How To Guide [GUIDE] Pixel 6 "oriole": Unlock Bootloader, Update, Root, Pass SafetyNet

[jant90]

I think something is wrong with my Pixel 6A because I can only ever boot from one slot, the other slot is always corrupted or gives bootloop (returns to bootloader). Even after flashing both slots with stock FW using PixelFlasher 4.4.0.0 and adb 33.0.3.

I've been out of the root game for a few years now, so before using my brand new Pixel 6A I first want to learn how to root, upgrade or apply OTA's (and keep root), recover from bad flash/root, etc. So I've played around with it for the past few days flashing, reflashing, rooting and upgrading my device so I can't tell you what I did exactly.

Therefore I decided to start fresh and I performed the following steps:

1. Fully restored my Pixel 6A to stock with Android Flash Tool, FW version TP1A.220905.004.A2 (slightly older FW so I can test upgrading/OTA's). I used options "Wipe Device", "Lock Bootloader", "Force Flash all Partitions".
2. Enabled adb debugging and unlocked the bootloader.
3. Enabled adb debugging after the wipe again.
4. At this point my Pixel 6A boots fine from slot A.
5. I changed the active slot to B and tried to boot, but it fails and returns to the bootloader. How is this possible? Other than the unlocked bootloader my device is flashed with clean, stock firmware.
6. In an attempt to fix this I used PixelFlasher to flash the same factory FW version to slot B. Now it boots fine from slot B but slot A won't boot: I can see the Google logo on a black background for a few seconds but then the phone goes to Fastboot Mode (with "Enter reason: reboot bootloader").
7. I repeated the previous step but now for slot A: so I activated slot A again, flashed it with the same factory image as I did for slot B. Now slot A is bootable but slot B isn't anymore.
8. Next, I put my phone in Recovery Mode and chose option "Apply update from ADB" and I sideloaded the same version OTA FW file by running adb sideload ota.zip. Now slot B is bootable again but slot A gives an error screen with a red exclamation and "Your device is corrupt" message (this is different from before when it would go straight to the bootloader).
9. Lastly, I tried to flash the stock factory FW with PixelFlasher with the "Flash both slots" option, but still only one slot is bootable.

How on earth do I get a fully working firmware in both slots so I can boot from either slot? That should be possible right?

 

[V0latyle]

I think something is wrong with my Pixel 6A because I can only ever boot from one slot, the other slot is always corrupted or gives bootloop (returns to bootloader). Even after flashing both slots with stock FW using PixelFlasher 4.4.0.0 and adb 33.0.3.

I've been out of the root game for a few years now, so before using my brand new Pixel 6A I first want to learn how to root, upgrade or apply OTA's (and keep root), recover from bad flash/root, etc. So I've played around with it for the past few days flashing, reflashing, rooting and upgrading my device so I can't tell you what I did exactly.

Therefore I decided to start fresh and I performed the following steps:

1. Fully restored my Pixel 6A to stock with Android Flash Tool, FW version TP1A.220905.004.A2 (slightly older FW so I can test upgrading/OTA's). I used options "Wipe Device", "Lock Bootloader", "Force Flash all Partitions".
2. Enabled adb debugging and unlocked the bootloader.
3. Enabled adb debugging after the wipe again.
4. At this point my Pixel 6A boots fine from slot A.
5. I changed the active slot to B and tried to boot, but it fails and returns to the bootloader. How is this possible? Other than the unlocked bootloader my device is flashed with clean, stock firmware.
6. In an attempt to fix this I used PixelFlasher to flash the same factory FW version to slot B. Now it boots fine from slot B but slot A won't boot: I can see the Google logo on a black background for a few seconds but then the phone goes to Fastboot Mode (with "Enter reason: reboot bootloader").
7. I repeated the previous step but now for slot A: so I activated slot A again, flashed it with the same factory image as I did for slot B. Now slot A is bootable but slot B isn't anymore.
8. Next, I put my phone in Recovery Mode and chose option "Apply update from ADB" and I sideloaded the same version OTA FW file by running adb sideload ota.zip. Now slot B is bootable again but slot A gives an error screen with a red exclamation and "Your device is corrupt" message (this is different from before when it would go straight to the bootloader).
9. Lastly, I tried to flash the stock factory FW with PixelFlasher with the "Flash both slots" option, but still only one slot is bootable.

