How To Guide January 3, 2023 (TQ1A.230105.002 - Global / .A1 Telstra) - Unlock bootloader / Root Pixel 7 Pro [Cheetah] / SafetyNet

Search This thread

i5lee8bit

Senior Member
My Pixel 7 is the first phone I've run rooted since my OnePlus 6T on Android 9. It appears the process to OTA update has changed since the last time I did it a few years ago. If I follow the steps in post #2 of this thread to update (running modified flash-all.bat w/ full factory image, patching the init_boot.img in Magisk, flashing patched .img), will this automatically put the new images on the inactive slot then switch it to active? Or do I need to manually switch slots first then run flash-all.bat?
You don't need to switch slots manually, generally ever, when updating your phone. If you flash full factory image, it'll just install over your current active slot and done. If you sideload OTA zip, it'll flash to the other slot and change slots for you and boot (you won't even notice it happening tbh).

One question though: are you currently running with verity/verification disabled? If you don't know what I'm talking about, it's probably a "no", but keep in mind if you want to flash a custom kernel for this device you'll need to disable them. And unfortunately that will require a data wipe the first time you do it, and then you need to remember to disable again each time you update on future updates. There's a very slim chance they'll find a workaround to needing them disabled eventually but I wouldn't count on it. More info on this can be found in the OP's and kernel development threads (e.g. Kirisakura). If you don't care about flashing custom kernels, simply disregard this last point and the next.

But my major reason for that last point is that if you are running verity and verification disabled, in that case you may want to manually switch slots and flash full factory image with v/v disabled as a means of being overcautious. My reasoning for this is that you never know when you may run into a bootloop from a bad flash, which will automatically trigger an active slot switch, and once it attempts to boot without those flags disabled, you're beat and have to wipe. So out of an abundance of caution, I flashed both slots last month with the flags disabled.
 

sharksfan7

Senior Member
Aug 7, 2011
266
88
San Diego
Thanks, @i5lee8bit. When I rooted my P7, I don't think I did anything to disable verity/verification. I just patched/flashed the init_boot.img then configured some stuff in Magisk. I don't plan on running a custom kernel.

I didn't think I could sideload just the OTA being rooted. Thought I needed to flash the full factory image and re-root. It's been a while since I've done this. Looks like I need to do a bit more research before I do this update.
 
Learning about Pixel OTAs + retain root.
* Unhide Magisk + disable modules
* Flash stock init_boot.img
* OTA or OTA side load
* Re-patch / flash init_boot.img

Question on side load. Google says to check System update before side loading?
I'm still on Oct - Pixel took it upon itself to start downloaded and I paused it.
Upon reviewing it shows resume...without any build info which I find annoying - pretty sure wants to update to Nov. It OK to sideload OTA in this paused state?

Which leads my 2nd question - is it that OTA via phone always incremental / delta. IE I need Nov OTA before Dec. 2 separate updates in this case?
But side load OTAs are full so one can jump to latest release via single ota side load?

I'm kinda leaning toward only dealing update / re-root quarterly so prefer the single update. Would also like to know how to block OTA check / auto download. Anything native or can I block with afwall+? (Auto updates was disabled in dev options but it still began downloading anyway)

Lastly will safeynet fixes periodically get broken with OTAs?

Thanks
Sorry I can't answer much of your questions; I just wanted to answer what I can and hope to bump your post a bit so maybe it can be answered by experts better than I.
I am not certain as for your first question (so please just take it as my opinion and don't base further action from it), I imagine Google anticipates such actions that by sideloading OTAs would cancel/invalidate whatever partial/paused OTA is currently being downloaded. If anything, I imagine it would only be troublesome if it was in the process of "installing", but if you paused it early on, most likely it was still downloading and/or I doubt you could pause it once it was actually in the middle of installing.
As for your second question (again, just my opinion and do not base further action from it), I imagine OTA's, although incremental, carry-over and/or include whatever improvements the previous OTA's had and it merely modifies & works-on the core system and much of it isn't really touched outside what the OTA patches so applying each update step-by-step isn't really applied to much of the core system. In the end, what I'm implying is that if I were in your position, I, myself, would not apply each OTA from what version you are in to current -- I would merely install the latest OTA only.
Honestly, if you are concerned with the incremental differences OTA's apply and are going to sideload them anyways and you mentioned you'd like to update it quarterly and prefer a "single update", you should consider flashing the full factory images instead of the OTA's. You have to open up a command prompt and run commands anyways (also you would need to if you plan to re-root), the major differences is you run commands in the bootloader mode (than recovery mode) and run a few more commands (fastboot than adb); one other important addition is you MUST remove "-w" from the flash-all script to keep your data -- but that's basically it. Again, this case & opinion only applies if you are sideloading OTA's, un-rooting and implementing the (very fairly slow, although it's been announced it has been more streamlined and process time has been cut down significantly) System Update in the OS would not need you using the adb command (necessarily) and downloading & applying images.
One other thing I might mention since you mention "Pixel OTAs + retain root" (even if it seems you know this info already, but take it as a reminder if that's the case) is you are unable to apply the OTA through System Update if you are rooted as well as once you apply the OTA (or Factory Image), you will lose root; there is (currently) no way to apply the OTA and "retain root" -- it must be re-applied.
As for your inquiry about blocking the OTA check/auto-download, roirraW "edor" ehT touched on the topic and pointed to a post that might be applicable back in post #1318. It might do and/or at least point you in the right direction.
Lastly, yes, sometimes the firmware & OTA updates break things related to root and bypassing root checks, but you can always count on it being reported/discussed here and can keep updated on things and its progress here -- but such is the risk of rooting and keeping the device up-to-date. Depending on the "damage", it's usually dealt with swiftly enough...the great developers that work on aspects of this device, Android OS, and Magisk work ever so diligently...
Thanks, @i5lee8bit. When I rooted my P7, I don't think I did anything to disable verity/verification. I just patched/flashed the init_boot.img then configured some stuff in Magisk. I don't plan on running a custom kernel.

I didn't think I could sideload just the OTA being rooted. Thought I needed to flash the full factory image and re-root. It's been a while since I've done this. Looks like I need to do a bit more research before I do this update.
I could be completely wrong, but I don't believe you need to be unrooted to sideload the OTA; you only need to be unrooted if you plan on using the System Update in the OS. BUT, regardless, in all options, root is lost and must always re-root afterwards. As I said with taysandman, I implore you to seriously consider still updating using the Full Factory images rather than sideloading the OTA merely because the Full Factory is a superior update (@roirraW "edor" ehT explains it best) as well as sideloading the OTA is not that much different or far-fetched from updating using the Full Factory image (both have to download images, open a command prompt, run commands, and you'd have to open/run fastboot to re-root anyway) -- the only big differences is it being done in bootloader mode instead of recovery, fastboot commands instead of adb, and you must modify the flash-all script before running it.


Apologies for the wordiness, but I hope it helps...
 

kornball

Senior Member
Oct 6, 2009
196
48
With the update to battery usage in Settings, is the graph gone for anyone else? Everything is properly listed in usage since last full charge, but there is no longer any sort of graph.
 

Techboyz97

Member
Apr 23, 2019
13
0
I was on T1B3.221003.008. I received an update yesterday night. Now I'm on TQ1A.221205.011 but I don't see the changes. Exemple : the battery usage graph shows the full charge on a day and not up to 7 days. The Security and Privacy are separated and not merged.
 

vurtomatic

Senior Member
Mar 22, 2015
535
111
I thought I used to be able to tap the battery icon in the status bar to open battery settings. That seems to be gone after the Dec update?
 

