[GUIDE] Pixel 4a (5G) "bramble": Unlock Bootloader, Update, Root, Pass SafetyNet

Search This thread

V0latyle

Forum Moderator
Staff member
If you are looking for my guide on a different Pixel, find it here:
Update 4-28-22: While Magisk 24.0 has been updated for use with Android 12, many users are still having problems with patching the out of band OTA, so Canary 24306 is recommended.
Discussion thread for migration to 24.0.

DO NOT use any version of Magisk lower than Canary 23016 as it does not yet incorporate the necessary fixes for Android 12 and your device.


WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.

Prerequisites:


Android Source - Setting up a device for development


  1. Follow these instructions to enable Developer Options and USB Debugging.
  2. Enable OEM Unlocking. If this option is grayed out, unlocking the bootloader is not possible.
  3. Connect your device to your PC, and open a command window in your Platform Tools folder.
  4. Ensure ADB sees your device:
    Code:
    adb devices
    If you don't see a device, make sure USB Debugging is enabled, reconnect the USB cable, or try a different USB cable.
    If you see "unauthorized", you need to authorize the connection on your device.
    If you see the device without "unauthorized", you're good to go.
  5. Reboot to bootloader:
    Code:
    adb reboot bootloader
  6. Unlock bootloader: THIS WILL WIPE YOUR DEVICE!
    Code:
    fastboot flashing unlock
    Select Continue on the device screen.

  1. Install Magisk on your device.
  2. Download the factory zip for your build.
  3. Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
  4. Copy boot.img to your device.
  5. Patch boot.img with Magisk: "Install" > "Select and Patch a File"
  6. Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
  7. Reboot your device to bootloader.
  8. Flash the patched image:
    Code:
    fastboot flash boot <drag and drop master root.img here>
  9. Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>

  1. Before you download the OTA, open Magisk, tap Uninstall, then Restore Images. If you have any Magisk modules that modify system, uninstall them now.
  2. Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
  3. Allow the update to download and install. DO NOT REBOOT WHEN PROMPTED. Open Magisk, tap Install at the top, then Install to inactive slot. Magisk will then reboot your device.
  4. You should now be updated with root.

  1. Download the OTA.
  2. Reboot to recovery and sideload the OTA:
    Code:
    adb reboot sideload
    Once in recovery:
    Code:
    adb sideload ota.zip
  3. When the OTA completes, you will be in recovery mode. Select "Reboot to system now".
  4. Allow system to boot and wait for the update to complete. You must let the system do this before proceeding.
  5. Reboot to bootloader.
  6. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  8. Reboot your device. You should now be updated with root.
Note: You can use Payload Dumper to extract the contents of the OTA if you want to manually patch the new boot image. However, I will not cover that in this guide.

Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
  1. Download the factory zip and extract the contents.
  2. Reboot to bootloader.
  3. Compare bootloader versions between phone screen and bootloader.img build number
    Code:
    fastboot flash bootloader <drag and drop new bootloader.img here>
    If bootloader is updated, reboot to bootloader.
  4. Compare baseband versions between phone screen and radio.img build number
    Code:
    fastboot flash radio <drag and drop radio.img here>
    If radio is updated, reboot to bootloader.
  5. Apply update:
    Code:
    fastboot update --skip-reboot image-codename-buildnumber.zip
    When the update completes, the device will be in fastbootd. Reboot to bootloader.
  6. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  8. Reboot your device. You should now be updated with root.
Note: If you prefer, you can update using the flash-all script included in the factory zip. You will have to copy the script, bootloader image, radio image, and update zip into the Platform Tools folder; you will then have to edit the script to remove the -w option so it doesn't wipe your device.
The scripted commands should look like this:
Code:
fastboot update bootloader <bootloader image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot update radio <radio image name>
fastboot reboot bootloader
ping -n 5 127.0.0.1 > nul
fastboot update  --skip-reboot --slot=all <image-device-buildnumber.zip>
Once this completes, you can reboot to bootloader and either boot your master patched image, or if you patched the new image, flash it at this time.

