Rooting the onn 12 Pro Tablet

onn 12 Pro Tablet — Rooting & Performance Guide

Unlock the bootloader, flash a Magisk-patched boot image, and squeeze real performance out of Walmart's $160 tablet.

Android 14 MediaTek MT8781 Magisk Root A/B Slots Model 100146663

Device & Firmware

Hardware

Marketing name	onn 12 Pro Tablet
Model number	100146663
Internal codename	`onn12TabletPro`
Manufacturer	onn (Walmart store brand)
SoC	MediaTek MT8781 (Helio G99), platform `mt6789`
RAM / A/B	A/B slots, dynamic partitions
Form factor	Tablet, 12.1"

Android / Firmware

Android version	14 (SDK 34)
Build ID	`UP1A.231005.007`
Build fingerprint	`onn/onn12TabletPro/onn12TabletPro:14/UP1A.231005.007/07281835:user/release-keys`
Build date	2024-07-28
Security patch	2024-07-05
Build flavor	`mssi-user`
Bootloader state	`flash.locked=0`, `verifiedbootstate=orange` (unlocked)

Pre-requisites

⚠

Back up first. Flashing a mismatched boot image will bootloop the tablet. Keep the files in stock-backup/ safe before you touch anything.

💻

Linux host

adb + fastboot (platform-tools)

🔧

mtkclient

pipx install mtkclient

🔌

USB-C cable

Must pass data

💾

Stock backup

Boot img + hwparam.json

udev rules for MediaTek preloader

sudo curl -o /etc/udev/rules.d/50-android.rules \
    https://raw.githubusercontent.com/bkerler/mtkclient/main/mtkclient/Setup/Linux/50-android.rules
sudo udevadm control --reload

Patch Your Own Boot Image

Pull your stock boot, push it to the tablet, open Magisk → Install → Select and Patch a File, then pull the result back:

adb push xda_boot_11101418.img /sdcard/Download/
# In Magisk app: Install → Select and Patch a File → pick the file
adb pull /sdcard/Download/magisk_patched-*.img ./magisk_patched.img

🔥

Only use a patched image on the matching fingerprint above. Flashing a mismatched boot image will bootloop the tablet.

Rooting Procedure

Enable developer options and OEM unlocking

Settings → About → tap Build number 7×. Then Developer options → enable OEM unlocking and USB debugging.

Unlock the bootloader

adb reboot bootloader
fastboot flashing unlock        # confirm on the device with volume+power

If fastboot flashing unlock is refused, fall back to mtkclient over BROM (power off → hold vol-down+vol-up → plug USB):

mtk da seccfg unlock

Flash the patched boot image (inactive slot)

The active slot on the stock tablet is _a. Flash into _b first so _a is a rollback path:

adb reboot bootloader
fastboot getvar current-slot            # confirm active slot
fastboot flash boot_b ./magisk_patched.img
fastboot --set-active=b

Disable dm-verity / AVB

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

If vbmeta.img isn't available, fastboot --disable-verity --disable-verification erase vbmeta works — verity was already off on this build in testing.

First boot & finalize Magisk

fastboot reboot

After first boot, open the Magisk app → it prompts "Requires additional setup" → Direct Install → reboot. Root is live; verify:

adb shell su -c id
# uid=0(root) gid=0(root) context=u:r:magisk:s0

✔

Root is live. If id returns uid=0, Magisk is properly installed on slot _b.

Recovery — If It Bootloops

adb reboot bootloader
fastboot --set-active=a    # switch back to untouched stock slot
fastboot reboot

If both slots are toast, enter BROM (vol-up+vol-down while plugging in) and restore with mtkclient using the backup in stock-backup/.

Performance Fixes Applied

These tweaks were made after root; most are reversible.

Debloat (no-root + root)

No-root debloat via adb shell pm disable-user --user 0 <pkg>:

com.google.android.apps.pixelmigrate
com.google.android.apps.restore
com.google.android.gms — kills analytics, social-reach, chimera intents
com.google.android.googlequicksearchbox — Hey Google hotword

Fully reversible with pm enable <pkg>.

Animation & refresh-rate tweaks

settings put global window_animation_scale 0.5
settings put global transition_animation_scale 0.5
settings put global animator_duration_scale 0.5
settings put system min_refresh_rate 90.0
settings put system peak_refresh_rate 90.0
settings put system user_refresh_rate 90.0
settings put secure smooth_display 1

Privacy / background traffic

settings put global package_verifier_enable 0
settings put global package_verifier_user_consent -1
settings put global upload_apk_enable 0
settings put global wifi_scan_always_enabled 0
settings put global assist_structure_enabled 0
settings put secure assist_screenshot_enabled 0
settings put secure google_assistant_enabled 0
settings put secure voice_interaction_service ''
settings put secure voice_recognition_service ''
settings put global private_dns_mode hostname
settings put global private_dns_specifier security.cloudflare-dns.com
settings put global cached_apps_freezer 1

Kernel / sysfs tweaks

CPU governor, Mali GPU, swappiness, and the zram gotcha that will crash init if you touch it too early — moved to their own article so this guide stays focused.

→ Read: Kernel & sysfs Tweaks for the onn 12 Pro Tablet

File Inventory

stock-backup/xda_boot_11101418.img — unmodified stock boot_a pulled from the device
stock-backup/magisk_patched.img — the patched boot to flash
stock-backup/Magisk.apk — the exact Magisk version used to patch
stock-backup/hwparam.json — hwcode/meid/socid needed for mtkclient DA recovery
stock-backup/packages_before.txt — pre-debloat package list (use to reverse pm disable-user)