Lughnasadh

Senior Member
Mar 23, 2015
4,683
5,298
Google Nexus 5
Huawei Nexus 6P
I was on T1B3.221003.008. I received an update yesterday night. Now I'm on TQ1A.221205.011 but I don't see the changes. Exemple : the battery usage graph shows the full charge on a day and not up to 7 days. The Security and Privacy are separated and not merged.
Some of the changes likely require a server side update, Google Play System update, Google Play Services update or the like.
 

taysandman

Member
May 15, 2016
41
8
Sorry I can't answer much of your questions; I just wanted to answer what I can and hope to bump your post a bit so maybe it can be answered by experts better than I.
I am not certain as for your first question (so please just take it as my opinion and don't base further action from it), I imagine Google anticipates such actions that by sideloading OTAs would cancel/invalidate whatever partial/paused OTA is currently being downloaded. If anything, I imagine it would only be troublesome if it was in the process of "installing", but if you paused it early on, most likely it was still downloading and/or I doubt you could pause it once it was actually in the middle of installing.
As for your second question (again, just my opinion and do not base further action from it), I imagine OTA's, although incremental, carry-over and/or include whatever improvements the previous OTA's had and it merely modifies & works-on the core system and much of it isn't really touched outside what the OTA patches so applying each update step-by-step isn't really applied to much of the core system. In the end, what I'm implying is that if I were in your position, I, myself, would not apply each OTA from what version you are in to current -- I would merely install the latest OTA only.
Honestly, if you are concerned with the incremental differences OTA's apply and are going to sideload them anyways and you mentioned you'd like to update it quarterly and prefer a "single update", you should consider flashing the full factory images instead of the OTA's. You have to open up a command prompt and run commands anyways (also you would need to if you plan to re-root), the major differences is you run commands in the bootloader mode (than recovery mode) and run a few more commands (fastboot than adb); one other important addition is you MUST remove "-w" from the flash-all script to keep your data -- but that's basically it. Again, this case & opinion only applies if you are sideloading OTA's, un-rooting and implementing the (very fairly slow, although it's been announced it has been more streamlined and process time has been cut down significantly) System Update in the OS would not need you using the adb command (necessarily) and downloading & applying images.
One other thing I might mention since you mention "Pixel OTAs + retain root" (even if it seems you know this info already, but take it as a reminder if that's the case) is you are unable to apply the OTA through System Update if you are rooted as well as once you apply the OTA (or Factory Image), you will lose root; there is (currently) no way to apply the OTA and "retain root" -- it must be re-applied.
As for your inquiry about blocking the OTA check/auto-download, roirraW "edor" ehT touched on the topic and pointed to a post that might be applicable back in post #1318. It might do and/or at least point you in the right direction.
Lastly, yes, sometimes the firmware & OTA updates break things related to root and bypassing root checks, but you can always count on it being reported/discussed here and can keep updated on things and its progress here -- but such is the risk of rooting and keeping the device up-to-date. Depending on the "damage", it's usually dealt with swiftly enough...the great developers that work on aspects of this device, Android OS, and Magisk work ever so diligently...

I could be completely wrong, but I don't believe you need to be unrooted to sideload the OTA; you only need to be unrooted if you plan on using the System Update in the OS. BUT, regardless, in all options, root is lost and must always re-root afterwards. As I said with taysandman, I implore you to seriously consider still updating using the Full Factory images rather than sideloading the OTA merely because the Full Factory is a superior update (@roirraW "edor" ehT explains it best) as well as sideloading the OTA is not that much different or far-fetched from updating using the Full Factory image (both have to download images, open a command prompt, run commands, and you'd have to open/run fastboot to re-root anyway) -- the only big differences is it being done in bootloader mode instead of recovery, fastboot commands instead of adb, and you must modify the flash-all script before running it.


Apologies for the wordiness, but I hope it helps...

Thanks.

I believe your correct it was just downloading OTA which was paused and shouldn't impact OTA side load. Just Google pointing it out made me wonder...

You're right my terminology was wrong. Retain data and re-root.

My only thought on full factory images vs OTAs via phone is that the Nov update showed ~30MB download. Yet looking at factory images over ~2.5GB. That's a big difference to write to nand storage to gain 30MB worth of security updates. So been curious about OTAs to help extend Pixels life. (Haven't actually looked if Google gives any write endurance specs on Pixel.)

However I did end up using Google's chrome flash tool to update to Dec last night. (Factory image) Didn't unroot. Just disable modules and unhide magisk and flash. Upon boot magisk was uninstalled. Re-install Magisk and re-patch init_boot. Re-enable modules. All went well including safetynet. I really do hope the guru devs over at TWRP will grace us with Pixel 7 / 6 support. Image backups help calm the nerves when doing system updates. :)

Regarding root after update I briefly read a few guides I believe mentioning "keeping root" with update. Pre-downloading the factory image + init_boot patch. Then re-packing factory image's zip to include patched init_boot. Allegedly flashing all in single update.

Thanks for suggestions. I'll explore roirraW "edor" #1318 to completely disable auto OTAs.

Coming from VZW note 8 which had to stay on Android 7 for last 5+ yrs to keep root. So quite rusty on these OTA things. :)
 

waldoud

Senior Member
May 30, 2016
63
6
Hello everyone, I have a question, what difference would there be between the uk and the global, can this version change be done?
 
My only thought on full factory images vs OTAs via phone is that the Nov update showed ~30MB download. Yet looking at factory images over ~2.5GB. That's a big difference to write to nand storage to gain 30MB worth of security updates. So been curious about OTAs to help extend Pixels life. (Haven't actually looked if Google gives any write endurance specs on Pixel.
As I understood the twitter post roirraW "edor" ehT posted about in post #1438, OTA's can be more than the simple size (~30MB in this instance) it posts in the System Update page in the OS. Updating through OTA can take painstakingly long; it felt like 30 minutes when I did it once on my wife's unrooted phone. Also, (according to the twitter post) it seems to depend a lot on its compression when it comes to processing. Depending on your internet speed, if you can download the 2.5GB relatively quickly (Google's servers have always been lightening in my experience), flashing the full factory is faster than the device slowly downloading the 30MB (I don't know why it took so long to download the 30MB) and then uncompressing and then installing/processing the OTA update. Running the flash-all on the Full Factory Image is usually finished in under 2 minutes (in my experience, YMMV). Also, it's not like you have to load the 2.5GB on the phone, just on your computer. Also, again, @roirraW "edor" ehT explains it best on how flashing and laying down the whole system image as an update is better than incrementally applying little patches over time. In one update it might just be 30MB worth of updates/changes, but after (let's say 4) months of around 30MB here and there, it adds up to 120MB months of incremental and intermittent data being patched here and there in variable places. Sorry I'm not explaining it well, i'm hoping the rode warrior can...
Regarding root after update I briefly read a few guides I believe mentioning "keeping root" with update. Pre-downloading the factory image + init_boot patch. Then re-packing factory image's zip to include patched init_boot. Allegedly flashing all in single update.

I think I've seen something like that; but from what I can recall on the instance I saw it, it was for a specific circumstance of attempting to repair a messed up partition and/or it was just put up in theory as a thought experiment. Now, I could be completely wrong so I hope some expert would come and correct me if I am, but I recall momentarily seeing that when running the flash-all command process, it checks and "validates" the partitions on the device and it may check it against the image files in the Factory Image zip. If I'm correct and that's true (again, I am completely guessing and could be completely wrong and hope an expert would correct if I am), then messing with the init_boot image file and changing it from what is stock may incur some bad juju; in my head I imagine it akin to checksums not matching. I dunno, just a thought/guess/concern 🤷‍♂️

In any case, I'm happy it all worked out for you and I'm glad I could help some...

Hello everyone, I have a question, what difference would there be between the uk and the global, can this version change be done?
If you had already flashed the global and wished to flash the UK one (or vice-versa), as I understand it, you can simply dirty-flash it over whatever is already installed/flashed. For November, I flashed/installed the Global, but wanted to install the Verizon one, and was told & able to just flash the Verizon one over the Global one with no issues.
If you are asking for a complete explanation on the difference between the two, that's a different question I am willing to let someone else answer ;)
 
  • Like
Reactions: roirraW "edor" ehT

linuxares

Senior Member
Aug 5, 2010
90
21
Hi!

Anyone know why with the OTAs my phone won't even start installing/downloading them? It like instantly "nopes" when I try to download.

I have no clue why since it doesn't give me any information what have gone wrong.

EDIT: I run the Telia version for November so might be why?

EDIT2: Found the issue. Magisk init_boot wasn't loved by the OTA updater. Restored the image file now it OTA updates.
 

Attachments

  • Screenshot (6 Dec 2022 22 58 19).png
    Screenshot (6 Dec 2022 22 58 19).png
    411.3 KB · Views: 55
Last edited:

proxyx

Member
Oct 5, 2020
8
5
After flashing Q1A.221205.011 to slot A on my P7P, I attempted to flash the same to slot B. However, when I attempt to do so and issue the "fastboot reboot bootloader "command, the P7P hangs at a black screen and eventually reboots to slot A. Im never able to flash-all on slot B because I can't get to it. Is this recoverable? Seems like without slot B i run the risk of a bricked device if something were to happen to slot A.
 

