How To Guide March 13, 2023 TQ2A.230305.008.C1 Global | .A3 WINDTRE/Canada - Unlock bootloader / Root Pixel 7 Pro [Cheetah] / SafetyNet

[collegencmc]

Hey All,

So thanks to roirraW I was able to root my 7 pro after doing:

fastboot flash init_boot magisk_patched-xx.img

however I'm findings some app's think I'm rooted even though they are apart of the DenyList, also Adaway isn't blocking any ads any more. Is there another step I need to do? I know I'm rooted because I can adb shell-> su-> props (MagiskHidePropsConf) to allow for wifi tethering.

Thanks,

 

[roirraW "edor" ehT]

Hey All,

So thanks to roirraW I was able to root my 7 pro after doing:

fastboot flash init_boot magisk_patched-xx.img

however I'm findings some app's think I'm rooted even though they are apart of the DenyList, also Adaway isn't blocking any ads any more. Is there another step I need to do? I know I'm rooted because I can adb shell-> su-> props (MagiskHidePropsConf) to allow for wifi tethering.

Thanks,

Hi, did you follow all the rest of the steps in the SafetyNet section of Post #2? Most specifically, the version of the Universal SafetyNet Fix to install.

I wouldn't be able to say about AdAway. Maybe they need to update it to work with the Pixel 7 Pro - I'm not currently using it.

 

[Lughnasadh]

I wouldn't be able to say about AdAway. Maybe they need to update it to work with the Pixel 7 Pro - I'm not currently using it.

Adaway is working fine for me

 

[collegencmc]

Hi, did you follow all the rest of the steps in the SafetyNet section of Post #2? Most specifically, the version of the Universal SafetyNet Fix to install.

I wouldn't be able to say about AdAway. Maybe they need to update it to work with the Pixel 7 Pro - I'm not currently using it.

So I'm using: safetynet-fix-v2.3.1-api33.zip found here: https://forum.xda-developers.com/t/...gain-all-relevant-links.4502805/post-87579103

I tired using safetynet-fix-v2.3.1-MOD_2.0.1.zip but it failed CTS. Let me try: safetynet-fix-v2.3.1-MOD_2.0.zip and I will report back. Thx for the help!!

Update: So now I'm on safetynet-fix-v2.3.1-MOD_2.0.zip but it still doesn't enforce DenyList on all apps but does pass all Safetynet test. Will keep an eye out for updates to it.

Let me know if any other ideas in mean time. Thanks again!!

 

[PurppleMonkey]

Correct, as long as you also remove the -w from the flash-all-.sh so that:

fastboot -w update image-cheetah-td1a.220804.031.zip

becomes

fastboot update image-cheetah-td1a.220804.031.zip

The -w wipes your phone.

Just for information, when you say the command wipes the phone, do you mean it erases everything?

I don't have it in the instructions, but if you use Official Google Android Flash Tool instead of flash-all, maybe you'll have better luck. It's generally considered the more user-friendly way. You'll still need the factory image zip, so that you can pull the init_boot.img out of the inner zip file - plus it's good to have all the files handy for if anything does go wrong.

If you use the Official Google Android Flash Tool you should have the following items not selected:

• Deselect Wipe
• Deselect Force Flash all partitions (which will also wipe)
• Deselect re-lock bootloader

For first-time rooting, it matters less if you let either tool wipe your phone. Feel free to wipe them if you wish to go through the first setup process - which will let you access the Google cloud restore steps, so you can restore the apps and a lot of the app data if you had your previous phone set to do Google cloud backups.


At Official Google Android Flash Tool. If you use it, just substitute it for almost half the steps in my How to update each month (and also how to root) section of Post #2. Edit: There are only two particular steps to skip when using the Android Flash Tool. I've now updated my instructions to indicate which steps to skip in that case.


Nothing I can think of. That's typically the safest part of the process (and actually gives you more options to recover from catastrophe in most circumstances).

Maybe I'll try with the official google tool after unlocking the bootloader!

You're welcome!

Can we buy you a coffee by making a donation somewhere?

Ignore what I said before about skipping steps 1 through 8. There are only two particular steps to skip when using the Android Flash Tool. I've now updated my instructions to indicate which steps to skip in that case.

Ok Thanks !

Did you get prompted to update to the latest SDK even though you were on latest SDK?
if so, please provide details in PF thread (support.zip would be best), this should not happen and I have not seen this happen with anyone.

Yes exactly, the command prompt asked me to download the latest version of platform-tools while I already have the latest version (33.0.3) on my MAC (with M1 chip).

