Development [ROM][13][UNOFFICIAL][Raven/Oriole] Magisk Patched GrapheneOS + Lockable Bootloader

FireRattus · Dec 3, 2022

Magisk Patched Unofficial GrapheneOS for the Pixel 6 / 6 Pro (oriole/raven)

This ROM will allow you to lock the boot loader. Do not ever disable the OEM unlocking checkbox when using a locked bootloader with root.
This is critically important. With root access, it is possible to corrupt the running system, for example by zeroing out the boot partition.
In this scenario, if the checkbox is turned off, both the OS and recovery mode will be made unbootable and fastboot flashing unlock will not be allowed.
This effectively renders the device hard bricked.

I am not responsible for any harm you may do to your device, follow at your own risk etc etc, Rooting your device can potentially introduce security flaws, I am not claiming this to be secure. If you would like to have more security and peace of mind then I highly recommend you follow This Guide to build this rom using your own encryption keys.

GrapheneOS is a privacy and security focused mobile OS with Android app compatibility developed as a non-profit open source project. It's focused on the research and development of privacy and security technology including substantial improvements to sandboxing, exploit mitigations and the permission model. It was founded in 2014 and was formerly known as CopperheadOS.

The features page provides an overview of the substantial privacy and security improvements added by GrapheneOS to the Android Open Source Project (AOSP). Many of the past features were contributed to AOSP, Linux and other projects to improve privacy and security for billions of users so they're no longer listed on the features page.

More info:

Installation Instructions: Fashing-factory-image
Locking the bootloader is Optional but does increase the device security Locking-the-bootloader

Update Instructions: simply follow these instructions Updates-sideloading to sideload the latest patched OTA update package (You can update from any previous version if using full ota update)

Android OS Version: 13
Current Version: See Post #2
Download: See Post #2

Sources: GrapheneOS - AVBRoot - Magisk - Patch Guide

PayPal Donation Link

FireRattus · Dec 3, 2022

Builds for Pixel 6 (Oriole)

Builds for Pixel 6 Pro (Raven)

Always do a backup of your data before flashing any updates, just in case.

I make no promises that this works or that I will provide regular updates. I will attempt to provide updates when they are available and I have time, you may have issues with this rom, you could lose your data or brick your device (although it's very unlikely if you follow the instructions and use common sense)

FireRattus · Dec 3, 2022

#reserved

spida_singh · Dec 5, 2022

Thanks for this!

FireRattus · Dec 5, 2022

New Release #2022120300
Changes since the 2022113000 release:

kernel (Pixel 4, Pixel 4 XL, Pixel 4a): add back our change enabling ARM64_SSBD now that upstream issues with it are resolved for this branch

Sandboxed Google Play compatibility layer: avoid chain crash of GmsCompat app following process death from OOM killer, etc.

Vanadium: update Chromium base to 108.0.5359.79

kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.76

kernel (Pixel 6, Pixel 6 Pro, Pixel 7, Pixel 7 Pro, Generic 5.10, Generic 5.15): update to latest GKI LTS branch revision

kernel (Pixel 6, Pixel 6 Pro, Pixel 7, Pixel 7 Pro): update Mali GPU driver to r37p0 (current release is r41p0 but there are substantial changes to the driver for the Tensor SoC on Pixels and it will take substantial work to upgrade all the way)

remove broken, obsolete upstream code causing install permissions defined by user install apps not being automatically granted for user installed apps installed before the app defining the permissions unless the app is reinstalled

Messaging: update MMS configuration database based on Google Messages 20221115_01_RC01

Dialer: update visual voicemail (VVM) configuration database based on Google Phone 90.0.477356402

Dialer: adjust VVM configuration database entries for compatibility with AOSP

Download in Post #2

nutzfreelance · Dec 8, 2022

does the full system install include the android 13 boot loader? if someone was still on A12 should they do a full oem update first?

FireRattus · Dec 8, 2022

nutzfreelance said:
does the full system install include the android 13 boot loader? if someone was still on A12 should they do a full oem update first?

I think you should upgrade to stock android 13 first just to be safe

Ictcreations · Dec 9, 2022

brilliant thanks!! can i ask a reallly random stupid question please. if i have a stock pixel 6 rom, can i just run the ota update to keep present apps/data in place and to upgrade it to graphene or would that break my phone if not already running graphene?

FireRattus · Dec 9, 2022

Ictcreations said:
brilliant thanks!! can i ask a reallly random stupid question please. if i have a stock pixel 6 rom, can i just run the ota update to keep present apps/data in place and to upgrade it to graphene or would that break my phone if not already running graphene?