Lughnasadh

Senior Member
Mar 23, 2015
4,683
5,298
Google Nexus 5
Huawei Nexus 6P
After flashing Q1A.221205.011 to slot A on my P7P, I attempted to flash the same to slot B. However, when I attempt to do so and issue the "fastboot reboot bootloader "command, the P7P hangs at a black screen and eventually reboots to slot A. Im never able to flash-all on slot B because I can't get to it. Is this recoverable? Seems like without slot B i run the risk of a bricked device if something were to happen to slot A.
What commands and in what order are you giving?

This should work:

Code:
adb reboot bootloader
fastboot --set-active=b (Since you are currently on slot a)
fastboot getvar current-slot (To confirm you are now on slot b)
flash-all.bat
 
  • Like
Reactions: Homeboy76

proxyx

Member
Oct 5, 2020
8
5
What commands and in what order are you giving?

This should work:

Code:
adb reboot bootloader
fastboot --set-active=b (Since you are currently on slot a)
fastboot getvar current-slot (To confirm you are now on slot b)
flash-all.bat
Yes that's the order of operations that I performed. I just tried the following:

Code:
adb reboot bootloader
fastboot --set-active=b
fastboot continue

and that gave a black screen and I noticed a couple of times a line flashed at the bottom of the screen then it eventually rebooted to slot A. Is slot B corrupted? If so, any way to recover?
 

proxyx

Member
Oct 5, 2020
8
5
Yes that's the order of operations that I performed. I just tried the following:

Code:
adb reboot bootloader
fastboot --set-active=b
fastboot continue

and that gave a black screen and I noticed a couple of times a line flashed at the bottom of the screen then it eventually rebooted to slot A. Is slot B corrupted? If so, any way to recover?
Got it to flash. Thank you very much for your input!
 
  • Like
Reactions: Lughnasadh

Lughnasadh

Senior Member
Mar 23, 2015
4,683
5,298
Google Nexus 5
Huawei Nexus 6P
Yes that's the order of operations that I performed. I just tried the following:

Code:
adb reboot bootloader
fastboot --set-active=b
fastboot continue

and that gave a black screen and I noticed a couple of times a line flashed at the bottom of the screen then it eventually rebooted to slot A. Is slot B corrupted? If so, any way to recover?
So you did exactly the commands I gave you?
 

Top Liked Posts

  • 1
    I tried Graphene OS for the past week and decided to go back to original.

    - bootloader is unlocked
    - am using Android Flash TOOL from here https://flash.android.com/
    - Removed non-stock key prior to proceeding with Flashing
    - i got to FastBoot screen during the Flash and the browser provided the following warning : '' Your device is being used by another program'' and then the Flasing process stopped.

    - Am now back at the main Google screen.
    - I believe Graphene OS already removed from device.
    - Trying to initialize Android Flash TOOL once again, i accept ADB / Grant access to ADB keys - device does not show up in the tool anymore to flash stock OS. (see attached screenshot)


    When I'm stuck at the main Google screen, I decided to factory reset.
    Turned device off > Pressed Volume down > highlight “Recovery mode.” > “Wipe data/factory reset” > After reset completed, pressed the Power button to select “Reboot system now.”





    View attachment 5826707


    I can get to recovery, tried to update via ADB command with the latest 2 image Pixel 7 pro found here https://developers.google.com/android/ota

    13.0.0 (TQ1A.230105.002, Jan 2023)Link0c8fdd0d42af8477338bf841524327f3aa253cf4a562eadc6a6198c3da88ed19
    13.0.0 (TQ1A.230105.002.A1, Jan 2023, Telstra)Linkc1f202817b5a56ca67d2165605ed0938d118646b22bd46be67f136a5ccc5d6b0


    , yet am getting this error.

    Verifying update package ...
    Error Recovery : footer is wrong
    Signature verification failed
    error:21

    Ideas ?
    Thank you
    Don't know why you are trying from recovery, have you tried putting the phone in Bootloader mode(fastboot) and see if phone is recognized?
  • 3
    This is from the OP



    the android flash tool tries relocking the bootloader without booting the phone. There is no opportunity to flash the stock init_boot image. Are these instructions incorrect? After wipe and flashing everything do I need to stop the android flash tool before relocking the bootloader, boot into bootloader, flash the stock init_boot image, and then re-lock the bootloader by selecting only that option from the android flash tool?
    The portion of the post you quoted describes 2 different methods. Method 1, Android Flash Tool, will do everything for you. Just run it.
    2
    And these instructions get me to completely stock?
    Yes.
    Actually, there are steps for this -- albeit straightforward simple ones -- in the OP in Post #3 in the "How to unroot" section. You may have missed it because it refers to "unrooting" while it actually is to relock the bootloader and resetting phone to stock.
    The only thing I might suggest is, when in the Android Flash Tool, you will have the option to select what Full Factory image version to use, and I suggest -- to minimize any kind of incompatibility or issue (because, when manually re-locking & flashing bootloader, if you apply the wrong one, it could hard-brick) -- to choose the Full Factory image version to the one on the the phone currently, if you can remember what version it would be.

    I've done this when sending back my Pixel 5's for trade-in and it's a very simple and straightforward process; there are proper prompts and directions on the website/tool -- just follow them (i.e. don't touch anything unless told to, don't restart it manually or stop it, only touch and do when directed). It's very similar to badabing2003's PixelFlasher (if you've used it before); maybe he gained inspiration from it.

    Good luck to you and hope this helps...!
    2
    Hi guys, first of all: thanks to all of you for your work and tutorials, this helps a lot of people!


    I have a question regarding unroot:

    I would like to unlock my bootloader, root my pixel 7 pro, then unroot it and relock the bootloader, so no one can see that it was ever rooted. Is that possible or is it still possible to see that it was rooted?

    Background: I need root access because I accidentally did a factory reset . Now I want to restore some data and therefore need root.

    Thanks in advance for your help.

    That would be no problem because I just need root to access the "deeper" storage. (hope any tool like DroidKit, Dr. Fone etc works).

    I would backup all relevant data (photos etc) - after that it is completely irrelvant for me if I have to wipe the phone again when unroot/relock bootloader.
    In your sequence of things, you "need root access because...[you] need restore some data" because you "accidentally did a factory reset (please do not ask, stupid like ...)", but if you accidentally factory reset, most of that data is gone/wiped/formatted. Then, you want to unlock the bootloader to achieve root access, but I think what @T.A.R.D.I.S. meant that in order to unlock the bootloader, you're going to have to format/wipe the phone AGAIN. That's a twice wiped/formatted device you're going to attempt to data recover on. That, or I'm misunderstanding the way you are saying things ("Now I want to restore some data and therefore need root." has me a bit tripped up) and you may be under the wrong impression that you have to have root access to restore data on -- which wouldn't make sense because you would have to initially have root to have restored it in the first place... I believe that's also why T.A.R.D.I.S. asked what was your backup method; if it is through Google One or cloud backup, you wouldn't require root access.
    I'm unfamiliar with tools like DroidKit or Dr. Fone, but I doubt they'd be able to do much with this phone and/or this type of situation. Maybe if it was an external sd card.... I do data recovery often on computers so I am well aware that formatting doesn't necessarily mean data is lost unless you start writing new data on the disk, but I don't think either Android/Pixel devices has the proper software or data/file-system structure to be able to restore data in the same way...

    In any case, to answer your initial question, yes you can unroot and relock your bootloader and the Pixel's aren't like Galaxy's where there is a physical mechanism that will "trip" in the system board when its bootloader is unlocked and/or device is rooted -- so it is doubtful (outside of Google breaking down and deeply diving into the device, I imagine) that anyone would be able to tell if it had ever been rooted/bootloader-unlocked before or not. Just be very very VERY careful locking your bootloader! Please, do as much research as you can before you attempt. More than enough people have permanently hard-bricked their Pixels dating all the way back to the very first OG Pixel attempting to relock their bootloader! Most experts even state/suggest that there's really no reason to relock it -- Google will take the device unlocked if a replacement/trade-in is processing and usually selling it or giving it away wouldn't mind or care; the only situation that come to mind is if one is ridiculously security paranoid about or other specific circumstance. The sole method I suggest (and have successfully relocked twice on 2 Pixel 5's) is using the Official Google Android Flash Tool. Again, please do as much research as you can if you go this route; I believe you have make sure to flash to both partitions or some such and to make sure to flash the right Android version...

