[Microsoft Surface Duo Guides, News, & Discussion] NTchrist:
okay I have mine working on the factory unlocked version, here's what I did. something something give a man a fire / set a man on fire... ima set you on fire and give you steps to follow from the top so you know what's going on and can do this yourself in the future

0. make sure USB debugging is on in settings > developer options

0. make sure the phone's bootloader is actually unlocked, if the below doesn't work, back up all the data on your phone because we're about to wipe it

.\fastboot.exe flashing unlock
.\fastboot.exe flashing unlock_critical

might both be required, if you only did one way back the first time you tried this you may not be fully unlocked. Both of these commands from the bootloader will factory reset your phone. if you've already done this, go to step 1.

1. go here https://support.microsoft.com/en-us/surface-recovery-image put in your serial number (can be found in settings) and download the latest recovery image, your current build is 2021.207.70 and it's what the zip file should be named when you grab it

2. download payload_dumper from here https://gist.github.com/ius/42bd02a.../48ffe1eee59af9a7da883d9ec7902d1507428dc4.zip

3. download the latest platform-tools from here https://developer.android.com/studio/releases/platform-tools

4. extract all three zips to the same folder, a folder on your desktop is fine, mine is 2021_207_70

5. open powershell, and cd to that folder.

6. from the folder, run it like this

PS C:\wherever\your\****\is\2021_207_70> python.exe -m payload_dumper ./payload.bin

(this will extract a bunch of stuff, boot.img is all we care about today)

6a. if you don't have python, get it from ninite https://ninite.com/pythonx3/ and go back to step 5/6 and try again

7. download the latest version of magisk manager (the new magisk app may work, but I've not tested it, this is the exact version I am using on the exact phone you are using) https://github.com/topjohnwu/Magisk/releases/download/manager-v8.0.7/MagiskManager-v8.0.7.apk

8. install magisk manager on your phone

9. make a text file, I called mine magisk_channel.txt and put this in it

https://raw.githubusercontent.com/Lethany/magisk_files/0755a7d5f596dc2a351270120b31b665fb561294/stable.json

this is the "custom" channel we are using to force an older version of magisk that doesn't choke on our device like newer versions do.

10. use usb data transfer mode to copy the boot.img file we extracted from step 6 and the text file we created in step 8 to your phone's internal storage, I have a folder on the root of the internal storage directory called Z_Phone, but anywhere is fine as long as you know where it is and remember it later.

11. in magisk manager, click the gear in the top right and then select "update channel" > "custom channel"

12. use your duo's dank duo mode to open a file browser on the other screen, open the text file we made in step 9

13. copy and paste the custom channel text into the custom channel field under update channel in magisk so it has the text from step 9 in it. (the text file just saves us typing it out by hand)

14. go back to the magisk main screen, and click install next to "magisk"

14b. click next

14c. click "select and patch a zip file"

14d. browse to the location we uploaded boot.img to in step 9 and select boot.img

14e. click let's go

(this will create the patched boot.img, it'll be named magisk_patched_[some garbage].img)

15. open the internal storage on your PC again, and go to your phone's "downloads" folder, it'll have that patched boot.img (if you've tried this a bunch of times and don't remember which one we just made, feel free to delete all the old ones and do 14-14e again) copy this patched_boot.img to your computer, I just put it in that same folder as step 4

16. in powershell, cd back to that same working folder we've been using and run

.\adb.exe reboot bootloader

The phone will reboot to the bootloader and we can now try booting the patched image

16. in powershell, run

.\fastboot.exe boot .\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img

17. if your phone boots, that's a great sign and we're out of the woods, nothing else will probably go wrong from here, if it doesn't boot factory reset your phone and start at step 0.

18. open an adb shell prompt and make our boot partitions writable with the below 4 lines, run one by one. Right now we're "rooted" but we've booted off an image over usb, what we really want is to boot off the images on your phone so we need to.

.\adb.exe shell
su
chmod 777 /dev/block/by-name/boot_a
chmod 777 /dev/block/by-name/boot_b

19. write the patched boot partition to your boot partitions with the below lines, again run one by one

adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_b

(my patched boot image is in a folder called "Z_Phone" and my patched image is called "magisk_patched_ks4OZ.img" so my commands look like:

dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_b

)

20. reboot your phone via the power button menu and if all went well, you're now rooted!