[Guide] Root Pixel 6 with Magisk + Unlock Bootloader + Pass SafetyNet + More
Android Security Bulletin—January 2023
Pixel Update Bulletin—January 2023
Introduction
This Guide is for Pixel 6 owners that want to Root their phone, and enjoy the benefits of rooting it. The Guide is divided into three parts: Information, Instructions, and Other.
~ ~ ~ Part I - INFORMATION ~ ~ ~
- Disclaimer
- I assume no responsibility for the malfunctioning/bricking of your phone.
- The order of listed items i.e., Custom Kernels, Custom ROMS, etc. Does not indicate my preference for them. It is your responsibility to do the research before selecting an item.
- Prerequisites
- A Pixel 6 phone with an unlocked bootloader.
- The latest Android 13 Factory or OTA Image: "oriole" for Pixel 6
Factory Image
OTA Image
- A Computer with the latest SDK Platform-Tools: r33.0.3 installed.
- Important Notes:
a. Update Platform Tools, regularly, for optimal performance.
- Update(s)
- Factory/OTA Images - 3 Jan
- Magisk Alpha - app-release_555a54ec-alpha.apk 2 Sep
- Magisk Beta - 25.2 21Jul
- Magisk Canary - app-release_831a398b -25206.apk 26Dec
- Magisk Delta - app-release
- Magisk Stable - 25.2 21Jul
- TWRP - Waiting for T.R.W.P. for Android 12
- SafetyNet - kdrag0n safetynet-fix-v2.4.0.zip 09Jan
This version only supports Zygisk (Magisk 24 and newer). - SDK Platform-tools - r33.0.3 11Aug
- Custom Kernels
Note: If you are using a Custom Kernel, please update using the method in the OP, ~ ~ ~ Part II - INSTRUCTIONS ~ ~ ~, Install/Update Factory Image keep data or wipe data, • Flash Factory Image Keep Data
- NEW
- The QRP2 Beta Factory/OTA images are up for:
- Pixel 4a and 4a (5G)
- Pixel 5 and 5a
- Pixel 6 and 6 Pro
- Pixel 6a
- Pixel 7 and 7 Pro
There are also 64-bit QRP2 Beta Factory images:
- Pixel 4a (5G)
- Pixel 5
- Pixel 6
- Pixel 6 Pro
- Temporary fix for rooting the Google Pixel 6/6 Pro:
https://forum.xda-developers.com/t/...der-pass-safetynet-more.4388733/post-87853193
- The QRP2 Beta Factory/OTA images are up for:
- My Other Guides
- Credits/Thanks/Recognitions
- @topjohnwu - Magisk.
- vvb2060 - Magisk alpha.
- Those I may have, inadvertently, forgotten.
(The Instructions listed below are not steps, they are individual sets of instructions.)
- Unlock Bootloader/Return Phone to Stock/Lock Bootloader
- Unlock Bootloader
- This will erase all user data from the device!
- Backup your data
- Activate Developer Options: Tap Settings > About Phone > Tap Build Number 7 times or until you see you are a Developer. Tap back > System > Advanced > Developer Options. Enable OEM Unlock and, USB Debugging.
- Boot fastboot mode
- Connect the phone to the Computer with USB cord.
- Open a Command Prompt on your computer and type
fastboot flashing unlock
and press enter. - You should see a request for confirmation on your phone, use the volume keys to scroll and the power key to select.
- Allow the process to complete and then type
fastboot reboot
at the Command Prompt and press enter. - When your phone reboots disconnect your usb cable.
Notes: After unlocking your bootloader, you'll see a warning: The bootloader is unlocked and... You will see this warning until, you relock the bootloader.
Do not relock your bootloader until you have returned the device to Stock.
- Return Phone to Stock
- Backup your data/Internal storage
- Use the Android flash tool:
select Wipe => Force Flash Partitions => Lock Bootloader.
- Lock Bootloader
- If your phone is not 100 percent stock do Return Phone to Stock. If you don't you may brick your phone.
- This will erase all user data from the device!
- Boot fastboot mode
- Open a Command Prompt and type this at the Prompt:
fastboot flashing lock
- You should see a request for confirmation on your phone, use the volume keys to scroll and the power key to select.
- Allow the process to complete, then type this at the Command Prompt:
fastboot reboot
- Enable Developer Options: Settings > About phone > Tap Build number 7 times or until you see 'you are a developer'.
- Tap Back > Developer options and toggle OEM Unlock off.
