How To Guide [GUIDE] Pixel 6 "oriole": Unlock Bootloader, Update, Root, Pass SafetyNet

Search This thread

jant90

Member
Jan 27, 2008
42
6
I think something is wrong with my Pixel 6A because I can only ever boot from one slot, the other slot is always corrupted or gives bootloop (returns to bootloader). Even after flashing both slots with stock FW using PixelFlasher 4.4.0.0 and adb 33.0.3.

I've been out of the root game for a few years now, so before using my brand new Pixel 6A I first want to learn how to root, upgrade or apply OTA's (and keep root), recover from bad flash/root, etc. So I've played around with it for the past few days flashing, reflashing, rooting and upgrading my device so I can't tell you what I did exactly.

Therefore I decided to start fresh and I performed the following steps:
  1. Fully restored my Pixel 6A to stock with Android Flash Tool, FW version TP1A.220905.004.A2 (slightly older FW so I can test upgrading/OTA's). I used options "Wipe Device", "Lock Bootloader", "Force Flash all Partitions".
  2. Enabled adb debugging and unlocked the bootloader.
  3. Enabled adb debugging after the wipe again.
  4. At this point my Pixel 6A boots fine from slot A.
  5. I changed the active slot to B and tried to boot, but it fails and returns to the bootloader. How is this possible? Other than the unlocked bootloader my device is flashed with clean, stock firmware.
  6. In an attempt to fix this I used PixelFlasher to flash the same factory FW version to slot B. Now it boots fine from slot B but slot A won't boot: I can see the Google logo on a black background for a few seconds but then the phone goes to Fastboot Mode (with "Enter reason: reboot bootloader").
  7. I repeated the previous step but now for slot A: so I activated slot A again, flashed it with the same factory image as I did for slot B. Now slot A is bootable but slot B isn't anymore.
  8. Next, I put my phone in Recovery Mode and chose option "Apply update from ADB" and I sideloaded the same version OTA FW file by running adb sideload ota.zip. Now slot B is bootable again but slot A gives an error screen with a red exclamation and "Your device is corrupt" message (this is different from before when it would go straight to the bootloader).
  9. Lastly, I tried to flash the stock factory FW with PixelFlasher with the "Flash both slots" option, but still only one slot is bootable.
How on earth do I get a fully working firmware in both slots so I can boot from either slot? That should be possible right?
 
Last edited:

V0latyle

Forum Moderator
Staff member
I think something is wrong with my Pixel 6A because I can only ever boot from one slot, the other slot is always corrupted or gives bootloop (returns to bootloader). Even after flashing both slots with stock FW using PixelFlasher 4.4.0.0 and adb 33.0.3.

I've been out of the root game for a few years now, so before using my brand new Pixel 6A I first want to learn how to root, upgrade or apply OTA's (and keep root), recover from bad flash/root, etc. So I've played around with it for the past few days flashing, reflashing, rooting and upgrading my device so I can't tell you what I did exactly.

Therefore I decided to start fresh and I performed the following steps:
  1. Fully restored my Pixel 6A to stock with Android Flash Tool, FW version TP1A.220905.004.A2 (slightly older FW so I can test upgrading/OTA's). I used options "Wipe Device", "Lock Bootloader", "Force Flash all Partitions".
  2. Enabled adb debugging and unlocked the bootloader.
  3. Enabled adb debugging after the wipe again.
  4. At this point my Pixel 6A boots fine from slot A.
  5. I changed the active slot to B and tried to boot, but it fails and returns to the bootloader. How is this possible? Other than the unlocked bootloader my device is flashed with clean, stock firmware.
  6. In an attempt to fix this I used PixelFlasher to flash the same factory FW version to slot B. Now it boots fine from slot B but slot A won't boot: I can see the Google logo on a black background for a few seconds but then the phone goes to Fastboot Mode (with "Enter reason: reboot bootloader").
  7. I repeated the previous step but now for slot A: so I activated slot A again, flashed it with the same factory image as I did for slot B. Now slot A is bootable but slot B isn't anymore.
  8. Next, I put my phone in Recovery Mode and chose option "Apply update from ADB" and I sideloaded the same version OTA FW file by running adb sideload ota.zip. Now slot B is bootable again but slot A gives an error screen with a red exclamation and "Your device is corrupt" message (this is different from before when it would go straight to the bootloader).
  9. Lastly, I tried to flash the stock factory FW with PixelFlasher with the "Flash both slots" option, but still only one slot is bootable.
How on earth do I get a fully working firmware in both slots so I can boot from either slot? That should be possible right?
From what I understand, this is normal - manually switching slots doesn't work, because of how the system marks the slots as "current", "bootable", and "successful". I would just leave it alone; the only time you should need to switch slots will be done automatically, like when updating via OTA.