PF checks your current Platform tools against the latest (currently set in the app to 33.0.3) and if it sees it to be older, it is only then that it warns you.
On the other hand you are saying "Maybe it's better to use pixel-flasher" are you suggesting that, because PF caught you using an older version, you prefer using PF, as it catches certain user oversights?

It was not PF that alerted me, but the command prompt following this tutorial when I first tried the "flash-all.sh" command

Thanks,

This comment threw me off

This is the message received from the command prompt, not PF

 

[PurppleMonkey]

I have to admit, I don't understand it exactly either, and I failed to ask where that message came from. Hopefully, @PurppleMonkey will clarify.

This message is from the command prompt. I put you the screenshot of the line of code responsible for this error message (Line of code extracted from "Flash-all.sh"

 

[Joeyxc]

There is a Google play system update available for the Pixel 7 pro finally. What precautions need to be taken to avoid losing root on reboot?

 

[JakeDHS07]

Those should never cause root to be lost from what I understand. They don't overwrite any of the rooted partitions.

 

[eg1122]

There is a Google play system update available for the Pixel 7 pro finally. What precautions need to be taken to avoid losing root on reboot?

The update keeps failing on my end. Let me know if it goes through for you.

 

[NepoRood]

That works for OTA, but if for any stupid reason the active slot somehow gets corrupted, then the system is unuseable (not necessarily unrecoverable).
As a modder, considering that we mock with the phone a lot, it's prudent that our first flash is to both slots.
After that, it's a good practice to flash to inactive slot, even when doing factory image based flashing to make sure we always have something recent to fallback on in case anything goes wrong.
All one has to do is change slots before doing the flash_all

Yeah, this is exactly what I was thinking and why when I found out I had no radio on my inactive slot I immediately flashed the factory image to that slot. There is no reason why a phone should ship with firmware on only one slot since obviously OTAs can be taken when a slot is full.

In this circumstance, however, I think it was just the radio that was missing as I believe there was a bootloader image reported on that inactive slot. Still very disconcerting, especially in your scenario where if something should happen to make the active slot unbootable.

Good points for sure, I was just spit balling, lol

 

[Namelesswonder]

Yeah, this is exactly what I was thinking and why when I found out I had no radio on my inactive slot I immediately flashed the factory image to that slot. There is no reason why a phone should ship with firmware on only one slot since obviously OTAs can be taken when a slot is full.

In this circumstance, however, I think it was just the radio that was missing as I believe there was a bootloader image reported on that inactive slot. Still very disconcerting, especially in your scenario where if something should happen to make the active slot unbootable.

Good points for sure, I was just spit balling, lol

I just tested recently and the bootloader version doesn't report properly for the other slot. I did a last ditch effort with downgrading to solve my eio mode woes (which it did solve, strange that flashing over with same version and resetting didn't) and in the process I noticed that even when the bootloader on the other slot was a different version it would still report the currently booted version. So it's entirely possible that there is nothing on the other slot.

Before I did my last ditch effort I ordered a 256GB with the intent to return my current phone, so I guess I can test the hypothesis when it comes in. Hope it doesn't brick it.

 

[pndwal]

Thanks for the explanation, definitely makes sense to me. I don't know what the slots should look like on a brand new, fresh out of the box device.... I'm guessing they're both loaded with the shipped firmware.

I don't know for certain if a new device comes with firmware on both slots, but I would think that it would. We pretty much get an OTA out of the box, what if it fails? That's my thinking anyway...

As you said, a new phone should come with full firmware on both slots... when I checked the radio version of my inactive and untouched slot using fastboot getvar version-baseband , it came back as unknown... or there really wasn't a radio, or something else, not sure.

Actually FWIW, 2nd slot ships w/o installed system, but /system is filled w/ odex files for system apps which are loaded to /data the first time user boots the device...

Basically A/B seamless updates actually halved the size of the system partition
https://source.android.com/docs/core/ota/ab/ab_faqs#how-did-ab-affect-the-2016-pixel-partition-sizes
and that's how Google were able to do this; by leaving odex files out of active /system slot (these were consuming about half the space) and simply moving them to /data when user first boots the phone, most of the space needed for dual slots is actually recovered...
https://source.android.com/docs/cor...size-of-the-system-partition-without-squashfs

The cited article goes on to explain why this 'doesn't really' impact on /data... bit complex... And why this doesn't mean slower reboot after an OTA but does impact reboot time after Factory data reset etc...