    Either way, I wish you success and hope everything works out!
    2
    USNF 2.4.0 so far working perfectly on P7 Pro, Galaxy Tab S8 Ultra, And Galaxy Tab S7+ for those hesitant on flashing. Like Displax mentioned before it would be, it was an easy update through Magisk Manager.

    I didn't have any weird bugs on any of the devices (I did have the Huawei thing temporarily several factory resets ago in the early P7 days, but it never lasted or came back) so there's nothing to report that it "fixed", but everything does continue to work as before including banking, GPay, etc as far as I can tell so far.
  • 58
    13.0.0 (TQ1A.230105.002, Jan 2023)FlashLink34d676ff4d260f02d9ada1f16f24fd7995c9b9ca832410099950d9c510db8793
    13.0.0 (TQ1A.230105.002.A1, Jan 2023, Telstra)FlashLink6632344c9647b04bfce622b0decf3733dfb3bc5c3b2c068ea118f8631c1b39b8

    Android Security Bulletin—January 2023​

    bookmark_border
    Published January 3, 2022
    The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2023-01-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version.
    Android partners are notified of all issues at least a month before publication. Source code patches for these issues will be released to the Android Open Source Project (AOSP) repository in the next 48 hours. We will revise this bulletin with the AOSP links when they are available.
    The most severe of these issues is a high security vulnerability in the Framework component that could lead to local escalation of privilege with no additional execution privileges needed. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.
    Refer to the Android and Google Play Protect mitigations section for details on the Android security platform protections and Google Play Protect, which improve the security of the Android platform.
    Note: Information on the latest over-the-air update (OTA) and firmware images for Google devices is available in the January 2023 Pixel Update Bulletin.

    Android and Google service mitigations​

    This is a summary of the mitigations provided by the Android security platform and service protections such as Google Play Protect. These capabilities reduce the likelihood that security vulnerabilities could be successfully exploited on Android.
    • Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
    • The Android security team actively monitors for abuse through Google Play Protect and warns users about Potentially Harmful Applications. Google Play Protect is enabled by default on devices with Google Mobile Services, and is especially important for users who install apps from outside of Google Play.

    2023-01-01 security patch level vulnerability details​

    In the sections below, we provide details for each of the security vulnerabilities that apply to the 2023-01-01 patch level. Vulnerabilities are grouped under the component they affect. Issues are described in the tables below and include CVE ID, associated references, type of vulnerability, severity, and updated AOSP versions (where applicable). When available, we link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID. Devices with Android 10 and later may receive security updates as well as Google Play system updates.

    Framework​

    The most severe vulnerability in this section could lead to local escalation of privilege with no additional execution privileges needed.
    CVEReferencesTypeSeverityUpdated AOSP versions
    CVE-2022-20456A-242703780EoPHigh10, 11, 12, 12L, 13
    CVE-2022-20489A-242703460EoPHigh10, 11, 12, 12L, 13
    CVE-2022-20490A-242703505EoPHigh10, 11, 12, 12L, 13
    CVE-2022-20492A-242704043EoPHigh10, 11, 12, 12L, 13
    CVE-2022-20493A-242846316EoPHigh10, 11, 12, 12L, 13
    CVE-2023-20912A-246301995EoPHigh13
    CVE-2023-20916A-229256049EoPHigh12, 12L
    CVE-2023-20918A-243794108EoPHigh10, 11, 12, 12L, 13
    CVE-2023-20919A-252663068EoPHigh13
    CVE-2023-20920A-204584366EoPHigh10, 11, 12, 12L, 13
    CVE-2023-20921A-243378132EoPHigh10, 11, 12, 12L, 13
    CVE-2022-20494A-243794204DoSHigh10, 11, 12, 12L, 13
    CVE-2023-20908A-239415861DoSHigh10, 11, 12, 12L, 13
    CVE-2023-20922A-237291548DoSHigh11, 12, 12L, 13

    System​

    The most severe vulnerability in this section could lead to local escalation of privilege of BLE with no additional execution privileges needed.
    CVEReferencesTypeSeverityUpdated AOSP versions
    CVE-2022-20461A-228602963EoPHigh10, 11, 12, 12L, 13
    CVE-2023-20904A-246300272EoPHigh12L, 13
    CVE-2023-20905A-241387741EoPHigh10
    CVE-2023-20913A-246933785EoPHigh10, 11, 12, 12L, 13
    CVE-2023-20915A-246930197EoPHigh10, 11, 12, 12L, 13

    Google Play system updates​

    The following issues are included in Project Mainline components.
    SubcomponentCVE
    MediaProviderCVE-2023-20912

    2023-01-05 security patch level vulnerability details​

    In the sections below, we provide details for each of the security vulnerabilities that apply to the 2023-01-05 patch level. Vulnerabilities are grouped under the component they affect. Issues are described in the tables below and include CVE ID, associated references, type of vulnerability, severity, and updated AOSP versions (where applicable). When available, we link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.

    Kernel​

    The most severe vulnerability in this section could lead to remote code execution with no additional execution privileges needed.
    CVEReferencesTypeSeveritySubcomponent
    CVE-2022-42719A-253642087
    Upstream kernel [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]
    RCECriticalmac80211
    CVE-2022-42720A-253642015
    Upstream kernel [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]
    RCECriticalWLAN
    CVE-2022-42721A-253642088
    Upstream kernel [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]
    RCECriticalMultiple Modules
    CVE-2022-2959A-244395411
    Upstream kernel
    EoPHighPipe

    Kernel components​

    The most severe vulnerability in this section could lead to remote code execution with no additional execution privileges needed.
    CVEReferencesTypeSeveritySubcomponent
    CVE-2022-41674A-253641805
    Upstream kernel [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]
    RCECriticalWLAN
    CVE-2023-20928A-254837884
    Upstream kernel
    EoPHighBinder driver

    Kernel LTS​

    The following kernel versions have been updated. Kernel version updates are dependent on the version of Android OS at the time of device launch.
    ReferencesAndroid Launch VersionKernel Launch VersionMinimum Launch Version
    A-224575820125.105.10.101

    Imagination Technologies​

    This vulnerability affects Imagination Technologies components and further details are available directly from Imagination Technologies. The severity assessment of this issue is provided directly by Imagination Technologies.
    CVEReferencesSeveritySubcomponent
    CVE-2022-20235A-259967780 *HighPowerVR-GPU

    MediaTek components​

    These vulnerabilities affect MediaTek components and further details are available directly from MediaTek. The severity assessment of these issues is provided directly by MediaTek.
    CVEReferencesSeveritySubcomponent
    CVE-2022-32635A-257714327
    M-ALPS07573237 *
    Highgps
    CVE-2022-32636A-257846591
    M-ALPS07510064 *
    Highkeyinstall
    CVE-2022-32637A-257860658
    M-ALPS07491374 *
    Highhevc decoder

    Unisoc components​

    These vulnerabilities affect Unisoc components and further details are available directly from Unisoc. The severity assessment of these issues is provided directly by Unisoc.
    CVEReferencesSeveritySubcomponent
    CVE-2022-44425A-258731891
    U-2028856 *
    HighKernel
    CVE-2022-44426A-258728978
    U-2028856 *
    HighKernel
    CVE-2022-44427A-258736883
    U-1888565 *
    HighKernel
    CVE-2022-44428A-258741356
    U-1888565 *
    HighKernel
    CVE-2022-44429A-258743555
    U-1981296 *
    HighKernel
    CVE-2022-44430A-258749708
    U-1888565 *
    HighKernel
    CVE-2022-44431A-258741360
    U-1981296 *
    HighKernel
    CVE-2022-44432A-258743558
    U-1981296 *
    HighKernel
    CVE-2022-44434A-258760518
    U-2064988 *
    HighAndroid
    CVE-2022-44435A-258759189
    U-2064988 *
    HighAndroid
    CVE-2022-44436A-258760519
    U-2064988 *
    HighAndroid
    CVE-2022-44437A-258759192
    U-2064988 *
    HighAndroid
    CVE-2022-44438A-258760781
    U-2064988 *
    HighAndroid

    Qualcomm components​

    These vulnerabilities affect Qualcomm components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm.
    CVEReferencesSeveritySubcomponent
    CVE-2022-22088A-231156521
    QC-CR#3052411
    CriticalBluetooth
    CVE-2022-33255A-250627529
    QC-CR#3212699
    HighBluetooth