You can use Magisk to switch slots by using "Install to Inactive Slot". After patching the alternate slot boot image, it then calls a reboot to that slot.

Trying to manually switch slots from bootloader "confuses" the system. You can use bootctl via an elevated shell. Context:
Code:
Commands:
  hal-info                       - Show info about boot_control HAL used.
  get-number-slots               - Prints number of slots.
  get-current-slot               - Prints currently running SLOT.
  mark-boot-successful           - Mark current slot as GOOD.
  get-active-boot-slot           - Prints the SLOT to load on next boot.
  set-active-boot-slot SLOT      - On next boot, load and execute SLOT.
  set-slot-as-unbootable SLOT    - Mark SLOT as invalid.
  is-slot-bootable SLOT          - Returns 0 only if SLOT is bootable.
  is-slot-marked-successful SLOT - Returns 0 only if SLOT is marked GOOD.
  get-suffix SLOT                - Prints suffix for SLOT.
  set-snapshot-merge-status STAT - Sets whether a snapshot-merge of any dynamic
                                   partition is in progress. Valid STAT values
                                   are: none, unknown, snapshotted, merging,
                                   or cancelled.
  get-snapshot-merge-status      - Prints the current snapshot-merge status.

SLOT parameter is the zero-based slot-number.

Here is a Magisk module that can be used to mount the bootctl utility
 

Lughnasadh

Senior Member
Mar 23, 2015
4,660
5,262
Google Nexus 5
Huawei Nexus 6P
I think something is wrong with my Pixel 6A because I can only ever boot from one slot, the other slot is always corrupted or gives bootloop (returns to bootloader). Even after flashing both slots with stock FW using PixelFlasher 4.4.0.0 and adb 33.0.3.

I've been out of the root game for a few years now, so before using my brand new Pixel 6A I first want to learn how to root, upgrade or apply OTA's (and keep root), recover from bad flash/root, etc. So I've played around with it for the past few days flashing, reflashing, rooting and upgrading my device so I can't tell you what I did exactly.

Therefore I decided to start fresh and I performed the following steps:
  1. Fully restored my Pixel 6A to stock with Android Flash Tool, FW version TP1A.220905.004.A2 (slightly older FW so I can test upgrading/OTA's). I used options "Wipe Device", "Lock Bootloader", "Force Flash all Partitions".
  2. Enabled adb debugging and unlocked the bootloader.
  3. Enabled adb debugging after the wipe again.
  4. At this point my Pixel 6A boots fine from slot A.
  5. I changed the active slot to B and tried to boot, but it fails and returns to the bootloader. How is this possible? Other than the unlocked bootloader my device is flashed with clean, stock firmware.
  6. In an attempt to fix this I used PixelFlasher to flash the same factory FW version to slot B. Now it boots fine from slot B but slot A won't boot: I can see the Google logo on a black background for a few seconds but then the phone goes to Fastboot Mode (with "Enter reason: reboot bootloader").
  7. I repeated the previous step but now for slot A: so I activated slot A again, flashed it with the same factory image as I did for slot B. Now slot A is bootable but slot B isn't anymore.
  8. Next, I put my phone in Recovery Mode and chose option "Apply update from ADB" and I sideloaded the same version OTA FW file by running adb sideload ota.zip. Now slot B is bootable again but slot A gives an error screen with a red exclamation and "Your device is corrupt" message (this is different from before when it would go straight to the bootloader).
  9. Lastly, I tried to flash the stock factory FW with PixelFlasher with the "Flash both slots" option, but still only one slot is bootable.
How on earth do I get a fully working firmware in both slots so I can boot from either slot? That should be possible right?
Whenever you manually switch slots as you were doing in Steps 5-7, you have to re-flash (can dirty flash) the firmware after you've switched slots to get it to boot on that slot (as you found out).

However, both slots are still likely "bootable". That is, if you got into a bootloop on one slot and it reverted to the other slot it should still boot on the other slot.
 