PW

 

[Lughnasadh]

Actually FWIW, 2nd slot ships w/o installed system, but /system is filled w/ odex files for system apps which are loaded to /data the first time user boots the device...

Basically A/B seamless updates actually halved the size of the system partition
https://source.android.com/docs/core/ota/ab/ab_faqs#how-did-ab-affect-the-2016-pixel-partition-sizes
and that's how Google were able to do this; by leaving odex files out of active /system slot (these were consuming about half the space) and simply moving them to /data when user first boots the phone, most of the space needed for dual slots is actually recovered...
https://source.android.com/docs/cor...size-of-the-system-partition-without-squashfs

The cited article goes on to explain why this 'doesn't really' impact on /data... bit complex... And why this doesn't mean slower reboot after an OTA but does impact reboot time after Factory data reset etc...

PW

Yes, for sure. This is one of the characteristics of the A/B seamless updates implemented a while back. But this doesn't explain why there is no radio being reported on the inactive slot. And if indeed there is no radio, what other critical partitions may be missing? It's inconceivable that they would ship a new phone without a radio on both slots.

Interestingly though, after flashing the factory image to the inactive slot it did indeed report the correct baseband version, as expected.

 

[roirraW "edor" ehT]

So I'm using: safetynet-fix-v2.3.1-api33.zip found here: https://forum.xda-developers.com/t/...gain-all-relevant-links.4502805/post-87579103

I tired using safetynet-fix-v2.3.1-MOD_2.0.1.zip but it failed CTS. Let me try: safetynet-fix-v2.3.1-MOD_2.0.zip and I will report back. Thx for the help!!

Update: So now I'm on safetynet-fix-v2.3.1-MOD_2.0.zip but it still doesn't enforce DenyList on all apps but does pass all Safetynet test. Will keep an eye out for updates to it.

Let me know if any other ideas in mean time. Thanks again!!

The "safetynet-fix-v2.3.1-MOD_2.0.zip" available from Displax' XDA post and website are the most recent official releases, so I curious where you found "safetynet-fix-v2.3.1-MOD_2.0.1.zip".

You had manually added the apps necessary to Magisk's DenyList, as per my SafetyNet instructions in Post #2?

Just for information, when you say the command wipes the phone, do you mean it erases everything?

Yes, the "-w" in fastboot -w update image-cheetah-td1a.220804.031.zip erases everything, just like a factory reset, which is why, normally when you update the phone with each month's latest firmware, you would normally remove the "-w".

Maybe I'll try with the official google tool after unlocking the bootloader!

Can we buy you a coffee by making a donation somewhere?

No, but I appreciate the thought very much. I used to take donations years ago. I just like helping people the way I was helped when I first came to XDA. Thank you!

Yes exactly, the command prompt asked me to download the latest version of platform-tools while I already have the latest version (33.0.3) on my MAC (with M1 chip).

It was not PF that alerted me, but the command prompt following this tutorial when I first tried the "flash-all.sh" command

This is the message received from the command prompt, not PF

Ah! I should've loaded the flash-all.sh file and taken a look. I assumed it was nearly identical to the Windows flash-all.bat, but the .sh is different than the .bat. If I knew I was using the latest and it kept throwing that error, I would be tempted to take out those lines of the .sh, leaving you with:

#!/bin/sh

# Copyright 2012 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

fastboot flash bootloader bootloader-cheetah-cloudripper-1.0-9070028.img
fastboot reboot-bootloader
sleep 5
fastboot flash radio radio-cheetah-g5300g-220908-220908-b-9040061.img
fastboot reboot-bootloader
sleep 5
fastboot -w update image-cheetah-td1a.220804.031.zip

This message is from the command prompt. I put you the screenshot of the line of code responsible for this error message (Line of code extracted from "Flash-all.sh"

View attachment 5737713

Thanks for the information and the screenshot.

 

[PurppleMonkey]

Yes, the "-w" in fastboot -w update image-cheetah-td1a.220804.031.zip erases everything, just like a factory reset, which is why, normally when you update the phone with each month's latest firmware, you would normally remove the "-w".

TY.

