How To Guide (Guide) Install TWRP + Root + Install Magisk + Bypass Safetynet

[PlasmaTornado]

Please note, the TWRP image used IS NOT the official TWRP image.
I am not responsible for any any harm, such as bricking, or bootloops, which may happen to your device. This is what worked for me.

Warning
As stated by @beatbreakee , do not flash anything on a T-Mobile related device.
Please read beatbreakee's comment regarding this.

Warning
This has only been tested on Android 13. This guide may not work for other Android versions.

Prerequisites

1. Unlocked Bootloader
2. Magisk 25.2 Installation ZIP (see attached files)
3. TWRP Image (download from GDrive)
4. ADB and Fastboot tools are installed on your machine. Please see this guide
5. Android 13

Spoiler: Step 1 - Unlocking Bootloader

Step 1 - Unlocking Bootloader:
1.A - Enable OEM Unlocking:
1. Open Settings Application -> About device -> Version -> Tap on Build Number 7 times
2. Open Settings Application -> Additional Settings -> Developer Options
3. Enable OEM Unlocking
4. Enable USB Debugging

1.B - Entering Bootloader
The bootloader must be unlocked in order to flash the recovery.
Ensure the device is connected to the computer via ADB by entering the following command

adb devices

The output should be something similar to this:

(note the device name on the left will not be the same)

Reboot into the bootloader by entering the following command:

adb reboot bootloader

1.C - Unlock
Once entered, enter the following command:

fastboot flashing unlock

WARNING: THIS WILL WIPE ALL DATA ON THE DEVICE

Use the volume keys to select unlocking, and then use the power button to confirm.
Once complete, enter the following command:

fastboot reboot

You will now have to go through the device setup.
Repeat steps 1.A and 1.B to enter back into the bootloader

Spoiler: Step 2 - Flashing TWRP

Step 2 - Flashing TWRP:
2.A - Entering Bootloader
Repeat steps 1.A and 1.B to re-enter the bootloader

2.B - Flashing TWRP:
Again, this IS NOT the official TWRP image. I am not responsible for any harm which this may cause to this device. That being said, it appears to be functional.
The image used is from a leak found on this XDA post

This is not a bootable image. You must flash. fastboot boot img will not work
Enter the following commands to flash the TWRP image:

fastboot flash recovery_a twrp.img

fastboot flash recovery_b twrp.img

fastboot reboot recovery

You should notice you are in TWRP.
You may need to change the language to English.

2.C - Changing TWRP Language:
1. Tap on the button on the Second column, Third Row
2. Tap on the World icon
3. Select your language
4. Tap on the button on the bottom right corner of your display.

2.D - Booting into your phone
1. Select Reboot
2. Select System
You should now have successfully booted in the system with TWRP installed as your recovery

Spoiler: Step 3 - Flashing Magisk

Step 3 - Flashing Magisk:
3.A Preparing the Device:
1. Move the Magisk-v25-2.zip to your device
2. Reboot into your recovery / TWRP
This can be done by entering the following ADB command:

adb reboot recovery

3.B - Flashing Magisk:
1. Tap Install
2. Select the Magisk-v25-2.zip
3. Swipe to flash (this may take some time)
4. Tap Reboot
5. Tap System
You should now enter the device

3.C - Installing Magisk APK
Install the Magisk APK, click here to download the APK.
Install the APK, and you should have root!

Spoiler: Fixing Data Backup [Optional]

If you encounter a createTarFork() exited with error 255, do the following:
1. Reboot into TWRP
2. Select File Manager
3. Navigate to /data
4. Copy /data/fonts into /sdcard/
5. Copy /data/nandswap into /sdcard/
6. Delete /data/fonts
7. Delete /data/nandswap

The error should now be resolved
The deleted files should not cause any issues. If any issues do occur, then promptly restore them using the backups made to /sdcard/.

