[OOS 5.1.5 | 5.1.6 | 5.1.7 | 5.1.8 | SafetyNet OK] Root without TWRP

[b1czu]

Your warranty is now void.
I am not responsible for bricked devices, dead SD cards, thermonuclear war, or you getting fired because the alarm app failed. Please do some research if you have any concerns about this procedure before doing it! YOU are choosing to make these modifications.

OP6 rooting without TWRP
Checklist before preceed:

• Working Fastboot
• Be on software OOS 5.1.5 | 5.1.6 | 5.1.7 | 5.1.8
• Unlocked bootloader (Instruction here, but remember to enable OEM Unlocking first)
  

  Enable OEM Unlocking
  On your phone go to Settings > Developer options. Then enable the 'OEM Unlocking' option. Also make sure that from now on, OEM unlocking option is enabled before you reboot as sometimes, it might get disabled itself.

WARNING:
Please double check that you have unlocked bootloader!
A few users has reported that instaling magisk with locked bootloader or wiping phone (using stock recovery) with patched boot.img can soft brick your phone! Please avoid doing this for now. If you've already done this and you are stuck with only fastboot working please follow this post https://forum.xda-developers.com/showpost.php?p=76608874&postcount=31 to restore your device to working state. Thank's to @SaiBork for more detailed instructions available here https://forum.xda-developers.com/showpost.php?p=76632484&postcount=82

Rooting process:

1. Make sure that you have UNLOCKED BOOTLOADER. DO NOT attempt to patch boot.img using Magisk Manager without unlocked bootloader because it WILL CAUSE SOFT BRICK!!!
2. Boot device using patched boot.img.
   For OOS 5.1.5 it can be downloaded [here]
   For OOS 5.1.6 it can be downloaded [here]
   For OOS 5.1.7 it can be downloaded [here]
   For OOS 5.1.8 it can be downloaded [here]
   It can be also patched manually (see bottom of this post).
   To do this you need working fastboot. Fire up your cmd/terminal and cd to directory where you've downloaded/placed patched boot image. When you are in correct directory just type in cmd/terminal:

   fastboot boot patched_boot_magisk1642_518.img

   (check if img filename in command is exactly same as name of downloaded boot img) The phone should boot to Android.
3. Once the phone has booted install Magisk Manager app and open it. It can be downloaded here or here.
4. Magisk Manager App should show that your phone is rooted - but at this stage it's just temporary, until next reboot (nothing flashed yet).
5. Go to settings and Tap on "Update channel" and change it to Beta.
6. Go back to Magisk main screen and make sure that "Preserve force encryption" and "Preserve AVB 2.0/dm-verity" are checked!
7. Tap on "Install" and select "Direct Install (Recommended)".
8. Wait until boot.img is patched and flashed and reboot your device when prompted to do so.

After boot there aren't any error messages shown before (or after) entering PIN code, unlike when rooting using other methods.
To check SafetyNet status just open Magisk Manager once again and tap on "Tap to start SafetyNet check". It should be all green.

wOOt wOOt you just got rOOt!

Video showing rooting process:
XDA user @GizmoFreak has made a video showing the whole procedure for 5.1.5! Thank you very much.

How to do an OTA update preserving root

1. Install OTA. It will be installed on the inactive slot. Do not restart your OP6 when installation finishes.
2. Start Magisk Manager app.
3. Tap on Install.
4. Tap on Install to Second Slot (After OTA).
5. Reboot your device.
6. Check if you got root and if safety net checks are passed.

How to extract from OTA and manually patch stock OOS boot.img using Magisk Manager:

1. Install python3 and PIP manager on your system .
2. Use pip to install "protobuf" module:

   pip3 install protobuf

3. Download payload_dumper.py and update_metadata_pb2.py from this gist https://gist.github.com/ius/42bd02a5df2226633a342ab7a9c60f15 and save them in one directory.
4. Download full update zip with OOS (containing payload.bin). It can be downloaded from this great thread by @Titokhan
5. Extract payload.bin from update zip to same directory where payload_dumper.py is located.
6. Use payload_dumper.py to extract original boot.img

   python payload_dumper.py payload.bin

   After a while you should have all img's included in payload.bin dumped in your working directory.
7. Install Magisk Manager app on your OP6.
8. Place that dumped boot.img on your phone storage.
9. In Magisk Manager app tap install, and select "Patching boot image file". Select boot.img that you've just uploaded to your phone.
10. Magisk Manager will patch boot.img and save it on Phone's internal storage in "MagiskManager" directory (file called "patched_boot.img").
11. Download this patched file to your computer and just use it to boot using fastboot

 

[liver20]

stock recovery img please

 

[NeoNecOP6]

Hi and thx for the Thread. Maybe more Details in your Guide would be nice and you dont lose you Void by OnePlus if you Root you Device only if u break the hardware with you root access (Like changing the CPU rate in the Kernel).

 

[jacdelad]

Hi and thx for the Thread. Maybe more Details in your Guide would be nice and you dont lose you Void by OnePlus if you Root you Device only if u break the hardware with you root access (Like changing the CPU rate in the Kernel).

