[GUIDE] Pixel 4 XL "coral": Unlock Bootloader, Update, Root, Pass SafetyNet

Search This thread

V0latyle

Forum Moderator
Staff member
If you are looking for my guide on a different Pixel, find it here:
For best results, use the latest stable Magisk release.
Discussion thread for migration to 24.0+.
Note: Magisk prior to Canary 23016 does not incorporate the necessary fixes for Android 12+.


WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.

Prerequisites:


Android Source - Setting up a device for development


  1. Follow these instructions to enable Developer Options and USB Debugging.
  2. Enable OEM Unlocking. If this option is grayed out, unlocking the bootloader is not possible.
  3. Connect your device to your PC, and open a command window in your Platform Tools folder.
  4. Ensure ADB sees your device:
    Code:
    adb devices
    If you don't see a device, make sure USB Debugging is enabled, reconnect the USB cable, or try a different USB cable.
    If you see "unauthorized", you need to authorize the connection on your device.
    If you see the device without "unauthorized", you're good to go.
  5. Reboot to bootloader:
    Code:
    adb reboot bootloader
  6. Unlock bootloader: THIS WILL WIPE YOUR DEVICE!
    Code:
    fastboot flashing unlock
    Select Continue on the device screen.

  1. Install Magisk on your device.
  2. Download the factory zip for your build.
  3. Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
  4. Copy boot.img to your device.
  5. Patch boot.img with Magisk: "Install" > "Select and Patch a File"
  6. Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
  7. Reboot your device to bootloader.
  8. Flash the patched image:
    Code:
    fastboot flash boot <drag and drop master root.img here>
  9. Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>

  1. Before you download the OTA, open Magisk, tap Uninstall, then Restore Images. If you have any Magisk modules that modify system, uninstall them now.
  2. Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
  3. Allow the update to download and install. DO NOT REBOOT WHEN PROMPTED. Open Magisk, tap Install at the top, then Install to inactive slot. Magisk will then reboot your device.
  4. You should now be updated with root.

  1. Download the OTA.
  2. Reboot to recovery and sideload the OTA:
    Code:
    adb reboot sideload
    Once in recovery:
    Code:
    adb sideload ota.zip
  3. When the OTA completes, you will be in recovery mode. Select "Reboot to system now".
  4. Allow system to boot and wait for the update to complete. You must let the system do this before proceeding.
  5. Reboot to bootloader.
  6. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  8. Reboot your device. You should now be updated with root.
Note: You can use Payload Dumper to extract the contents of the OTA if you want to manually patch the new boot image. However, I will not cover that in this guide.

Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
  1. Download the factory zip and extract the contents.
  2. Reboot to bootloader.
  3. Compare bootloader versions between phone screen and bootloader.img build number
    Code:
    fastboot flash bootloader <drag and drop new bootloader.img here>
    If bootloader is updated, reboot to bootloader.
  4. Compare baseband versions between phone screen and radio.img build number
    Code:
    fastboot flash radio <drag and drop radio.img here>
    If radio is updated, reboot to bootloader.
  5. Apply update:
    Code:
    fastboot update --skip-reboot image-codename-buildnumber.zip
    When the update completes, the device will be in fastbootd. Reboot to bootloader.
  6. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  8. Reboot your device. You should now be updated with root.
Note: If you prefer, you can update using the flash-all script included in the factory zip. You will have to copy the script, bootloader image, radio image, and update zip into the Platform Tools folder; you will then have to edit the script to remove the -w option so it doesn't wipe your device.
The scripted commands should look like this:
Code:
fastboot flash bootloader <bootloader image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot flash radio <radio image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot update  --skip-reboot <image-device-buildnumber.zip>
Once this completes, you can reboot to bootloader and either boot your master patched image, or if you patched the new image, flash it at this time.

PixelFlasher by @badabing2003 is an excellent tool that streamlines the update process - it even patches the boot image for you.
The application essentially automates the ADB interface to make updating and rooting much easier. However, it is STRONGLY recommended that you still learn the "basics" of using ADB.

