• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[RECOVERY] TWRP for Onn Android Tablets (unofficial) - 2019-11-30

Search This thread

diplomatic

Senior Member
Mar 12, 2017
1,410
1,872
TWRP Custom Recovery for the Onn Android Tablet series

This is the first fully-featured custom recovery for Walmart's MediaTek-based Onn tablets: ONA19TB002, ONA19TB003 and ONA19TB007. TWRP needs no introduction. If you have come here, you probably have some idea of what it is and what it's used for. This TWRP build does not need the bootloader unlocked or VBMeta verification disabled, although it's recommended that you at least unlock the bootloader.

DISCLAIMER
Everything described in this thread is done at your own risk. No one else will be responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software.

FEATURES
  • Decrypted data partition
  • All USB modes functional: MTP, ADB, Mass Storage, OTG, Charging
  • Fast boot time
  • Adoptable storage mounting
  • Firmware image backup and restore
  • Works under locked bootloader
  • Android 9 build fits within the 16MB recovery partition -- no compromises or partition resizing necessary

INSTALLATION METHOD 1
  1. Download the recovery to your PC and unzip the image
  2. Unlock the bootloader (skip if you have already done this)
    1. Enable OEM Unlock in Developer Options in Android Settings
    2. Boot into fastboot mode either by holding vol. up+power to power it on and selecting "Fastboot mode", or by running the 'adb reboot bootloader' command from within Android.
    3. Install fastboot and appropriate drivers on your PC if you have not set those up
    4. Unlock the bootloader with the command
      Code:
      fastboot flashing unlock
      ...and follow the instructions on the screen. This will wipe your data.
  3. Flash the custom recovery with
    Code:
    fastboot flash recovery twrp-3.3.1-ONA19TB002.img
    (use the right file name path for your device)
  4. Reboot to recovery with
    Code:
    fastboot oem reboot-recovery

INSTALLATION METHOD 2
  1. This assumes you are familiar with SP Flash Tool or can figure it out on your own
  2. Download the recovery to your PC and unzip the image
  3. Get the appropriate scatter file for your device. The scatter file may be found in the device's firmware under /system/data/misc.
  4. Set up SPFT Download tab as Download Only. Load your scatter file.
  5. Under the recovery line, double-click Location and open your TWRP image.
  6. Click Download and connect your powered-off tablet to your PC. SPFT will automatically flash the recovery to the emmc and disconnect when finished.

INSTALLATION METHOD 3
  1. Head over to Amazing Temp Root for MediaTek ARMv8, read the requirements and directions, and grab the latest mtk-su.
  2. Open a root shell with mtk-su
  3. Flash the (unzipped) recovery with the command:
    Code:
    dd bs=1048576 if=twrp-3.3.1-0-ONA19TB002.img of=/dev/block/by-name/recovery
    (replace the if= file name with your appropriate recovery image path)
  4. Exit root shell

START RECOVERY
Three methods:
  • On a powered off tablet, hold Vol. up+power for about 3 seconds. In the menu that appears, select "Recovery mode"
  • With Android ADB, use the command 'adb reboot recovery'
  • From Android root shell, use the command 'reboot recovery' or just use any root app with OS reboot features

NOTES
  • Kind of important: Make a backup of your Crypto Footer as soon as you can. This is the encryption key to your data partition. When accessed from TWRP, this key can get "upgraded" so that you will get locked out of Android. TWRP uses a hacky workaround that saves and restores the original footer on every /data decrypt. But that method is not what I would call 100% reliable.
  • Make sure you have a backup of the untouched stock system and vendor images. There are no official firmware packages available to download.
  • Only mount system/vendor partitions in read/write mode if you have unlocked the bootloader. It is recommended to choose to leave system read-only at the startup prompt unless you have a specific reason to modify it. If the bootloader is locked, then dm-verity is enforced.* So merely mounting it once in r/w will cause a boot loop.
  • It's currently not possible to install incremental OTA updates using this TWRP. Use the stock recovery to update the FW. That will only work if you have never mounted system/vendor in write mode.

DOWNLOAD (Nov. 30, 2019)
Current version: 3.3.1-1

Source code
ONA19TB002 | ONA19TB003 | ONA19TB007

ACKNOWLEDGEMENTS
  • The team behind TWRP & OmniROM
  • @tek3195 for testing and feedback on the 8" model
 

Attachments

  • twrp-3.3.1-0-ONA19TB002.zip
    16 MB · Views: 1,137
  • twrp-3.3.1-0-ONA19TB003.zip
    16 MB · Views: 571
  • twrp-3.3.1-1-ONA19TB002.zip
    16 MB · Views: 2,293
  • twrp-3.3.1-1-ONA19TB003.zip
    16 MB · Views: 1,645
  • twrp-3.3.1-1-ONA19TB007.zip
    16 MB · Views: 1,521
  • android_device_onn_ONA19TB002.tar
    7.9 MB · Views: 930
  • android_device_onn_ONA19TB003.tar
    7.9 MB · Views: 696
  • android_device_onn_ONA19TB007.tar
    7.9 MB · Views: 782
Last edited:

NFSP G35

Senior Member
Feb 28, 2012
361
195
Very nice! I'll download and test the 003 one soon.
I also have a 007 model to experiment with.
I tried about a dozen times to build TWRP and failed miserably LOL. Closest I got was one that would boot but the rotation was all messed up, USB wouldn't work, didn't mount some partitions... Yeah, it was a hot mess.