How on earth do I get a fully working firmware in both slots so I can boot from either slot? That should be possible right?

From what I understand, this is normal - manually switching slots doesn't work, because of how the system marks the slots as "current", "bootable", and "successful". I would just leave it alone; the only time you should need to switch slots will be done automatically, like when updating via OTA.

You can use Magisk to switch slots by using "Install to Inactive Slot". After patching the alternate slot boot image, it then calls a reboot to that slot.

Trying to manually switch slots from bootloader "confuses" the system. You can use bootctl via an elevated shell. Context:

Commands:
  hal-info                       - Show info about boot_control HAL used.
  get-number-slots               - Prints number of slots.
  get-current-slot               - Prints currently running SLOT.
  mark-boot-successful           - Mark current slot as GOOD.
  get-active-boot-slot           - Prints the SLOT to load on next boot.
  set-active-boot-slot SLOT      - On next boot, load and execute SLOT.
  set-slot-as-unbootable SLOT    - Mark SLOT as invalid.
  is-slot-bootable SLOT          - Returns 0 only if SLOT is bootable.
  is-slot-marked-successful SLOT - Returns 0 only if SLOT is marked GOOD.
  get-suffix SLOT                - Prints suffix for SLOT.
  set-snapshot-merge-status STAT - Sets whether a snapshot-merge of any dynamic
                                   partition is in progress. Valid STAT values
                                   are: none, unknown, snapshotted, merging,
                                   or cancelled.
  get-snapshot-merge-status      - Prints the current snapshot-merge status.

SLOT parameter is the zero-based slot-number.

Here is a Magisk module that can be used to mount the bootctl utility

 

[Lughnasadh]

I think something is wrong with my Pixel 6A because I can only ever boot from one slot, the other slot is always corrupted or gives bootloop (returns to bootloader). Even after flashing both slots with stock FW using PixelFlasher 4.4.0.0 and adb 33.0.3.

I've been out of the root game for a few years now, so before using my brand new Pixel 6A I first want to learn how to root, upgrade or apply OTA's (and keep root), recover from bad flash/root, etc. So I've played around with it for the past few days flashing, reflashing, rooting and upgrading my device so I can't tell you what I did exactly.

Therefore I decided to start fresh and I performed the following steps:

1. Fully restored my Pixel 6A to stock with Android Flash Tool, FW version TP1A.220905.004.A2 (slightly older FW so I can test upgrading/OTA's). I used options "Wipe Device", "Lock Bootloader", "Force Flash all Partitions".
2. Enabled adb debugging and unlocked the bootloader.
3. Enabled adb debugging after the wipe again.
4. At this point my Pixel 6A boots fine from slot A.
5. I changed the active slot to B and tried to boot, but it fails and returns to the bootloader. How is this possible? Other than the unlocked bootloader my device is flashed with clean, stock firmware.
6. In an attempt to fix this I used PixelFlasher to flash the same factory FW version to slot B. Now it boots fine from slot B but slot A won't boot: I can see the Google logo on a black background for a few seconds but then the phone goes to Fastboot Mode (with "Enter reason: reboot bootloader").
7. I repeated the previous step but now for slot A: so I activated slot A again, flashed it with the same factory image as I did for slot B. Now slot A is bootable but slot B isn't anymore.
8. Next, I put my phone in Recovery Mode and chose option "Apply update from ADB" and I sideloaded the same version OTA FW file by running adb sideload ota.zip. Now slot B is bootable again but slot A gives an error screen with a red exclamation and "Your device is corrupt" message (this is different from before when it would go straight to the bootloader).
9. Lastly, I tried to flash the stock factory FW with PixelFlasher with the "Flash both slots" option, but still only one slot is bootable.

How on earth do I get a fully working firmware in both slots so I can boot from either slot? That should be possible right?

Whenever you manually switch slots as you were doing in Steps 5-7, you have to re-flash (can dirty flash) the firmware after you've switched slots to get it to boot on that slot (as you found out).