For instructions, downloads, and support, please refer to the PixelFlasher thread.

  1. Follow the instructions on the Android Flash Tool to update your device. Make sure Lock Bootloader and Wipe Device are UNCHECKED.
  2. When the update completes, the device will be in fastbootd. Reboot to bootloader.
  3. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  4. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  5. Reboot your device. You should now be updated with root.

SafetyNet has been deprecated for the new Play Integrity API. More information here.

In a nutshell, Play Integrity uses the same mechanisms as SafetyNet for the BASIC and DEVICE verdicts, but uses the Trusted Execution Environment to validate those verdicts. TEE does not function on an unlocked bootloader, so legacy SafetyNet solutions will fail.

However, @Displax has modified the original Universal SafetyNet Fix by kdrag0n; his mod is able to force basic attestation instead of hardware, meaning that the device will pass BASIC and DEVICE integrity.

Mod available here. Do not use MagiskHide Props Config with this mod.

This is my configuration that is passing Safety Net. I will not provide instructions on how to accomplish this. Attempt at your own risk.

Zygisk + DenyList enabled
All subcomponents of these apps hidden under DenyList:
  • Google Play Store
  • GPay
  • Any banking/financial apps
  • Any DRM media apps
Modules:
  • Universal SafetyNet Fix 2.3.1 Mod - XDA post
To check SafetyNet status:
To check Play Integrity status:
I do not provide support for Magisk or modules. If you need help with Magisk, here is the Magisk General Support thread. For support specifically with Magisk v24+, see this thread.

Points of note:
  • The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
  • While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
    screenshot_20230323-072859-3-png.5870161
  • "Installed" shows the version of patch in the boot image. If this says N/A, you do not have root access - the boot image is not patched, or you have a problem with Magisk.
  • "App" simply shows the version of the app itself.
  • If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.
  • If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
  • Some Magisk modules, especially those that modify read only partitions like /system, may cause a boot loop after updating. As a general rule, disable these modules before updating. You are responsible for knowing what you have installed, and what modules to disable.


Credits:
Thanks to @badabing2003 , @pndwal , @Displax , @Az Biker , @ipdev , @kdrag0n , @Didgeridoohan , and last but not least, @topjohnwu for all their hard work!
 
Last edited:

dortok

Senior Member
Jan 22, 2010
485
32
Toronto
I can pass SafetyNet but GPay does not allow contactless. The only thing unclear is what settings you used from MagiskHide Props Config. Can you please share?
 

V0latyle

Forum Moderator
Staff member
I thought the purpose of MHPC is to easily change the prop settings to another device. Does it even do anything by just installing the module?
I'm not sure, I've never messed with anything under the hood, and honestly I didn't install it myself - I'm not sure how it got installed. Other users have mentioned success using only USNF.
 

Broken.exe

Member
Sep 3, 2017
8
2
Thank you for well written guides, will this guide work with any android version? I'm willing to follow this rooting process at Android 13
 

jljtgr

Senior Member
I just wanted to make a comment about the blanket statement of using the latest platform tools.

As of this writing, v34.0.0 is the most current, but it did not work for me and flashing the full images to a Pixel 4 XL.
Code:
{...}
extracting product.img (2440 MB) to disk... took 10.694s
extracting system.img (821 MB) to disk... took 4.031s
extracting system_ext.img (298 MB) to disk... took 1.498s
extracting system_other.img (23 MB) to disk... took 0.121s
extracting vendor.img (823 MB) to disk... took 4.021s
archive does not contain 'vendor_other.img'
Sending sparse 'super' 1/1 (4194303 KB)            FAILED (Sparse file is too large or invalid)
fastboot: error: Command failed

Using v33.0.3 of the platform tools worked correctly for the Feb 2023 and Oct 2022 images. v34.0.0 failed for both of those.
 

Lughnasadh

Senior Member
Mar 23, 2015
5,494
6,551
Google Nexus 5
Huawei Nexus 6P
I just wanted to make a comment about the blanket statement of using the latest platform tools.