Ah! I should've loaded the flash-all.sh file and taken a look. I assumed it was nearly identical to the Windows flash-all.bat, but the .sh is different than the .bat. If I knew I was using the latest and it kept throwing that error, I would be tempted to take out those lines of the .sh, leaving you with:

#!/bin/sh

# Copyright 2012 The Android Open Source Project
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

fastboot flash bootloader bootloader-cheetah-cloudripper-1.0-9070028.img
fastboot reboot-bootloader
sleep 5
fastboot flash radio radio-cheetah-g5300g-220908-220908-b-9040061.img
fastboot reboot-bootloader
sleep 5
fastboot -w update image-cheetah-td1a.220804.031.zip

Yes, that's what I did. But what I don't understand is why it displayed this error when I ran the command prompt in the "Platform-tools" folder downloaded from the official site in version 33.0.3... Interesting!


Well.. I just splurged, ordered a new one directly from google. He arrives tomorrow. I will follow your tutorial using PF after unlocking the Bootloader.

I have 2,5 questions:
1) on the command prompt, there is a way to know which version of platform-tools is used, on PF we can know it in advance?

2) When I run the command Flash-all.sh, normally I would go through all these steps (on MAC):

./fastboot flash bootloader bootloader-cheetah-cloudripper-1.0-9070028.img
./fastboot reboot-bootloader
sleeping 5
./fastboot radio flash radio-cheetah-g5300g-220908-220908-b-9040061.img
./fastboot reboot-bootloader
sleeping 5
./fastboot update image-cheetah-td1a.220804.031.zip

But, if in my case, like the first time, the process stops here:

./fastboot flash bootloader bootloader-cheetah-cloudripper-1.0-9070028.img
./fastboot reboot-bootloader

--What should I do ?
--Why wouldn't "Sleep 5" work for me?




EDIT : Instead of "cheetah" Mine, should be "Panther"

 

[whatsisnametake2]

Hey All,

So thanks to roirraW I was able to root my 7 pro after doing:

fastboot flash init_boot magisk_patched-xx.img

however I'm findings some app's think I'm rooted even though they are apart of the DenyList, also Adaway isn't blocking any ads any more. Is there another step I need to do? I know I'm rooted because I can adb shell-> su-> props (MagiskHidePropsConf) to allow for wifi tethering.

Thanks,

you have selected systemless hosts in magisk?

 

[roirraW "edor" ehT]

TY.

You're welcome!

Yes, that's what I did. But what I don't understand is why it displayed this error when I ran the command prompt in the "Platform-tools" folder downloaded from the official site in version 33.0.3... Interesting!

Indeed, no idea. I would emulate a mac and see what happens for me but it's not an easy task since I use Hyper-V a ton on my personal computer on a regular basis.

Well.. I just splurged, ordered a new one directly from google. He arrives tomorrow. I will follow your tutorial using PF after unlocking the Bootloader.

To be clear, my tutorial doesn't involve PixelFlasher at all. I've never used it. I use the manual method every month, and once or at the most twice used the Official Google Android Flash Tool instead when I had a weird issue, and I adjusted my instructions to indicate which two steps to skip if you're using this Android Flash Tool instead of the factory image (although you still need the factory image for the init_boot.img file).

I have 2,5 questions:
1) on the command prompt, there is a way to know which version of platform-tools is used, on PF we can know it in advance?

The only way I know is to send the command:

adb /?

I don't know if it would be different at all on a Mac.

Spoiler: This results in, with the latest ADB:

S:\platform-tools>adb /?
Android Debug Bridge version 1.0.41
Version 33.0.3-8952118
Installed as S:\platform-tools\adb.exe

global options:
-a listen on all network interfaces, not just localhost
-d use USB device (error if multiple devices connected)
-e use TCP/IP device (error if multiple TCP/IP devices available)
-s SERIAL use device with given serial (overrides $ANDROID_SERIAL)
-t ID use device with given transport id
-H name of adb server host [default=localhost]
-P port of adb server [default=5037]
-L SOCKET listen on given socket for adb server [default=tcp:localhost:5037]
--one-device SERIAL|USB only allowed with 'start-server' or 'server nodaemon', server will only connect to one USB device, specified by a serial number or USB device address.
--exit-on-write-error exit if stdout is closed

general commands:

<snipped a long list of commands in different categories>

So it does at least say 33.0.3. There doesn't seem to be a similar way for Fastboot, or at least not as easy. Anyone, please fill me in if there is a way - I don't have time to look into it right now.

For what it's worth, every month I rename my old platform-tools folder (the one I used to update to the previous month's firmware), and I freshly extract the latest platform-tools to a new folder, so everything's nice and clean - plus I keep the old firmware and files handy in case I need to flash back in a hurry.