However, both slots are still likely "bootable". That is, if you got into a bootloop on one slot and it reverted to the other slot it should still boot on the other slot.

 

[phaino00]

.
How on earth do I get a fully working firmware in both slots so I can boot from either slot? That should be possible right?

You can't. It's not designed for the dual boot functionality. It's not possible without dual boot functionality.

 

[V0latyle]

Whenever you manually switch slots as you were doing in Steps 5-7, you have to re-flash (can dirty flash) the firmware after you've switched slots to get it to boot on that slot (as you found out).

However, both slots are still likely "bootable". That is, if you got into a bootloop on one slot and it reverted to the other slot it should still boot on the other slot.

Not quite true...you just have to use bootctl to tell it to boot to the other slot. Simply setting the other slot active in bootloader short circuits the process.

 

[Lughnasadh]

Not quite true...you just have to use bootctl to tell it to boot to the other slot. Simply setting the other slot active in bootloader short circuits the process.

I was answering in the way that person was trying to do it without getting into more in depth details. I saw your earlier post.

.........................

 

[jant90]

Thanks for easing my mind about this guys! So just a misunderstanding on my side.

I was having some issues with applying an OTA update and keeping root through Magisk Manager and I thought that maybe for that to work both slots should have up-to-date, working firmware (and to test that I tried booting from them).

Luckily I learned a lot from all this flashing, rooting, updating with adb, fastboot and PixelFlasher and I think that should I ever screw up a future update I should be able to recover without data loss pretty easy and quick now.

 

[badabing2003]

@V0latyle I don't doubt your wealth of knowledge, bootctl github page is saying
> Switch My Slot is an Android app that helps you switch between android A & B slots easily without having to enter commands in adb or fastboot shell.
I think it is designed to be easy or another medium to be able to switch, I don't see any mention of adb / fastboot based switching being non-functional.
It's the first I hear, which only reflects on my ignorance of the issue, but if there are any discussions threads about this, I would like to catch up, I personally never had issues with slot switching.

@jant90
Are you sure that it is booting to the slot you just flashed?, just making sure, because if it fails to boot to one of the slots, it would switch to the other and perhaps that would seem that it is booting fine.

You can provide a support.zip file and I can peruse the logs and see if anything stands out, you probably want to do that in PF support thread to keep this free of unnecessary chatter.

Update: I just missed @jant90 post while posting this.
I'm still interested to learn about the slot related issues.

 

[V0latyle]

@V0latyle I don't doubt your wealth of knowledge, bootctl github page is saying
> Switch My Slot is an Android app that helps you switch between android A & B slots easily without having to enter commands in adb or fastboot shell.
I think it is designed to be easy or another medium to be able to switch, I don't see any mention of adb / fastboot based switching being non-functional.
It's the first I hear, which only reflects on my ignorance of the issue, but if there are any discussions threads about this, I would like to catch up, I personally never had issues with slot switching.

I could be wrong but I believe the bootctl binary isn't already installed and enabled by default, necessitating the module. I'm not all that familiar with Android shell but I imagine anything that can be done in shell can be done in an app.

 

[badabing2003]

I could be wrong but I believe the bootctl binary isn't already installed and enabled by default, necessitating the module. I'm not all that familiar with Android shell but I imagine anything that can be done in shell can be done in an app.

Thank you, I will look into this and try to understand how it is working.

 

[gazdajezda]

V0latyle, I think I need your opinion badly. Today I notice that home screen widget which shows calendar (my and shared events, ppl birthdays...) begins to shows birthdays of people I know I never enter their birthday date. Also, I know that this could be because of my phone's uptime was approx 2550 hours so I just restart it. After restart it never came alive, but enter into some mode where only three options are available after long press on power button:

- Lockdown
- Power off
- Restart

Screen is black, it seems that nothing non Google is started (I use Nova launcher) so only response from phone is on long press to Power button.

Phone is still on Android 12 or 12.1 don't remember honestly, with unlocked bootloader & rooted with Magisk with addons for SN pass.

