Question How to root OnePlus 9RT 5G?

[archz2]

I just got my new Oneplus 9RT 5G. I searched a lot but unable to find a method to root it via TWRP.

Can anyone please share a link to TWRP recovery so that I can flash it and root it via Magisk?


I tried to unlock the bootloader by going to the fastboot mode but keep getting 'failed' message.

I have enabled 'USB debugging' and 'allow OEM unlock' in the developer options.

 

[penguinus]

Use fastboot flashing unlock instead of oem unlock.

 

[archz2]

Use fastboot flashing unlock instead of oem unlock.

Okay and what about a compatible TWRP recovery file that I can flash?

 

[penguinus]

No TWRP for now. You should get boot.img from stock firmware, then patch it using Magisk Manager, then load the phone using patched boot.img, an then install magisk to the system

 

[archz2]

No TWRP for now. You should get boot.img from stock firmware, then patch it using Magisk Manager, then load the phone using patched boot.img, an then install magisk to the system

Okay. How to get the stock firmware? I checked the official website. It's not available.

 

[penguinus]

Okay. How to get the stock firmware? I checked the official website. It's not available.

Yes, it is not available on site. If you have chinese firmware (ColorOS), you can get full rom from OTA servers. Even more, for the most recent versions I can provide ready to use boot.img. But for indian Oxygen full roms not availabe yet. You can try to dump boot.img from your phone using dd.

 

[archz2]

You can try to dump boot.img from your phone using dd.

How do I do it? Please provide step by step process. I bought this phone in India and it's running Android 11 , Oxygen OS.

 

[penguinus]

Well, looks like to dump boot.img you need root. Please try attached file (unzip it). Found it in TG, labeled as boot.img for indian Oxigen. Please note that you should NOT flash it to your device, so it should be safe enough. We will try to sideload it.

You already have installed fastboot to your PC, so I will skip this part.

To check boot.img
1. Place boot.img to your computer, to the same folder where you have fastboot installed
2. Reboot your phone to fastboot mode i.e with adb reboot bootloader
3. Do fastboot boot boot.img.
If phone will start normally, looks like boot is ok and you can use it to get rooted.

To install Magisk (get root)
1. Place boot image to phone.
2. Download Magisk and install it to the phone. Note that we use canary version of Magisk. Latest stable version doesn't work at least on chinese (ColorOS) version.
3. Start Magisk on a phone, press "Install" and choose "Select and Patch a File" (the only available option), select boot.img file.
4. Patched boot.img will be placed to Download directory named something like "magisk_patched*.img". Download this file back to PC, place to the same directory with fastboot.
5. Reboot your phone to fastboot mode i.e with adb reboot bootloader
6. Do fastboot boot magisk_patched*.img (change to correct name of file). Phone should start correctly.
7. Start Magisk again. Select "Install". This time all options should be available. Select "Direct Install (Recommended)".
8. At the end reboot and check if root is working.

 

[archz2]

Well, looks like to dump boot.img you need root. Please try attached file (unzip it). Found it in TG, labeled as boot.img for indian Oxigen. Please note that you should NOT flash it to your device, so it should be safe enough. We will try to sideload it.

You already have installed fastboot to your PC, so I will skip this part.

To check boot.img
1. Place boot.img to your computer, to the same folder where you have fastboot installed
2. Reboot your phone to fastboot mode i.e with adb reboot bootloader
3. Do fastboot boot boot.img.
If phone will start normally, looks like boot is ok and you can use it to get rooted.

To install Magisk (get root)
1. Place boot image to phone.
2. Download Magisk and install it to the phone. Note that we use canary version of Magisk. Latest stable version doesn't work at least on chinese (ColorOS) version.
3. Start Magisk on a phone, press "Install" and choose "Select and Patch a File" (the only available option), select boot.img file.
4. Patched boot.img will be placed to Download directory named something like "magisk_patched*.img". Download this file back to PC, place to the same directory with fastboot.
5. Reboot your phone to fastboot mode i.e with adb reboot bootloader
6. Do fastboot boot magisk_patched*.img (change to correct name of file). Phone should start correctly.
7. Start Magisk again. Select "Install". This time all options should be available. Select "Direct Install (Recommended)".
8. At the end reboot and check if root is working.