You must install Graphene OS first, and if you want to lock the bootloader then you will need to erase your data anyway

People from GrapheneOS will permanently suspend your account on their forums for simply telling people that it is in fact possible to ROOT Graphene and Lock the Bootloder
They like to LIE to people and tell them it's impossible, while preventing anyone from contradicting them

Sbodezzi · Dec 9, 2022

I flashed the oriole image flawlessy, everythings seems to be fine except for the magisk manager that keeps crashing. I need to do something in order to make it works?

Edit: my bad, i was installing a super old version of magisk

Sorry.
Thank you so much for you hard work

timuh · Dec 10, 2022

i cant find any information if its possbile to use google pay and android auto again with a rooted grapheneos and working magisk modul.
i like graphene and the features but it sucks to use an iphone for my car and cant use my galaxy watch for paying something :/

any1 got an idea or is the only possibility to flash stock google for both apps

FireRattus · Dec 10, 2022

timuh said:
i cant find any information if its possbile to use google pay and android auto again with a rooted grapheneos and working magisk modul.
i like graphene and the features but it sucks to use an iphone for my car and cant use my galaxy watch for paying something :/

any1 got an idea or is the only possibility to flash stock google for both apps

You cannot use google pay with official Graphene, I mean it works with loyalty cards but not NFC payment cards
So you should not expect it to work with a magisk patched Graphene, maybe you can find some magisk module and a configuration to get safety net passing and google pay working. But I am not aware of anything that works with Graphene

boom15 · Dec 10, 2022

Why so much headache as go trough build for such simple task as resign especially for Graphene? Just get ota, follow instruction in readme.txt avbroot and that it.
I understand if you do any changes to source (patches, unneeded apps, own apps, implement of root). But just for locked bootloader? Bootloader locked or not doing it job.
If you loose and somebody stole your device how locked bootloader helps? Get your data from recovery (it stock, not custom) over adb shell if you use pass not possible. Find device or location not on graphene build. You can't pass Safetycheck or use phone for contactless payments (NFC)
So all that wind just not allow to thief reflash and use device?

FireRattus · Dec 10, 2022

boom15 said:
Why so much headache as go trough build for such simple task as resign especially for Graphene? Just get ota, follow instruction in readme.txt avbroot and that it.
I understand if you do any changes to source (patches, unneeded apps, own apps, implement of root). But just for locked bootloader? Bootloader locked or not doing it job.
If you loose and somebody stole your device how locked bootloader helps? Get your data from recovery (it stock, not custom) over adb shell if you use pass not possible. Find device or location not on graphene build. You can't pass Safetycheck or use phone for contactless payments (NFC)
So all that wind just not allow to thief reflash and use device?

If you think it's too much headache, that's fine, it's not for you.
I prefer to build it from source myself using my own keys for the whole process, it may be possible as you say just to patch the provided ota with avbroot, but I haven't tested this and don't have any plans to

I don't want to argue about the potential security benefits or downsides, If you don't believe it's secure and you don't feel safe using it then just don't use it. I like my data being secure and not easily accessible, regular backups are important

You can't pass safetynet or use google pay for contactless payments on official graphene, so please take it up with them to fix that as rooting it isn't going to make you more likely to pass safetynet

The thief can always just reflash and use the device unless you disable OEM unlocking in the developer settings
But you should not do this, because if something happened and your phone started to boot loop or something then there would be no way to fix it and you will brick your device, but at least your data will be safe if you had the bootloader locked

boom15 · Dec 11, 2022

FireRattus said:
If you think it's too much headache, that's fine, it's not for you.
I prefer to build it from source myself using my own keys for the whole process, it may be possible as you say just to patch the provided ota with avbroot, but I haven't tested this and don't have any plans to

I don't want to argue about the potential security benefits or downsides, If you don't believe it's secure and you don't feel safe using it then just don't use it. I like my data being secure and not easily accessible, regular backups are important

You can't pass safetynet or use google pay for contactless payments on official graphene, so please take it up with them to fix that as rooting it isn't going to make you more likely to pass safetynet

The thief can always just reflash and use the device unless you disable OEM unlocking in the developer settings
But you should not do this, because if something happened and your phone started to boot loop or something then there would be no way to fix it and you will brick your device, but at least your data will be safe if you had the bootloader locked