As of this writing, v34.0.0 is the most current, but it did not work for me and flashing the full images to a Pixel 4 XL.
Code:
{...}
extracting product.img (2440 MB) to disk... took 10.694s
extracting system.img (821 MB) to disk... took 4.031s
extracting system_ext.img (298 MB) to disk... took 1.498s
extracting system_other.img (23 MB) to disk... took 0.121s
extracting vendor.img (823 MB) to disk... took 4.021s
archive does not contain 'vendor_other.img'
Sending sparse 'super' 1/1 (4194303 KB)            FAILED (Sparse file is too large or invalid)
fastboot: error: Command failed

Using v33.0.3 of the platform tools worked correctly for the Feb 2023 and Oct 2022 images. v34.0.0 failed for both of those.
v34.0.0 has problems with fastbootd. It basically skips it, so v33.0.3 is the one people should be using right now until they fix it. There has been an issue opened up for it.
 
  • Like
Reactions: V0latyle

Graeme354

Member
Oct 10, 2012
49
4
If you are looking for my guide on a different Pixel, find it here:
For best results, use the latest stable Magisk release.
Discussion thread for migration to 24.0+.
Note: Magisk prior to Canary 23016 does not incorporate the necessary fixes for Android 12+.


WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.

Prerequisites:


Android Source - Setting up a device for development


  1. Follow these instructions to enable Developer Options and USB Debugging.
  2. Enable OEM Unlocking. If this option is grayed out, unlocking the bootloader is not possible.
  3. Connect your device to your PC, and open a command window in your Platform Tools folder.
  4. Ensure ADB sees your device:
    Code:
    adb devices
    If you don't see a device, make sure USB Debugging is enabled, reconnect the USB cable, or try a different USB cable.
    If you see "unauthorized", you need to authorize the connection on your device.
    If you see the device without "unauthorized", you're good to go.
  5. Reboot to bootloader:
    Code:
    adb reboot bootloader
  6. Unlock bootloader: THIS WILL WIPE YOUR DEVICE!
    Code:
    fastboot flashing unlock
    Select Continue on the device screen.

  1. Install Magisk on your device.
  2. Download the factory zip for your build.
  3. Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
  4. Copy boot.img to your device.
  5. Patch boot.img with Magisk: "Install" > "Select and Patch a File"
  6. Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
  7. Reboot your device to bootloader.
  8. Flash the patched image:
    Code:
    fastboot flash boot <drag and drop master root.img here>
  9. Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>

  1. Before you download the OTA, open Magisk, tap Uninstall, then Restore Images. If you have any Magisk modules that modify system, uninstall them now.
  2. Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
  3. Allow the update to download and install. DO NOT REBOOT WHEN PROMPTED. Open Magisk, tap Install at the top, then Install to inactive slot. Magisk will then reboot your device.
  4. You should now be updated with root.

  1. Download the OTA.
  2. Reboot to recovery and sideload the OTA:
    Code:
    adb reboot sideload
    Once in recovery:
    Code:
    adb sideload ota.zip
  3. When the OTA completes, you will be in recovery mode. Select "Reboot to system now".
  4. Allow system to boot and wait for the update to complete. You must let the system do this before proceeding.
  5. Reboot to bootloader.
  6. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  8. Reboot your device. You should now be updated with root.
Note: You can use Payload Dumper to extract the contents of the OTA if you want to manually patch the new boot image. However, I will not cover that in this guide.

Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
  1. Download the factory zip and extract the contents.
  2. Reboot to bootloader.
  3. Compare bootloader versions between phone screen and bootloader.img build number
    Code:
    fastboot flash bootloader <drag and drop new bootloader.img here>
    If bootloader is updated, reboot to bootloader.
  4. Compare baseband versions between phone screen and radio.img build number
    Code:
    fastboot flash radio <drag and drop radio.img here>
    If radio is updated, reboot to bootloader.
  5. Apply update:
    Code:
    fastboot update --skip-reboot image-codename-buildnumber.zip
    When the update completes, the device will be in fastbootd. Reboot to bootloader.
  6. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  8. Reboot your device. You should now be updated with root.
Note: If you prefer, you can update using the flash-all script included in the factory zip. You will have to copy the script, bootloader image, radio image, and update zip into the Platform Tools folder; you will then have to edit the script to remove the -w option so it doesn't wipe your device.
The scripted commands should look like this:
Code:
fastboot flash bootloader <bootloader image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot flash radio <radio image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot update  --skip-reboot <image-device-buildnumber.zip>
Once this completes, you can reboot to bootloader and either boot your master patched image, or if you patched the new image, flash it at this time.

