• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

[Guide] How to ROOT OnePlus8T (CN/IN/EU/US) KB2000,KB2001,KB2003,KB2005

Search This thread

nujackk

Senior Member
Jun 16, 2008
600
114
Kent
OnePlus 8T
OnePlus 9
I was able to temporarily boot TWRP to backup the kernel from 11.0.9.9. Instead of a boot.img file it gave a boot.emmc.win but I flashed it back with "fastboot flash boot boot.emmc.win" and it worked fine. I also tested the Magisk patch and it booted with working root access. I have North American KB2005.

Stock 11.0.9.9.KB05AA boot.emmc.win (NA): https://drive.google.com/file/d/1LS7ZL9ib9PqszQL_KW_BASQox8nOAKJX/view?usp=sharing

Magisk patched 11.0.9.9.KB05AA boot.img (NA): https://drive.google.com/file/d/15OS1wx7u7P6yc9ggDguWtVm-9Y6s8H1d/view?usp=sharing
Do you have the full NA update?
 
Last edited:

ddaharu

Senior Member
Mar 30, 2011
1,250
333
OnePlus 8T
11.0.9.9.KB05AA International Boot image & ROOT

CAUTION!
I do not know if are multiple OTA files for those still stuck on a previous versions before 11.0.8.13.KB05AA. I recommend just updating it through the system update or download the full rom. I updated through system update.
Silly question! I'm seeing that getting root for kb2005 got a few more steps so I just wanted to find out: COMING FROM SCRATCH, if I unlock my bootloader and then "fastboot boot boot.img" the correct boot.img followed by installing magisk, should I be able to get root?
 

g96818

Senior Member
Dec 27, 2014
303
55
Silly question! I'm seeing that getting root for kb2005 got a few more steps so I just wanted to find out: COMING FROM SCRATCH, if I unlock my bootloader and then "fastboot boot boot.img" the correct boot.img followed by installing magisk, should I be able to get root?
That's right. I wouldn't say there are more steps since it depends on the device.
 

pratyush28

Senior Member
Oct 4, 2016
470
184
OnePlus 8T
Sorry, don't know about a TWRP version for OnePlus8T, can you point me to it?
Thanks again ;)
Sure thing, here you go
 
  • Like
Reactions: jcespi2005

RickDangerous

Member
Feb 5, 2012
31
1
Why do you guys still prefer this way of flashing magisk? I installed twrp and flashed the magisk zip, everything works and safetynet passes too.
Well topjohnwu himself refers to this method as deprecated and recommends against it.
This installation method is deprecated and is maintained with minimum effort. YOU HAVE BEEN WARNED!
It is very difficult to accurately detect the device’s information in custom recovery environments. Due to this reason, installing Magisk through custom recoveries on modern devices is no longer recommended.
Even though it is much more convenient, I suppose this kinda makes you have second thoughts, coming from the creator of Magisk himself.
 

pratyush28

Senior Member
Oct 4, 2016
470
184
OnePlus 8T
Even though it is much more convenient, I suppose this kinda makes you have second thoughts, coming from the creator of Magisk himself.

Well the method might be deprecated but it saves a lot of time and effort. It's not like the method is not functional, it's just that it doesn't work with every device. There's been several guinea pigs now and looks like it works perfectly with OOS on 8T.

Anyways, it's up to you whether you want to go around the puddle or leap over it, both work just fine.
 
  • Like
Reactions: Lz3807775t

jcespi2005

Senior Member
Feb 15, 2006
2,380
191
50
Madrid
OnePlus 8T
OnePlus 9 Pro
Well the method might be deprecated but it saves a lot of time and effort. It's not like the method is not functional, it's just that it doesn't work with every device. There's been several guinea pigs now and looks like it works perfectly with OOS on 8T.

