[Walmart Onn Tablets General] b1zk1t.1337:
Since all Onn. tablets are the same SoC for every generation (except the pro models, they have a different chipset), they are vulnerable to the exploit MTKClient and SP Flasher uses. (but so are pro models)

THIS GUIDE WILL NOT WORK WITH 2023 11" PRO MODELS. THEY HAVE NO DOWNLOAD AGENTS FOR THEIR CPU. I've already tried, and it doesn't work.

This guide assumes you use Windows.

For ease of use, please only use MTKClient. SP Flasher needs a scatter file, and it's possible there are none for the tablet you're trying to exploit.

I AM NOT RESPONSIBLE FOR DAMAGES CAUSED TO YOUR TABLET. PERFORM THIS ROOT METHOD AT YOUR OWN RISK!

What you'll need​

An 8GB USB drive or greater

A PC running Windows that can boot from USB

Your tablet

A USB-C cable

An internet connection is recommended on the PC at first to download the Live DVD, but it is required on the tablet to download Magisk.

Step 1. Dumping vbmeta.img and boot.img​

To dump vbmeta.img and boot.img, you have to use Re LiveDVD. Link to that is here OR here (which ever one still works).

Setting up USB flash drive with Re LiveDVD​

This step requires a USB drive of at least 8GB

Download Ventoy from here. Once Ventoy is extracted, open the ventoy-1.0.97 folder, or whatever version it currently is. Run Ventoy2Disk.exe and select your USB drive. Be careful if you have multiple USB drives plugged into your system. If you have more than one, try to find out which one it is by unplugging them. If you have an old computer that uses MBR, change it using Option > Partition Style > MBR. In the device field, pick your USB drive and hit install. Once it's finished it should come up as a storage device. Next you want to paste the ISO in the Ventoy drive.

Booting into Re LiveDVD​

Once you have put Re LiveDVD on your USB drive, press F12 or Delete while booting your PC (which ever to access boot order by your BIOS). You should be able to change your boot device to the USB drive. Once you boot in, the password is "user".

Don't exit Re LiveDVD until I say so.

When you get to the desktop, open "MTK", not "MTKClient".

Readying your tablet​

Fully power off your tablet at this point. Make sure it's fully off or it won't work. When your tablet is powered off do these steps

1. Open "MTK" and type python mtk r boot,vbmeta boot.img,vbmeta.img .

Please note, if you're on a Android 13 device, instead of boot,vbmeta boot.img,vbmeta.img use boot_a,vbmeta_a boot_a.img,vbmeta_a.img. Some of these devices have A and B slots for VBMeta and boot. I'm not responsible for any damage. I have no clue if any of these devices that have A and B slots use boot_a as system, so perform AT YOUR OWN RISK! If you use Android 13, every instance of "boot.img" in this post is now "boot_a.img"

2. Hold volume up and volume down while powered off. Don't do this for too long, or else you'll enter recovery mode. Hold this while you connect a USB from your computer to your tablet and release it 2 seconds after you plug the USB C in.

3. The terminal should fill up with loading bars. When this is complete, you can now power the tablet on and move on to the next step.

Sending boot.img back to the tablet​

In the Re LiveDVD distro, open the file manager and go to /opt/mtkclient/ . You should see vbmeta.img, vbmeta.blank.img and boot.img. You shouldn't have to flash the blank vbmeta unless you're on Pie or below.

Enable developer mode by going to Settings > About Tablet > press Build number 14 times. Enable OEM Unlock and USB debugging. Plug your tablet in to your PC and press yes on trust this device.

Now issue these commands on the Re LiveDVD distro in the same terminal:

Install ADB and Fastboot first using this command in the terminal first​

sudo apt install adb fastboot

Using ADB to push the boot.img back to the tablet​

adb devices
adb push /opt/mtkclient/boot.img /sdcard/Downloads/

The boot image will be pushed to the tablet's download.

Patching boot.img​

Install the latest Magisk from here. Don't forget to disable Play Protect if you haven't already. Once installed, hit install on the Magisk card and select "Select and Patch a File". It will ask you for a boot.img. Locate it in Downloads and patch it. Please make note of the final patched image.

Once patched, send the patched boot.img back to the PC using this command (This is very important!):

adb pull /sdcard/Download/magisk_patched_[random_strings].img

where [random_strings] are your file name.

Now that your boot.img and your patched magisk img is saved on your PC, copy them to your Windows install in your Documents so that you don't lose them.

Unlocking bootloader​

! WARNING ! THIS WILL WIPE YOUR TABLET!

If your bootloader is not unlocked, you need to go do that. Doing so will factory reset your tablet, so make sure it doesn't have anything important on it and you've backed it all up.

Connect your tablet to the PC and issue these commands:

adb devices
adb reboot bootloader

Once your tablet goes to a screen that says `=> FASTBOOT` you can issue the next commands:

fastboot devices
fastboot flashing unlock

When it asks you if you want to continue, press Y and hit enter. Your tablet will be factory reset and needs to be set up again. Keep your tablet in => FASTBOOT mode.

Flashing Magisk​

Here comes the fun part, flashing Magisk!

Issue this command:

fastboot flash boot /path/to/magisk_patched_[random_strings].img

If you're using Android 13 (This may or may not be required.):

fastboot flash --disable-verity --disable-verification vbmeta_a vbmeta_a.img

After it has flashed you can power down then back up.

Setting tablet back up​

You may have to go through the whole setup screen again, but once you get back into the main OS, disable Play Protect. Open Magisk (reinstall it if it's not there) and it will tell you Magisk needs a restart.

Congratulations!​

If you got this far, that means your tablet is already rooted. You can now return to your normal OS that you use.