PixelFlasher by @badabing2003 is an excellent tool that streamlines the update process - it even patches the boot image for you.
The application essentially automates the ADB interface to make updating and rooting much easier. However, it is STRONGLY recommended that you still learn the "basics" of using ADB.

For instructions, downloads, and support, please refer to the PixelFlasher thread.

  1. Follow the instructions on the Android Flash Tool to update your device. Make sure Lock Bootloader and Wipe Device are UNCHECKED.
  2. When the update completes, the device will be in fastbootd. Reboot to bootloader.
  3. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  4. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  5. Reboot your device. You should now be updated with root.

SafetyNet has been deprecated for the new Play Integrity API. More information here.

In a nutshell, Play Integrity uses the same mechanisms as SafetyNet for the BASIC and DEVICE verdicts, but uses the Trusted Execution Environment to validate those verdicts. TEE does not function on an unlocked bootloader, so legacy SafetyNet solutions will fail.

However, @Displax has modified the original Universal SafetyNet Fix by kdrag0n; his mod is able to force basic attestation instead of hardware, meaning that the device will pass BASIC and DEVICE integrity.

Mod available here. Do not use MagiskHide Props Config with this mod.

This is my configuration that is passing Safety Net. I will not provide instructions on how to accomplish this. Attempt at your own risk.

Zygisk + DenyList enabled
All subcomponents of these apps hidden under DenyList:
  • Google Play Store
  • GPay
  • Any banking/financial apps
  • Any DRM media apps
Modules:
  • Universal SafetyNet Fix 2.3.1 Mod - XDA post
To check SafetyNet status:
To check Play Integrity status:
I do not provide support for Magisk or modules. If you need help with Magisk, here is the Magisk General Support thread. For support specifically with Magisk v24+, see this thread.

Points of note:
  • The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
  • While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
    screenshot_20230323-072859-3-png.5870161
  • "Installed" shows the version of patch in the boot image. If this says N/A, you do not have root access - the boot image is not patched, or you have a problem with Magisk.
  • "App" simply shows the version of the app itself.
  • If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.
  • If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
  • Some Magisk modules, especially those that modify read only partitions like /system, may cause a boot loop after updating. As a general rule, disable these modules before updating. You are responsible for knowing what you have installed, and what modules to disable.


Credits:
Thanks to @badabing2003 , @pndwal , @Displax , @Az Biker , @ipdev , @kdrag0n , @Didgeridoohan , and last but not least, @topjohnwu for all their hard work!
Just a question, what does it take to get TWRP recovery to "stay" on a Pixel 4XL ?? Every time I update Lineage it just disappears 🤔
 

V0latyle

Forum Moderator
Staff member
Just a question, what does it take to get TWRP recovery to "stay" on a Pixel 4XL ?? Every time I update Lineage it just disappears 🤔
I explained this recently in another thread:
Pixels do not have a recovery partition. The recovery kernel is compressed and lives in the boot image. Because TWRP does not support compression, it cannot be installed. If the TWRP image is written to /boot, it will overwrite the system kernel, resulting in a device that will only boot to TWRP, until the original boot image is reflashed.

The proper way to use TWRP on a Pixel is live boot: fastboot boot twrp.img

This tells the device to load TWRP into memory so that the user may perform desired functions; upon reboot, the device will boot normally.

However, most flashing operations can be performed by ADB from bootloader or fastbootd, obviating the need for a custom recovery
On previous versions of Android it was possible to repack TWRP into the boot ramdisk, but that is no longer possible on Android 12/13.