Anyways, it's up to you whether you want to go around the puddle or leap over it, both work just fine.
Can confirm works just fine ;-)
Rooted yesterday after latest update
 
  • Like
Reactions: pratyush28

matteool

Senior Member
Nov 4, 2010
127
82
29
www.matteoolivieri.com
hello, I bought a used kb2003, the open beta 7 is already installed.
what steps should i follow to root? should i downgrade and then reinstall the ota beta 7 update?

current settings:

adb shell getprop ro.build.version.ota
OnePlus8TOxygen_15.X.07_GLO_0070_2106281221

adb shell getprop ro.build.display.id
KB2003_15_210628
 
Last edited:
  • Like
Reactions: Lz3807775t

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    In my About phone section, my model is KB2003, but my build number said 11.0.10.10.KB05AA. Which patched boot.img should I use? The KB2003 or KB05AA?
    You won't find a KB2003 boot image because the software is determined by build numbers, not phone models.
    1
    Hi, I have 8T running on android 11( Oxygen OS 11.0.9.9 KB05DA) can anyone help me rooting it with this process

    PS I really am noob and I just unlocked the OEM (Somehow without messing it up)
    Okay i did it i'll attach the patched image for this version follow step 10 & 11 to do so
    (PS I followed "Temporarily boot into a rooted system" at Step 11)



    Attached file is patched "boot.img" for - -Oxygen OS 11.0.9.9 KB05DA { INDIAN VARIANT }

    edited --- https://anonfiles.com/vcx1m8N5u1/magisk_patched_img
    1
    @g96818 has stated (but seems to have deleted his post https://forum.xda-developers.com/t/...00-kb2001-kb2003-kb2005.4178675/post-85386145) that the easiest way to keep root after an OTA was to use Magisk to install to the inactive slot.
    I tried that a couple of times and it never worked for me. But recently I came across this: https://github.com/topjohnwu/Magisk/blob/master/docs/ota.md#devices-with-ab-partitions where it says:
    After installation is done, press the reboot button in the Magisk app. Under-the-hood, the Magisk app forces your device to switch to the updated slot, bypassing any possible post-OTA verifications.

    In the past, when I used the "install to inactive slot", I've rebooted the phone using the power button or the reboot message on the OTA install message. And that has never worked well for me.

    This time, when I updated, I rebooted using the button in Magisk after installing to the inactive slot... and it worked perfectly!

    So, @g96818 is right about this process (thank you!) and I think it's the simplest method. But the trick is to reboot from Magisk immediately after installing to the inactive slot.

    Note: since I have both Magisk and TWRP installed I had to restore the active boot and recovery partitions to stock before running the update (edit: only if the update is incremental). But that's easily done using a terminal session.
  • 19
    DISCLAIMER

    I have only tested this on my OnePlus8T Indian model - KB2001
    Huge thanks to @topjohnwu for his magic.

    YOU NEED TO UNLOCK YOUR BOOTLOADER!
    In case you brick your device, use this unbrick guide
    If you get into a boot-loop by flashing problematic magisk modules, consider using the patched recoveries from my post HERE to remove the modules.


    Manual ROOT procedure
    Skip to step #6 and then #10 if you do not want to use the payload dumper tool and want to directly flash the patched images for your variant and Build version!
    1. If you haven't updated OxygenOS yet, download it via the system updater. It will be stored in /sdcard/.Ota folder in your internal storage ( /sdcard/.Ota/OnePlus8TOxygen_15.I.16_OTA_0160_all_2010150110_84be0c.zip )
      The size should be >2GB. If it is not, it's probably an incremental OTA, not a full one. This guide will NOT work on incremental OTA Zips.
      DO NOT Reboot or else you will lose the file
    2. Copy the ZIP file over to your PC
    3. Download the Payload Dumper
      Alt dumper for windows only:
      https://androidfilehost.com/?fid=818070582850510260
      1.Put payload.bin to "payload_input" folder
      2.Run payload_dumper.exe
      3.Successfully extracted img files are in "payload_output" folder
      Extract the zip in the folder where you downloaded the payload dumper.
    4. Follow the instructions in the readme of payload dumper, and extract the OTA images:
      Code:
      python payload_dumper.py payload.bin
      You will get a boot.img file in the output folder.
    5. Proceed with installing the OxygenOS update and reboot the phone.
    6. Download and install the latest magisk canary release to your phone : https://raw.githubusercontent.com/topjohnwu/magisk_files/canary/app-debug.apk
    7. Copy over the boot.img file created by payload_dumper to your internal storage
    8. Open Magisk Manager > Select Install > "Select and patch a file"
    9. Browse and select the boot.img file.
      Magisk will create a patched boot.img file in /sdcard/Downloads/magisk_patched.img . Copy this file over to your PC.​
    10. Reboot to fastboot mode
      Code:
      adb reboot bootloader
    11. Either flash the patched magisk_patched.img in the active slot or temporarily boot into it if you are skeptical.
      I recommend to BOOT first and then perform a direct install via magisk as it is more reliable to patch the active slot.