Last edited:

V0latyle

Forum Moderator
Staff member
Whenever you manually switch slots as you were doing in Steps 5-7, you have to re-flash (can dirty flash) the firmware after you've switched slots to get it to boot on that slot (as you found out).

However, both slots are still likely "bootable". That is, if you got into a bootloop on one slot and it reverted to the other slot it should still boot on the other slot.
Not quite true...you just have to use bootctl to tell it to boot to the other slot. Simply setting the other slot active in bootloader short circuits the process.
 

jant90

Member
Jan 27, 2008
42
6
Thanks for easing my mind about this guys! So just a misunderstanding on my side. :)

I was having some issues with applying an OTA update and keeping root through Magisk Manager and I thought that maybe for that to work both slots should have up-to-date, working firmware (and to test that I tried booting from them).

Luckily I learned a lot from all this flashing, rooting, updating with adb, fastboot and PixelFlasher and I think that should I ever screw up a future update I should be able to recover without data loss pretty easy and quick now.
 

badabing2003

Recognized Contributor
Sep 17, 2012
1,565
1,845
@V0latyle I don't doubt your wealth of knowledge, bootctl github page is saying
> Switch My Slot is an Android app that helps you switch between android A & B slots easily without having to enter commands in adb or fastboot shell.
I think it is designed to be easy or another medium to be able to switch, I don't see any mention of adb / fastboot based switching being non-functional.
It's the first I hear, which only reflects on my ignorance of the issue, but if there are any discussions threads about this, I would like to catch up, I personally never had issues with slot switching.

@jant90
Are you sure that it is booting to the slot you just flashed?, just making sure, because if it fails to boot to one of the slots, it would switch to the other and perhaps that would seem that it is booting fine.

You can provide a support.zip file and I can peruse the logs and see if anything stands out, you probably want to do that in PF support thread to keep this free of unnecessary chatter.

Update: I just missed @jant90 post while posting this.
I'm still interested to learn about the slot related issues.
 

V0latyle

Forum Moderator
Staff member
@V0latyle I don't doubt your wealth of knowledge, bootctl github page is saying
> Switch My Slot is an Android app that helps you switch between android A & B slots easily without having to enter commands in adb or fastboot shell.
I think it is designed to be easy or another medium to be able to switch, I don't see any mention of adb / fastboot based switching being non-functional.
It's the first I hear, which only reflects on my ignorance of the issue, but if there are any discussions threads about this, I would like to catch up, I personally never had issues with slot switching.
I could be wrong but I believe the bootctl binary isn't already installed and enabled by default, necessitating the module. I'm not all that familiar with Android shell but I imagine anything that can be done in shell can be done in an app.
 

badabing2003

Recognized Contributor
Sep 17, 2012
1,565
1,845
I could be wrong but I believe the bootctl binary isn't already installed and enabled by default, necessitating the module. I'm not all that familiar with Android shell but I imagine anything that can be done in shell can be done in an app.
Thank you, I will look into this and try to understand how it is working.
 

gazdajezda

Senior Member
Apr 24, 2011
433
84
V0latyle, I think I need your opinion badly. Today I notice that home screen widget which shows calendar (my and shared events, ppl birthdays...) begins to shows birthdays of people I know I never enter their birthday date. Also, I know that this could be because of my phone's uptime was approx 2550 hours so I just restart it. After restart it never came alive, but enter into some mode where only three options are available after long press on power button:

- Lockdown
- Power off
- Restart

Screen is black, it seems that nothing non Google is started (I use Nova launcher) so only response from phone is on long press to Power button.

Phone is still on Android 12 or 12.1 don't remember honestly, with unlocked bootloader & rooted with Magisk with addons for SN pass.

Do I need to flash it totally (from scratch) or can I restore current system with flash boot image or similar action? It's enough if I can restore to that version (I still have images on home comp, I will get there in 4-5 hours), I was fully happy with it. So I can skip A13 upgrade path for now, will do that later, when there will be more time to play with it. Any hint, PLEASE?
 