How do they know if you manipulate the CPU frequency?

 

[Kaeltis]

Thanks, I'd like to try patching the boot.img myself - how did you extract it from the device without root?
I also couldn't figure out how to extract it from the update files OP provided (since they are all A/B updates only containing a payload.bin)

 

[Displax]

stock recovery img please

There is no separate recovery partition. Recovery in boot.img, as all A/B devices.

 

[b1czu]

and you dont lose you Void by OnePlus if you Root you Device only if u break the hardware with you root access (Like changing the CPU rate in the Kernel).

I know but it's just a disclaimer

Thanks, I'd like to try patching the boot.img myself - how did you extract it from the device without root?
I also couldn't figure out how to extract it from the update files OP provided (since they are all A/B updates only containing a payload.bin)

You can extract it from A/B update using python tool called payload_dumper.py Check this post for more information https://forum.xda-developers.com/showpost.php?p=76598704&postcount=80

 

[NeoNecOP6]

How do they know if you manipulate the CPU frequency?

if that's why your smartphone broke down. Any company can find out if the device has been rooted.

 

[DocRambone]

http://tinypic.com/view.php?pic=2dquejq&s=9
Rooted
Thanks op

 

[xByt3z]

This worked perfectly for me. No vendor image issues either. No flashing (that's cool!). Thanks! I saw you posted how you did it but it'd be cool if you could add it to this thread so people can learn.

Thanks!

 

[mcdavid]

Your warranty is now void.
I am not responsible for bricked devices, dead SD cards, thermonuclear war, or you getting fired because the alarm app failed. Please do some research if you have any concerns about this procedure before doing it! YOU are choosing to make these modifications.

For all interested in rooting I suggest to do it this way:

Checklist before preceed:
- Working Fastboot
- Unlocked bootloader
- Be on software OSS 5.1.5!!

1. Boot patched boot.img that can be downloaded here [https://drive.google.com/open?id=1BIH5sGfMADfhWIAfQDsiw4f-UI_1WvqX]
To do this you need working fastboot and cd to directory where you've downloaded patched boot image. When you are in correct directory just type in cmd/terminal:

fastboot boot patched_boot_magisk1642.img

The phone should boot to Android.
2. Once phone is booted up install Magisk Manager and open it.
3. It should show that you have root - but at this stage it's just temporary, until next reboot (nothing flashed yet).
4. Go to settings and Tap on "Update channel" and change it to Beta.
5. Go back to Magisk main screen and make sure that "Preserve force encrypotion" and "Preserve AVB 2.0/dm-verity" are checked!
6. Tap on "Install" and select "Direct Install (Recommended)"
6. Reboot

After boot there are no any Error messages before entering PIN code.
Just open magisk manager once again and tap on "Tap to start SafetyNet check". It should be all green.

wOOt wOOt you just got rOOt!

Thanks for this. Probably a dumb question. But, does this need to be undone when TWRP comes out? Is there a way to revert back?

Thanks again.

 

[b1czu]

But, does this need to be undone when TWRP comes out?

No, you don't need to undone this. Flashing magisk root using TWRP recovery would lead to same end-effect.

Is there a way to revert back?

Yes. You can flash back stock OOS 5.1.5's boot.img, because nothing other was modified. Link to download STOCK boot.img for OOS 5.1.5 https://drive.google.com/open?id=1RPQZj6HQxNNdJiMrAjtkxncH3PLBTZp_
To revert you need fastboot tool:

fastboot flash boot boot.img

And that's it. You're again rootles on stock 5.1.5's boot.img.

 

[stefal639]

thanks man!!!
Op6 rooted and ready for me!

 

[_MartyMan_]

OnePlus 3: TWRP, Root & Cyanogenmod before most users got the device,
OnePlus 5: Unofficial TWRP,
And OnePlus 6: Root without any custom recovery....

Thank you!

 

[CautiousBites]

Wow thank you for this, can't live without root and I get my OP6 tomorrow so this is great

 

[dynamic_4444]

i installed patched boot file for oss5.1.3 using boot file for oss5.1.3. my question is when i update oss to latest for now i.e oss5.1.5 will i need to re root it? or it will stay rooted? and i won't get stuck at installing the update too right? considering its gonna be full updates now(no partial updates).

 

[Teren49]

i installed patched boot file for oss5.1.3 using boot file for oss5.1.3. my question is when i update oss to latest for now i.e oss5.1.5 will i need to re root it? or it will stay rooted? and i won't get stuck at installing the update too right? considering its gonna be full updates now(no partial updates).

When you update, boot.img will be overwritten with 5.1.5's one and you'll have to repeat the process again.
@b1czu, thank you very much! Rooted flawlessly .

 

[Vodderz]

Worked like a charm! I'm grateful for my fellow impatient people. Time to unlock the Oneplus 6's true potential!

 

[brmbjn]

I try it to night

 

[Marcell96]

Thanks man, so far it works great!