How To Guide Gain L1 on OnePlus 9 Pro T-Mobile (Widevine)

[Appreciative]

I got L1 with unlocked bootloader and Magisk.

I have LE2110. I used MSM tool (Global) to get back to OOS 11. It locked the bootloader; it always does. So I set up the phone offline (without connecting to WiFi or Mobile Data). Then I upgraded to OOS 11.2.10.10 version through local upgrade. Then opened Developer Options for OEM Unlocking. The option was greyed out and it asked to connect to internet. So I connected my WiFi for a minute or two until that OEM Unlocking was available. I enabled it, and disconnected WiFI. I DID NOT login to my Google account or opened Play Store. I rebooted to fastboot, and unlocked bootloader. Then rebooted. Then did the initial setup again (without connecting to WiFi or Mobile Data). Then I turned off and got the boot.img through MSM tool's readback option. (I was on slot_b so I got boot_b from MSM). Patched this boot.img with Magisk. Booted it temporarily and then through Magisk app, gainded permanent root by Direct Install. Rebooted. Enabled Zygisk from Magisk and Enforce Denylist, and rebooted again. Installed Universal SafetyNet Fix through Magisk and rebooted again. Opened Magisk and hid the Magisk app (just named it Settings; it installed and then showed root lost, but I just closed the app, and reopened new hidden Magisk again). Rebooted. Then I went ahead and connected to WiFi, logged in to my Google account and stuff. Checked from YASNAC and DRM Info and found that Safety Net passed as well as got L1.

I did not put any Google related app to Denylist.

You're saying you have L1 but still on oos11? If so, oos11 (11.2.10.10) L1 has never been a problem with unlocked bootloader, but thanks for sharing for others. People on oos13 and custom roms seem to be hit and miss

 

[ffejy462]

Oos 13 f20. Unlocked. Rooted Widevine L1.

Excellent summary of Widevine! I've tested extensively using every method I could find on XDA, and I've come to the conclusion that it isn't possible to attain L1 status in A13 with an unlocked bootloader on my OP 9 Pro.

 

[Appreciative]

Oos 13 f20. Unlocked. Rooted Widevine L1.

Since this seems to be a HIT rather than a miss, can you detail the steps you took to arrive on oos13 f20 with L1?

 

[ffejy462]

Since this seems to be a HIT rather than a miss, can you detail the steps you took to arrive on oos13 f20 with L1?

I didn't implicitly try, but I've always had Netflix disabled as a system app.
Google services, Google Play store, Netflix and services on denylist in magisk.
I enabled Netflix, updated it, and logged on.

 

[shadabkiani]

You're saying you have L1 but still on oos11? If so, oos11 (11.2.10.10) L1 has never been a problem with unlocked bootloader, but thanks for sharing for others. People on oos13 and custom roms seem to be hit and miss

Oh I see.

Update: I have now updated to OOS12 (C.48) through OTA. I still have L1.
I had rooted with Magisk so OTA was failing. I followed the guide on how to keep Magisk as well as OTA but it didn't work (I went to Magisk app, choose uninstall and restore images, DID NOT reboot, but went straight to system update and let it install, when it asked to reboot, I didn't, but went back to Magisk and chose install to other slot, then rebooted from Magisk. This failed to Qualcomm crash dump, so the system reverted to old active slot). Since root was already lost, I just tried OTA again and rebooted when it asked. The system was updated to OOS12 (C.48). As soon as it booted, I just turned off my phone. Backed up my current active slot boot.img from MSM tool. Turned on my phone. Patched that boot.img from Magisk. Booted it temporarily from fastboot. Went to Magisk app and got permanent root by direct install method. Rebooted. I checked from my Magisk app of the Zygisk and modules were active. Cleared data for Google Play Services, Play Store, and Services Framework (that's a system app). Then waited a few minutes for Play Services to download/gather/whatever data from internet. Then I checked from YASNAC and DRM Info, and SafetyNet passed as well as L1.

I will update to OOS13 in a few days, then post the results again.

 

[camparks]

I am able to get L1 to hold with unlocked bootloader and root on OOS A13, converted to Global, but with one caveat.

All my in-depth testing has been on converting to LE2125 Global, because with EU I couldn't ever get past the dual-SIM bug knocking out my data on stock, so I had to give up and go to Global instead. Trying the data fix module did not work either - this was on Verizon, others may have better luck.

My attempts on Global center around information found in Steve0007's root thread, where it says:

My device has Widevine L3, how to get back L1?​

Downgrading to Oos 11 using MSM Tool.
Unlock bootloader and update system flash the first OOS 12 OTA provided by the system itself.
Then update to the latest F18 (for Global and Indian devices) or F72 (for EU device) OTA using FastbootEnhance. Widevine will back to L1.