Do I need to flash it totally (from scratch) or can I restore current system with flash boot image or similar action? It's enough if I can restore to that version (I still have images on home comp, I will get there in 4-5 hours), I was fully happy with it. So I can skip A13 upgrade path for now, will do that later, when there will be more time to play with it. Any hint, PLEASE?

 

[V0latyle]

V0latyle, I think I need your opinion badly. Today I notice that home screen widget which shows calendar (my and shared events, ppl birthdays...) begins to shows birthdays of people I know I never enter their birthday date. Also, I know that this could be because of my phone's uptime was approx 2550 hours so I just restart it. After restart it never came alive, but enter into some mode where only three options are available after long press on power button:

- Lockdown
- Power off
- Restart

Screen is black, it seems that nothing non Google is started (I use Nova launcher) so only response from phone is on long press to Power button.

Phone is still on Android 12 or 12.1 don't remember honestly, with unlocked bootloader & rooted with Magisk with addons for SN pass.

Do I need to flash it totally (from scratch) or can I restore current system with flash boot image or similar action? It's enough if I can restore to that version (I still have images on home comp, I will get there in 4-5 hours), I was fully happy with it. So I can skip A13 upgrade path for now, will do that later, when there will be more time to play with it. Any hint, PLEASE?

Lockdown? I haven't seen that option on the boot menus of previous Pixels

Does the device even begin to boot? As in, do you get the Google logo after the bootloader warning screen?

It's hard to say how to fix it without knowing what's going on. I suggest flashing the stock boot image (unpatched) for your build and see if the device boots.

Also, if it begins to boot on the patched image, but bootloops, you can disable Magisk modules with this command: adb wait-for-device shell magisk --remove-modules

If restoring the boot image doesn't fix it, you could try dirty flashing the factory image. And if that doesn't solve the problem, you probably need to wipe data.

 

[gazdajezda]

Lockdown? I haven't seen that option on the boot menus of previous Pixels

Does the device even begin to boot? As in, do you get the Google logo after the bootloader warning screen?

It's hard to say how to fix it without knowing what's going on. I suggest flashing the stock boot image (unpatched) for your build and see if the device boots.

Also, if it begins to boot on the patched image, but bootloops, you can disable Magisk modules with this command: adb wait-for-device shell magisk --remove-modules

If restoring the boot image doesn't fix it, you could try dirty flashing the factory image. And if that doesn't solve the problem, you probably need to wipe data.

Yes, it boots. First Bootloader unlocked warning, then normal Google logo then animation and after that shows G colored in purple, gray, light blue and dark grey combination. After a while screen went black and only long press works (shows those three options). There is something that system is not satisfied with it. Maybe too old Android, don't know.

Ok, when I will be at my comp, I will first flash stock boot image and hope for success.

If not, then dirty flash and if that also would not help, wipe will come to play sad).

And when I will doing that, just a question: is latest A13 rootable (Magisk)? Are there any problems with it? I just need to rooting it with Magisk with SN pass addon and for ad removal (AdAway).

Uff, Google Authenticator... I hope I will restore it...

 

[V0latyle]

Yes, it boots. First Bootloader unlocked warning, then normal Google logo then animation and after that shows G colored in purple, gray, light blue and dark grey combination. After a while screen went black and only long press works (shows those three options). There is something that system is not satisfied with it. Maybe too old Android, don't know.

Ok, when I will be at my comp, I will first flash stock boot image and hope for success.

If not, then dirty flash and if that also would not help, wipe will come to play sad).

And when I will doing that, just a question: is latest A13 rootable (Magisk)? Are there any problems with it? I just need to rooting it with Magisk with SN pass addon and for ad removal (AdAway).

Uff, Google Authenticator... I hope I will restore it...

Considering it is booting, I think your chances of recovery are quite good. Start with the command I recommended; this will tell Magisk to disable any modules during boot, so if one of those is causing the problem, that should help.

Yes, Android 13 is rootable. Just make sure you use Magisk v24 or newer, latest 25.2 recommended.

SafetyNet has been replaced by Play Integrity, so you need to address whether your device passes Play Integrity attestation. It is possible to pass SafetyNet but fail Play Integrity. Most apps that require security guarantees such as banking/DRM have already switched to the Play Integrity API. I have provided more information in the OP.