Short answer: You cannot replace stock recovery with TWRP on a Pixel phone. You can live boot it for temporary use only.
 
  • Like
Reactions: Graeme354

Graeme354

Member
Oct 10, 2012
49
4
I have TWRP'd in the wrong place I think as it would not stay. Any help in the resurrection of my 4XL will result in a substantial donation. My bad as I was told not to try and make it permanent in the first place. I am wearing the donkeys ears already. 🫡
 

Attachments

  • 2023-09-08-21-54-52-883.jpg
    2023-09-08-21-54-52-883.jpg
    2.3 MB · Views: 5

V0latyle

Forum Moderator
Staff member
I have TWRP'd in the wrong place I think as it would not stay. Any help in the resurrection of my 4XL will result in a substantial donation. My bad as I was told not to try and make it permanent in the first place. I am wearing the donkeys ears already. 🫡
Always ALWAYS ask questions before you try the unknown. I am guessing you borked your partitions trying to create a recovery partition...which wouldn't work by the way because the bootloader only knows "boot"

But, assumptions won't do any good, so please explain exactly what you did and how you got to this point?

DO NOT try to rebuild your partitions until we figure out what is going on, as you will most likely permabrick your device.
 

Graeme354

Member
Oct 10, 2012
49
4
I flashed to boot, to both slots A and B and a recovery drive I think you call it. I have ADHD and am compulsive. I reckon I'm going to have to flash firmware and start again buddy. 😕
 

V0latyle

Forum Moderator
Staff member
I flashed to boot, to both slots A and B and a recovery drive I think you call it. I have ADHD and am compulsive. I reckon I'm going to have to flash firmware and start again buddy. 😕
Pixels do not have a recovery partition; the recovery kernel lives in the boot image. Replacing the stock recovery requires modifying the ramdisk which generally breaks Magisk.

The proper way to use TWRP on a Pixel is to live boot it, without flashing.

Did you remove, rename, or otherwise modify any of the partitions on the device?
 

Graeme354

Member
Oct 10, 2012
49
4
Pixels do not have a recovery partition; the recovery kernel lives in the boot image. Replacing the stock recovery requires modifying the ramdisk which generally breaks Magisk.

The proper way to use TWRP on a Pixel is to live boot it, without flashing.

Did you remove, rename, or otherwise modify any of the partitions on the device?
No, I did nor rename anything, nor had magisk installed. I no longer root my phones and will just do anything to debloat and DeGoogle. Live boot I know nothing about and used adb from my laptop. I just wanted TWRP permanent , flashed and reflashed , with TWRP to be in the situation I am now. I have a Samsung A52s modified and working and keep 2 phones for when I f**k up as you can see. I am no developer and will make a substantial donation to anyone who assists me to resurrect my phone. All I want to do is to adb sideload and leave it be. It won't do it. 😕
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Well, at this point I'm starting to think it would indeed be a good idea to start with a clean slate.

    Put your phone in bootloader mode, then while it's connected to the PC, go to flash.android.com, and use it to flash the latest factory image. Select the "Force flash all partitions" and "Wipe device" options; leave everything else unchecked
    OK buddy and thanks. 👍🏴󠁧󠁢󠁳󠁣󠁴󠁿
  • 6
    If you are looking for my guide on a different Pixel, find it here:
    For best results, use the latest stable Magisk release.
    Discussion thread for migration to 24.0+.
    Note: Magisk prior to Canary 23016 does not incorporate the necessary fixes for Android 12+.


    WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.

    Prerequisites:


    Android Source - Setting up a device for development


    1. Follow these instructions to enable Developer Options and USB Debugging.
    2. Enable OEM Unlocking. If this option is grayed out, unlocking the bootloader is not possible.
    3. Connect your device to your PC, and open a command window in your Platform Tools folder.
    4. Ensure ADB sees your device:
      Code:
      adb devices
      If you don't see a device, make sure USB Debugging is enabled, reconnect the USB cable, or try a different USB cable.
      If you see "unauthorized", you need to authorize the connection on your device.
      If you see the device without "unauthorized", you're good to go.
    5. Reboot to bootloader:
      Code:
      adb reboot bootloader
    6. Unlock bootloader: THIS WILL WIPE YOUR DEVICE!
      Code:
      fastboot flashing unlock
      Select Continue on the device screen.