Okay. Thanks a lot.

I checked the boot image, all the three step went absolutely fine.

To obtain Magisk, everything went well till step no. 5.

When I try to reboot with the patched image in the bootloader, the phone keeps booting in the bootloader itself. I also changed the name of the image from 'magisk_patched_bco6o' to 'bestimage', just to make sure that there aren't any special characters in the filename. Same. The phone kept booting in the fastboot mode using the image.

Now what should I do?

Edit.
I just updated the Magisk app directly from its UI. Now the phone booted fine using step 6. My device is rooted! Thanks a ton!

 

[archz2]

Okay. I'm connected to the internet and ensure that magisk has internet connectivity. I cannot see any packages to download and install. Is this normal in canary version or I have to do something about it?

 

[penguinus]

Okay. I'm connected to the internet and ensure that magisk has internet connectivity. I cannot see any packages to download and install. Is this normal in canary version or I have to do something about it?

Canary doesn't have internet repository. You should install modules manually. Please note that "Magisk Hide" is not available also and replaced by Zygisk function in settings. Basically it works similar to magisk hide.

 

[penguinus]

My device is rooted! Thanks a ton!

What ROM version is it? Especially a build number. Want to know what version of Oxygen is elighble for rooting with provided boot.img.

 

[archz2]

Here's the build information

 

[archz2]

Okay.

Canary doesn't have internet repository. You should install modules manually. Please note that "Magisk Hide" is not available also and replaced by Zygisk function in settings. Basically it works similar to magisk hide.

Okay can I install a normal magisk app now since my device is already rooted?

Having a direct internet repository in magisk is quite convenient.

Another question. I want to install Lsposed on this phone to install GravityBox module. Now in my previous phone, (oneplus 5t running stock oxygen OS, Android 10) , I always used to keep a edxposed uninstaller zip file which helped in cases when there would be a bootloop after installing a module. I used to flash that zip in the TWRP, get back things to normal, and then uninstall a particular xposed module.

Now I don't have any TWRP on this phone. I don't have any custom recovery installed on this phone!

What do you recommend for doing xposed/lsposed/edxposed based flashing and module installation?

 

[penguinus]

I can't say for sure it will not work. I just know stable version of Magisk DOESN'T work with 9RT chinese version (ColorOS). The chance to get it worked on OxigenOS is minimal as it looks for me. And what is happening with chinese phone with current magisk is bootloop. So I think it is better to not even try. At least while you don't have full ROM to recover.
Regarding absense of net repository in canary, there is a post from Magisk creator about it. Unfortunately, these functions will not back. I don't use many Magisk modules - just installed safetynet-fix and Systemizer manually.
Sorry, I don't have much experience with Magisk modules, the only recommendation for now is to not experiment too much while we don't have msm tool or at least full ROM.

 

[archz2]

Okay. And any comment on installing xposed? I don't have any TWRP or any custom recovery.

 

[penguinus]

I didn't tried it, but please check threads of lsposed and EdXposed

Looks like both can be installed as Magisk modules, but needs Riru. Probably will give them a try later.

 

[archz2]

Thanks. I successfully installed latest Riru, Lsposed and GravityBox. All good so far.

Having issues with Viper installations. Will post about it in a separate thread.

 

[archz2]

I don't use many Magisk modules - just installed safetynet-fix and Systemizer manually.

I flashed safetynet fix and rebooted but I'm still not able to pass safetynet. Any solution?

 

[penguinus]

I flashed safetynet fix and rebooted but I'm still not able to pass safetynet. Any solution?

After installing and activating safetynet fix you should clear data for Google Play Store and Google Play Services. Then open Play Store -> Settings -> About -> Play Protect certification. Should be "Device is certified"