2) When I run the command Flash-all.sh, normally I would go through all these steps (on MAC):

./fastboot flash bootloader bootloader-cheetah-cloudripper-1.0-9070028.img
./fastboot reboot-bootloader
sleeping 5
./fastboot radio flash radio-cheetah-g5300g-220908-220908-b-9040061.img
./fastboot reboot-bootloader
sleeping 5
./fastboot update image-cheetah-td1a.220804.031.zip

But, if in my case, like the first time, the process stops here:

./fastboot flash bootloader bootloader-cheetah-cloudripper-1.0-9070028.img
./fastboot reboot-bootloader

--What should I do ?
--Why wouldn't "Sleep 5" work for me?

I don't know enough about Macs to be able to help with that directly, but you can just copy and paste the individual commands at the right time yourself. Let yourself be the "sleeper".

EDIT : Instead of "cheetah" Mine, should be "Panther"

You're using the correct factory image, then? The Panther one? You're scaring me by showing a copy and paste from the Cheetah flash-all.sh.

you have selected systemless hosts in magisk?

Ah! I forgot to put that step in my instructions! Thank you.

Edit: Added now. DOH me!

 

[PurppleMonkey]

I don't know enough about Macs to be able to help with that directly, but you can just copy and paste the individual commands at the right time yourself. Let yourself be the "sleeper".

Hahahahah, You're right ! In this case, no need to specify a slot (a or b) or desable Verity and verification through prompt command ?

You're using the correct factory image, then? The Panther one? You're scaring me by showing a copy and paste from the Cheetah flash-all.sh.

hahahaha yes, i just copied your text with cheetah inside ! Mine is Panther on my computer, no need to use your gun !

 

[pndwal]

Yes, for sure. This is one of the characteristics of the A/B seamless updates implemented a while back. But this doesn't explain why there is no radio being reported on the inactive slot. And if indeed there is no radio, what other critical partitions may be missing? It's inconceivable that they would ship a new phone without a radio on both slots.

Why load anything in B slots if you're not going to ship with a working B system??... What's the point of unused baseband?...

As soon as you take an OTA, all necessary partitions are populated... With A/B Streaming update support the whole thing will necessarily be overwritten anyway; the update engine doesn't consider any data on B...

The delta differential payload algorithm simply uses blocks from active (A in this case) partition plus the delta payload (basically combines zero-filled block address info, unchanged block address info, binary blobs for new files and binary diff blobs for changed files) to produce the update by writing blocks directly to the B partition as they are read/downloaded...

What's on the inactive slot prior to an OS being installed there makes no difference.

Interestingly though, after flashing the factory image to the inactive slot it did indeed report the correct baseband version, as expected.

Wouldn't expect anything else!...

PW

 

[roirraW "edor" ehT]

Hahahahah, You're right ! In this case, no need to specify a slot (a or b)

The correct commands in post #2 are literal - there's no need to specify a slot, in which case, the currently active slot is the one that's flashed. If you opted to do anything at all with slots, as several users said recently in this thread, each month you flash a new factory image, you could change slots beforehand, but it's completely optional. I only list the steps you absolutely must take in my instructions.

The optional commands to switch slots are:

adb reboot bootloader
(wait for phone to boot into the bootloader / fastboot mode)

fastboot set_active other
fastboot reboot bootloader

then proceed with the commands from the flash-all.sh/flash-all.bat

or desable Verity and verification through prompt command ?

The only part of my instructions that references that is the Optional next steps when updating - flashing custom kernels portion. Right now, if you plan on flashing a custom kernel - which is optional - you must disable those things and disabling Verification requires that you factory reset the device after, otherwise you'll get a screen that says the device is corrupted. All that's required to fix that is to factory reset, which again, will wipe everything.

The developers are working on getting the kernel flashing on the Pixel 7 Pro to a point where you at least don't need to disable Verification (disabling just Verity doesn't require a factory reset). This happened on the Pixel 6 Pro, too, and took a month or two before they developed a way for custom kernels to be able to be used without disabling either of those.

My advice is to wait, but it's completely up to you.

Note that if you disable them now, then every time you update the firmware (effectively, any time you run commands that end up flashing vbmeta.img, which the flash-all scripts do), you must re-disable them because the default action when flashing vbmeta.img is to enable them. If you forget to re-disable them, then if you disable them again later, you'll have to factory reset the device yet again.

Edit: You can also reference what I said about this subject recently here.

hahahaha yes, i just copied your text with cheetah inside ! Mine is Panther on my computer, no need to use your gun !

I figured, but I just wanted to make sure. LOL!