    Qualcomm closed-source components​

    These vulnerabilities affect Qualcomm closed-source components and are described in further detail in the appropriate Qualcomm security bulletin or security alert. The severity assessment of these issues is provided directly by Qualcomm.
    CVEReferencesSeveritySubcomponent
    CVE-2021-35097A-209469821 *CriticalClosed-source component
    CVE-2021-35113A-209469998 *CriticalClosed-source component
    CVE-2021-35134A-213239776 *CriticalClosed-source component
    CVE-2022-23960A-238203772 *HighClosed-source component
    CVE-2022-25725A-238101314 *HighClosed-source component
    CVE-2022-25746A-238106983 *HighClosed-source component
    CVE-2022-33252A-250627159 *HighClosed-source component
    CVE-2022-33253A-250627591 *HighClosed-source component
    CVE-2022-33266A-250627569 *HighClosed-source component
    CVE-2022-33274A-250627236 *HighClosed-source component
    CVE-2022-33276A-250627271 *HighClosed-source component
    CVE-2022-33283A-250627602 *HighClosed-source component
    CVE-2022-33284A-250627218 *HighClosed-source component
    CVE-2022-33285A-250627435 *HighClosed-source component
    CVE-2022-33286A-250627240 *HighClosed-source component

    Common questions and answers​

    This section answers common questions that may occur after reading this bulletin.
    1. How do I determine if my device is updated to address these issues?
    To learn how to check a device's security patch level, see Check and update your Android version.
    • Security patch levels of 2023-01-01 or later address all issues associated with the 2023-01-01 security patch level.
    • Security patch levels of 2023-01-05 or later address all issues associated with the 2023-01-05 security patch level and all previous patch levels.
    Device manufacturers that include these updates should set the patch string level to:
    • [ro.build.version.security_patch]:[2023-01-01]
    • [ro.build.version.security_patch]:[2023-01-05]
    For some devices on Android 10 or later, the Google Play system update will have a date string that matches the 2023-01-01 security patch level. Please see this article for more details on how to install security updates.
    2. Why does this bulletin have two security patch levels?
    This bulletin has two security patch levels so that Android partners have the flexibility to fix a subset of vulnerabilities that are similar across all Android devices more quickly. Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level.
    • Devices that use the 2023-01-01 security patch level must include all issues associated with that security patch level, as well as fixes for all issues reported in previous security bulletins.
    • Devices that use the security patch level of 2023-01-05 or newer must include all applicable patches in this (and previous) security bulletins.
    Partners are encouraged to bundle the fixes for all issues they are addressing in a single update.
    3. What do the entries in the Type column mean?
    Entries in the Type column of the vulnerability details table reference the classification of the security vulnerability.
    AbbreviationDefinition
    RCERemote code execution
    EoPElevation of privilege
    IDInformation disclosure
    DoSDenial of service
    N/AClassification not available
    4. What do the entries in the References column mean?
    Entries under the References column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs.
    PrefixReference
    A-Android bug ID
    QC-Qualcomm reference number
    M-MediaTek reference number
    N-NVIDIA reference number
    B-Broadcom reference number
    U-UNISOC reference number
    5. What does an * next to the Android bug ID in the References column mean?
    Issues that are not publicly available have an * next to the corresponding reference ID. The update for that issue is generally contained in the latest binary drivers for Pixel devices available from the Google Developer site.
    6. Why are security vulnerabilities split between this bulletin and device / partner security bulletins, such as the Pixel bulletin?
    Security vulnerabilities that are documented in this security bulletin are required to declare the latest security patch level on Android devices. Additional security vulnerabilities that are documented in the device / partner security bulletins are not required for declaring a security patch level. Android device and chipset manufacturers may also publish security vulnerability details specific to their products, such as Google, Huawei, LGE, Motorola, Nokia, or Samsung.

    Versions​

    VersionDateNotes
    1.0January 3, 2022Bulletin Published

    Kush M.

    Community Manager•Original Poster


    Google Pixel Update - January 2023​

    Announcement
    Hello Pixel Community,

    We have provided the monthly software update for January 2023. All supported Pixel devices running Android 13 will receive these software updates starting today. The rollout will continue over the next few weeks in phases depending on carrier and device. Users will receive a notification once the OTA becomes available for their device. We encourage you to check your Android version and update to receive the latest software.

    Details of this month’s security fixes can be found on the Android Security Bulletin: https://source.android.com/security/bulletin

    This update also includes support for static spatial audio, which will provide surround sound for any connected headset. Another update will roll out to Pixel Buds Pro in the coming weeks that will enable spatial audio with head tracking.

    Thanks,
    Google Pixel Support Team


    Software versions

    Global
    • Pixel 4a: TQ1A.230105.001
    • Pixel 4a (5G): TQ1A.230105.001
    • Pixel 5: TQ1A.230105.001
    • Pixel 5a (5G): TQ1A.230105.001
    • Pixel 6: TQ1A.230105.002
    • Pixel 6 Pro: TQ1A.230105.002
    • Pixel 6a: TQ1A.230105.001.A2
    • Pixel 7: TQ1A.230105.001.A2
    • Pixel 7 Pro: TQ1A.230105.002

    Canada
    • Pixel 4a: TQ1A.230105.001.B1

    Telstra (AU)
    • Pixel 7: TQ1A.230105.001.A3
    • Pixel 7 Pro: TQ1A.230105.002.A1
    What’s included

    The January 2023 update includes bug fixes and improvements for Pixel users – see below for details.

    Audio
    • Add support for Spatial Audio with certain devices and accessories *[1]

    Biometrics
    • Additional improvements for fingerprint recognition and response in certain conditions *[2]

    Bluetooth
    • Fix for issue occasionally preventing certain Bluetooth Low Energy devices or accessories from pairing or reconnecting
    • Fix for issue preventing audio from playing over certain headphones or accessories while connected in certain conditions

    Camera
    • Fix for issue occasionally causing captured photos to appear corrupted or distorted while zoomed in *[3]

    Display & Graphics
    • Fix for issue occasionally preventing display from waking or appearing turned off while device is powered on *[3]

    User Interface
    • Fix for issue occasionally causing UI to display in landscape layout while device is held in portrait mode
    ---------------------------------------------------------------

    Device Applicability

    Fixes are available for all supported Pixel devices unless otherwise indicated below.

    *[1] Included on Pixel 6, Pixel 6 Pro, Pixel 7, Pixel 7 Pro
    *[2] Included on Pixel 6a, Pixel 7
    *[3] Included on Pixel 7, Pixel 7 Pro

    Details
    Other

    The answer to life, the universe, and everything.​

    1667221900824.jpeg
    (* I do not claim copyright to this image, nor do I benefit monetarily from it or these posts)

    Just kidding (the answer is 42, by the way):
    Here there be dragons. 🐉 I am not responsible for anything at all. 😹

    VERY IMPORTANT - On the Pixel 7/Pro, we use Magisk to patch init_boot.img, NOT boot.img AND we flash the patched init_boot to the init_boot partition - do not flash it to the boot partition.​

    Thanks to @edcsxz, @Lughnasadh, and @AndyYan for news about that and confirming it.

    Moved @mariusnoor's provided zero-day OTA.zip to Post #8 - Old news from the OP.

    Unlocking or locking the bootloader will wipe the device every single time, so be sure to have your data backed up before doing so, or better yet, just unlock it as soon as you get the device.​

    Keep in mind that unlocking the bootloader or rooting might affect your phone's capability to use banking apps such as Google Pay, your local bank's app, or even the ability to install some apps like NetFlix. See Post #2 - Unlocking Bootloader / Rooting / Updating | SafetyNet | ADB/Fastboot & Windows USB Drivers.​

    If you're going to re-lock the bootloader, make sure the ROM you have on your phone is completely stock (by flashing the latest official firmware) BEFORE re-locking it.​

    There are no permanent negative consequences if you unlock or re-lock the bootloader other than it will wipe your phone, and while your bootloader is unlocked you get a brief screen when you boot the phone telling you (and anyone who sees your phone at the time) that it's unlocked. You will also continue to receive updates (if you've merely unlocked the bootloader, you can take updates as normal) unlike Samsung, Sony, et cetera, which have permanent major consequences with reduced functionality even if you un-root and re-lock your bootloader. If you're actually rooted (not just bootloader unlocked), you'll have to perform extra steps to manually update each month, and to keep root/re-root.