Read one more time my comment

I'm not said that I will or plan to use your guide to build. I said that it to much work for average person.
I saw your post where you clearly state that you wanna locked bootloader. I pointed to easiest way to do that. Don't like it? Do what you like.
For patching ota by using avbroot. I did it and tested on my own pixels(6a,2 -6, not pro) and not pushing you to do that. As all here I wanna show people another option.
I don't need rom signed you or any one else. It personal rom and I do not have time and willing to inspect it. For me enough that I trust graphene team! I already build rom for my self with implemented of root, patching some graphene code, remove some apks and replaced it with mine and settings that I need. Of cause I sign but that rom it for me and my family not for public. So no any need in secondhand roms.
I did't tell that you responcible for NFC, Saftynet pass just wanna point out that locking bootloader not helps with these issue.Not expect you fix that. You said that you didn't touch code. It's Graphene and it on their side. I used Graphene long enough to know advantages and disadvantages.
And I as you don't intend to start security discussion here or with someone else. Don't worry and have a good day!

FireRattus · Dec 11, 2022

boom15 said:
Read one more time my comment

I'm not said that I will or plan to use your guide to build. I said that it to much work for average person.

I saw your post where you clearly state that you wanna locked bootloader. I pointed to easiest way to do that. Don't like it? Do what you like.

For patching ota by using avbroot. I did it and tested on my own pixels(6a,2 -6, not pro) and not pushing you to do that. As all here I wanna show people another option.

I don't need rom signed you or any one else. It personal rom and I do not have time and willing to inspect it. For me enough that I trust graphene team! I already build rom for my self with implemented of root, patching some graphene code, remove some apks and replaced it with mine and settings that I need. Of cause I sign but that rom it for me and my family not for public. So no any need in secondhand roms.

I did't tell that you responcible for NFC, Saftynet pass just wanna point out that locking bootloader not helps with these issue.Not expect you fix that. You said that you didn't touch code. It's Graphene and it on their side. I used Graphene long enough to know advantages and disadvantages.

And I as you don't intend to start security discussion here or with someone else. Don't worry and have a good day!

1.I already know this, I thought this would be obvious. I think using Graphene OS at all is too much for the average person, the average person will just use their phone as it comes and never put a custom rom onto it. This was never intended for the average person.

2. I appreciate that there is an easier way to do it, But I already said I was going to do what I like instead.

3. I appreciate that you have tested this works, I will likely update the guide I have created with this information for people who don't want to build it from source but would also prefer to patch official builds with magisk themselves

4. I do highly recommend everyone does build it themself, I think you should not rely on and trust graphene to always provide updates that have not been modified in some malicious way, it's always possible they could get hacked and an update build could be silently replaced with a malicious version

5. Locking the bootloader has nothing to do with safetynet for me, It's more about the other protections that locking the bootloader enables, like making it much harder for someone to be able to access my data or use the phone without erasing the data
Thankfully there is several banking apps which work and even let you use NFC for payments, while you do not pass safetynet

6. I appreciate it, thank you. I hope you have a good day also.

Klavaro · Dec 11, 2022

FireRattus said:
1.I already know this, I thought this would be obvious. I think using Graphene OS at all is too much for the average person, the average person will just use their phone as it comes and never put a custom rom onto it. This was never intended for the average person.

2. I appreciate that there is an easier way to do it, But I already said I was going to do what I like instead.

3. I appreciate that you have tested this works, I will likely update the guide I have created with this information for people who don't want to build it from source but would also prefer to patch official builds with magisk themselves

4. I do highly recommend everyone does build it themself, I think you should not rely on and trust graphene to always provide updates that have not been modified in some malicious way, it's always possible they could get hacked and an update build could be silently replaced with a malicious version

5. Locking the bootloader has nothing to do with safetynet for me, It's more about the other protections that locking the bootloader enables, like making it much harder for someone to be able to access my data or use the phone without erasing the data
Thankfully there is several banking apps which work and even let you use NFC for payments, while you do not pass safetynet

6. I appreciate it, thank you. I hope you have a good day also.

I spent half of my week following your guide because with my old ass I7-3770K running Debian within VMware takes days since I didn't know there was another way.

The main building part (m target-files-package took 6,5 hours to complete) Reading what boom15 said I'd be very happy if I never had to go down this route ever again.

Thank both of you gentlemen for spreading information about this, I wound't be able to figure it out by myself.

I guess I only have to download the OTA from grapheneos.org/releases and follow avbroot's readme, right? (I feel like a retard right now for wasting that much time setting up my VM, it running out of disk space, reinstalling it, etc..

)

FireRattus · Dec 11, 2022

Klavaro said:
I spent half of my week following your guide because with my old ass I7-3770K running Debian within VMware takes days since I didn't know there was another way. The main building part (m target-files-package took 6,5 hours to complete) Reading what boom15 said I'd be very happy if I never had to go down this route ever again.