 

[gazdajezda]

Just to be sure, for flashing boot.img from current state I need to do:

• connect phone with PC

then one of this:

• start phone in Fastboot mode (PWR + vol. down) or select (with vol. keys) "Restart Bootloader" and confirm with PWRB?)?

or

• on computer execute: fastboot reboot-bootloader (is this same as selecting it with vol. keys?)

Don't know why, but I think all that is same?

Then for ROM patching:

• flash-all.bat (without -w for dirty and with it for real wipe)

or below command to only flash boot image:

• fastboot flash boot <boot.img>

Really sorry for bothering, but I simpl forgot all those right steps, it's been a while when I last time doing it (half a year ago), just don't wanna get bricked device

 

[gazdajezda]

Considering it is booting, I think your chances of recovery are quite good. Start with the command I recommended; this will tell Magisk to disable any modules during boot, so if one of those is causing the problem, that should help.

I will and sincerelly hope so.

Yes, Android 13 is rootable. Just make sure you use Magisk v24 or newer, latest 25.2 recommended.

SafetyNet has been replaced by Play Integrity, so you need to address whether your device passes Play Integrity attestation. It is possible to pass SafetyNet but fail Play Integrity. Most apps that require security guarantees such as banking/DRM have already switched to the Play Integrity API. I have provided more information in the OP.

Ok, so Play Integrity is not beatable at the moment (i will read OP, not need to answer).
I will try today and will get back to report. Just need to clarify with commands I will need.

 

[V0latyle]

Just to be sure, for flashing boot.img from current state I need to do:

• connect phone with PC

then one of this:

• start phone in Fastboot mode (PWR + vol. down) or select (with vol. keys) "Restart Bootloader" and confirm with PWRB?)?

or

• on computer execute: fastboot reboot-bootloader (is this same as selecting it with vol. keys?)

Don't know why, but I think all that is same?\

You need to be in bootloader mode. How you get there doesn't matter.

Then for ROM patching:

• flash-all.bat (without -w for dirty and with it for real wipe)

I'm probably splitting hairs here...but "patching" means to update existing code with a bit of new code, like "patching fabric", so to refer to dirty flashing as patching is incorrect. Dirty flashing in this regard means we are rewriting the OS binaries to the device, without wiping user data (which would be a "clean" flash)

or below command to only flash boot image:

• fastboot flash boot <boot.img>

Really sorry for bothering, but I simpl forgot all those right steps, it's been a while when I last time doing it (half a year ago), just don't wanna get bricked device

No worries. The only way you'll brick your device is if you screw up the bootloader.

Since this is a Pixel 6, I highly recommend you click the warning at the top of the OP and read. As this is your first time updating to Android 13, it is important you update both bootloader slots at the same time.

Also, be aware that there is no easy way to return to Android 12, as the new bootloader prevents downgrading. So, if you aren't absolutely sure you want to update to 13, don't.

 

[gazdajezda]

Yes, my mistake. Don't know why i wrote "patching", it is "flashing". I know the difference

I will stay on 12 for now. Also, will return in few hours, hopefully with smile on my face

And, thank you!!!

 

[gazdajezda]

Hi!

I tried to flash a patched boot.img, no sucess, same. Then with official boot.img, same. Also tried to disable Magisk modules, but ADB said device unknown or unpaired, so no go... Just finishing the dirty flash of my current system (oriole-sq3a.220605.009.b1), same. So only way for device to start working again is wipe... so let's go with that... Eh Gugl, damn you.

 

[V0latyle]

Hi!

I tried to flash a patched boot.img, no sucess, same. Then with official boot.img, same. Also tried to disable Magisk modules, but ADB said device unknown or unpaired, so no go... Just finishing the dirty flash of my current system (oriole-sq3a.220605.009.b1), same. So only way for device to start working again is wipe... so let's go with that... Eh Gugl, damn you.

What happened when you tried to flash the boot image? Copy and paste the output here, or take a photo. Make sure you're using the correct firmware - "oriole" for Pixel 6.

You could also use Pixel Flasher to make this a bit easier.