I don’t have much experience with Android. I use iOS for my mobile device, MacOS and Linux for my computing, Roku for my TV. I briefly owned a Meta Quest VR headset, which ran some version of Android, but I didn’t get deep down into it. I’ve also done a very minimal bit of Android app development, but that was nearly ten years ago (and I only ever ran the apps on a simulator).
I’ve got a new hobby, though: home automation. I’ve replaced some of my overhead lights with Philips Hues, I’ve got a few fancy Zigbee dimmers with an extra button, and I’m working on some custom firmware for some cheaper wifi-enabled switches, but there are certain things that are a much better experience with a screen involved, especially when it comes to customization like adjusting the color of lights.
So I thought I’d look into getting a touch-screen based controller. Home Assistant has a very full-featured web view, so really any tablet with a web browser would work.
My ideal is to mount something on the wall, that could possibly be easily removed and reattached via magnets, which would present a very simple interface. The screen should stay unnoticed unless someone approaches or interacts with it in some way. The interaction should be very minimal and not require any sort of swiping, and it should take less than a second to go from “asleep” to “ready for user input”.
Walmart sells a $40 7″ Android tablet, so I grabbed a couple and figured I had at least a couple weeks to try them out and see if I could make them work.
The specs for the Onn 7″ Tablet (2024 edition) are:
- 2.2 GHz Octa-Core processor + 3 GB RAM
- Up to 10 hours of battery life for gaming, web browsing, watching videos, and listening to music
- 7″ 1024 x 600 resolution IPS LCD touchscreen
- Android 14 (go edition)
- 32 GB storage; expandable with memory card reader
- 2 MP front-facing camera + 2 MP rear-facing camera
After unboxing it, my first impressions of the hardware were that it felt pretty decent for $40. The screen is very low resolution and dim, but the case feels solid enough. I got the “pearl” color, which is a very slightly pinkish gray and would look fine for the bezel when mounted on a wall.
Knowing nothing about Android, I figured this would have at least a web browser. And it does, but it also has a lot of annoying behavior that doesn’t appear to be changeable via stock. First of all, it seemed to crash a bit when I was just browsing the web. So I removed nearly every pre-installed app that had an app icon, updated the OS, and it seemed to be a little bit more stable, if still slow to respond. It still had that annoying lock screen, though.
I checked out an app called Fully Kiosk Browser which promised to address some of the things I wanted (wake on approach, skip lock screen, full screen browser!), but when I installed it, I learned that some of those features weren’t supported on Android (Go Edition).
So I have learned that there are multiple editions of Android. I was aware that vendors typically performed many of their own customizations on top of Android, but Go Edition seems to be a very purposefully stripped-down version of Android optimized for lower-memory devices (devices with less than 2 GB of RAM, according to the page above). But my device has 3 GB of RAM – maybe I can “upgrade” it?
So now I find myself looking into hacking Android devices. Apparently this is a very big thing, because although Android is open source (?), carriers like to lock down their hardware and people need to resort to hacks to unlock it. There’s even a forum dedicated to hacking Onn tablets.
I found a post describing how to “root” my device. I also found a post explaining that once a device is rooted, it’s possible to replace the OS with a custom Android OS, possibly LineageOS, and run fully-kiosk on that.
Back things up
- Install mtkclient
- Dump boot and vbmeta (note that mtkclient’s instructions are for Android 9-12 and have different partitions). Turn off device completely, run the following command, then plug the device into USB while holding Volume + and Volume – buttons for ~2 seconds, then release them
$ sudo python mtk.py r boot_a,vbmeta_a,boot_b,vbmeta_b boot_a.img,vbmeta_a.img,boot_b.img,vbmeta_b.img
3. Enable developer mode by going into Settings app, About, and tap on the Build Number box 7 times
4. Settings > System > Developer Options, enable OEM unlocking and USB debugging. Plug in USB to computer, and allow it
5. Run adb devices and ensure that there is a device with a long ID listed
6. Copy boot_a.img to the device:
$ adb push ./boot_a.img /storage/self/primary/Download
7. Turn off Play Protect from Settings > Security and Privacy > PlayProtect > Gear icon
8. Download latest Magisk apk from Releases and install it
$ adb install ~/Downloads/Magisk-v28.1.apk
9. Run Magisk, and tap Install next to Magisk, select an image file, choose boot_a.img, tap Let’s Go
10. Get the patched boot file back on your computer (replace the filename with whatever Magisk prints)
$ adb pull /storage/self/primary/Download/magisk_patched-28100_y8S3m.img
11. Flash the new patched boot file
$ adb devices $ adb reboot bootloader # wait for => FASTBOOT to show on tablet screen $ fastboot devices $ fastboot flashing unlock
12. Press the volume up button on the tablet to say “Yes”
$ fastboot flash boot magisk_patched-28100_y8S3m.img $ fastboot flash --disable-verity --disable-verification vbmeta_a vbmeta_a.img
The first time I did this, I skipped the second command (vbmeta_a) and reset my tablet. This led to a boot loop, although it came up eventually but got a bit confused. See Troubleshooting below for how to fix it!
13. Power off (hold power button down for 10 seconds) and restart
14. Go through initial setup, then go into Settings and reenable Developer mode and USB debugging (OEM unlocking should still be enabled)
15. Reinstall Magisk
16. Run Magisk, and it should prompt you that your device needs additional setup. Press Yes to reboot
17. When the tablet comes back up, open Magisk again and verify that Magisk shows as “Installed”
18. Disable Play Protect again, and the tablet is now rooted!
Installing Lineage
$ adb reboot bootloader $ fastboot erase userdata # got a warning from the above, ******** Did you mean to fastboot format this f2fs partition? $ fastboot reboot fastboot $ fastboot erase cache
The first fastboot is an imposter. The second fastboot is what we want
$ fastboot erase system $ fastboot delete-logical-partition system_ext_a $ fastboot delete-logical-partition system_ext_b $ fastboot delete-logical-partition product_a $ fastboot delete-logical-partition product_b $ fastboot flash system ~/Downloads/lineage-21.0-20241118-UNOFFICIAL-a64_bgN-signed.img $ fastboot reboot
Rebooting took a super long time on the Orange message, but it eventually loaded up and I was greeted by a new loading animation of some circles spinning around each other!
Troubleshooting
“Orange State” message appears on boot, and it appears to be in a loop, but eventually it finishes booting.
This looks to be what happens if it is unable to boot from one “slot,” and so it switches to the other slot.
Go through initial setup, then go into Settings and reenable Developer mode and USB debugging (OEM unlocking should still be enabled)
Run adb reboot bootloader
Run fastboot getvar current-slot and verify current-slot: b
Epilogue
Even with LineageOS running on this, the performance was still very poor and the screen had pretty bad viewing angles, so I decided to return these Onn tablets. I am now looking into other cheap tablets, and am at least thankful I got to dip my toe into this stuff – I expect I might be doing more of it to get the perfect dashboard.
Leave a Reply