    INDEX:

    • Post #2 - Unlocking Bootloader / Rooting / Updating | SafetyNet | ADB/Fastboot & Windows USB Drivers:
      • How to Root the first time / aka How to unlock the Bootloader
      • TL;DR - for the seasoned repeat users
        • Unlocking Bootloader (required in order to root)
        • How to update each month (and also how to root)[requires an unlocked bootloader for updating via this factory image method]
          • OPTIONAL: If you want to flash both slots, after this first time, then after do the following
        • SafetyNet
        • Optional steps when updating - flashing custom kernels
          • The two schools of thought on disabling Verity and Verification
      • ADB/Fastboot and Windows USB Drivers - direct download links and the most recent changelog
    • Post #3 - Other, most important resources:
      • A list of other important apps
      • TWRP [not made for the Pixel 7 (or 6) Pro yet - will update when or if ever it has - don't hold your breath]
      • Factory Images (requires an unlocked bootloader)
      • Full OTA Images(doesn't require an unlocked bootloader - you can ask questions in this thread, but I won't be providing the steps necessary, as I always use the factory image)
        • @mariusnoor's provided official URL to download the zero-day OTA to TD1A.220804.031.
      • Check warranty status
      • Official Google Pixel Update and Software Repair (reported as of January 23, 2022 to still not be updated for the Pixel 6/Pro - no idea if it has yet now, or if it will be for the 7/Pro)
      • Official Google Pixel Install fingerprint calibration software (also available at the bottom of the Update and Software Repair page above) - I believe this is only helpful if you've replaced the screen - if it's anything like the Pixel 6 Pro: if you have the screen replaced, then you *must* have the fingerprint reader replaced as well.
      • Find problem apps, Magisk, and LSposed Modules by (three different methods)
      • Official Google Android Flash Tool (OEM Unlocking needs to be toggled on - you do not have to manually unlock the bootloader - their site will do that on its own)
      • How to determine if you already have Verity and Verification disabled (required for custom kernels for now)
      • How to unroot
    • Post #4 - Google Pixel Updates (more user-friendly to read than Pixel Update Bulletins) (nothing for the P7P yet)
      • Old Google posts/updates
    • Post #5 - Pixel Update Bulletins
      • Old Bulletins
    • Post #6 - Regarding P7P 5G model numbers and capabilities, and how to determine your hardware version
    • Post #7 - My personal advice for how to get your device back up and running as you had it before a factory reset
    • Post #8 - Old news from the OP

    Thank you to the following users who have all contributed greatly to my knowledge of Pixels since I came back to XDA a year ago after a few years of mostly inactivity. Apologies if I miss anybody. In alphabetical order:

    39

    Unlocking Bootloader / Rooting / Updating | SafetyNet | ADB/Fastboot & Windows USB Drivers


    Unlocking Bootloader / Rooting / Updating:

    How to Root the first time / aka How to unlock the Bootloader:
    Unlocking the bootloader will factory reset your device. There is no way around this. I highly suggest never re-locking your bootloader once you unlock it. If you do ever re-lock the bootloader, only do so after restoring the phone to 100% stock by using the latest Pixel 7 Pro Factory Image or Official Google Android Flash Tool.

    Verizon variants:
    Will never be able to have their bootloader unlocked. It's like winning the lottery, and just as rare and relatively random. There is nothing that anyone on XDA can do to help you unlock your Verizon variant.

    T-Mobile and AT&T variants:
    Can be unlocked once you pay the phone off, then you contact the carrier and arrange to Carrier unlock the phone. Once the phone is Carrier unlocked, then you can unlock the bootloader with the usual caveats (will wipe the device and there's no way around it).

    The direct-from-Google (or other retailers who aren't U.S. Carriers), the factory Carrier Unlocked Pixels:
    Can be bootloader unlocked at any time. I'd try it first before putting a SIM card in the phone. If OEM unlocking is grayed out, try connecting to Wi-Fi, and reboot if necessary. If it's still grayed out, try with your SIM card, and reboot again. Historically on Pixels, most of the time you can toggle OEM unlocking immediately, but occasionally some users have found it took a little while after being either connected to Wi-Fi or having your SIM card installed in it, and then eventually (hours? day? days?) you can toggle OEM unlocking.

    The rest of the world's carriers:
    No idea. Feel free to ask in the thread and hopefully, someone with specific knowledge will answer.

    Other than trying the things I mentioned above, there is nothing else that anyone on XDA can do to help get OEM unlocking to be ungrayed.

    Unlocking Bootloader (required in order to root)
    The one-time first steps are:
    1. Android Settings
    2. About phone
    3. Click on Build number repeatedly, about seven times
    4. Go back to the main Android Settings
    5. System
    6. Developer options
      • Toggle OEM unlocking on. See @Namelesswonder's tip below (this won't help with variants that are supposed to be bootloader locked):
        Also a little tip for anyone trying to enable OEM unlocking on a device and it is grayed out, you can force the phone to check for eligibility by connecting to the internet in whatever way, going to the dialer, and dialing *#*#2432546#*#* (CHECKIN).
        You should receive a notification from Google Play services with "checkin succeeded" and OEM unlocking should be available immediately if the device is eligible.
        Google account not needed, SIM not needed, no other setup required. Works on completely-skipped-setup-wizard. Just need to make sure to connect to the internet and select the connection as metered to avoid any updates.
      • Toggle USB debugging on.
      • [Optional] I highly suggest you also disable Automatic system updates. Note that in a situation such as the Android 12 serious bootloader security issue, this setting will not keep Google from forcing an update to come through anyway.
    7. How to actually root follows the same steps below as how to update each month.
    8. Download the latest ADB/Fastboot (SDK Platform Tools) and Windows USB Drivers.
    9. Unzip the Platform Tools and Drivers.
    10. NOTE: If you have USB drivers for other Android devices installed, like Samsung, they can alternately sometimes work and not work with Google Pixels. I recommend uninstalling those drivers, or at least updating that driver to Google's driver as instructed below (the Device Manager entry may be different with other OEMs).​

    11. The Windows USB Drivers may have to be installed twice:
      • The first time while your phone is running and unlocked as normal.
        1. In Windows, right-click on the Start Button and choose Device Manager.
        2. Plug your phone into the computer and look for the new hardware entry in Device Manager. Near the top of Device Manager should be Android Device. Click the drop-down arrow to the left of it.
        3. Below Android Device, it should now show Android Composite ADB Interface
        4. Right-click the Android Composite ADB Interface and choose Update driver
        5. Choose Browse my computer for drivers
        6. Click Browse and navigate to where you unzipped the Windows USB drivers to.
        7. Follow the prompts to install the driver.
        8. Keep Device Manager itself open - you'll need it again in a minute, but you can close any other Device Manager windows after you have installed the driver.
        9. Open a Command Prompt and navigate to the platform-tools folder.
        10. Run command:
          Code:
          adb devices
        11. On your Android device, you'll get an ADB prompt. Check the box to always give ADB permission and click OK.
        12. Confirm that the command results in a list of Android devices. When doing these producedures, you should only have the one device you want to work on connected, to keep things simple.
      • The second time to install the driver is while the phone is in Bootloader (fastboot mode), notFastbootD (fastbootd) mode. I know it's confusing.
        • Run command:
          Code:
          adb reboot bootloader
        • Repeat the instructions above starting with "Right-click the Android Composite ADB Interface".
          • This second time installing the drivers while in Bootloader (fastboot mode), it will show up as "Android Bootloader Interface". Thanks @simplepinoi177 for the suggestion to add this detail.
    12. Run command:
      Code:
      fastboot flashing unlock
    13. On the phone, press either the up or down volume button once until you see Unlock the bootloader |>| beside the power button.
    14. Press the power button. The phone will go black for a second and then show near the bottom Device state: unlocked.
    15. After these first-time steps to unlock the bootloader, if you want to root, continue below at the step:
    How to update each month (and also how to root) [requires an unlocked bootloader for updating via this factory image method]
    1. These three instructions only apply if you're already rooted and updating from one firmware version to another:
      • Made sure all Magisk Modules have been updated.
      • Disable all Magisk Modules.
      • UNhide Magisk!
    2. If you are going to use the Official Google Android Flash Tool, then skip the steps I indicate with FAB(Flash-All.Bat).
      • If using the Android Flash Tool to update/dirty flash, you should have the following items notselected:
        • Deselect Wipe
        • Deselect Force Flash all partitions (which will also wipe)
        • Deselect re-lock bootloader
    3. Always use the latest ADB/Fastboot (SDK Platform Tools) and Windows USB Drivers.
    4. Unzip the Platform Tools.
    5. Download the latest Pixel 7 Pro Factory Image (at the bottom of the "Cheetah" section).
    6. Unzip the factory image to the same platform-tools folder, i.e. so that flash-all.bat and all other files are in the same folder as ADB and Fastboot from the platform-tools.
    7. * FAB VERY important - Edit the flash-all.bat (on Windows) or flash-all.sh (on Linux) and remove the -w from the fastboot update image-cheetah-etcetera.zip line. This will keep the script from wiping your phone when you run it.
    8. Extract only the init_boot.img file from the image-cheetah-etcetera.zip to the same platform-tools folder.
    9. Copy the init_boot.img from the PC to the phone's internal storage.
    10. * FAB Run commands:
      Code:
      adb reboot bootloader
      flash-all.bat (on Windows)
      or
      flash-all.sh (on Linux)
      