  1. Follow the instructions on the Android Flash Tool to update your device. Make sure Lock Bootloader and Wipe Device are UNCHECKED.
  2. When the update completes, the device will be in fastbootd. Reboot to bootloader.
  3. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
    Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
  4. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  5. Reboot your device. You should now be updated with root.

This is my configuration that is passing Safety Net. I will not provide instructions on how to accomplish this. Attempt at your own risk.

Zygisk + DenyList enabled
All subcomponents of these apps hidden under DenyList:
  • Google Play Store
  • GPay
  • Any banking/financial apps
  • Any DRM media apps
Modules:
To check SafetyNet status:
I do not provide support for Magisk or modules. If you need help with Magisk, here is the Magisk General Support thread. For support specifically with Magisk v24+, see this thread.

Points of note:
  • The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
  • While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
    screenshot_20211218-194517-png.5486339
  • "Installed" shows the version of patch in the boot image. If this says N/A, you do not have root access - the boot image is not patched, or you have a problem with Magisk.
  • "App" simply shows the version of the app itself.
  • If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.
  • If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
  • Some Magisk modules, especially those that modify read only partitions like /system, may cause a boot loop after updating. As a general rule, disable these modules before updating. You are responsible for knowing what you have installed, and what modules to disable.


Credits:
Thanks to @ipdev , @kdrag0n , @Didgeridoohan , and last but not least, @topjohnwu for all their hard work!
 
Last edited:

V0latyle

Forum Moderator
Staff member
Hi ! Thanks for the thread 👍.
Just one question ?
Why they had "--slot=all" for flash vmbeta and patch boot.
The OTA is an out of band update, meaning it installs to the inactive slot. I like to command a flash to both slots just to be safe. It may not really be necessary, but again, better safe than sorry.
 
  • Like
Reactions: ggkameleon

j-a-d-z

Senior Member
Oct 30, 2013
562
289
Google Pixel 3a
Google Pixel 3a XL
As many of you know by now, in order to run a patched boot image on Android 12 requires disabling Android Boot Verification.

On Android 12, disabling verity and verification will require a data wipe if it hasn't been done before. What seems to "lock" the state of boot verification is booting into system; so, if you perform an update, or flash vbmeta without the disable flags, then reboot into Android, you have essentially enabled boot verification and will require a wipe to disable it again. Confusing, I know.
So, for all slow dumb ****s like me:

No permanent root possible on my 4a 5G when updating from A11 to A12 without a wipe?

Or is this tutorial the workaround for that?

Or is this tutorial the workaround for flashing patched boot for the monthly security updates for A12 so I don't have to wipe each month?

Or, I'm just a slow dumb ****?

¯\_(ツ)_/¯
 

V0latyle

Forum Moderator
Staff member
So, for all slow dumb ****s like me:

No permanent root possible on my 4a 5G when updating from A11 to A12 without a wipe?

Or is this tutorial the workaround for that?
As it seems, yes. But I have a theory if you want to be a test subject....
Or is this tutorial the workaround for flashing patched boot for the monthly security updates for A12 so I don't have to wipe each month?

Or, I'm just a slow dumb ****?

¯\_(ツ)_/¯
This is meant for updating but still applies the first time you root on A12.
 

j-a-d-z

Senior Member
Oct 30, 2013
562
289
Google Pixel 3a
Google Pixel 3a XL
As it seems, yes. But I have a theory if you want to be a test subject....

This is meant for updating but still applies the first time you root on A12.
What does your "yes" stands for? Yes, no permanent root without wipe? Or yes, that may be the workaround?

If I wanna be your test subject, what could go wrong in the worst case scenario? (or the "Wurst-Käse-Szenario", as we like to say here in Germany 😂)

Would I still be able to fastboot boot the magisked boot image to gain temp root and backup my in-app data?
 

