[Google Pixel 3 XL Guides, News, & Discussion] jkoch3:
Being a huge fan of the Pixel series and living in China is not easy. Just upgraded my XL to 3 XL and naturally I had to enable the LTE to work in China. Regardless what you may see on the Chinese forums (gfan), all the files you need are already present on the phone.

Files you need:

1) The ADB bridge for Windows

2) The most recent factory image

3) Magisk Manager

4) Chinese-Carrier-Pixel-3-xl-LTE-VoLTE-Enabler (Magisk Manager module) - Github direct: https://github.com/wangdaning/Chinese-Carrier-Pixel-3-xl-LTE-VoLTE-Enabler (big thank you to wangdaning for allowing me to publish it.) Also attached as a zip file to this post.

If you don't understand what these files are for or where to find them, perhaps you should ask a friend to help you. Flashing anything wrong could result in an expensive brick. Always backup your data, never blindly trust a post, and do your research. This post is in good faith and I am not liable for your actions.

Now, I don't have any of the variants of 3 (Pixel 3, 3a, 3a XL) but I would assume it would work in a similar fashion; however, see above and do your research. Check file structures, read some posts, backup data, etc. If someone does try it, please report both success and failure to build the knowledge.

1) We need to ensure our phone has an unlocked bootloader. If your bootloader is locked, you WILL lose all your data. Ensure you backup everything you want to keep. There is no getting around this step. We need to be a developer first. Go to Setting->About Phone->Build number (tap it until it says you are a developer). Then go to System-> Developer options -> OEM unlocking: turn it on. Next we need to reboot to the bootloader by resetting the phone and hold the down volume key as it reboots. In the bootloader, first use the volume keys to find and select the unlock the bootloader command with the power key. Then, we need to send the following command:

fastboot flashing unlock

You will receive a wipe and security warning. Accept and reboot the phone. It will wipe and reset your phone to factory.

2) I started from a stock image (May update; QQ2A.200501.001.B2). I suggest you start from there.

3) While we have the May update in front of us, we need to extract the boot.img so it can be patched to root the phone. TWRP doesn't support us at the time of writing on Android 10. (Hope that new baby is healthy!) The boot image can be found in the zip image-crosshatch-*release code*.zip/boot.img. Transfer this boot.img to the phone to be modded to enable root.

4) Next the phone needs to be rooted. You need to download the most recent version of Magisk Manager. Once installed, open up Magisk Manager. It will report no Magisk and that's ok, we are installing it now.

5) Tap install on Magisk and it will ask if you want to install, so install. Then you need to select the method. We will choose "Select and patch a file." Tell it where you saved your boot.img and it will patch it to allow us to root the phone. The output file we need is called magisk_patched.img is on the phone. Move it back to your directory with your ADB bridge.

6) Next we need to flash this patched boot file to our phone to complete the rooting process. Reboot to the bootloader and send the two commands:

fastboot flash boot_a magisk_patched.img
fastboot flash boot_b magisk_patched.img

Reboot the phone and congrats, you are rooted with an unlocked bootloader.

7) To prepare for the install of the mock files that will point to the files on the phone, we need to delete a few checking files. Using your file explorer of choice that can gain root access delete the following:

/data/vendor/modem_fdr/fdr_check

everything in /data/vendor/radio/ (make the target folder empty)

8) Download the LTE_enabler from Github or the zip file here. Open Magisk Manager and open the menu -> Modules -> "Yellow Plus" to add. Point it to the zip file.

9) Reboot and enjoy using your phone as intended.

I tried to be as detailed as I could but not be over verbose either. If any step is unclear, there are more detailed guides on this forum concerning bootloader unlocking and Magisk rooting on Android 10. As a bonus tip, does the "x" showing no data bother you and stop some services from working? If so, this can be fixed by re-pointing your captive portal to something inside the firewall. This can be accomplished with one line of code:

adb shell "settings put global captive_portal_https_url https://developers.google.cn/generate_204"

Enjoy and if you have questions about Pixel and China, feel free to post them. Support right to repair!