Measurable function from $[0,1]$ to $[0,1]$, mapping each sub interval onto $[0,1]$

I think I found such a function $f$. This function has some similarities to your idea.

However, a detailed proof would require a lot of work to write down, so I will not provide all the details.

Construction of $f$: First, let $a_n(x)$ denote the $n$-th binary digit of $x$, i.e. $a_n(x) \in \{0,1\}$ such that $x = \sum_{n=1}^\infty\frac{a_n(x)}{2^n}$ (we agree that we avoid binary representations ending in $11111\dots$ in order to make the functions $a_n$ well-defined).

Then we define $f$ via $$ f(x) = \limsup_{n\to\infty} \frac1n \sum_{k=1}^n a_k(x). $$

In a sense, the function $f$ is a limit ($\limsup$) of other weird piecewise functions, similar to your idea.

Measurability of $f$: One can show that each of the functions $a_n$ is measurable. Since the limsup of measurable functions is measurable, it follows that $f$ is measurable

arguments for the property $f((a,b))=[0,1]$: (Some details are ommited, and a much more rigorous solution would make this answer too long in my opinion) Let $a,b,s\in[0,1]$ with $a<b$ be given and we want to show that $s\in f((a,b))$ holds. Thus, we need to find a point $c\in(a,b)$ with $f(c)=s$.

The idea is to choose a point $c$ such that the ratio of the binary digits who are $1$ is equal to $s$.

First, we can find numbers $k,m$ such that the half-open interval $I:=[k2^{-m},(k+1)2^{-m})$ is contained in $(a,b)$. Note that the first $m$ binary digits of points in $I$ are all the same, which we will denote by $b_1,\ldots,b_m$.

Then we continue this sequence $b_n$ such that $\limsup_{n\to\infty} \frac1n \sum_{k=1}^n b_n = s$. This is always possible, and it is even possible to avoid the case that $b_n=1$ for all sufficiently large $n$. we then can construct the point $c\in I$ via $$ c:= \sum_{n=1}^\infty \frac{b_n}{2^n}. $$ Then it can be shown that $c\in I\subset (a,b)$ and that $f(c)=s$.

Let $I_1,I_2,I_3,\dots$ enumerate all subintervals of $[0,1]$ with rational endpoints. Construct a sequence $A_1,A_2,A_3,\dots$ of pairwise disjoint sets so that $A_n$ is similar to the Cantor set and $A_n\subseteq I_n$. For each $n$ define a continuous surjection $f_n:A_n\to[0,1]$. Define $f:[0,1]\to[0,1]$ so that $f(x)=f_n(x)$ if $x\in A_n$ and $f(x)=0$ if $x\in[0,1]\setminus\bigcup_nA_n$.

Then $f$ maps each subinterval of $[0,1]$ onto $[0,1]$ because each subinterval contains an $A_n$, and $f$ is Borel measurable because, for each closed set $S$, the set $f^{-1}(S)$ is the union of an $F_\sigma$ set and a $G_\delta$ set.

P.S. To define a continuous surjection from the Cantor set to $[0,1]$, note that each element of the Cantor set can be expressed uniquely in the form $\sum_{k=1}^\infty\frac{2a_k}{3^k}$ with $a_k\in\{0,1\}$, and that the map $\sum_{k=1}^\infty\frac{2a_k}{3^k}\mapsto\sum_{k=1}^\infty\frac{a_k}{2^k}$ is continuous.