      (Note:  At least two Apple Macintosh users had trouble using the flash-all.sh - at least one of those users, everything went smooth once they used a Windows PC for this part of the process)

      IMPORTANT - The flash-all will take several minutes and reboot on its own several times including to a mode called "FastbootD", and finally reboot into full Android when it's done. Do not interrupt this process. On the FastbootD screen on the phone, do not use any of the manual selection options - let the flash-all script do it's work. Do not unplug your phone until it has fully booted into Android.​

      Thanks to @PurppleMonkey and @xgerryx for suggesting a warning about this. Thanks to @simplepinoi177 for suggesting the "FastbootD" clarification.
    11. On the phone:
      • Wait for the phone to boot normally. Unlock the phone.
      • OPTIONAL: If you want to flash both slots, after this first time, then after do the following:

        • Code:
          adb reboot bootloader
          fastboot --set-active=other
          flash-all.bat
        So you're doing the flash-all.bat a second time on the second slot.
      • Apply Magisk Stable to it. NOTE: It is always possible that an Android Update (Monthly, QPR [Quarterly Platform Release], new major Android versions, and Beta versions) might need a new version of Magisk Stable, Beta, or Canary from GitHub to work correctly. XDA forum for Magisk is here.
        • Launch the Magisk app.
        • Beside "Magisk", click "Install".
        • Click "Select and Patch a File", and choose the init_boot.img that you just copied to the phone's storage.
    12. Copy the Magisk'd init_boot.img (filename similar to magisk_patched-25200_1a2B3c.img)back over to the computer.
    13. Open a Command Prompt and navigate to the platform-tools folder.
    14. Run command:
      Code:
      adb reboot bootloader
    15. After phone has rebooted into Bootloader (Fastboot) mode, run command:
      Code:
      fastboot flash init_boot magisk_patched-25200_1a2B3c.img
      fastboot reboot
    16. Confirm that the phone boots completely normally.
    17. Cautiously re-enable Magisk Modules.
    18. Reboot.
    19. Confirm everything worked fine.
    20. If the phone won't boot correctly after having enabled Magisk Modules, see either of the two solutions below:
      • For the future, you don't need to go into safe mode unless that's your preference. I forgot what all it resets, but it's many settings and it's bothersome. I'd rather just reinstall my modules and not have to figure out those Android settings/changes which I come across days or weeks later when I infrequently do something. Have your phone reboot and run this:
        Code:
        adb wait-for-device shell magisk --remove-modules
        I like to just do this first:
        Code:
        adb devices
        So the server is running, then I have the long one pasted and ready to go once the phone turns off.
      • Find problem apps, Magisk, and LSposed Modules by (three different methods) section in my next post. After following that link, you may have to scroll up a little bit and the section title will be highlighted.

    SafetyNet:

    New Official Universal SafetyNet Fix released by @kdrag0n v2.4.0 available at XDA
    1. Launch the Magisk app.
    2. Go to Magisk's Settings (Gear in top right).
      • Click Hide the Magisk app.
      • When you hide it, you'll have the optional opportunity to change the Magisk app's name to whatever you wish. It doesn't have to be complex to fool apps that check for Magisk.
      • Important: When you have the Magisk app hidden or renamed, you can accidentally install a new copy of Magisk. This situation won't work at all - neither copy of Magisk will work with two installed. This is one reason why I don't completely hide Magisk, so I can tell it's installed because I have it renamed as something easily recognizable.
      • Back to the Magisk app's Settings...
      • Click Systemless hosts. This adds a Magisk Module to Magisk, which you can verify in a later step.
      • Toggle Zygisk on.
      • Toggle Enforce DenyList on.
      • Click Configure DenyList.
        • Add every app that you want to explicitly deny root and the existence of root.
        • You can click the 3-dot menu and choose the options to display system and/or OS apps, if necessary.
        • Note that for many apps, it is not enough to click the single checkmark to the right of the app name in this list. For many but not all apps, you should click on the app name and you'll see it expand to two or more entries, each with its own toggles. In this expanded state, you can now check the single top checkbox beside the main app name and it'll toggle all individual sub-entries.
        • Some apps add new entries to this list from time to time, so if you find that an app used to work for you when rooted and doesn't now, check this list again and look for the entries that aren't fully checked. There will be an incomplete horizontal line above the apps that don't have all of their sub-entries toggled.
        • You can use the Search button at the top of this list to find specific apps quickly.
        • The most common apps you should definitely fully check in this list are:
          • IMPORTANT - There are some things, such as Google Play Services which it's fine to add to the DenyList, but it's perfectly normal when used in combination with the Universal SafetyNet Fix (USNF) that it is back to being unchecked the next time you visit the DenyList. Since USNF takes care of Google Play Services, you don't even have to add it to the DenyList in the first place.​

          • Google Play Store
          • Google Services Framework
          • Google Play Protect Service
          • Wallet
          • GPay
          • Any banking apps.
          • Any streaming apps that use DRM.
          • Any 2FA apps, especially those for work.
          • Some of those Google apps might not need denying, but it doesn't hurt to deny them.
          • Any time you toggle more entries in this list, it may be necessary to reboot the phone for it to take effect.
    3. From the main screen in the Magisk app, go to Modules at the bottom.
    4. Confirm that the Systemless hosts Magisk Module is added to this list, and enabled.
    5. Install the Magisk Module: Universal SafetyNet Fix. New Official Universal SafetyNet Fix released by @kdrag0n v2.4.0 available at XDA.
    6. Reboot.
    7. Install from the Play Store:
      • YASNAC - SafetyNet Checker
        • Launch it.
        • Click Run SafetyNet Attestation.
        • It should say:
          • Basic integrity: Pass
          • CTS profile match: Pass
          • Evaluation type: BASIC
      • Play Integrity API Checker
        • Launch it.
        • Click Check.
        • It should have the following with a green checkmark:
          • MEETS_DEVICE_INTEGRITY
          • MEETS_BASIC_INTEGRITY
        • It's normal for MEETS_STRONG_INTEGRITY to have a red X.
      • You don't have to keep these installed, although I keep them handy.
      • Sometimes, clearing app cache and/or data for apps like the Google Play Store, GPay, Wallet and others (and then rebooting) after these steps may help pass SafetyNet as well.
    8. See @V0latyle's explanation (and further linked post) for why we can't achieve STRONG_INTEGRITY with an unlocked bootloader.
    9. See @V0latyle's [DISCUSSION] Play Integrity API regarding why SafetyNet, per se, is actually defunct and replaced with Play Integrity - and New Official Universal SafetyNet Fix released by @kdrag0n v2.4.0 referenced in the steps above takes care of the latter.