      To flash:
      Code:
      fastboot flash boot magisk_patched.img
      To Temporarily boot into a rooted system (RECOMMENDED!!):
      Code:
      fastboot boot magisk_patched.img

      If you used the fastboot BOOT method, next you'll have to open magisk manager again, and this time, perform a "Direct Install".
      This will install magisk on the active boot slot and the next reboot will give you root.
    How to update OTA and KEEP ROOT
    It is advised to disable all magisk modules to be safe!
    - Go to System-Update
    - Tap OK when the message that you are rooted appears
    - Tap "Download and install"
    - Wait until you are prompted to reboot - DO NOT REBOOT NOW!
    - Open Magisk Manager, select install -> Install to inactive slot and start installation
    - When Magisk has finished to install, reboot and you stay rooted with newest OTA.

    For the curious / impatient, Here are the OTAs / boot images for the different 8T Versions:

    To find your model and build to download the right file:
    Bash:
    adb shell getprop ro.product.model
    KB2001
    adb shell getprop ro.build.version.ota
    OnePlus8TOxygen_15.I.16_GLO_0160_2010150110
    adb shell getprop ro.build.display.id
    KB2001_15_201015
    KB2000 / KB05?? - Chinese Variant
    KB2001 / KB05DA - Indian Variant
    KB2003 / KB05BA - EU Variant
    KB2005 / KB05AA - International Variant

    Credit @northmendo @SAKO4444GODZ and @g96818
    UPDATE:
    For this variant please refer to this guide first! The OTA updates on this variant are partial and hence the rooting method isn't straightforward.
    https://forum.xda-developers.com/showpost.php?p=83791723&postcount=95
    Stock KB2005_15_201015 boot image SHA-1 D59C74767F74F4D7876BDCA930DEF23CCAA3FD2E
    Patched KB2005_15_201015 boot image SHA-1 C1126E8057EF9FB25D80645B850374BBDDE983C5
    OOS 11.0.3.4.KB05AA : Refer to https://forum.xda-developers.com/showpost.php?p=83893183&postcount=151
    OOS 11.0.4.5.KB05AA : Refer to https://forum.xda-developers.com/showpost.php?p=83940123&postcount=210
    OOS 11.0.5.6.KB05AA : Refer to https://forum.xda-developers.com/showpost.php?p=84003695&postcount=258

    KB2007 / KB05CB - T-Mobile Variant
    ¯\_(ツ)_/¯

    It's also a good practice to backup a few important partitions once you're rooted.
    I used ADB shell, but you can use any terminal emulator from the play store (Termux)

    adb shell
    [email protected]:/ $ su
    [email protected]:/ #

    Now run:
    Bash:
    dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/modemst1 of=/sdcard/modemst1.img
    dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/modemst2 of=/sdcard/modemst2.img
    dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/modemdump of=/sdcard/modemdump.img
    dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/persist of=/sdcard/persist.img
    dd if=/dev/block/platform/soc/1d84000.ufshc/by-name/persist_bkp of=/sdcard/persist_bkp.img
    Other Misc Stuff for my reference!