V0latyle

Forum Moderator
Staff member
What does your "yes" stands for? Yes, no permanent root without wipe? Or yes, that may be the workaround?
I mean yes as in "yes, it appears that wiping /data is required when disabling vbmeta for permanent root".
If I wanna be your test subject, what could go wrong in the worst case scenario? (or the "Wurst-Käse-Szenario", as we like to say here in Germany 😂)
Das ist mir Wurst.

The sausage cheese scenario is that you lose your data and have to wipe anyway. What I have in mind is this: Reflash vbmeta with the disable flags while on Android 11, die Daumen drucken, see if it requires you to wipe /data. If not, proceed to dirty flash factory image with disable flags and see if the upgrade is successful.
Would I still be able to fastboot boot the magisked boot image to gain temp root and backup my in-app data?
Temp root does work on Android 12. And if my idea sorta works but you still get Rescue Party after upgrading to Android 12, then you should just be able to reflash /vbmeta and /boot with the stock images and use temp root.

I would advise, however, that if you're interested in trying my idea, make sure to back up your data first.
 
  • Like
Reactions: Samuel Holland

j-a-d-z

Senior Member
Oct 30, 2013
562
289
Google Pixel 3a
Google Pixel 3a XL
The sausage cheese scenario is that you lose your data and have to wipe anyway. What I have in mind is this: Reflash vbmeta with the disable flags while on Android 11, die Daumen drucken, see if it requires you to wipe /data. If not, proceed to dirty flash factory image with disable flags and see if the upgrade is successful.
Does this vbmeta reflash warn me that a wipe is required before it does anything?
 

dneill2006

Senior Member
May 25, 2010
492
39
32
Lisburn
So can I update A11 to A12 and retain root as long as I don't boot into the system before flashing vbmeta.img and boot.img?
 

V0latyle

Forum Moderator
Staff member
Does this vbmeta reflash warn me that a wipe is required before it does anything?
Reflashing vbmeta doesn't wipe your data. If you disable verity and verification, when they were previously enabled, the system will not boot, and you will instead land in Rescue Party - a screen telling you that your data may be corrupted.

So, when we say that a data wipe is required, it means you must do it yourself.
So can I update A11 to A12 and retain root as long as I don't boot into the system before flashing vbmeta.img and boot.img?
As far as we know, no. The problem is, as I stated above, the first time verity and verification are disabled on Android 12 requires a clean system. We have not found a way to be able to keep data and re-root following an upgrade. You can keep your data and either go unrooted or use temporary root, or you can wipe data for permanent root.
 
Last edited:

V0latyle

Forum Moderator
Staff member
Magisk Canary was updated to 23016 last night. This includes a fix for the vbmeta header issue, meaning that disabling verity/verification should no longer be required, and we should be able to root as we did before.

Q: "If verity/verification are disabled, do I need to enable them now?"
A: No. The only thing you have to do is update to Magisk 23016.
Q: "Will enabling verity/verification wipe my data?"
A: No.

I will be updating the OP to reflect this.
 
Last edited:
  • Like
Reactions: gladi8r

j-a-d-z

Senior Member
Oct 30, 2013
562
289
Google Pixel 3a
Google Pixel 3a XL
Magisk Canary was updated to 23016 last night. This includes a fix for the vbmeta header issue, meaning that disabling verity/verification should no longer be required, and we should be able to root as we did before.
So I did upgrading from latest 11 to latest 12 some minutes ago. Booted, patched boot.img with magisk 23016 and flashed the patched image to get back root. Worked like a charm just like any update before. So no more wipe needed.

So, it's time for the good old pal Stinky Wizzleteats and his song about being happy. That's right, it's the happy, happy, joy, joy song:
Happy, happy, joy, joy
Happy, happy, joy, joy
Happy, happy, joy, joy
Happy, happy, joy, joy
Happy, happy, joy, joy
Happy, happy, joy, joy

┌(・。・)┘♪
 

proac

Member
Dec 26, 2015
10
2
Update 12/15/21: Magisk 23016 incorporates fixes for vbmeta header patching; disabling verity/verification is no longer necessary. Update and root should work as it always has.