V0latyle

Forum Moderator
Staff member
V0latyle, I think I need your opinion badly. Today I notice that home screen widget which shows calendar (my and shared events, ppl birthdays...) begins to shows birthdays of people I know I never enter their birthday date. Also, I know that this could be because of my phone's uptime was approx 2550 hours so I just restart it. After restart it never came alive, but enter into some mode where only three options are available after long press on power button:

- Lockdown
- Power off
- Restart

Screen is black, it seems that nothing non Google is started (I use Nova launcher) so only response from phone is on long press to Power button.

Phone is still on Android 12 or 12.1 don't remember honestly, with unlocked bootloader & rooted with Magisk with addons for SN pass.

Do I need to flash it totally (from scratch) or can I restore current system with flash boot image or similar action? It's enough if I can restore to that version (I still have images on home comp, I will get there in 4-5 hours), I was fully happy with it. So I can skip A13 upgrade path for now, will do that later, when there will be more time to play with it. Any hint, PLEASE?
Lockdown? I haven't seen that option on the boot menus of previous Pixels

Does the device even begin to boot? As in, do you get the Google logo after the bootloader warning screen?

It's hard to say how to fix it without knowing what's going on. I suggest flashing the stock boot image (unpatched) for your build and see if the device boots.

Also, if it begins to boot on the patched image, but bootloops, you can disable Magisk modules with this command: adb wait-for-device shell magisk --remove-modules

If restoring the boot image doesn't fix it, you could try dirty flashing the factory image. And if that doesn't solve the problem, you probably need to wipe data.
 

gazdajezda

Senior Member
Apr 24, 2011
433
84
Lockdown? I haven't seen that option on the boot menus of previous Pixels

Does the device even begin to boot? As in, do you get the Google logo after the bootloader warning screen?

It's hard to say how to fix it without knowing what's going on. I suggest flashing the stock boot image (unpatched) for your build and see if the device boots.

Also, if it begins to boot on the patched image, but bootloops, you can disable Magisk modules with this command: adb wait-for-device shell magisk --remove-modules

If restoring the boot image doesn't fix it, you could try dirty flashing the factory image. And if that doesn't solve the problem, you probably need to wipe data.

Yes, it boots. First Bootloader unlocked warning, then normal Google logo then animation and after that shows G colored in purple, gray, light blue and dark grey combination. After a while screen went black and only long press works (shows those three options). There is something that system is not satisfied with it. Maybe too old Android, don't know.

Ok, when I will be at my comp, I will first flash stock boot image and hope for success.

If not, then dirty flash and if that also would not help, wipe will come to play :)sad).

And when I will doing that, just a question: is latest A13 rootable (Magisk)? Are there any problems with it? I just need to rooting it with Magisk with SN pass addon and for ad removal (AdAway).

Uff, Google Authenticator... I hope I will restore it...
 

V0latyle

Forum Moderator
Staff member
Yes, it boots. First Bootloader unlocked warning, then normal Google logo then animation and after that shows G colored in purple, gray, light blue and dark grey combination. After a while screen went black and only long press works (shows those three options). There is something that system is not satisfied with it. Maybe too old Android, don't know.

Ok, when I will be at my comp, I will first flash stock boot image and hope for success.

If not, then dirty flash and if that also would not help, wipe will come to play :)sad).

And when I will doing that, just a question: is latest A13 rootable (Magisk)? Are there any problems with it? I just need to rooting it with Magisk with SN pass addon and for ad removal (AdAway).

Uff, Google Authenticator... I hope I will restore it...
Considering it is booting, I think your chances of recovery are quite good. Start with the command I recommended; this will tell Magisk to disable any modules during boot, so if one of those is causing the problem, that should help.

Yes, Android 13 is rootable. Just make sure you use Magisk v24 or newer, latest 25.2 recommended.

SafetyNet has been replaced by Play Integrity, so you need to address whether your device passes Play Integrity attestation. It is possible to pass SafetyNet but fail Play Integrity. Most apps that require security guarantees such as banking/DRM have already switched to the Play Integrity API. I have provided more information in the OP.
 

gazdajezda

Senior Member
Apr 24, 2011
433
84
Just to be sure, for flashing boot.img from current state I need to do:
  • connect phone with PC
then one of this:
  • start phone in Fastboot mode (PWR + vol. down) or select (with vol. keys) "Restart Bootloader" and confirm with PWRB?)?
or
  • on computer execute: fastboot reboot-bootloader (is this same as selecting it with vol. keys?)
Don't know why, but I think all that is same?