- Unlock Bootloader
- Install/Update Factory Image keep data, wipe data, or use @badabing2003 PixelFlasher (the link to it is in the Important Note(s) 2.) below.
- Important Note(s):
- "Updating Pixel 6, Pixel 6 Pro, and Pixel 6a devices to Android 13 for the first time
Warning: The Android 13 update for Pixel 6, Pixel 6 Pro, and the Pixel 6a contains a bootloader update that increments the anti-roll back version for the bootloader. This prevents the device from rolling back to previous vulnerable versions of the bootloader. After flashing an Android 13 build on these devices you will not be able to flash and boot older Android 12 builds. For developers who need to develop and test against an Android 12 environment, a special Developer Support Build that contains the bootloader update should be used.
After taking an Android 13 update and successfully booting the device post update, an Android 12 build resides in the inactive slot (seamless updates for more information on slots) of the device. The inactive slot contains an older bootloader whose anti-rollback version has not been incremented. If the active slot is then flashed with a build that fails to boot, the fallback mechanism of seamless updates kicks in and the device tries to boot from the inactive slot. Since the inactive slot contains the older bootloader, the device enters an unbootable state.
To avoid hitting this state, if you are flashing a Pixel 6, Pixel 6a, or Pixel 6 Pro device with an Android 13 build for the first time, please flash the bootloader partition to the inactive slot"...
- If the previous factory image was rooted (you used Magisk to patch the boot.img of the previous factory image). Open Magisk manager and disable all Magisk modules.
- If you want to update to the Android 13 Factory image without wiping your phone: Do Flash Factory Image Keep Data (below).
- Always verify you have the latest version of SDK Platform-Tools installed on your computer before installing the Factory Image: Pixel 6 - oriole.
- If you get an error while flashing, try one of these options:
- Change the USB port to a non charging USB port.
- Change the USB cord.
- Change Computers.
- If you phone bootloops
- Press the Power button until the phone turns off.
- Press the Power and Volume Down to boot the bootloader.
- Open a Command Prompt in the SDK-Platform-tools folder or the folder that has adb.exe in it, and type
adb wait-for-device shell magisk --remove-modules
then type fastboot Reboot
- If you are uncomfortable manually flashing the factory image. Try PixelFlasher by badabing2003.
Please post Comments/Discussions/Questions about PixelFlasher on that thread. - Backup your data
- Download the latest Factory Image: Pixel 6 - oriole to your Computer.
- Go to Part II - INSTRUCTIONS => 4. Extract Files from the FactoryImage/Flash boot.img and extract the flash-all.bat file.
- "Updating Pixel 6, Pixel 6 Pro, and Pixel 6a devices to Android 13 for the first time
- Flash Factory Image Keep Data
- If you are Updating/Upgrading to Android 13. Open the folder you extracted the Factory Image to and edit the flash-all.bat file with a text editor i.e., DroidEdit app (See Bold items below).
Upgrade To Android 13 (First Time Installing Android 13)
* * * S T A R T - E D I T * * *
@Echo off
PATH=%PATH%;"%SYSTEMROOT%\System32"
fastboot flash bootloader bootloader-oriole-slider-9.9-9999999.img --slot all
fastboot reboot-bootloader
timeout /t 5 >nul
fastboot flash radio radio-oriole-a9999a-999999-999999-a-9999999.img --slot all
fastboot reboot-bootloader
timeout /t 5 >nul
fastboot -- skip-reboot update image-oriole-aa9a.999999.999.zip
Note: I replaced the -w with -- skip-reboot to Keep Data.
fastboot reboot-bootloader
timeout /t 5 >nul
fastboot --set-active=other
timeout /t 10 >nul
fastboot reboot-bootloader
timeout /t 5 >nul
fastboot update image-oriole-aa9a.999999.999.zip
echo Press any key to exit...
pause >nul
exit
* * * * E N D - Edit * * * *
Update Android 13
* * * S T A R T - E D I T * * *
@Echo off
PATH=%PATH%;"%SYSTEMROOT%\System32"
echo Change active slot
fastboot getvar current-slot
fastboot --set-active=other
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot getvar current-slot
fastboot flash bootloader bootloader-oriole-slider-9.9-9999999.img
fastboot reboot-bootloader
timeout /t 5 >nul
fastboot flash radio radio-oriole-a99999-999999-999999-a-9999999.img
fastboot reboot-bootloader
timeout /t 5 >nul
fastboot update image-oriole-aa9a.999999.999.zip
Note: I removed the -w to Keep Data.
echo Press any key to exit...
pause >nul
exit
* * * * * * E N D * * * * * * - After, you have edited the flash-all.bat file. Copy/Move these files to the Platform-tools folder:
- bootloader-oriole-....img
- flash-all.bat
- image-oriole-....zip
- radio-oriole-....img
- On your phone: Boot the bootloader (Power off the phone => Press the Power and Down buttons until you see Start)
- Connect your phone to the computer.
