I have an Onn Surf 8 (One of the surprisingly-not-that-shitty ultra-cheap Walmart tablets) that my research group bought a couple of to use as Android dev testbeds. I’ve been occasionally using it as a normal tablet since I have it around, and have been consistently irritated by the collection of bloatware it comes with…. so I decided to hack it. To tl;dr this whole thing, ignore the collection of typically scammy Android dev forum and blogspam crud, and use the open-source mtkclient for your MediaTek Android device hackin’ needs.
It’s internally a pretty straightforward MT8768t (close relative of the MT6765) device, with eight Cortex-A53 AArch64 cores, 2GB of RAM, 32GB of storage and a MicroSD slot, a passable 800×1280 screen, USB-C, a 3.5mm headphone jack because apparently that’s an unusual feature now, and updates available up to Android 10 (a QP1A build). The materials and build quality are better than expected (5 sides of formed sheet-metal, one side of glass) They are also staggeringly cheap even when they were new – my little RG351p gaming handheld cost more than this thing.
After a frustrating round of fucking around with cancerous proprietary bullshit that doesn’t actually work, it turns out there is a lovely open-source tool called mtkclient that does literally every hacky thing you might want to a MediaTek Android device (that isn’t already covered by adb and fastboot).
No sketchy probably-malware downloads (MiracleBox, wwrMTK, MTK Droid Tool; the first of which detected that I was running it under a VM which is maximum malware behavior). No “Oh, it works on only older Android versions” (anything based on CVE-2020-0069). No “It only works if you have a scatter file from somewhere else for your device.” (SPFlashTools). It just works. From an easy-to-deal-with python script.
The bootloader on the one I was fiddling with was already unlocked by simple ADB/fastboot incantation, but after all the other tools failed miserably, mtkclient just prompts for you to get the attached device into BROM mode (VolUp+Power), and can display/read/write all the partitions as needed. The root instructions in the mtktool README worked fine.
A few pm uninstalls later and it’s mostly free of crapware. Using an Android device without a system-level adblocker is basically intolerable, so it now has a nice root-mode Adaway config. I can’t figure out how to get rid of the walmart icon in the NavBar (which, after the uninstalls, brings up an empty favorites menu) when it’s in 3-button mode, but it doesn’t show up in 2-button, which is adequate for now. It’s possible one could just write an A/B GSI into the super partition (it’s a dynamic partition setup) and replace the whole system, but I haven’t been that ambitious…yet.
I continue to be amazed how much the Android ecosystem is dominate by scams, repeated bad advice, and other bullshit, while people from the normal FOSS world just make things that work.