Then for ROM patching:
  • flash-all.bat (without -w for dirty and with it for real wipe)
or below command to only flash boot image:
  • fastboot flash boot <boot.img>
Really sorry for bothering, but I simpl forgot all those right steps, it's been a while when I last time doing it (half a year ago), just don't wanna get bricked device :)
 

gazdajezda

Senior Member
Apr 24, 2011
433
84
Considering it is booting, I think your chances of recovery are quite good. Start with the command I recommended; this will tell Magisk to disable any modules during boot, so if one of those is causing the problem, that should help.

I will and sincerelly hope so.

Yes, Android 13 is rootable. Just make sure you use Magisk v24 or newer, latest 25.2 recommended.

SafetyNet has been replaced by Play Integrity, so you need to address whether your device passes Play Integrity attestation. It is possible to pass SafetyNet but fail Play Integrity. Most apps that require security guarantees such as banking/DRM have already switched to the Play Integrity API. I have provided more information in the OP.

Ok, so Play Integrity is not beatable at the moment (i will read OP, not need to answer).
I will try today and will get back to report. Just need to clarify with commands I will need.
 

V0latyle

Forum Moderator
Staff member
Just to be sure, for flashing boot.img from current state I need to do:
  • connect phone with PC
then one of this:
  • start phone in Fastboot mode (PWR + vol. down) or select (with vol. keys) "Restart Bootloader" and confirm with PWRB?)?
or
  • on computer execute: fastboot reboot-bootloader (is this same as selecting it with vol. keys?)
Don't know why, but I think all that is same?\
You need to be in bootloader mode. How you get there doesn't matter.
Then for ROM patching:
  • flash-all.bat (without -w for dirty and with it for real wipe)
I'm probably splitting hairs here...but "patching" means to update existing code with a bit of new code, like "patching fabric", so to refer to dirty flashing as patching is incorrect. Dirty flashing in this regard means we are rewriting the OS binaries to the device, without wiping user data (which would be a "clean" flash)
or below command to only flash boot image:
  • fastboot flash boot <boot.img>
Really sorry for bothering, but I simpl forgot all those right steps, it's been a while when I last time doing it (half a year ago), just don't wanna get bricked device :)
No worries. The only way you'll brick your device is if you screw up the bootloader.

Since this is a Pixel 6, I highly recommend you click the warning at the top of the OP and read. As this is your first time updating to Android 13, it is important you update both bootloader slots at the same time.

Also, be aware that there is no easy way to return to Android 12, as the new bootloader prevents downgrading. So, if you aren't absolutely sure you want to update to 13, don't.
 

gazdajezda

Senior Member
Apr 24, 2011
433
84
Yes, my mistake. Don't know why i wrote "patching", it is "flashing". I know the difference :)

I will stay on 12 for now. Also, will return in few hours, hopefully with smile on my face :)

And, thank you!!!
 
  • Like
Reactions: V0latyle

gazdajezda

Senior Member
Apr 24, 2011
433
84
Hi!

I tried to flash a patched boot.img, no sucess, same. Then with official boot.img, same. Also tried to disable Magisk modules, but ADB said device unknown or unpaired, so no go... Just finishing the dirty flash of my current system (oriole-sq3a.220605.009.b1), same. So only way for device to start working again is wipe... so let's go with that... Eh Gugl, damn you.
 

V0latyle

Forum Moderator
Staff member
Hi!

I tried to flash a patched boot.img, no sucess, same. Then with official boot.img, same. Also tried to disable Magisk modules, but ADB said device unknown or unpaired, so no go... Just finishing the dirty flash of my current system (oriole-sq3a.220605.009.b1), same. So only way for device to start working again is wipe... so let's go with that... Eh Gugl, damn you.
What happened when you tried to flash the boot image? Copy and paste the output here, or take a photo. Make sure you're using the correct firmware - "oriole" for Pixel 6.

You could also use Pixel Flasher to make this a bit easier.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Thanks!
    You are absolutely right what you are saying about learning the manual process. So I tried a couple of times, which isn't really a lot.
    At some stage after searching the error(corrupt image error in adb) on the web some solution came up that the Android adb interface driver could possibly be missing. So I tried to install it, though the pc complained that it wasn't a 64 bit driver or something along these lines. Hence I moved to PF. No complaints during that procedure.
    If Pixel Flasher worked, that's not the problem because PF uses the same ADB tools and interfaces.

