seccfg -> /dev/block/mmcblk0p12
    super -> /dev/block/mmcblk0p32
    tee1 -> /dev/block/mmcblk0p22
    tee2 -> /dev/block/mmcblk0p23
    userdata -> /dev/block/mmcblk0p34
    vbmeta -> /dev/block/mmcblk0p28
    vbmeta_system -> /dev/block/mmcblk0p29
    vbmeta_vendor -> /dev/block/mmcblk0p30
    1
    So the top, non-existent USB connector seems to be in parallel with the bottom connector, although it seems that parts haven't been populated so that the two data lines don't go through.

    There's a stupid (depending on your taste) "Entertainment space" which is a multicolor tab that is always present on your homepage.
    Yes, you can disable "Entertainment space" and the tab turns white, but you can't get rid of it.
    Like the Google search bar (that you can't get rid of) this seems to be part of the Launcher.
    I just set my minimalistic "Lunch" app as the Home app.

    Edit: The model is 100071483
    The 8" Gen 1 was MT8163, Gen 2 & 3 are MT8168
    Maybe the only thing different is colors?
    1
    I've been having fun with this.

    I used bkerler's MTKClient to pull the boot image. https://github.com/bkerler/mtkclient
    It's easier to do this in Linux, I used a spare Raspberry Pi.
    Save your data plan (if you have one), don't use the GUI version and don't just "pip install -r requirements.txt".
    Use requirements.txt as a guide and just pip install them when the program complains.

    If you wanted you could let Magisk take over from there.

    I've pulled the kallsyms out of the kernel and made a few mods to the code.
    I put in an "empty" vbmeta too.
    Code:
    100071483:/ # getenforce
    Permissive
    1
    The boot image is signed but relies on the vbmeta partiton which can be overwritten with an empty vbmeta (not erased).
    I modded a boot image and it worked fine.
    The recovery image is also signed and the AVB0 signature is used.
    I modded a recovery image and it didn't work.
    I have to figure out how to use avbtool.

    If I get around to it I will make a "lean and mean" native Windows MTK client that will do reading/writing of partitions without needing UsbDK or external payloads.

    I have never seen a device that picks up grease and dust like this screen.
    You definitely need a microfiber cloth to wipe down the screen all the time.