Do you happen to have sources available?
 
  • Like
Reactions: Vortell
Jun 29, 2019
32
6
Hey,

This is a neat thing to see for the Onn tablets. I have a question though. I own a device based on the mt8163, and am trying to help people with another device I don't own (the powkiddy x18 which also uses the mt8163). One of the things I wanted to do was to make a custom rom for the x18, since it's stock firmware is horrible. And of course, one of the first steps to custom roms is twrp. So I have a question for you that I hope you can answer for me. How did you make this build of twrp? I have seen no device trees for this device so I was kinda curious. If you can help me in any way, I'd be so grateful, and I'm sure the other people with the x18 would be grateful for help.
 
  • Like
Reactions: blakegriplingph

Spatry

Member
@diplomatic
Is there a different procedure for installing TWRP on a locked bootloader?

I can confirm that using SP Flash to load your TWRP.img will produce a bootloop when installing to a device with the BL locked. Reflashing the original recovery.img makes the problem go away. You mentioned in the OP that this TWRP will work on a locked BL so I thought I would share my case study with you in following the procedure you defined.

MY SINCERE GRATITUDE FOR YOUR EFFORTS IN PORTING THIS TO THE ONN!
 

diplomatic

Senior Member
Mar 12, 2017
1,410
1,872
You're welcome, @Spatry.... Can you describe how you ended up with a locked BL? Was it unlocked before? Have you ever tweaked vbmeta? Also, when you say bootloop, do you mean for Android or just for recovery? I'm not going to insist that it works under locked BL. I tested it once and it did boot up...
 
Last edited:
  • Like
Reactions: tek3195

Spatry

Member
You're welcome, @Spatry.... Can you describe how you ended up with a locked BL? Was it unlocked before? Have you ever tweaked vbmeta? Also, when you say bootloop, do you mean for Android or just for recovery? I'm not going to insist that it works under locked BL. I tested it once and it did boot up...
Presently, I am running stock with Magisk patched BOOT on locked bootloader, stock vbmeta. The boot loop was at the ONN Android screen, I could not get it to even boot into recovery.

At one time I did run with the bootloader unlocked (with --disable-verification on stock vbmeta) and I ran Phusson's AOSP, Liquid Remix and Bliss. I found there was no benefit to me in running the other mods so I reverted back to stock courtesy of @CaffeinePizza and the bootloader re-locked to get rid of that annoying 5 second orange state.

In each instance, I always used SP Flash tools to load all .img files. I only used fastboot to install magisk_patched.img onto the stock installation. Unlocking the bootloader erases all data and I did not feel like reinstalling everything again, so I figured I would try to install TWRP per your instruction to see if it would work while the BL was still locked... Restoring the original recovery got rid of the bootloop. I do want to try your TWRP so I will try it with BL unlocked when I get some free time to do so.
 
Last edited:

diplomatic

Senior Member
Mar 12, 2017
1,410
1,872
Presently, I am running stock with Magisk patched BOOT on locked bootloader, stock vbmeta. The boot loop was at the ONN Android screen, I could not get it to even boot into recovery.

This sounds like you might have flashed a wrong/corrupt image to recovery. It may have to do with AVB checks rather than bootloader lock. But those conditions might be interdependent somehow so I can't tell you for sure. The fact that you are able to boot a patched image on a locked BL says it doesn't care too much about verification. I can tell you for sure that any recovery image must have avb metadata, not necessarily the required hash, for both Android and recovery to boot. Can you try to unzip the image file and flash it over again?
 
  • Like
Reactions: tek3195

blakegriplingph

Senior Member
May 13, 2011
976
145
Amazon Fire
Realme C3
Hmm, the situation with the bootloader lock sounds eerily similar to the Nabi SE. The latter also had a similar implementation where there's not much in the way of locking things down, other than an (easily circumvented) SP Flash Tool signature check and different preloader keys. And here's the real kicker: the nearly-identical Fisher Price Nabi also ran on the MT8163, so it makes me wonder if it's possible to boot Pie on it, or perhaps a GSI assuming that Treble can be tacked onto it.

Also, do you have the source repo to this TWRP port of yours?
 
If anyone here gave me an XDA ad-free subscription, thanks a lot! I didn't get a notification of who it was. Using this site is a lot more bearable now. :)

Kinda cool without the ads isn't it. I know I sent one about a week ago or so. I think everybody ought to send you one, you deserve it. THANKS and AWESOME work.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 10
    TWRP Custom Recovery for the Onn Android Tablet series

    This is the first fully-featured custom recovery for Walmart's MediaTek-based Onn tablets: ONA19TB002, ONA19TB003 and ONA19TB007. TWRP needs no introduction. If you have come here, you probably have some idea of what it is and what it's used for. This TWRP build does not need the bootloader unlocked or VBMeta verification disabled, although it's recommended that you at least unlock the bootloader.