    HI!
    Kind of new :)

    I've got 2 questions about this, I am using Pixel 6 - Paranoid Android ROM:
    - Ive checked my bootloader version and A&B are both "slider-1.2-9152140"
    Is this fine or should i change something?

    - Will this rooting option and safetynet work with my installed rom?
    If yes, will it clear my data (if successfull)?

    Thanks!
    Questions about Paranoid ROM should be asked in the Paranoid ROM thread.

    As for your bootloader version, I do not know off the top of my head what the Android 13 bootloader is. Since you're using a custom ROM this shouldn't be an issue.
    1
    If Pixel Flasher worked, that's not the problem because PF uses the same ADB tools and interfaces.
    Perhaps it wasn't the drivers, but rather the Android Platform Tools.
    When using PF, you select the directory where Android Platform Tools are installed and PF hard codes that full path in the generated flash_all script along with the selected device's ID, hence avoiding any potential of picking up any other Android Platform Tools in the system path.
    It's not uncommon for people to have several old versions of adb lingering in their system and some unfortunately added to their system environment.

    If it was a driver issue, you are absolutely correct, PF would have ran into the same issue.
    1
    Updated to the latest jan5 build using the factory image and pixel flasher. Everything went beyond smoothly (shoutout to badabing2003). Kept root, all my modules are there and working.Overall great. Only one thing I've run into that I have a question about:

    Google wallet is now prompting me about detecting root. It only prompts me once in a while when entering the app. Now here's the thing: when I go to app>tap to pay setup, all the items on the list are checked, including the "your phone meets security requirements" part.

    Now my question is, will this prompt disappear on its own? Is this a known thing? Anybody else run into this after updating? I tried clearing cache/appdata, but I'm still getting the prompt.

    Using latest Magisk canary, zygisk, universal safetynet fix modded by displax, enforce deny list with google wallet and google play store on the deny list (as well as google play protect service).

    I was on the october update prior to updating, with the same magisk setup and didn't have this issue back then. Any help or suggestions would be greatly appreciated, thanks!
    What does Integrity Checker or TB Checker say?
    1
    Yeah, everything looks good. Maybe clear data for Wallet? It won't remove your cards
    I'm going to give this a shot as mine literally stopped working yesterday without having any problems prior to then. I installed the latest security update a few days after it first became available.
  • 48
    ⚠️⚠️⚠️WARNING! IF YOU ARE UPDATING TO ANDROID 13 FOR THE FIRST TIME, READ THIS FIRST! ⚠️⚠️⚠️

    If you are looking for my guide on a different Pixel, find it here:
    Update 6-20-22: Magisk 25.1 is recommended as this includes fixes for OTA updates, as well as support for the Android 13 beta.
    Discussion thread for migration to 24.0+.

    DO NOT use any version of Magisk lower than Canary 23016 as it does not yet incorporate the necessary fixes for Android 12 and your device.


    WARNING: YOU AND YOU ALONE ARE RESPONSIBLE FOR ANYTHING THAT HAPPENS TO YOUR DEVICE. THIS GUIDE IS WRITTEN WITH THE EXPRESS ASSUMPTION THAT YOU ARE FAMILIAR WITH ADB, MAGISK, ANDROID, AND ROOT. IT IS YOUR RESPONSIBILITY TO ENSURE YOU KNOW WHAT YOU ARE DOING.

    Prerequisites:


    Android Source - Setting up a device for development


    1. Follow these instructions to enable Developer Options and USB Debugging.
    2. Enable OEM Unlocking. If this option is grayed out, unlocking the bootloader is not possible.
    3. Connect your device to your PC, and open a command window in your Platform Tools folder.
    4. Ensure ADB sees your device:
      Code:
      adb devices
      If you don't see a device, make sure USB Debugging is enabled, reconnect the USB cable, or try a different USB cable.
      If you see "unauthorized", you need to authorize the connection on your device.
      If you see the device without "unauthorized", you're good to go.
    5. Reboot to bootloader:
      Code:
      adb reboot bootloader
    6. Unlock bootloader: THIS WILL WIPE YOUR DEVICE!
      Code:
      fastboot flashing unlock
      Select Continue on the device screen.