Thank both of you gentlemen for spreading information about this, I wound't be able to figure it out by myself.

I guess I only have to download the OTA from grapheneos.org/releases and follow avbroot's readme, right? (I feel like a retard right now for wasting that much time setting up my VM, it running out of disk space, reinstalling it, etc.. )

I do completely understand and sympathize, I have already updated the guide with this simple method of patching graphene for those who are unable to or don't want to build it from source themselves
I think you have gained some valuable experience and knowledge though which will likely help you in the future with other endeavors.
At least you didn't spend a good couple of weeks trying to patch graphene with magisk manually before I even discovered AVBRoot was a thing, so glad that exists

Klavaro · Dec 12, 2022

FireRattus said:
I do completely understand and sympathize, I have already updated the guide with this simple method of patching graphene for those who are unable to or don't want to build it from source themselves
I think you have gained some valuable experience and knowledge though which will likely help you in the future with other endeavors.
At least you didn't spend a good couple of weeks trying to patch graphene with magisk manually before I even discovered AVBRoot was a thing, so glad that exists

I understand your side too, my end goal would be using only self built opensource software on every device I have, but you gotta start somewhere, right? Maybe once I'll have nothing better to spend money on I'll build myself a newer pc and dual boot linux so it doesn't take ages to build graphene.

I'm all about doing new things, getting experience and knowledge, so I'm not even mad, but just feel relieved that I'll be able to update it easily. Atleast now I'm getting familiar with Debian, which will come in handy when I'll get myself to continue setting up my VPS, so I can selfhost everything I need..

Well I didn't try that, mainly because I'm curious if I'll be able to use my banking app if I root my phone and lock the bootloader, since that sucker won't even let me use contactless payment with a stock os combined with an unlocked bootloader.

FireRattus · Dec 14, 2022

New Release #2022121100
Missed a couple of update releases due to build errors then other errors I have finally resolved so

Changes since the 2022120300 release:

resolve upstream bug in Android 13 QPR1 causing screen brightness dimming on user profile changes

Settings: replace hard-wired refresh rate in the text for the smooth display toggle with the actual max refresh rate used for the device model (Android has the string hard-wired to say 90Hz and expects the device to provide an overlay with the correct string which isn't present in AOSP for Pixels)

kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.156

kernel (Generic 5.15): update to latest GKI LTS branch revision including update to 5.15.77

Sandboxed Google Play compatibility layer: new infrastructure for controlling Play Store updates of Play Store and Play services with a max version of Play services and the Play Store set via GmsCompatCompat and an override toggle for allowing it to update to any version

Sandboxed Google Play compatibility layer: hide GrapheneOS Auditor variant (app.attestation.auditor) from the Play Store so it doesn't try to update it (note: we plan to fully switch to app.grapheneos.auditor.play for the Play Store and we can remove this workaround once we unpublish the GrapheneOS variant of the app there and stop updating it)

Pixel 7, Pixel 7 Pro: remove unused Google Camera SELinux policy

Auditor: update to version 67

Camera: update to version 58

2022120700

Launcher: fix Recent Apps activity crashing when using the TalkBack screen reader due to an incorrect port of the Storage Scopes shortcut to Android 13 QPR1

2022120600

full 2022-12-01 security patch level

full 2022-12-05 security patch level

rebased onto TQ1A.221205.011 release, which is the first quarterly maintenance/feature release for Android 13

Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro: rewrite under display fingerprint scanner integration

Sandboxed Google Play compatibility layer: set GmsCompat versionCode to 1000 (v1) to prepare for defining dependencies on the compatibility layer version for the Google Play apps mirrored in our app repository

Pixel 6, Pixel 6 Pro, Pixel 6a: use Scudo instead of hardened_malloc for camera service for consistency with the Pixel 7 and Pixel 7 Pro until memory corruption issues with it are resolved

add back support for OS device controls and wallet quick tiles

kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro, Generic 5.10): update to latest GKI LTS branch revision including update to 5.10.152

Download in Post #2

Development [ROM][13][UNOFFICIAL][Raven/Oriole] Magisk Patched GrapheneOS + Lockable Bootloader

Senior Member

No Google apps or services​

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Senior Member

Senior Member

New member

Senior Member

Member

Senior Member

Member

Senior Member

New member

Senior Member

New member

Senior Member

Similar threads

Top Liked Posts

No Google apps or services​

No Google apps or services

No Google apps or services