Spoiler: Bypassing Safetynet [Optional]

Step - Bypassing Safetynet:
This is optional; however, highly recommend
Note, due to the nature of Safetynet, this can change at anytime and may begin failing in the future.
A - Repackaging Magisk
1. Launch Magisk Manager
2. Tap Settings Icon (Top Right Corner)
3. Tap "Hide The Magisk App"
4. Enter New Application Name
5. Click OK and wait
6. Uninstall original Magisk APK if it has persisted

B - Enable Zygisk & Deny List
1. Launch Magisk Manager
2. Tap Settings Icon (Top Right Corner)
3. Enable "Zygisk"
4. Enable "Enforce Deny List"

C - Configure Deny List
it is recommended to add any application you would like to hide from Magisk here
1. Launch Magisk Manager
2. Tap Settings Icon (Top Right Corner)
3. Tap "Configure DenyList"
4. Tap the 3 dots in the top right and select "Show System Apps"
5. Select the following applications:
~ Android System
~ Google Play Store
~ Google Play Services
~ Google Services Framework
D - Delete App Data
1. Launch Settings Application
2. Select Apps
3. Select App Management
4. Clear data for the following apps:
~ Google Play Store
~ Google Play Services
~ Google Services Framework
5. Reboot the device

E - Flash Universal Safetynet Fix
1. Download the Universal Safetynet Fix
2. Launch Magisk
3. Select Modules
4. Select "Install From Storage"
5. Select Universal Safetynet Fix
6. Wait for Flashing to complete
7. Reboot

F - Test Safetynet
1. Install YASNAC
2. Grant Super User rights
3. Select "Run Safetynet Attestation"
If both checks pass, you successfully have passed Safetynet!

 

[Canuck Knarf]

Please note, the TWRP image used IS NOT the official TWRP image.
I am not responsible for any any harm, such as bricking, or bootloops, which may happen to your device. This is what worked for me.

Prerequisites

1. Unlocked Bootloader
2. Magisk 25.2 Installation ZIP (see attached files)
3. TWRP Image (download from GDrive)
4. ADB and Fastboot tools are installed on your machine. Please see this guide

Step 1 - Unlocking Bootloader:
1.A - Enable OEM Unlocking:
1. Open Settings -> About -> Tap on Build Number 7 times
2. Open Developer Settings
3. Enable OEM Unlocking
4. Enable Android Debugging Bridge (ADB)

1.B - Entering Bootloader
The bootloader must be unlocked in order to flash the recovery.
Ensure the device is connected to the computer via ADB by entering the following command

adb devices

The output should be something similar to this:
View attachment 5792895
(note the device name on the left will not be the same)

Reboot into the bootloader by entering the following command:

adb reboot bootloader

1.C - Unlock
Once entered, enter the following command:

fastboot oem unlock

WARNING: THIS WILL WIPE ALL DATA ON THE DEVICE

Then finally:

fastboot reboot

You will now have to go through the device setup.
Repeat steps 1.A and 1.B to enter back into the bootloader

Step 2 - Flashing TWRP Image:
2.A - Entering Bootloader
Repeat steps 1.A and 1.B to re-enter the bootloader

2.B - Flashing TWRP:
Again, this IS NOT the official TWRP image. I am not responsible for any harm which this may cause to this device. That being said, it appears to be functional.
The image used is from a leak found on this XDA post

! It is HIGHLY recommended that you boot into the twrp.img before flashing to ensure that TWRPworks . I did not, but I recommend you do. !
To test this, enter the following command:

fastboot boot twrp.img

Enter the following commands to flash the TWRP image:

fastboot flash recovery_a twrp.image

fastboot flash recovery_b twrp.image

fastboot reboot recovery

You should notice you are in TWRP.
You may need to change the language to English.

2.C - Changing TWRP Language:
1. Tap on the button on the Second column, Third Row
2. Tap on the World icon
3. Select your language
4. Tap on the button on the bottom right corner of your display.