    1. Install Magisk on your device.
    2. Download the factory zip for your build.
    3. Inside the factory zip is the update zip: "device-image-buildnumber.zip". Open this, and extract boot.img
    4. Copy boot.img to your device.
    5. Patch boot.img with Magisk: "Install" > "Select and Patch a File"
    6. Copy the patched image back to your PC. It will be named "magisk_patched-23xxx_xxxxx.img". Rename this to "master root.img" and retain it for future updates.
    7. Reboot your device to bootloader.
    8. Flash the patched image:
      Code:
      fastboot flash boot <drag and drop master root.img here>
    9. Reboot to Android. Open Magisk to confirm root - under Magisk at the top, you should see "Installed: <Magisk build number>

    1. Before you download the OTA, open Magisk, tap Uninstall, then Restore Images. If you have any Magisk modules that modify system, uninstall them now.
    2. Take the OTA update when prompted. To check for updates manually, go to Settings > System > System Update > Check for Update
    3. Allow the update to download and install. DO NOT REBOOT WHEN PROMPTED. Open Magisk, tap Install at the top, then Install to inactive slot. Magisk will then reboot your device.
    4. You should now be updated with root.

    1. Download the OTA.
    2. Reboot to recovery and sideload the OTA:
      Code:
      adb reboot sideload
      Once in recovery:
      Code:
      adb sideload ota.zip
    3. When the OTA completes, you will be in recovery mode. Select "Reboot to system now".
    4. Allow system to boot and wait for the update to complete. You must let the system do this before proceeding.
    5. Reboot to bootloader.
    6. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    8. Reboot your device. You should now be updated with root.
    Note: You can use Payload Dumper to extract the contents of the OTA if you want to manually patch the new boot image. However, I will not cover that in this guide.

    Please note that the factory update process expects an updated bootloader and radio. If these are not up to date, the update will fail.
    1. Download the factory zip and extract the contents.
    2. Reboot to bootloader.
    3. Compare bootloader versions between phone screen and bootloader.img build number
      Code:
      fastboot flash bootloader <drag and drop new bootloader.img here>
      If bootloader is updated, reboot to bootloader.
    4. Compare baseband versions between phone screen and radio.img build number
      Code:
      fastboot flash radio <drag and drop radio.img here>
      If radio is updated, reboot to bootloader.
    5. Apply update:
      Code:
      fastboot update --skip-reboot image-codename-buildnumber.zip
      When the update completes, the device will be in fastbootd. Reboot to bootloader.
    6. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    7. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    8. Reboot your device. You should now be updated with root.
    Note: If you prefer, you can update using the flash-all script included in the factory zip. You will have to copy the script, bootloader image, radio image, and update zip into the Platform Tools folder; you will then have to edit the script to remove the -w option so it doesn't wipe your device.
    The scripted commands should look like this:
    Code:
    fastboot flash bootloader <bootloader image name>
    fastboot reboot bootloader
    ping -n 5 127.0.0.1 > nul
    fastboot flash radio <radio image name>
    fastboot reboot bootloader
    ping -n 5 127.0.0.1 > nul
    fastboot update  --skip-reboot <image-device-buildnumber.zip>
    Once this completes, you can reboot to bootloader and either boot your master patched image, or if you patched the new image, flash it at this time.

    PixelFlasher by @badabing2003 is an excellent tool that streamlines the update process - it even patches the boot image for you.
    The application essentially automates the ADB interface to make updating and rooting much easier. However, it is STRONGLY recommended that you still learn the "basics" of using ADB.

    For instructions, downloads, and support, please refer to the PixelFlasher thread.

    1. Follow the instructions on the Android Flash Tool to update your device. Make sure Lock Bootloader and Wipe Device are UNCHECKED.
    2. When the update completes, the device will be in fastbootd. Reboot to bootloader.
    3. Boot the master root image (See note 1):
      Code:
      fastboot boot <drag and drop master root.img here>
      Note: If you prefer, you can download the factory zip and manually patch the new boot image, then flash it after the update. Do not flash an older boot image after updating.
    4. Your device should boot with root. Open Magisk, tap Install, and select Direct Install.
    5. Reboot your device. You should now be updated with root.

    SafetyNet has been deprecated for the new Play Integrity API. More information here.

    In a nutshell, Play Integrity uses the same mechanisms as SafetyNet for the BASIC and DEVICE verdicts, but uses the Trusted Execution Environment to validate those verdicts. TEE does not function on an unlocked bootloader, so legacy SafetyNet solutions will fail.