    1. Install Magisk on your device.
    2. Download the factory zip for your build.
    3. Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
    4. Copy boot.img to your device.
    5. Patch boot.img with Magisk: "Install" > "Select and Patch a File"
    6. Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
    7. Reboot your device to bootloader.
    8. Flash the patched image:
      Code:
      fastboot flash boot <drag and drop master root.img here>
    9. Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>

    1. Before you download the OTA, open Magisk, tap Uninstall, then Restore Images. If you have any Magisk modules that modify system, uninstall them now.
    2. Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
    3. Allow the update to download and install. DO NOT REBOOT WHEN PROMPTED. Open Magisk, tap Install at the top, then Install to inactive slot. Magisk will then reboot your device.
    4. You should now be updated with root.

    1. Download the OTA.
    2. Reboot to recovery and sideload the OTA:
      Code:
      adb reboot sideload
      Once in recovery:
      Code:
      adb sideload ota.zip
    3. When the OTA completes, you will be in recovery mode. Select "Reboot to system now".
    4. Allow system to boot and wait for the update to complete. You must let the system do this before proceeding.
    5. Reboot to bootloader.
    6. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    8. Reboot your device. You should now be updated with root.
    Note: You can use Payload Dumper to extract the contents of the OTA if you want to manually patch the new boot image. However, I will not cover that in this guide.

    Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
    1. Download the factory zip and extract the contents.
    2. Reboot to bootloader.
    3. Compare bootloader versions between phone screen and bootloader.img build number
      Code:
      fastboot flash bootloader <drag and drop new bootloader.img here>
      If bootloader is updated, reboot to bootloader.
    4. Compare baseband versions between phone screen and radio.img build number
      Code:
      fastboot flash radio <drag and drop radio.img here>
      If radio is updated, reboot to bootloader.
    5. Apply update:
      Code:
      fastboot update --skip-reboot image-codename-buildnumber.zip
      When the update completes, the device will be in fastbootd. Reboot to bootloader.
    6. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    8. Reboot your device. You should now be updated with root.
    Note: If you prefer, you can update using the flash-all script included in the factory zip. You will have to copy the script, bootloader image, radio image, and update zip into the Platform Tools folder; you will then have to edit the script to remove the -w option so it doesn't wipe your device.
    The scripted commands should look like this:
    Code:
    fastboot flash bootloader <bootloader image name>
    fastboot reboot bootloader
    ping -n 5 127.0.0.1 > nul
    fastboot flash radio <radio image name>
    fastboot reboot bootloader
    ping -n 5 127.0.0.1 > nul
    fastboot update  --skip-reboot <image-device-buildnumber.zip>
    Once this completes, you can reboot to bootloader and either boot your master patched image, or if you patched the new image, flash it at this time.

    PixelFlasher by @badabing2003 is an excellent tool that streamlines the update process - it even patches the boot image for you.
    The application essentially automates the ADB interface to make updating and rooting much easier. However, it is STRONGLY recommended that you still learn the "basics" of using ADB.

    For instructions, downloads, and support, please refer to the PixelFlasher thread.

    1. Follow the instructions on the Android Flash Tool to update your device. Make sure Lock Bootloader and Wipe Device are UNCHECKED.
    2. When the update completes, the device will be in fastbootd. Reboot to bootloader.
    3. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    4. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    5. Reboot your device. You should now be updated with root.

    SafetyNet has been deprecated for the new Play Integrity API. More information here.

    In a nutshell, Play Integrity uses the same mechanisms as SafetyNet for the BASIC and DEVICE verdicts, but uses the Trusted Execution Environment to validate those verdicts. TEE does not function on an unlocked bootloader, so legacy SafetyNet solutions will fail.