- Open a Command Prompt on your computer in the Platform-tools folder and type:
flash-all
at the Command Prompt and press enter. - The phone will reboot when flashing is completed.
- Go-to Part II - INSTRUCTIONS => 5. Root/Reroot with Magisk and Pass SafetyNet, • Patching the boot.img - to root/reroot.
- If you are Updating/Upgrading to Android 13. Open the folder you extracted the Factory Image to and edit the flash-all.bat file with a text editor i.e., DroidEdit app (See Bold items below).
- Flash Factory Image Wipe Data
- This will wipe your phone's Internal Storage.
- Open the folder you extracted the Factory Image to and edit the flash-all.bat file with a text editor i.e., DroidEdit app (See Bold items below).
Upgrade To Android 13 (First Time Installing Android 13)
* * * S T A R T - E D I T * * *
@Echo off
PATH=%PATH%;"%SYSTEMROOT%\System32"
fastboot flash bootloader bootloader-oriole-slider-9.9-9999999.img --slot all
fastboot reboot-bootloader
timeout /t 5 >nul
fastboot flash radio radio-oriole-a9999a-999999-999999-a-9999999.img --slot all
fastboot reboot-bootloader
timeout /t 5 >nul
fastboot -w update image-oriole-aa9a.999999.999.zip
echo Press any key to exit...
pause >nul
exit
* * * E N D - E D I T * * * - After, you have edited the flash-all bat file. Open the folder you extracted the Factory Image to and Copy/Move these files to the Platform-tools folder:
- bootloader-oriole-....img
- flash-all.bat
- image-oriole-....zip
- radio-oriole-....img
- On your phone: Boot the bootloader (Power off the phone => Press the Power and Down buttons until you see Start)
- Connect your phone to the computer.
- Open a Command Prompt on your computer in the Platform-tools folder and type:
flash-all
at the Command Prompt and press enter. - The phone will reboot when flashing is complete.
- Setup phone
- Enable Developer Mode and USB Debugging
- Setup => About phone => Tap Build number 7 times or untill you see you are a 'Devloper'.
- Setup => System => Developer options => Enable Developer options => enable USB Debugging
- Go-to Part II - INSTRUCTIONS => 5. Root/Reroot with Magisk and Pass SafetyNet, • Patching the boot.img - to root/reroot.
- Important Note(s):
- Take the OTA Update and Maintain Root
- This set of instructions was written by @topjohnwu: Install Magisk to Inactive Slot , use the latest Magisk Canary, Beta, or Stable.
- NOTE: After you Open Magisk and Restore Images. If you had a Custom Kernel installed, Please check the OP of the Custom Kernel thread you install for instruction to remove the Custom Kernel and return your phone to Stock. Additionally, if you installed Mod Please check the OP of the Mod thread you installed for instruction to remove the Mod and return your phone to Stock before you download the OTA.
- If you phone bootloops
- Press the Power button until the phone turns off.
- Press the Power and Volume Down to boot the bootloader.
- Open a Command Prompt in the SDK-Platform-tools folder or the folder that has adb.exe in it, and type
adb wait-for-device shell magisk --remove-modules
fastboot Reboot
- Extract Files from Factory Image/Flash boot.img
- Extract Files from Factory Image
- Extract flash-all.bat and boot.img file
- Download the latest Factory image to your phone.
- Extract the Factory Image file (oriole-a9a9a.999999.999-factory-99a9a99a.zip) to a folder. The, stock, flash-all.bat file should be in this folder.
- Open the folder you extracted the Factory image to and, extract the Image file (image-oriole-aa9a.999999.999.zip) into the folder. The, stock, boot.img file should be in this folder.
- Flash boot.img
- Flashing the boot.img removes root.
- Open the folder you extracted the 'image...zip' file to and copy the boot.img file to your computer's platform-tools folder or to the folder that has fastboot.exe in it.