    DISCLAIMER
    Everything described in this thread is done at your own risk. No one else will be responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software.

    FEATURES
    • Decrypted data partition
    • All USB modes functional: MTP, ADB, Mass Storage, OTG, Charging
    • Fast boot time
    • Adoptable storage mounting
    • Firmware image backup and restore
    • Works under locked bootloader
    • Android 9 build fits within the 16MB recovery partition -- no compromises or partition resizing necessary

    INSTALLATION METHOD 1
    1. Download the recovery to your PC and unzip the image
    2. Unlock the bootloader (skip if you have already done this)
      1. Enable OEM Unlock in Developer Options in Android Settings
      2. Boot into fastboot mode either by holding vol. up+power to power it on and selecting "Fastboot mode", or by running the 'adb reboot bootloader' command from within Android.
      3. Install fastboot and appropriate drivers on your PC if you have not set those up
      4. Unlock the bootloader with the command
        Code:
        fastboot flashing unlock
        ...and follow the instructions on the screen. This will wipe your data.
    3. Flash the custom recovery with
      Code:
      fastboot flash recovery twrp-3.3.1-ONA19TB002.img
      (use the right file name path for your device)
    4. Reboot to recovery with
      Code:
      fastboot oem reboot-recovery

    INSTALLATION METHOD 2
    1. This assumes you are familiar with SP Flash Tool or can figure it out on your own
    2. Download the recovery to your PC and unzip the image
    3. Get the appropriate scatter file for your device. The scatter file may be found in the device's firmware under /system/data/misc.
    4. Set up SPFT Download tab as Download Only. Load your scatter file.
    5. Under the recovery line, double-click Location and open your TWRP image.
    6. Click Download and connect your powered-off tablet to your PC. SPFT will automatically flash the recovery to the emmc and disconnect when finished.

    INSTALLATION METHOD 3
    1. Head over to Amazing Temp Root for MediaTek ARMv8, read the requirements and directions, and grab the latest mtk-su.
    2. Open a root shell with mtk-su
    3. Flash the (unzipped) recovery with the command:
      Code:
      dd bs=1048576 if=twrp-3.3.1-0-ONA19TB002.img of=/dev/block/by-name/recovery
      (replace the if= file name with your appropriate recovery image path)
    4. Exit root shell

    START RECOVERY
    Three methods:
    • On a powered off tablet, hold Vol. up+power for about 3 seconds. In the menu that appears, select "Recovery mode"
    • With Android ADB, use the command 'adb reboot recovery'
    • From Android root shell, use the command 'reboot recovery' or just use any root app with OS reboot features

    NOTES
    • Kind of important: Make a backup of your Crypto Footer as soon as you can. This is the encryption key to your data partition. When accessed from TWRP, this key can get "upgraded" so that you will get locked out of Android. TWRP uses a hacky workaround that saves and restores the original footer on every /data decrypt. But that method is not what I would call 100% reliable.
    • Make sure you have a backup of the untouched stock system and vendor images. There are no official firmware packages available to download.
    • Only mount system/vendor partitions in read/write mode if you have unlocked the bootloader. It is recommended to choose to leave system read-only at the startup prompt unless you have a specific reason to modify it. If the bootloader is locked, then dm-verity is enforced.* So merely mounting it once in r/w will cause a boot loop.
    • It's currently not possible to install incremental OTA updates using this TWRP. Use the stock recovery to update the FW. That will only work if you have never mounted system/vendor in write mode.

    DOWNLOAD (Nov. 30, 2019)
    Current version: 3.3.1-1

    Source code
    ONA19TB002 | ONA19TB003 | ONA19TB007

    ACKNOWLEDGEMENTS
    • The team behind TWRP & OmniROM
    • @tek3195 for testing and feedback on the 8" model
    4
    Version Update

    Hi everyone,

    A new version of TWRP is out for the 8" and 10" models. It has major improvements such as:
    • Mixed adoptable/shared SD mounting
    • New build for the ONA19TB007
    • Proper landscape mode on the 10" variants
    • Now you can install TWRP on a locked bootloader and boot the OS at the same time
    • Faster bootup
    • Reduced ramdisk size
    I've also uploaded the source code as promised. For anyone curious about it, you can now see "how I did it". :) It has a brief readme file that explains the build process. Let me know if you have questions about it.

    Also, not to state the obvious, but please report any bugs with the recovery, etc.
    4
    Hi @NFSP G35,

    I'll have the source code soon. Most of the tricks involved patching bootable/recovery. So I need to commit those changes and include the proper patch set from my tree....
    3
    Please post feedback since these are still pretty new and not exhaustively tested. Let me know if I should port it to other models in the series.
    3