If you have already disabled verity/verification, you do not need to re-enable them; they are enabled by default when the /vbmeta partition is written, unless the "--disable-" options are used. The only thing you have to worry about next update is literally just updating your device.

DO NOT substitute Magisk Stable, as it does not yet include the necessary fixes for this device!

WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.


Points of note:

  • The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
  • While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
    screenshot_20211218-194517-png.5486339
  • "Installed" shows the version of patch in the boot image. If this says N/A, the boot image is not patched, or you have a problem with Magisk.
  • "App" simply shows the version of the app itself.
Prerequisites:
As many of you know by now, in order to run a patched boot image on Android 12 requires disabling Android Verified Boot.

Verified Boot on Android 12 devices, at least Pixels with the SD765G and Tensor, is tied to device encryption. Therefore, disabling Verified Boot requires a wipe, if it was not previously disabled.

To make this clear:
Verified Boot is disabled by flashing /vbmeta with disable flags:
Code:
fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img
Verified Boot is enabled by flashing /vbmeta without flags:
Code:
fastboot flash vbmeta vbmeta.img

Booting the device essentially "locks" the vbmeta state.

I know this is confusing, Bear with me:

If you previously disabled vbmeta, you MUST ensure it is disabled again when you update, BEFORE you boot. If you do not, you will have to wipe to regain root.

Unfortunately, the update process enables Verified Boot by default, because it writes /vbmeta without flags.

This means that the automatic OTA, or any other update process without intervention, WILL enable Verified Boot, which will require a wipe to disable!


****



  1. Install Magisk on your device.
  2. Download the factory zip for your build.
  3. Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
  4. Copy boot.img to your device.
  5. Patch boot.img with Magisk: "Install" > "Select and Patch a File"
  6. Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
  7. Reboot your device to bootloader.
  8. Flash the patched image:
    Code:
    fastboot flash boot <drag and drop master root.img here>
  9. Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>

  1. Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
  2. Allow the update to complete. Your device will reboot without root as the OTA overwrites the patched boot image.
  3. Reboot your device to bootloader.
  4. Boot the master root image (See note 1)
    Code:
    fastboot boot <drag and drop master root.img here>
  5. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  6. Reboot your device. You should now be updated with root.

  1. Download the OTA.
  2. Reboot to recovery and sideload the OTA: select Apply Update via ADB, then on your PC:
    Code:
    adb sideload ota.zip
  3. When the OTA completes, you will be in recovery mode. Select "Reboot to bootloader".
  4. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
  5. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  6. Reboot your device. You should now be updated with root.

Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
  1. Download the factory zip and extract the contents.
  2. Reboot to bootloader.
  3. Compare bootloader versions between phone screen and bootloader.img build number
    Code:
    fastboot flash bootloader <drag and drop new bootloader.img here>
    If bootloader is updated, reboot to bootloader.
  4. Compare baseband versions between phone screen and radio.img build number
    Code:
    fastboot flash radio <drag and drop radio.img here>
    If radio is updated, reboot to bootloader.
  5. Apply update:
    Code:
    fastboot update --skip-reboot image-codename-buildnumber.zip
    When the update completes, the device will be in fastbootd. Reboot to bootloader.
  6. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
  7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  8. Reboot your device. You should now be updated with root.

  1. Follow the instructions on the Android Flash Tool to update your device. Check the "Skip reboot" box.
  2. When the update completes, the device will be in fastbootd. Reboot to bootloader.
  3. Boot the master root image (See note 1):
    Code:
    fastboot boot <drag and drop master root.img here>
  4. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
  5. Reboot your device. You should now be updated with root.

This is my configuration:
Zygisk + DenyList enabled
All subcomponents of these apps hidden under DenyList:
  • Google Play Services
  • Google Play Store
  • GPay
  • Any banking/financial apps
  • Any DRM media apps
Modules:
  • MagiskHide Props Config 6.1.2
  • Universal SafetyNet Fix 2.2.0

Note 1: If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.