2.D - Booting into your phone
1. Select Reboot
2. Select System
You should now have successfully booted in the system with TWRP installed as your recovery

Step 3 - Flashing Magisk:
3.A Preparing the Device:
1. Move the Magisk-v25-2.zip to your device
2. Reboot into your recovery / TWRP
This can be done by entering the following ADB command:

adb reboot recovery

3.B - Flashing Magisk:
1. Tap Install
2. Select the Magisk-v25-2.zip
3. Swipe to flash (this may take some time)
4. Tap Reboot

You should now enter the device

3.C - Installing Magisk APK
If for some reason the Magisk Installer did not install the Magisk APK, click here to download the APK.
Install the APK, and you should have root!

Good post but one problem...to unlock is " fastboot flashing unlock"

 

[PlasmaTornado]

Good post but one problem...to unlock is " fastboot flashing unlock"

Of course! Thank you, used to the old way of unlocking

 

[kouzelnik3]

I wonder about any major issues with this TWRP as of now. Updating ZIP OOS13 with flashing magisk direclty is working etc.?

 

[PlasmaTornado]

I wonder about any major issues with this TWRP as of now. Updating ZIP OOS13 with flashing magisk direclty is working etc.?

Following the method created by @dladz should still work perfectly fine!
There could still be issues with this TWRP as this is not an official image.
AFAIK Switching ROM is still untested, but decryption, backups and flashing are all confirmed working, which for me makes me feel significantly more comfortable

 

[kouzelnik3]

I won't switch ROMs as there aren't any, so this is ok. I was just asking if installing official OOS updates can be done via twrp now with flashing magisk right after for example.
But I glad decryption, backups and flashing zips working fine now. This is great news!

 

[PlasmaTornado]

I won't switch ROMs as there aren't any, so this is ok. I was just asking if installing official OOS updates can be done via twrp now with flashing magisk right after for example.
But I glad decryption, backups and flashing zips working fine now. This is great news!

This has yet to be tested but I have high hopes! If anyone could confirm in the near future it would be fantastic!

 

[Canuck Knarf]

This has yet to be tested but I have high hopes! If anyone could confirm in the near future it would be fantastic!

I will try factory wipe...flash flash from 2213...to 2215...might work

 

[PlasmaTornado]

I will try factory wipe...flash flash from 2213...to 2215...might work

Fantastic news. Let us know the results!

 

[beatbreakee]

i wouldnt advise ANYONE with an original TMOBILE device, ANY attempt to flash ANY firmware from the official builds just yet. Tmobile embedded a VERY WELL HIDDEN check into the EFS partition that only appeared in builds after 11_A.14 ... This check forcefully activates a lock triggered by the CarrierDevicePolicy.xml in the efs system... and if the Region and model does not match the original build that it came with, all of your apps will be completely disabled and there is nothing accessible but the settings button. It also disables ADB/USB debugging completely, and deauthorizes your computer from the adb wireless keys too... then it removes the USB DEBUGGING toggle from settings, followed by a persistent message that your phone is "Violating Contract Policy... Please contact after sales for support" ... Tmobile cannot remove this warning... and even them sending an UNLOCK request to your phone for APPROVED will get ignored by your phone. You can hear ringing, but cannot accept calls... hear emails but not open them,.. and you dialer is in emergency calls only!...

At this point you will think panic is the only option, but instead just Pull your sim card, and use your buttons to force reboot and enter recovery .... Then do a Format Data ,,,, followed by a reboot, but do not put your sim back in... Until you go thru the whole setup wizard, enable usb debugging, and then flash a rollback package to a fw earlier than the one i listed above, your phone will INSTANTLY lock again any time you insert ANY sim card.

