• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[Guide] How to ROOT OnePlus8T (CN/IN/EU/US) KB2000,KB2001,KB2003,KB2005

Search This thread

DroidFreak32

Senior Member
Jul 24, 2013
1,259
2,507
Mangalore
Sony Xperia SP
Google Nexus 5
DISCLAIMER

I have only tested this on my OnePlus8T Indian model - KB2001
Huge thanks to @topjohnwu for his magic.

YOU NEED TO UNLOCK YOUR BOOTLOADER!
In case you brick your device, use this unbrick guide
If you get into a boot-loop by flashing problematic magisk modules, consider using the patched recoveries from my post HERE to remove the modules.


Manual ROOT procedure
Skip to step #6 and then #10 if you do not want to use the payload dumper tool and want to directly flash the patched images for your variant and Build version!
  1. If you haven't updated OxygenOS yet, download it via the system updater. It will be stored in /sdcard/.Ota folder in your internal storage ( /sdcard/.Ota/OnePlus8TOxygen_15.I.16_OTA_0160_all_2010150110_84be0c.zip )
    The size should be >2GB. If it is not, it's probably an incremental OTA, not a full one. This guide will NOT work on incremental OTA Zips.
    DO NOT Reboot or else you will lose the file
  2. Copy the ZIP file over to your PC
  3. Download the Payload Dumper
    Alt dumper for windows only:
    https://androidfilehost.com/?fid=818070582850510260
    1.Put payload.bin to "payload_input" folder
    2.Run payload_dumper.exe
    3.Successfully extracted img files are in "payload_output" folder
    Extract the zip in the folder where you downloaded the payload dumper.
  4. Follow the instructions in the readme of payload dumper, and extract the OTA images:
    Code:
    python payload_dumper.py payload.bin
    You will get a boot.img file in the output folder.
  5. Proceed with installing the OxygenOS update and reboot the phone.
  6. Download and install the latest magisk canary release to your phone : https://raw.githubusercontent.com/topjohnwu/magisk_files/canary/app-debug.apk
  7. Copy over the boot.img file created by payload_dumper to your internal storage
  8. Open Magisk Manager > Select Install > "Select and patch a file"
  9. Browse and select the boot.img file.
    Magisk will create a patched boot.img file in /sdcard/Downloads/magisk_patched.img . Copy this file over to your PC.​
  10. Reboot to fastboot mode
    Code:
    adb reboot bootloader
  11. Either flash the patched magisk_patched.img in the active slot or temporarily boot into it if you are skeptical.
    I recommend to BOOT first and then perform a direct install via magisk as it is more reliable to patch the active slot.

    To flash:
    Code:
    fastboot flash boot magisk_patched.img
    To Temporarily boot into a rooted system (RECOMMENDED!!):
    Code:
    fastboot boot magisk_patched.img

    If you used the fastboot BOOT method, next you'll have to open magisk manager again, and this time, perform a "Direct Install".
    This will install magisk on the active boot slot and the next reboot will give you root.
How to update OTA and KEEP ROOT
It is advised to disable all magisk modules to be safe!
- Go to System-Update
- Tap OK when the message that you are rooted appears
- Tap "Download and install"
- Wait until you are prompted to reboot - DO NOT REBOOT NOW!
- Open Magisk Manager, select install -> Install to inactive slot and start installation
- When Magisk has finished to install, reboot and you stay rooted with newest OTA.

For the curious / impatient, Here are the OTAs / boot images for the different 8T Versions:

To find your model and build to download the right file:
Bash:
adb shell getprop ro.product.model
KB2001
adb shell getprop ro.build.version.ota
OnePlus8TOxygen_15.I.16_GLO_0160_2010150110
adb shell getprop ro.build.display.id
KB2001_15_201015
KB2000 / KB05?? - Chinese Variant
KB2001 / KB05DA - Indian Variant
KB2003 / KB05BA - EU Variant
KB2005 / KB05AA - International Variant

Credit @northmendo @SAKO4444GODZ and @g96818
UPDATE:
For this variant please refer to this guide first! The OTA updates on this variant are partial and hence the rooting method isn't straightforward.
https://forum.xda-developers.com/showpost.php?p=83791723&postcount=95
Stock KB2005_15_201015 boot image SHA-1 D59C74767F74F4D7876BDCA930DEF23CCAA3FD2E
Patched KB2005_15_201015 boot image SHA-1 C1126E8057EF9FB25D80645B850374BBDDE983C5
OOS 11.0.3.4.KB05AA : Refer to https://forum.xda-developers.com/showpost.php?p=83893183&postcount=151
OOS 11.0.4.5.KB05AA : Refer to https://forum.xda-developers.com/showpost.php?p=83940123&postcount=210
OOS 11.0.5.6.KB05AA : Refer to https://forum.xda-developers.com/showpost.php?p=84003695&postcount=258

KB2007 / KB05CB - T-Mobile Variant
¯\_(ツ)_/¯

It's also a good practice to backup a few important partitions once you're rooted.
I used ADB shell, but you can use any terminal emulator from the play store (Termux)

adb shell
[email protected]:/ $ su
[email protected]:/ #

Now run:
Bash:
dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/modemst1 of=/sdcard/modemst1.img
dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/modemst2 of=/sdcard/modemst2.img
dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/modemdump of=/sdcard/modemdump.img
dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/persist of=/sdcard/persist.img
dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/persist_bkp of=/sdcard/persist_bkp.img
Other Misc Stuff for my reference!