Note 2: If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
 

proac

Member
Dec 26, 2015
10
2
Already rooted, do I need to uninstall magisk and delete all modules? Then OTA Android 12, and then install 230016.
 

V0latyle

Forum Moderator
Staff member
Already rooted, do I need to uninstall magisk and delete all modules? Then OTA Android 12, and then install 230016
First, update Magisk to 23016. Do this from within the Magisk app.

Next, follow the instructions under "Initial Root" to patch the boot image. You can then use any method to upgrade to Android 12; after you have upgraded, flash the patched boot image. I recommend using the factory image method seeing as you will have already downloaded the factory image.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Well, I'll know soon enough. I'm planning to replace the port tomorrow. Just hope I don't crack the glass or mess up the digitizer taking it apart.
  • 9
    If you are looking for my guide on a different Pixel, find it here:
    Update 4-28-22: While Magisk 24.0 has been updated for use with Android 12, many users are still having problems with patching the out of band OTA, so Canary 24306 is recommended.
    Discussion thread for migration to 24.0.

    DO NOT use any version of Magisk lower than Canary 23016 as it does not yet incorporate the necessary fixes for Android 12 and your device.


    WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.

    Prerequisites:


    Android Source - Setting up a device for development


    1. Follow these instructions to enable Developer Options and USB Debugging.
    2. Enable OEM Unlocking. If this option is grayed out, unlocking the bootloader is not possible.
    3. Connect your device to your PC, and open a command window in your Platform Tools folder.
    4. Ensure ADB sees your device:
      Code:
      adb devices
      If you don't see a device, make sure USB Debugging is enabled, reconnect the USB cable, or try a different USB cable.
      If you see "unauthorized", you need to authorize the connection on your device.
      If you see the device without "unauthorized", you're good to go.
    5. Reboot to bootloader:
      Code:
      adb reboot bootloader
    6. Unlock bootloader: THIS WILL WIPE YOUR DEVICE!
      Code:
      fastboot flashing unlock
      Select Continue on the device screen.

    1. Install Magisk on your device.
    2. Download the factory zip for your build.
    3. Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
    4. Copy boot.img to your device.
    5. Patch boot.img with Magisk: "Install" > "Select and Patch a File"
    6. Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
    7. Reboot your device to bootloader.
    8. Flash the patched image:
      Code:
      fastboot flash boot <drag and drop master root.img here>
    9. Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>

    1. Before you download the OTA, open Magisk, tap Uninstall, then Restore Images. If you have any Magisk modules that modify system, uninstall them now.
    2. Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
    3. Allow the update to download and install. DO NOT REBOOT WHEN PROMPTED. Open Magisk, tap Install at the top, then Install to inactive slot. Magisk will then reboot your device.
    4. You should now be updated with root.

    1. Download the OTA.
    2. Reboot to recovery and sideload the OTA:
      Code:
      adb reboot sideload
      Once in recovery:
      Code:
      adb sideload ota.zip
    3. When the OTA completes, you will be in recovery mode. Select "Reboot to system now".
    4. Allow system to boot and wait for the update to complete. You must let the system do this before proceeding.
    5. Reboot to bootloader.
    6. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    8. Reboot your device. You should now be updated with root.
    Note: You can use Payload Dumper to extract the contents of the OTA if you want to manually patch the new boot image. However, I will not cover that in this guide.

    Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
    1. Download the factory zip and extract the contents.
    2. Reboot to bootloader.
    3. Compare bootloader versions between phone screen and bootloader.img build number
      Code:
      fastboot flash bootloader <drag and drop new bootloader.img here>
      If bootloader is updated, reboot to bootloader.
    4. Compare baseband versions between phone screen and radio.img build number
      Code:
      fastboot flash radio <drag and drop radio.img here>
      If radio is updated, reboot to bootloader.
    5. Apply update:
      Code:
      fastboot update --skip-reboot image-codename-buildnumber.zip
      When the update completes, the device will be in fastbootd. Reboot to bootloader.
    6. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    8. Reboot your device. You should now be updated with root.
    Note: If you prefer, you can update using the flash-all script included in the factory zip. You will have to copy the script, bootloader image, radio image, and update zip into the Platform Tools folder; you will then have to edit the script to remove the -w option so it doesn't wipe your device.
    The scripted commands should look like this:
    Code:
    fastboot update bootloader <bootloader image name>
    fastboot reboot bootloader
    ping -n 5 127.0.0.1 > nul
    fastboot update radio <radio image name>
    fastboot reboot bootloader
    ping -n 5 127.0.0.1 > nul
    fastboot update  --skip-reboot --slot=all <image-device-buildnumber.zip>
    Once this completes, you can reboot to bootloader and either boot your master patched image, or if you patched the new image, flash it at this time.

    1. Follow the instructions on the Android Flash Tool to update your device. Make sure Lock Bootloader and Wipe Device are UNCHECKED.
    2. When the update completes, the device will be in fastbootd. Reboot to bootloader.
    3. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    4. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    5. Reboot your device. You should now be updated with root.

    This is my configuration that is passing Safety Net. I will not provide instructions on how to accomplish this. Attempt at your own risk.

    Zygisk + DenyList enabled
    All subcomponents of these apps hidden under DenyList:
    • Google Play Store
    • GPay
    • Any banking/financial apps
    • Any DRM media apps
    Modules:
    To check SafetyNet status:
    I do not provide support for Magisk or modules. If you need help with Magisk, here is the Magisk General Support thread. For support specifically with Magisk v24+, see this thread.

    Points of note:
    • The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
    • While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
      screenshot_20211218-194517-png.5486339
    • "Installed" shows the version of patch in the boot image. If this says N/A, you do not have root access - the boot image is not patched, or you have a problem with Magisk.
    • "App" simply shows the version of the app itself.
    • If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.
    • If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
    • Some Magisk modules, especially those that modify read only partitions like /system, may cause a boot loop after updating. As a general rule, disable these modules before updating. You are responsible for knowing what you have installed, and what modules to disable.


    Credits:
    Thanks to @ipdev , @kdrag0n , @Didgeridoohan , and last but not least, @topjohnwu for all their hard work!
    2
    Magisk Stable is now at version 24.1, so I will no longer be providing any Magisk updates.

    You can use any version of Magisk now - Stable, Beta, or Canary. as long as it is 23016 or newer.

    Once again, if you want to switch versions of Maagisk, it is HIGHLY RECOMMENDED that you "Complete Uninstall" within Magisk before installing the new version. Multiple instances of Magisk can break root.

    If you simply want to update Magisk, the best way to do so is from within the app.


    Once the February update is out, I will perform some testing with installing to inactive slot, and if it works, I will update this guide.

    Given the low activity on this thread, I will probably close it if everything goes well with the next update.

    Thank you all for your testing and contributions.
    2
    Magisk Canary was updated to 23016 last night. This includes a fix for the vbmeta header issue, meaning that disabling verity/verification should no longer be required, and we should be able to root as we did before.
    So I did upgrading from latest 11 to latest 12 some minutes ago. Booted, patched boot.img with magisk 23016 and flashed the patched image to get back root. Worked like a charm just like any update before. So no more wipe needed.

    So, it's time for the good old pal Stinky Wizzleteats and his song about being happy. That's right, it's the happy, happy, joy, joy song:
    Happy, happy, joy, joy
    Happy, happy, joy, joy
    Happy, happy, joy, joy
    Happy, happy, joy, joy
    Happy, happy, joy, joy
    Happy, happy, joy, joy

    ┌(・。・)┘♪
    1
    DO NOT take the automatic OTA if you are rooted.

    Well, that explains why I haven't been able to update boot with my patched file.

    First I've heard of it and not sure I'm ready to wipe everything and start over.

    Sucks to be an early adopter.

    Thanks for the post.
    1
    Well, I'll know soon enough. I'm planning to replace the port tomorrow. Just hope I don't crack the glass or mess up the digitizer taking it apart.