- Boot fastboot mode
- Connect the phone to the Computer
- Open a Command Prompt and type the following command at the prompt:
fastboot flash boot --slot all boot.img
- Reboot
- Extract Files from Factory Image
- Root/Reroot with Magisk and Pass SafetyNet.
- Android 13
- Upgrade to Android 13: OP, Part II - INSTRUCTIONS, 2. Install/Update Factory Image keep data or wipe data, Keep data
- Patching the boot.img - to root/reroot.
- Go to Part II - INSTRUCTIONS => 4. Extract Files from the FactoryImage/Flash boot.img and extract the boot.img file.
- Install Magisk Canary - Download app-release.apk
or
Magisk Beta/Stable App - Open Magisk Beta/Canary/Stable App
- The Update Channel should be set to Beta/Canary/Stable, depending on the version you Installed.
- Tap Install (next to Magisk)
- Tap, Select and Patch a File
- Select the boot.img file you extracted from the latest factory image.
- Tap the ✓ (Check Mark)
- Tap Let's Go
- When you see done, the boot.img has been patched (magisk_patched_xxxxxx.img), and stored in the download folder.
- Reboot
- Copy/Move the patched boot.img file to your computer's Platform-tools folder or the folder that has fastboot.exe in it:
- Copy it to a USB drive and transfer it to your computer.
- Move it to your computer using adb push
- Boot fastboot mode
- Connect the phone to the Computer with USB cord.
- Open a Command Prompt in the folder you copied the patched boot.img to.
- Type
fastboot flash boot "name of patched boot".img
without the quote marks at the Prompt and press enter. - Type
fastboot reboot
at the Prompt and press enter. - Important, if your phone boot loops try one of the following options:
- Flash the 'stock' boot.img to both slots:
fastboot flash boot boot.img --slot all
- Remove Modules
- Press the Power button until the phone turns off.
- Press the Power and Volume Down to boot the bootloader.
- Open a Command Prompt in the SDK-Platform-tools folder or the folder that has adb.exe in it, and type
adb wait-for-device shell magisk --remove-modules
- fastboot Reboot.
- Flash the 'stock' boot.img to both slots:
- Important, if the Magisk Manager app has the Superuser and Module buttons greyed out:
- Pass Safety Net with SafetyNet Fix
- Download File(s)
- kdrag0n safetynet-fix-v2.4.0.zip
This version only supports Zygisk (Magisk 24 and newer). If you are having problems passing SafetyNet with kdrag0n Mod, use Displax's safetynet-fix v2.3.1-MOD_2.1.zip, a "fork" of kdrag0n safetynet-fix. - https://github.com/Fox2Code/Fox Magisk Module Manager
(This is the new Magisk Module repository.)
- kdrag0n safetynet-fix-v2.4.0.zip
- Install kdrag0n safetynet-fix-v2.4.0.zip/Displax's safetynet-fix v2.3.1-MOD_2.1.zip
- Open Magisk
- Tap Modules icon
- Tap Install from storage
- Navigate to the kdrag0n safetynet-fix-v2.4.0.zip/Displax's safetynet-fix v2.3.1-MOD_2.1.zip file you downloaded.
- Tap the kdrag0n safetynet-fix-v2.4.0.zip/ Displax's safetynet-fix v2.3.1-MOD_2.1.zip file.
- Tap the check mark (✓ at the bottom) to start the installation.
- Note: You do not have to disable/remove SafetyNet Fix.
- After it installs tap the Save icon to save the log
- Tap Reboot.
- Settings for Magisk Canary
- Open Magisk App
- Tap the Setup icon.
- Scroll down to App and set the Update Channel to Canary.
- Scroll down to Check Updates and enable it.
- Scroll down to Magisk and enable Zygisk.
- Enable Denylist
- Tap Configure DenyList => Tap 3 Dot Menu => Check ✓ Show system apps => Check ✓ Google Play Store, Google Pay, Google Wallet etc.
- Scroll down to Superuser and enable Enable Biometric Authentication.
- Get Device Certified Clear Google Play Store, Google Play Services, Google Pay, Google Wallet, etc. data[/B]
- Turn Airplane mode on
- Open Settings
- Tap Apps & notifications
- Tap see all...
- Tap three dot menu
- Tap Show system
- Scroll down to Google Play Store
- Tap Storage & Cache
- Tap Clear storage
Note: Repeat the 3 steps above for Google Play Services, Google Pay, Google Wallet, etc. - reboot
- Turn Airplane mode off
- Check Device Certification, I may take 24 hours for Device Certification
- Open Google Play Store app
- Tap Menu - Circle top right
- Tap Settings
- Tap About
- Check Play protect certification.