    If after flashing a custom kernel, you see Sim cards not working:
    Be sure NOT to have a magisk patched image on both boot slots. That causes this behavior
    Recovering lost app data after a failed boot:
    • Download and flash one of my adb-patched recoveries from my post here
    • Reboot to recovery, enter the password, open adb shell
    • Create a tar bundle of the app via tar -czvf MiXBackup.tgz data/data/com.mixplorer/silver and adb pull it to your system
    • *Or* the entire /data partition via tar --exclude /data/media/0 -czvf /data/media/0/data.tgz data/ (You CANNOT restore all of /data like this due to encryption stuff! but you can extract one app at a time and test)
    • Reinstall the app , reboot to recovery, adb push, and extract via tar xf MiXBackup.tar
    4
    11.0.8.12 boot.img? Anyone?
    Already patched 11.0.8.12 boot.img EU variant

    discleamer;
    Not my fault if your phone gets bricked


    cheers!
    3
    I'm posting here to detail how I solved an OTA update issue with my OnePlus 8T. For disclosure, I purchased this phone used, like new from someone who themselves got it open-box from a reputable retailer. So I don't know the full history of the phone, only that when I first booted it, it had clearly been factory reset and has been running flawlessly.

    After I got the phone, I started looking into options for rooting. I unlocked the bootloader, and then, seeing that there was an OTA update for 11.0.9.9.KB05AA, prepared to try to root. I ultimately downloaded a Magisk-pre-patched boot image, thanks to Xi Jing Pooh (whoever you are), linked in these forum.

    So after updated to the 11.0.9.9 OTA, I flashed that image, gained root, and again, didn't have any issues.

    However, when the 11.0.10.10.KB05AA rolled out, I ran into problems. The OTA update kept failing with the message "Couldn't update, Installation problem."

    I had prepared to update by following instructions on the forum; going into Magisk and restoring the stock boot image (an option when you choose "Uninstall Magisk"). I think it turned out I may flashed the pre-rooted boot image before ever booting into 11.0.9.9, so that might have been a problem. So I then used fastboot to flash the stock 11.0.9.9 boot image. I even did this to both a and b slots (maybe not necessary, I'm not sure).

    While I did successfully unroot, my attempts to OTA update still kept failing. I then tried to manually update using a local copy of the OTA zip and got the same error.

    After discussing with and getting good advice from @BillGoss and @g96818, I decided I would need to use the MSM tool to fully restore my phone to a previous OOS version and then incrementally update. @BillGoss also pointedly recommended I should do a full, manual update to 11.0 8.13 before letting OTA updates install, to ensure my file system had no inconsistencies.

    Before I did this, I decided to try to capture a logcat while once again trying to manually update using my local zip of the 11.0.10.10 OTA. I started the update then immediately issued the logcat command in adb shell. As soon as the OTA install failed, I stopped logcat, then scrolled back to find the source of the error. Turned out that my dsp partition had been modified at some point and its SHA did not match that expected by the update.

    @BillGoss pointed out to me later that 1) it's likely that the 11.0.9.9 OTA didn't touch the dsp partition, and that's why I had no problem with that update, and 2) I could have tried to dump the dsp parition from the full OTA for 11.0.8.13 and fix the issue without reverting to using the MSM tool.

    But, I went ahead and followed detailed instructions to restore the phone to 11.0.7.9 (the latest MSM tool version). Per Bill's advice, after getting the phone setup again, I ignored prompts to download the OTA for 11.0.10.10 and manually ran the full OTA for 11.0.8.13. Finally, I OTA upgraded to 11.0.10.10, this time with no issues at all.

    I forgot to unlock my bootloader during this process, so ended up doing that and setting up the phone twice. Then I rooted again, this time using the alpha TWRP that can be found here and installing the Magisk zip, which itself patches and installs the rooted boot image. This seems to have worked fine, and I've tested that I can also easily restore the stock boot before attempting to install the next OTA that comes out.