Im very sure that there is a system process that can be disabled which will at least block the lockout.... but i dont have that knowledge as to which process(es) are calling it! A logcat generated about 15 screens on my computer as soon as i plugged a sim in... so that was too much for me to sift thru. This is present on both the 10 Pro and 10 T so be warned.... If you are already not using your original T-MO firmware, but you also have been loading other regions with no problem, that does not matter.... I have found an exact reference to the ORIGINAL FW build and Model # that was loaded by TMO at the factory level, in several different TXT and XML files inside the EFS part. AND my 10T and 10 Pro BOTH have been fully bricked, then formatted and flashed thru an authorized MSM Account.... Doing an ERASE ENTIRE FILE SYSTEM, thru msm, did not get rid of this file, so i doubt a twrp level wipe will do it either... MAYBE an "unlock Critical" in Fastboot, followed by a "Fastboot wipe", "DM-verity disable", and "VB-Meta erasure" MIGHT take out this crazy security system, but i know this .... if you flash an original FW using TWRP, it has protections in it to keep IT (twrp) from being overwritten, so you might find yourself in bootloop territory if you region hop.... cuz the fw might notice the changes to the partitions... For now, until someone is brave enough to challenge the Android 12 kernel and remove these trapdoors, I would just be happy you have TWRP, and wait for the person who finds and slays the Tmobile Dragon hidden in our phones! But this is truly an android 12 function that was put in place for Carrier and Manufacturer benefit ONLY. Another strike against 1+

 

[PlasmaTornado]

i wouldnt advise ANYONE with an original TMOBILE device, ANY attempt to flash ANY firmware from the official builds just yet. Tmobile embedded a VERY WELL HIDDEN check into the EFS partition that only appeared in builds after 11_A.14 ... This check forcefully activates a lock triggered by the CarrierDevicePolicy.xml in the efs system... and if the Region and model does not match the original build that it came with, all of your apps will be completely disabled and there is nothing accessible but the settings button. It also disables ADB/USB debugging completely, and deauthorizes your computer from the adb wireless keys too... then it removes the USB DEBUGGING toggle from settings, followed by a persistent message that your phone is "Violating Contract Policy... Please contact after sales for support" ... Tmobile cannot remove this warning... and even them sending an UNLOCK request to your phone for APPROVED will get ignored by your phone. You can hear ringing, but cannot accept calls... hear emails but not open them,.. and you dialer is in emergency calls only!...

At this point you will think panic is the only option, but instead just Pull your sim card, and use your buttons to force reboot and enter recovery .... Then do a Format Data ,,,, followed by a reboot, but do not put your sim back in... Until you go thru the whole setup wizard, enable usb debugging, and then flash a rollback package to a fw earlier than the one i listed above, your phone will INSTANTLY lock again any time you insert ANY sim card.

Im very sure that there is a system process that can be disabled which will at least block the lockout.... but i dont have that knowledge as to which process(es) are calling it! A logcat generated about 15 screens on my computer as soon as i plugged a sim in... so that was too much for me to sift thru. This is present on both the 10 Pro and 10 T so be warned.... If you are already not using your original T-MO firmware, but you also have been loading other regions with no problem, that does not matter.... I have found an exact reference to the ORIGINAL FW build and Model # that was loaded by TMO at the factory level, in several different TXT and XML files inside the EFS part. So this is truly an android 12 function that was put in place for Carrier benefit ONLY. Another strike against 1+

Absolutely despicable and such an anti-consumer technique.
This stands against everything OnePlus was. It's sad to see OnePlus turn into such an anti-developer phone
A Carrier should never have this much power over a device. It is absurd

 

[beatbreakee]

heres a google drive link to my account if anyone wants to see a video of what you will go thru if triggered!

feel free to share or re-upload the link/video to anywhere... ppl need to know this is happening thanks to Tmobile and Oneplus collaboration. I have not seen any reference to another carrier inside any of the device policy files, and my phone was restored to a NON TMO branded build of android 12 for the 2217 NA model, so it should NOT have even recognized the TMO policies cuz i even used a new sim card after the MSM Unbrick, and it still instantly locked in less than a second of plugging it in... heres the vid

https://drive.google.com/file/d/17H6YpGrUCe1Y7PoFji4gperdpTHNX5AI/view?usp=sharing

 