    Optional steps when updating - flashing custom kernels:
    • Download the custom kernel of choice on the phone.
      • Be sure to read the particular installation instructions in the kernel threads' OP - any instructions in their OPs takes priority over anything I say here, which is generalized.​

        For now even the AK3 Zip versions of custom kernels requires Verity and Verification to be disabled.
        How to determine if you already have Verity and Verification disabled - see section in Post #3 - Other, most important resources
      • The two schools of thought on disabling Verity and Verification:
        • My post here. If you want to discuss it any, please do so in my thread, or at least not in that custom kernel thread, so as to keep the thread on-topic.
    • Extract the vbmeta.img file from the inner Zip of the factory image zip and put it in the same folder with the latest extracted platform-tools.
    • Hook the phone up to your computer and run the following commands:

      • Code:
        adb reboot bootloader
        [wait for the phone to reboot to bootloader (fastboot mode)]
        Code:
        fastboot flash vbmeta vbmeta.img --disable-verity
        fastboot reboot
    • Unlock the phone once it's booted up.
    • Make sure the Kernel Flasher app is up to date. XDA thread for the Kernel Flasher app is here.
    • Launch Kernel Flasher.
    • Select the slot that's mounted.
    • Choose Flash AK3 Zip.
    • Select the custom kernel zip just downloaded.
    • When it's done flashing, head to Android Settings and perform a Factory Reset, as is currently needed for Despair kernel.
    • If you failed to disable Verity and Verification ahead of time, if you have to, just force the phone off using these instructions: Turn your Pixel phone on & off, then press the Volume Down and Power buttons for a couple of seconds to get into the bootloader (fastboot mode). You'll still have to factory reset after disabling Verity in combination with this kernel, for now.
    • Whenever you use the flash-all to flash your phone, as long as you want to continue to disable Verity and Verification, you'll have to further modify the flash-all script as such:

      • Code:
        fastboot update image-cheetah-buildnumber.zip --disable-verity --disable-verification

    ADB/Fastboot & Windows USB Drivers:

    Platform Tools was updated in August 2022 to v33.0.3:
    Windows: https://dl.google.com/android/repository/platform-tools-latest-windows.zip
    Mac: https://dl.google.com/android/repository/platform-tools-latest-darwin.zip
    Linux: https://dl.google.com/android/repository/platform-tools-latest-linux.zip

    Release Notes https://developer.android.com/studio/releases/platform-tools:

    33.0.3 (Aug 2022)​

    • adb
      • Don't retry adb root if first attempt failed.
      • Fix track-devices duplicate entry.
      • Add receive windowing (increase throughput on high-latency connections).
      • More specific error messages in the "more than one device" failure cases.
      • Reject unexpected reverse forward requests.
      • Fix install-multi-package on Windows.
    • fastboot
      • Remove e2fsdroid as part of SDK platform-tools.
      • Print OemCmdHandler return message on success.
    You'll need this if you're going to unlock the bootloader on your Pixel 7 Pro: SDK Platform Tools (download links for Windows, Mac, and Linux). Note that you can find links to download the tools elsewhere, but I wouldn't trust them - you never know if they've been modified. Even if the person providing the link didn't do anything intentionally, the tools could be modified without them being aware. Why take a chance of putting your phone security further at risk?

    You can alternately use the tools from the SDK Manager, but most of us will want to stick to the basic tools-only without the complications of the full development manager.
    For Windows, get Google's drivers here Get the Google USB Driver (ADB will likely work while the phone is fully booted, but if you're like me, you'll need these drivers for after you adb reboot-bootloader, to be able to use ADB and Fastboot.
    33
    Please test this UNSF build. Should be passing basic/device integrity.

    Use updated version from main post instead
    22
    I would expect that once 2.4.0 is released publicly, we should probably go back to using the official release, but conversely, as long as something works for you, there's also not necessarily a need to fix what isn't broken. Personally, I plan on switching once it's made completely public.

    Note that @Displax wasn't trying to replace the official version - they always kept it the same version as the most recent official along with "Mod", "Mod 2", or "Mod 2.1", so that suggests to me they were merely making temporary workarounds until/if the official was updated.
    Indeed. My MOD is a temporary solution until kdrag0n release accurate fix.

    I didn't change the update channel in the module on purpose so that everyone can upgrade to the new official version automatically without any problems.
    17

    Other, most important resources


    A list of other important apps: - be sure to thank the respective OPs:
    How to unroot
    One of these two options:
    1. Official Google Android Flash Tool (OEM Unlocking needs to be toggled on - you do not have to manually unlock the bootloader - their site will do that on its own).
      Select the options to:
      • Wipe
      • Force flash all partitions
      • Re-lock bootloader
    2. Flash the completely stock init_boot.img from the same firmware version that you're on:
      Code:
      adb reboot bootloader
      fastboot flash init_boot init_boot.img

    TWRP [not made for the Pixel 7 (or 6) Pro yet - will update when or if ever it has - don't hold your breath]
    I would guess that this should be the appropriate URL for official TWRP custom recovery for the Pixel 7 Pro, but who knows when/if that will actually be made available, and it may become available unofficially in these forum sections before being made official. I'll adjust this URL as needed. https://twrp.me/google/googlepixel7pro.html.

    Factory Images (requires an unlocked bootloader)
    It's also handy to have to the full official firmware available, whether it's to recover from accidents or for actual development. Note the official link to the general Factory Images for Nexus and Pixel Devices page. The following link goes directly to the Pixel 7 Pro (Cheetah) section: Pixel 7 Pro Factory Images. I prefer to actually bookmark a link to the device listed immediately below the device I want the firmware for, because Google dumbly (in my opinion) puts the latest firmware at the bottom of the list for each particular device, and that ends up making you scroll a lot after a year or two of monthly updates.

    Full OTA Images (doesn't require an unlocked bootloader - you can ask questions in this thread, but I won't be providing the steps necessary, as I always use the factory image)

    Check warranty status - *may* reveal if a phone is refurbished, only if the phone was refurbished through Google - thanks to @Alekos for making me aware of the site.

    Official Google Pixel Update and Software Repair (reported as of January 23, 2022 to still not be updated for the Pixel 6/Pro - no idea if it has yet now, or if it will be for the 7/Pro)

    Official Google Pixel Install fingerprint calibration software (also available at the bottom of the Update and Software Repair page above) - I believe this is only helpful if you've replaced the screen - if it's anything like the Pixel 6 Pro: if you have the screen replaced, then you *must* have the fingerprint reader replaced as well.

    Find problem apps, Magisk, and LSposed Modules by (three different methods):
    1. Google's Help Page for Find problem apps by rebooting to safe mode - this can be a lifesaver and keep you from having to do a restore to 100% complete stock or even from having to do a factory reset. This will deactivate all Magisk modules, and they'll remain deactivated even after you boot normally after briefly booting to safe mode. You can re-enable the Magisk modules as you wish to try to narrow down the problem if it was caused by a Magisk module. This can even get things working again after a Magisk Module wasn't finished installing and potentially causing a bootloop.
    2. You can also follow @Jon8RFC's advice:
      For the future, you don't need to go into safe mode unless that's your preference. I forgot what all it resets, but it's many settings and it's bothersome. I'd rather just reinstall my modules and not have to figure out those Android settings/changes which I come across days or weeks later when I infrequently do something. Have your phone reboot and run this:
      Code:
      adb wait-for-device shell magisk --remove-modules
      I like to just do this first:
      Code:
      adb devices
      So the server is running, then I have the long one pasted and ready to go once the phone turns off.
      Worked for me yesterday when I accidentally tried some old version of a Magisk Module. You have to reinstall your Magisk Modules, but if you're using a third-party widget, it won't disable them like Safe mode does.
    3. (May only be for mis-behaving LSposed modules):
      In the future try this

      adb wait-for-device shell su -c "touch /data/adb/modules/zygisk_lsposed/disable"
      adb reboot

      Official Google Android Flash Tool (OEM Unlocking needs to be toggled on - you do not have to manually unlock the bootloader - their site will do that on its own)
      OEM unlocking in developer options needs to be toggled on. I don't "believe" you have to actually do the "fastboot flashing unlock" command.

      How to determine if you already have Verity and Verification disabled (required for custom kernels for now)
      I keep seeing this asked, so I added a Magisk module for it to the linked Github release. With the module installed, you can just run:

      Code:
      su
      avbctl get-verity
      avbctl get-verification

      I spent way more time debugging that I downloaded Github's HTML of the update-binary script rather than the raw file than I care to admit. 🤦‍♂️ Off to bed.
      Alternative two more manual ways of checking:
      Since you´re probably already rooted anyway if you plan to flash this kernel, simply reboot your device. After you enter the device immediately take a kernel log with for example EXKM or any other app that allows to do that, terminal, etc.

      Look for that line
      [ 1.273480] init: [libfs_avb]AVB HASHTREE disabled on: /vendor_dlkm

      If you see this line, verity/verification should be disabled.
      I've seen several cases where having the ability to check would have been handy, so I pushed an avbctl binary built against the latest aosp sources here.

      The simplest way to use it would be the following:

      Code:
      adb push avbctl /data/local/tmp
      adb shell
      su
      cd /data/local/tmp
      chmod +x avbctl
      ./avbctl get-verity
      ./avbctl get-verification