How To Guide [CLOSED] Firmware is out! Get your root on!

[snovvman]

The potential workaround, which doesn't seem to be solid, is to sideload the OTA, then immediately enter fastboot, and flash /vbmeta and /boot. Sometimes you'll still end up in Rescue Party, where you can either flash back to stock and try again, or give up and wipe. We are still testing over at the Pixel 5 forum.

Thanks V. I am running this test today:

1) P6P as shipped
2) Setup w/o network so it won't update
3) Download latest OTA image
4) Patch boot and sideload OTA
5) After OTA, boot directly into bootloader
6) Flash verity with flags
7) Flash patched boot
8) Boot
9) See what happens

If this works would show that, at least this time, we can sideload an OTA and get perm boot w/o wiping.

///

In another thread, I was going to run some tests w/ P3XL and P4XL but things got busy. Did you still need me to try anything? It seems like pre P4a root is now well understood and the focus is on >P4a. Let me know if you need something.

 

[rester555]

So I tried flashing the factory image and when I get to the part of loading into fastbootd, it says error: failed to boot into userspace fastboot; one or more components might not be bootable... Anyone run into this before?

 

[Pekempy]

Yeah, I would wait until the .036 firmware drops.

I plan to flash the full 0.15 to go back to it, then root 0.15, and see if I can OTA that way and update root with magisk.
I'm also using a fork of magisk by vvb2060 which reportedly has MagiskDenyList which passes safetynet.. we'll see how this turns out later on.

 

[V0latyle]

Thanks V. I am running this test today:

1) P6P as shipped
2) Setup w/o network so it won't update
3) Download latest OTA image
4) Patch boot and sideload OTA
5) After OTA, boot directly into bootloader
6) Flash verity with flags
7) Flash patched boot
8) Boot
9) See what happens

If this works would show that, at least this time, we can sideload an OTA and get perm boot w/o wiping.

///

In another thread, I was going to run some tests w/ P3XL and P4XL but things got busy. Did you still need me to try anything? It seems like pre P4a root is now well understood and the focus is on >P4a. Let me know if you need something.

No - after OTA, you want to go directly into FASTBOOT. Not bootloader. When the OTA finishes it will dump you in the recovery menu. Select "Enter Fastboot" and flash /vbmeta and /boot from there.

 

[V0latyle]

I plan to flash the full 0.15 to go back to it, then root 0.15, and see if I can OTA that way and update root with magisk.
I'm also using a fork of magisk by vvb2060 which reportedly has MagiskDenyList which passes safetynet.. we'll see how this turns out later on.

If it works, please post it!

 

[Pekempy]

If it works, please post it!

This will all be in a couple of hours when I get to my PC, someone may beat me to it but I'll report back regardless

 

[V0latyle]

By the way....Those of you who took the OTA: You should be able to boot the patched .015 image:

fastboot boot magisk_patched-23011_xxxxx.img

Then use Direct Install in Magisk to patch the .036 boot image.

 

[snovvman]

No - after OTA, you want to go directly into FASTBOOT. Not bootloader. When the OTA finishes it will dump you in the recovery menu. Select "Enter Fastboot" and flash /vbmeta and /boot from there.

Thanks for that. I'm seeing that Magisk 23001 does not work to patch the P6P boot. I thought that I read in another thread that I need to go to 23010. I'll first figure out how to pass safetynet with 23010 on my P4XL before coming back to the P6P test.

 

[THEbigSWEEN]

Just got mine today and getting it unlocked and rooted. Wanted to also confirm that when taking the OTA before flashing vbmeta and patched boot that I had to factory reset before it would boot. So far it does seem that root is working as intended, which I'm stoked about because I thought I wouldn't have root the day I got this bad boy. Thanks to everyone for their trial and error, because coming from a 2 XL it would've taken me WAY longer to try and figure this all out, if at all.

 

[V0latyle]

Thanks for that. I'm seeing that Magisk 23001 does not work to patch the P6P boot. I thought that I read in another thread that I need to go to 23010. I'll first figure out how to pass safetynet with 23010 on my P4XL before coming back to the P6P test.

It should, it was working for me on the P5.

 

[rester555]

So something screwed up in my windows environment when I flashed. I got the factory image to flash. ugh, I should have never updated to W11

 

[V0latyle]

So something screwed up in my windows environment when I flashed. I got the factory image to flash. ugh, I should have never updated to W11

Yeah, I'll be staying with Windows 10. I didn't upgrade from 7 Ultimate until I discovered Enterprise LTSC.

 

[Nekromantik]

so is newest magisk canary not possible to pass saftynet with until they update the module?

 

[plasticarmyman]

I plan to flash the full 0.15 to go back to it, then root 0.15, and see if I can OTA that way and update root with magisk.
I'm also using a fork of magisk by vvb2060 which reportedly has MagiskDenyList which passes safetynet.. we'll see how this turns out later on.

dude...definitely let us know if that works

 

[rester555]

@V0latyle I ended up flashing the factory image. Then I patched in latest canary magisk the boot.img. Then I went into fastboot bootloader. where I flashed the disable verity and verification where I used --slot=all. I then immediately flashed the patched magisk image. It failed to boot and went into recovery. I ended up having to factory wipe and now I am setting up the phone again... This process still seems finicky when having to patch the magisk boot.img.

EDIT: I have the P6 Pro sorta sunny 128gb. Windows 11 environment. usb a to c cable. latest platform tools 31.0.3. using canary magisk 23010.

 

[V0latyle]

so is newest magisk canary not possible to pass saftynet with until they update the module?

You can, it's just a bit more complicated because you have to use an older version of Universal SafetyNet Fix (2.0.0 if I remember correctly) as Riru doesn't work with Zygisk; you also have to use MagiskHide Props Config.

Personally I found it easier to just use 23001.

 

[V0latyle]

@V0latyle I ended up flashing the factory image. Then I patched in latest canary magisk the boot.img. Then I went into fastboot bootloader. where I flashed the disable verity and verification where I used --slot=all. I then immediately flashed the patched magisk image. It failed to boot and went into recovery. I ended up having to factory wipe and now I am setting up the phone again... This process still seems finicky when having to patch the magisk boot.img.

EDIT: I have the P6 Pro sorta sunny 128gb. Windows 11 environment. usb a to c cable. latest platform tools 31.0.3. using canary magisk 23010.

If it makes you feel better, I just did a full factory reflash with wipe too. Couldn't get root working after using the OTA sideload method, although that may have just been me being a dumbass

 

[Pekempy]

I plan to flash the full 0.15 to go back to it, then root 0.15, and see if I can OTA that way and update root with magisk.
I'm also using a fork of magisk by vvb2060 which reportedly has MagiskDenyList which passes safetynet.. we'll see how this turns out later on.

Update:
Unfortunately didn't work, I have root working with this version but no Safetynet (both flags failing).
I've got one last hail mary to try though...

Edit: Not looking good Still can't pass SafetyNet

Update2:
Basic Integrity passing now, but CTS failing

Basic integrity seems to disappear after a reboot :/ strange
Final edit for the night, yup Basic integrity I can't get back now it's started failing again damn.

 

[zymphad]

Just found out John works for Google now. Wonder how the development of Magisk will go, seems some conflict of interest between Google and Magisk.

 

[Pekempy]

Just found out John works for Google now. Wonder how the development of Magisk will go, seems some conflict of interest between Google and Magisk.

This is why MagiskHide is dead, because it's a conflict of interest working on the security team and developing a bypass to that security.. but I think MagiskDenyList is the hope, when we can pass safetynet.

I have magisk deny list working, but just SafetyNet won't pass