[beatbreakee]

also everyone should know, that EVERY fw on the internet no matter whether it is labeled, 2213, or 2215... 2217, as well as 2413-2419 ALL have EVERY other model's manifest built in and all of the restrictions / bloatware that each region comes with, saved into the OFP extracted files.... so there really is nothing that expressly was bricking your phones by simply flashing a different labeled FW..... the brick came from the manifest reading the region identifiers that the manifests are labeled under.... it is a file that is again picked by some random hidden check inside the TMO EFS, and as soon as your phone tries to boot the newly flashed FW, the TMO Lock is what bricks your phone, to either a bootloop state, or if you continue to force a flash by using Fastboot , you will have a non responsive phone, thanks to this stupid security issue. If unresponsive, the only way out is MSM Tool... and i can help you locate your test points if your buttons dont work.

I cannot publicly post a picture nor a description of where the test points lie inside the 10T , because i already got a cease and desist letter from BBK and i dont know if they have said anything to the mods here about posting Undisclosed hardware access points.... but ive been a member here almost 10 years, and i aint risking a ban from a tattle tale company! There are test points on the 10 t though,.. just well hidden!

The 2nd pic is of the 2217 Unpacked OFP , yet the build prop shows a 2210-2211 base in one and a 2413-2415 base in the.... with NO 2217 in either prop,or manifest file, yet when my phone was flashed back from Brick status, THIS is the FW that was used, and my phone identifies as a 2217 NA now..... can oneplus be any more clear that they have completely turned against us, by straight SHOWING US that they are being super cryptic and sneaky in something as common as the BUILD.PROP files?!?

 

[kouzelnik3]

The weird thing happened to me. I was doing "fastboot boot twrp.img" and adb gave me an error "Too many links" and the device only shows a OP logo for a half second, then turned off and then again repetatively.
Even if I turned off the device by holding power button + volume up + volume down, then turned on, same behavior happened.
Well, my fastboot was accessible so I did "fastboot boot boot.img" which worked and system booted up. But what happened, what might been wrong?

 

[Canuck Knarf]

The weird thing happened to me. I was doing "fastboot boot twrp.img" and adb gave me an error "Too many links" and the device only shows a OP logo for a half second, then turned off and then again repetatively.
Even if I turned off the device by holding power button + volume up + volume down, then turned on, same behavior happened.
Well, my fastboot was accessible so I did "fastboot boot boot.img" which worked and system booted up. But what happened, what might been wrong?

It could been...cause you might of had to many things open containing the same file...plus you might want to try the command ( fastboot flash recovery_a )....then ( fastboot flash recovery_b )

 

[kouzelnik3]

It could been...cause you might of had to many things open containing the same file...plus you might want to try the command ( fastboot flash recovery_a )....then ( fastboot flash recovery_b )

Oh. I had opened like two or three folders containing that file, yes. But this can cause it? Wow. And I wanted to try to boot it first instead of flashing it.

 

[Canuck Knarf]

Oh. I had opened like two or three folders containing that file, yes. But this can cause it? Wow. And I wanted to try to boot it first instead of flashing it.

Yeah i hear you but I'm not sure if this a bootable version or a just install version....I will try it on mine to see if i get the same as you

 

[Canuck Knarf]

Don't use command "fastboot boot twrp.img"....your phone will keep rebooting to op logo...but fastboot still works

 

[kouzelnik3]

Don't use command "fastboot boot twrp.img"....your phone will keep rebooting to op logo...but fastboot still works

Yeah, I realised that, this happened to me. Thanks to fastboot I was able to boot into stock boot image, so nothign really happened, but hey. So if I dont want to flash it but only try it, what willl be the command? Fastboot boot recovery twrp.img?

 

[PlasmaTornado]

Yeah, I realised that, this happened to me. Thanks to fastboot I was able to boot into stock boot image, so nothign really happened, but hey. So if I dont want to flash it but only try it, what willl be the command? Fastboot boot recovery twrp.img?

It appears the image is not bootable. As stated, this is the one thing I didn't try.
I have amended the guide. Thank you