    However, @Displax has modified the original Universal SafetyNet Fix by kdrag0n; his mod is able to bypass TEE, meaning that the device will pass BASIC and DEVICE integrity.

    Mod available here. Do not use MagiskHide Props Config with this mod.

    This is my configuration that is passing Safety Net. I will not provide instructions on how to accomplish this. Attempt at your own risk.

    Zygisk + DenyList enabled
    All subcomponents of these apps hidden under DenyList:
    • Google Play Store
    • GPay
    • Any banking/financial apps
    • Any DRM media apps
    Modules:
    • Universal SafetyNet Fix 2.3.1 Mod - XDA post
    To check SafetyNet status:
    To check Play Integrity status:
    I do not provide support for Magisk or modules. If you need help with Magisk, here is the Magisk General Support thread. For support specifically with Magisk v24+, see this thread.

    Points of note:
    • The boot image is NOT the bootloader image. Do not confuse the two - YOU are expected to know the difference. Flashing the wrong image to bootloader could brick your device.
    • While the Magisk app is used for patching the boot image, the app and the patch are separate. This is what you should see in Magisk for functioning root:
      screenshot_20211218-194517-png.5486339
    • "Installed" shows the version of patch in the boot image. If this says N/A, you do not have root access - the boot image is not patched, or you have a problem with Magisk.
    • "App" simply shows the version of the app itself.
    • If you do not have a patched master boot image, you will need to download the factory zip if you haven't already, extract the system update inside it, then patch boot.img.
    • If you prefer updating with the factory image, you can also extract and manually patch the boot image if desired.
    • Some Magisk modules, especially those that modify read only partitions like /system, may cause a boot loop after updating. As a general rule, disable these modules before updating. You are responsible for knowing what you have installed, and what modules to disable.


    Credits:
    Thanks to @ipdev , @kdrag0n , @Didgeridoohan , and last but not least, @topjohnwu for all their hard work!
    7
    Magisk Canary was updated to 23016 last night. This includes a fix for the vbmeta header issue, meaning that disabling verity/verification should no longer be required, and we should be able to root as we did before. This needs testing, make sure you back up your data and photos before you do this!

    Additionally, for the Pixel 6 and 6 Pro, fstab will now load from /system/etc which should fix the root issue many of you were having.

    Q: "If verity/verification are disabled, do I need to enable them now?"
    A: No. The only thing you have to do is update to Magisk 23016.
    Q: "Will enabling verity/verification wipe my data?"
    A: No.

    I will be updating the OP to reflect this.
    5
    Magisk 24306 (release notes) is now available on the canary channel, and I can confirm that the installation to the inactive slot OTA method is working for the April update.
    5
    Interesting. How did you command the reboot?

    When I tried to update this way on my wife's 5a, it bootlooped back to the original slot.
    I always follow these steps once I know the OTA is available:

    1. Open Magisk and select 'Uninstall Magisk -> Restore Images'
    2. Open Settings and Download/Install OTA *DO NOT REBOOT*
    3. Go back to Magisk and select 'Install -> Install to Inactive Slot (After OTA)' *DO NOT REBOOT*
    4. Go back to Settings and 'Reboot' to finalize the OTA
    5
    So, if I use this tool after rooting OTA updates will work and I'll still have root?

    Edit: And can you explain more clearly the process on how to do this?

    No, the tool does nothing to maintain root. It simply allows you to take the OTA. You will still need to reboot into fastboot and flash or boot from a patched boot image.

    The steps would be:
    1. Restore boot in the Magisk app
    2. Restore vbmeta in Vbmeta Patcher
    3. Take the OTA in System Updater
    4. Patch vbmeta in Vbmeta Patcher
    5. Patch the new boot image in the Magisk app and copy it to your computer
    6. Reboot into fastboot
    7. Boot from the new patched boot image
    8. Direct Install Magisk in the Magisk App
    As I noted the quote post, this process should be considered experimental until it has been more thoroughly tested. You should consider backing up any critical data before attempting it, in case something goes wrong.

    I'm working on another tool to make it a bit easier to acquire the new boot image in step 5, but that will likely be a few days. Hopefully we'll be able to install Magisk to the inactive slot on Pixel devices again in the future, which would consolidate steps 5-8.