If after flashing a custom kernel, you see Sim cards not working:
Be sure NOT to have a magisk patched image on both boot slots. That causes this behavior
Recovering lost app data after a failed boot:
  • Download and flash one of my adb-patched recoveries from my post here
  • Reboot to recovery, enter the password, open adb shell
  • Create a tar bundle of the app via tar -czvf MiXBackup.tgz data/data/com.mixplorer/silver and adb pull it to your system
  • *Or* the entire /data partition via tar --exclude /data/media/0 -czvf /data/media/0/data.tgz data/ (You CANNOT restore all of /data like this due to encryption stuff! but you can extract one app at a time and test)
  • Reinstall the app , reboot to recovery, adb push, and extract via tar xf MiXBackup.tar
 

Attachments

  • Screenshot_20201019-164245.jpg
    Screenshot_20201019-164245.jpg
    203.7 KB · Views: 4,009
  • Screenshot_20201019-164234.jpg
    Screenshot_20201019-164234.jpg
    135.4 KB · Views: 3,982
Last edited:

DroidFreak32

Senior Member
Jul 24, 2013
1,259
2,507
Mangalore
Sony Xperia SP
Google Nexus 5
I wonder if this same process would work for the KB2005 model? Unfortunately I was too quick to pull the trigger on the system update ??*♂️

guess I'll be waiting a little longer

Yep, the procedure will stay the same. I would recommend waiting for someone to upload the OOS OTA zip or Oneplus to provide a direct download link.
However, if you are on the same build version, you try to patch the KB2001 boot.img and just use the fastboot boot method instead of flashing the patched image.
If it boots, you're in luck. If it doesn't, force reboot back into stock OOS.
 

5nickers

Senior Member
Sep 26, 2010
601
171
-
Would be nice if someone can do this with the european version too. Maybe I can do it tomorrow but only if the dumper tool works on windows. Any idea on that?
 

DroidFreak32

Senior Member
Jul 24, 2013
1,259
2,507
Mangalore
Sony Xperia SP
Google Nexus 5

5nickers

Senior Member
Sep 26, 2010
601
171
-

theincognito

Senior Member
Feb 26, 2015
594
731
Redmi K20 Pro
OnePlus 8T
  • Like
Reactions: TheMystic

epr

Senior Member
Jan 19, 2007
124
20
I captured the OTA yesterday. But I'm having a hard time getting the payload extracted.

Here is the link to the OTA:

https://r5---sn-vgqs7ney.gvt1.com/p.../c552fbf9fb85a74c246c1265a2f10b2382015e82.zip

If I understand correctly, we need to use python payload_dumber.py --diff payload.bin
But we don't have the original boot.img?
Here is the boot.img extracted from your OTA:
https://drive.google.com/file/d/1jxf6EBSU6-8TuIUV_vN5ABiy-bUA38L1/view?usp=sharing
 
Last edited:

JWhetstone02

Senior Member
Mar 6, 2011
1,071
871
South Carolina

I captured the OTA yesterday. But I'm having a hard time getting the payload extracted.

Here is the link to the OTA:

https://r5---sn-vgqs7ney.gvt1.com/p.../c552fbf9fb85a74c246c1265a2f10b2382015e82.zip

If I understand correctly, we need to use python payload_dumber.py --diff payload.bin
But we don't have the original boot.img?

What model is this for? ... Or would it matter?
 

DroidFreak32

Senior Member
Jul 24, 2013
1,259
2,507
Mangalore
Sony Xperia SP
Google Nexus 5
I captured the OTA yesterday. But I'm having a hard time getting the payload extracted.
Here is the link to the OTA:
https://r5---sn-vgqs7ney.gvt1.com/p.../c552fbf9fb85a74c246c1265a2f10b2382015e82.zip
If I understand correctly, we need to use python payload_dumber.py --diff payload.bin
But we don't have the original boot.img?
Yes, you'll need to have the original boot.img as this is just an incremental OTA, not a full one.
I will add a note in the OP as well to not use incremental OTA files.


I wouldn't use this image. It cannot be just 4.4 MB in size. I believe it is a partial extract as the OTA zip is just incremental, not a full ~2GB OTA
 

theincognito

Senior Member
Feb 26, 2015
594
731
Redmi K20 Pro
OnePlus 8T
Yes, you'll need to have the original boot.img as this is just an incremental OTA, not a full one.
I will add a note in the OP as well to not use incremental OTA files.



I wouldn't use this image. It cannot be just 4.4 MB in size. I believe it is a partial extract as the OTA zip is just incremental, not a full ~2GB OTA

Hi. Could you please answer my earlier question? Thank you :)
 

zellleonhart

Senior Member
Jan 19, 2013
579
184

theincognito

Senior Member
Feb 26, 2015
594
731
Redmi K20 Pro
OnePlus 8T
I am about to receive my China version of OnePlus 8T. Since the Global ROM is not yet released by OnePlus, if I flash this full OTA will it work? I want to replace the stock HydrogenOS with OxygenOS.

It will. Though I suggest that you flash the EU variant over the Indian variant (cleanest OOS variant).

---------- Post added at 09:07 PM ---------- Previous post was at 08:49 PM ----------

@DroidFreak32

Magisk patched boot image for OOS 11.0.1.2 EU variant (from the full OTA zip - OnePlus8TOxygen_15.E.17_OTA_0170_all_2010150108_77edc51b51680.zip)

https://androidfilehost.com/?fid=10763459528675567936
 

Top Liked Posts