    However, @Displax has modified the original Universal SafetyNet Fix by kdrag0n; his mod is able to force basic attestation instead of hardware, meaning that the device will pass BASIC and DEVICE integrity.

    Mod available here. Do not use MagiskHide Props Config with this mod.

    This is my configuration that is passing Safety Net. I will not provide instructions on how to accomplish this. Attempt at your own risk.

    Zygisk + DenyList enabled
    All subcomponents of these apps hidden under DenyList:
    • Google Play Store
    • GPay
    • Any banking/financial apps
    • Any DRM media apps
    Modules:
    • Universal SafetyNet Fix 2.3.1 Mod - XDA post
    To check SafetyNet status:
    To check Play Integrity status:
    I do not provide support for Magisk or modules. If you need help with Magisk, here is the Magisk General Support thread. For support specifically with Magisk v24+, see this thread.

    Points of note:
    • The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
    • While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
      screenshot_20230323-072859-3-png.5870161
    • "Installed" shows the version of patch in the boot image. If this says N/A, you do not have root access - the boot image is not patched, or you have a problem with Magisk.
    • "App" simply shows the version of the app itself.
    • If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.
    • If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
    • Some Magisk modules, especially those that modify read only partitions like /system, may cause a boot loop after updating. As a general rule, disable these modules before updating. You are responsible for knowing what you have installed, and what modules to disable.


    Credits:
    Thanks to @badabing2003 , @pndwal , @Displax , @Az Biker , @ipdev , @kdrag0n , @Didgeridoohan , and last but not least, @topjohnwu for all their hard work!
    1
    Thanks for the guide, im currently on android 12, planing to downfgrade to Android 11, will be ok to follow the Master Root guide to patch, downgrade and root at the same time to Android 11?
    1
    Thanks for the guide, im currently on android 12, planing to downfgrade to Android 11, will be ok to follow the Master Root guide to patch, downgrade and root at the same time to Android 11?
    Yep.
    1
    I just wanted to make a comment about the blanket statement of using the latest platform tools.

    As of this writing, v34.0.0 is the most current, but it did not work for me and flashing the full images to a Pixel 4 XL.
    Code:
    {...}
    extracting product.img (2440 MB) to disk... took 10.694s
    extracting system.img (821 MB) to disk... took 4.031s
    extracting system_ext.img (298 MB) to disk... took 1.498s
    extracting system_other.img (23 MB) to disk... took 0.121s
    extracting vendor.img (823 MB) to disk... took 4.021s
    archive does not contain 'vendor_other.img'
    Sending sparse 'super' 1/1 (4194303 KB)            FAILED (Sparse file is too large or invalid)
    fastboot: error: Command failed

    Using v33.0.3 of the platform tools worked correctly for the Feb 2023 and Oct 2022 images. v34.0.0 failed for both of those.
    v34.0.0 has problems with fastbootd. It basically skips it, so v33.0.3 is the one people should be using right now until they fix it. There has been an issue opened up for it.
    1
    Just a question, what does it take to get TWRP recovery to "stay" on a Pixel 4XL ?? Every time I update Lineage it just disappears 🤔
    I explained this recently in another thread:
    Pixels do not have a recovery partition. The recovery kernel is compressed and lives in the boot image. Because TWRP does not support compression, it cannot be installed. If the TWRP image is written to /boot, it will overwrite the system kernel, resulting in a device that will only boot to TWRP, until the original boot image is reflashed.

    The proper way to use TWRP on a Pixel is live boot: fastboot boot twrp.img

    This tells the device to load TWRP into memory so that the user may perform desired functions; upon reboot, the device will boot normally.

    However, most flashing operations can be performed by ADB from bootloader or fastbootd, obviating the need for a custom recovery
    On previous versions of Android it was possible to repack TWRP into the boot ramdisk, but that is no longer possible on Android 12/13.

    Short answer: You cannot replace stock recovery with TWRP on a Pixel phone. You can live boot it for temporary use only.