Going off the above, you need to flash a payload.bin to keep L1 active when going from A12 to A13. If you flash an update instead, you will drop to L3 - either immediately upon upgrade if the bootloader is already unlocked, or as soon as you unlock the bootloader on A13, or sometimes even drop to L3 on just a reboot despite the bootloader still locked. I assume the same would be true for EU, but I never got to testing since I couldn't get my SIM/cell service to ever work.

The caveat with Global is that you are stuck on whatever A13 you flash payload.bin from. OTA's fail to install, both within the system and using the update apk from OnePlus(looks like what you see in the system on A11). This rang true for trying with both F.16 and F.17, and with OTA's to both F.18 and F.20.

So, here is a condensed version on how to get A13 with L1, unlocked, rooted, but can't update:

1. Convert LE2127 to EU or Global using craznazn's method.
2. Either OTA or local install with flashable zips to A12 - for global it should go update once on A11 to 11.2.10.10, then to C.48 for A12.
3. If you haven't yet, you must unlock the bootloader while still on A12 for the next step. (Side note - when testing taking OTA's all the way, I found that if you haven't unlocked your bootloader yet but plan to later, you MUST at least make sure that OEM unlocking is enabled. If not, it will stay greyed and locked once you go to A13 and the adb shell command won't enable it either)
4. Use FlashBoot Enhance to flash payload.bin from an A13 flashable zip - I tried both F.16 and F.17, but both have F.18 & F.20 updates fail. Follow the instructions in this post from that thread, plus you will most likely have to delete any prior installation temporary partitions ending in '.cow' - scroll down a few more posts in that thread and you will see some conversation on those. You can't delete those with your bootloader locked.
5. At this point, you will have A13 with L1, but SafetyNet will be failing on CTS due to the unlocked bootloader. Follow the root directions back in Steve0007's root thread to temp boot a patched bootloader, patch the bootloader on the phone/create a backup, install Universal SafetyNet & Shamiko, Zygisk, Deny List, etc.

In terms of trying to work around the update issue, here is what I tried and didn't work:

• Flashing the OTA's locally by downloading from Oxygen Updater still fail.
• Flashing the same update as used with FastBoot Enhance locally will work, BUT with the bootloader unlocked will result in Widevine dropping to L3 just like if OTA was done for all updates. I think I tried an update to F.20 after this and it worked, but was still L3.
• Flashing both slots via FastBoot Enhance had no effect on OTA's, they still fail.
• Flashed F.11 abl.img, but updates still fail.

Edit 02/27/23: Added more info the update attempts

 

[Appreciative]

Good info guys.

During your tests, were you orange-state'ing on boot? If so, have you tried the orange-state warning removal here (dropping in F11 abl.img) and seeing if that changes anything with OTA or L1 state in general? I'm not sure if the checks that are missing from F11 abl.img are maybe used elsewhere to check for bootloader state or if there's additional checks taking place and that's ONLY used at boot and never used again. Or if that missing check sets things up/props or similar values, for later, and they'll pass.

Having a reliable and repeatable path to success for L1 on oos13 is still helpful for many. Even if OTAs are not working, maybe that will be sorted out with more testing too

 

[camparks]

Actually, yes, I forgot I had the same thought and tried theF1.11 boot as well with updates. I will update my post.

Having done this for the last several days, I started getting lazy in my frustation and stopped taking notes since I had narrowed down the major processes worked.

 

[maxishappy]

Leuke vondst! Jammer dat ik de Indiase MSM op mijn T-Mobile-variant heb gebruikt, dus ik kan niet meer cross-flashen.

What is 'cross-flashing' ? Can you duel boot like on windows when you have 2 installs on windows ?

 

[TheGhost1951]

Good info guys.

During your tests, were you orange-state'ing on boot? If so, have you tried the orange-state warning removal here (dropping in F11 abl.img) and seeing if that changes anything with OTA or L1 state in general? I'm not sure if the checks that are missing from F11 abl.img are maybe used elsewhere to check for bootloader state or if there's additional checks taking place and that's ONLY used at boot and never used again. Or if that missing check sets things up/props or similar values, for later, and they'll pass.

Having a reliable and repeatable path to success for L1 on oos13 is still helpful for many. Even if OTAs are not working, maybe that will be sorted out with more testing too

Hey, using the DRM app from the play store shows my Widevine security level as L1. I have LE2127 TMO stock OS13 with unlocked bootloader and rooted with magisk 26.1

 

[Appreciative]

Hey, using the DRM app from the play store shows my Widevine security level as L1. I have LE2127 TMO stock OS13 with unlocked bootloader and rooted with magisk 26.1

That's good news man. Have you tried using Netflix or Disney+ and checking to be sure? Netflix has a check for it in the app. App Settings->playback specifications

It's real cool that you're at that point. Hopefully it's easily repeatable too. A lot of conflicting info for L1 on oos12/13.

Are you using remove orange state module?
Or manual method? Or neither

 

[TheGhost1951]

That's good news man. Have you tried using Netflix or Disney+ and checking to be sure? Netflix has a check for it in the app. App Settings->playback specifications

View attachment 5929913

It's real cool that you're at that point. Hopefully it's easily repeatable too. A lot of conflicting info for L1 on oos12/13.

Are you using remove orange state module?
Or manual method? Or neither

Neither, see the Orange State at every boot. Will try Netflix to see if it starts. I don't have an account.

 

[TheGhost1951]

That's good news man. Have you tried using Netflix or Disney+ and checking to be sure? Netflix has a check for it in the app. App Settings->playback specifications

View attachment 5929913

It's real cool that you're at that point. Hopefully it's easily repeatable too. A lot of conflicting info for L1 on oos12/13.

Are you using remove orange state module?
Or manual method? Or neither

Ok, Netflix would not install from Play Store said it does not work for this device. Disney+ installed and opened and asked to signing or sign up. I downloaded Netflix 7.2 from APKPure website and it installed and opened up. My wife's phone which is the same setup as mine with the factory installed version of Netflix, she was able to open and login to Netflix no problem......

 

[Appreciative]

Ok, Netflix would not install from Play Store said it does not work for this device. Disney+ installed and opened and asked to signing or sign up. I downloaded Netflix 7.2 from APKPure website and it installed and opened up. My wife's phone which is the same setup as mine with the factory installed version of Netflix, she was able to open and login to Netflix no problem......

If she's able to login and using the same unlocked bootloader setup, check the Playback Specifications under settings. Are you passing play store certification in play store settings? I don't remember if I kept my factory installed netflix or not. I am on oos11 and gain+keep l1 after the first ota with unlocked bl.

If she's rooted with ubl and also showing L1 on oos13, that's cool. Any reason you haven't tried the orange state abl swap module?

 

[TheGhost1951]

If she's able to login and using the same unlocked bootloader setup, check the Playback Specifications under settings. Are you passing play store certification in play store settings? I don't remember if I kept my factory installed netflix or not. I am on oos11 and gain+keep l1 after the first ota with unlocked bl.

If she's rooted with ubl and also showing L1 on oos13, that's cool. Any reason you haven't tried the orange state abl swap module?

Haven't tried the abl fix, simple reason being if something does go wrong, grrr, 4 hours of starting from scratch....

 

[Appreciative]

Haven't tried the abl fix, simple reason being if something does go wrong, grrr, 4 hours of starting from scratch....

I hear you. I think you could just unload the module in adb or twrp if it failed but if I'm wrong, indeed that's a long road.

Since you're on stock Tmo oos13, did you recently temp unroot to take the ota? (We're you on oos12 prior?). If so, that's exactly how it worked for me in oos11. I go L3 with unlocked BL but if I temp unroot and take the ota, then reroot, it takes me back to L1. That could be repeatable for stock Tmo if they msm back to 11, unlock bl and root, temp unroot to take ota to 12/13. Hmmm

I'm tempted to try that and do the 4+ hr reset on my phone to test that idea. Then stick on stock Tmo for a bit. But I'm also worried oos13 will piss me off as much as oos12 did


My only issue on oos11 EU conversion is if I turn on 5G and get speeds above 500mbps, it will crash my modem. If I use hotspot, the connected device will get 500+ without my modem crashing so I dunno what that's about

 

[TheGhost1951]

I hear you. I think you could just unload the module in adb or twrp if it failed but if I'm wrong, indeed that's a long road.

Since you're on stock Tmo oos13, did you recently temp unroot to take the ota? (We're you on oos12 prior?). If so, that's exactly how it worked for me in oos11. I go L3 with unlocked BL but if I temp unroot and take the ota, then reroot, it takes me back to L1. That could be repeatable for stock Tmo if they msm back to 11, unlock bl and root, temp unroot to take ota to 12/13. Hmmm

I'm tempted to try that and do the 4+ hr reset on my phone to test that idea. Then stick on stock Tmo for a bit. But I'm also worried oos13 will piss me off as much as oos12 did


My only issue on oos11 EU conversion is if I turn on 5G and get speeds above 500mbps, it will crash my modem. If I use hotspot, the connected device will get 500+ without my modem crashing so I dunno what that's about

I was boot unlock and magisk rooted when I updated to OS13. Did not unroot or anything. Some of the updates immediately reboot after installing which prevents magisk install to inactive slot. I do know a time when it was suppose to update to 13 (I have had to start over for whatever reason) it would fail. Then I have to factory reset the phone (bootloader would still be unlocked) then take the update and then regain root through magisk. For my use, I have not had any issues. I get 5G when it is available. I live in a rural area and cell service can get a little spotty!

 

[TheGhost1951]

Also, the wife logs into our bank to balance checkbook etc.. no issues,