- Download File(s)
- Android 13
- Set Magisk App Update Channel/Update Magisk
- Set Magisk App Update Channel
- Open Magisk App > Tap Settings icon > Update Channel > Select Stable, Beta, Canary or Custom.
- Update Magisk
- When Magisk App notifies you of an update:
- Tap install.
- Select, Direct Install (Recommended)
- When it finishes installing
- Tap, Save Log
- Log location: /storage/emulated/0/Download
- Tap, Reboot
- Done!
- Set Magisk App Update Channel
- Install/Update Magisk Modules
- Download Modules
- Install Modules from Storage
- Open Magisk
- Tap the Modules icon
- Tap Install from storage
- Navigate to the folder with the Module you want to install.
- Tap the Module to highlite it and tap Select.
- After it installs, tap the Disc Icon to save the install log.
- Tap Reboot
- Install Modules from Fox2Code/Fox Magisk Module Manager
- Open Fox2Code/Fox Magisk Module Manager
- Tap the Modules icon
- Locate the Module you want to install
- Tap Install
- After it installs, tap the Disc Icon to save the install log.
- Tap Reboot
- Update Modules
- Open Fox2Code/Fox Magisk Module Manager
- You, will see the Modules that have Updates.
- Tap the Module you want to update.
- Tap install.
- After it installs, tap the Disc Icon to save the install log.
- Tap Reboot
- Download Modules
- Open a Command Prompt/Boot Fastboot Mode/Boot Recovery
- Open a Command Prompt on Computer
- Open File Explorer, click the platform-tools folder ==> click the folder icon (left side of address bar) to highlight it type cmd and press enter.
- Open a Powershell Command Prompt on Computer: Open File Explorer, click the platform-tools folder ==> click the folder icon (left side of address bar) to highlight it type powershell and press enter.
- Notes:
- Enable USB Debugging, on your phone: Settings ==> System ==> Advanced ==> Developer options ==> Scroll down to USB debugging and enable it.
- When using the Powershell Command Prompt Commands must be preceeded with ./: i.e, ./fastboot devices
- If you do not want to open a Command Prompt every time you want to use the fastboot command, add the path to the Platform-tools folder to Windows environment variables.
- Boot fastboot mode (bootloader):
- Power off phone, press and hold the power and volume down buttons until you see Start.
- Boot Recovery
- Power off phone, press and hold the power and volume down buttons until you see Start. Use volume up/down button until you see Recovery mode. Press power button.
- Open a Command Prompt on Computer
- Test fastboot
- Enable Developer Options - Tap Settings > About phone > Build number 7 times or until you should see 'you are a Developer'.
- Enable USB Debugging - Tap Settings > System > Advanced > Developer options >
Enable USB Debugging. - Open a Command Prompt on your computer in the Platform-tools folder.
- Boot fastboot mode on your phone
- Connect the phone to the Computer.
- At the prompt type:
fastboot devices
to verify communication with phone. It should return your phone's serial number.
- ADB Sideload
- Stock Recovery
- Custom Recovery TWRP
- Waiting for Android 12 (R) T.W.R.P
- Stock Recovery
- Custom ROMs
- Need help with a Custom ROM?
- If you are you are trying to install or have installed a Custom ROM, read and follow the Installation Instructions in the OP of the Custom ROM thread.
- Search the thread of the Custom ROM you are trying to install or have installed for answer(s)/solution(s) to your question(s)/problem(s): If you don't find a answer(s)/solution(s) to your question(s)/problem(s). Post your question(s)/request(s) for help in the Custom ROM thread you are trying to install or have installed.
- If you are trying to install a Addon(s) {Custom Kernel, Magisk, etc.} to the Custom ROM you installed: Search the thread of the Custom ROM you installed or the thread of the Addon you want to add to your Custom ROMfor answer(s)/solution(s) to your question(s)/problem(s). If you don't find an answer(s)/solution(s) to your question(s)/problem(s). Post your question(s)/request(s) for help in the Custom ROM or Addon (Custom Kernel, Magisk, etc.) thread.
- ROMs
- Need help with a Custom ROM?
- Themes, Apps, and Mods
- T.W.R.P. Backup/Restore
- Waiting for Android 13 T.W.R.P.
Last edited: