[Microsoft Surface Duo Guides, News, & Discussion] NTchrist:
==== READ THIS POST BEFORE ROOTING ====​

https://www.reddit.com/r/surfaceduo/comments/wn5joi/a_warning_to_wouldbe_developers_and_hobbyist/

(ORIGINAL GUIDE BELOW)​

Since the last guy hasn't been updating his op, I figured I'd start a fresh thread with what we know and what to do for newcomers.

I will not be posting patched boot images in this thread, I'm a firm believer of "give you steps to follow from the top so you know what's going on and can do this yourself in the future". The more hands we have in the kitchen, the more we learn, and the better we are off as a community.

Walkthroughs for both fresh rooting and updating while rooted are both below:

==== FRESH ROOT ====​

0. make sure USB debugging is on in settings > developer options

0. make sure the phone's bootloader is actually unlocked, if the below doesn't work, back up all the data on your phone because we're about to wipe it

.\fastboot.exe flashing unlock
.\fastboot.exe flashing unlock_critical

I did both, but it might only require one of the two, if you only did one and it doesn't work you may not be fully unlocked and might have to do the other. Both of these commands from the bootloader will factory reset your phone. if you've already done this, go to step 1.

1. go here https://support.microsoft.com/en-us/surface-recovery-image put in your serial number (can be found in settings) and download the latest recovery image

2. download payload_dumper from here https://gist.github.com/ius/42bd02a.../48ffe1eee59af9a7da883d9ec7902d1507428dc4.zip

3. download the latest platform-tools from here https://developer.android.com/studio/releases/platform-tools

4. extract all three zips to the same folder, a folder on your desktop is fine, mine is just the name of the current MS zip archive (2021_314_91 at time of writing and used in the below examples)

5. open powershell, and cd to that folder.

6. from the folder, run it like this

PS C:\wherever\your\****\is\2021_314_91> python.exe -m payload_dumper ./payload.bin

(this will extract a bunch of stuff, boot.img is all we care about today)

6a. if you don't have python, get it from ninite https://ninite.com/pythonx3/ and go back to step 5/6 and try again, you will likely also need to do a "pip install protobuf" to get the required python libraries for payload-dumper

7. download the latest version of magisk manager (the new magisk app may work, but I've not tested it, this is the exact version I am using on the exact phone you are using. If you feel like trying the app please report in the thread below!) https://github.com/topjohnwu/Magisk/releases/download/manager-v8.0.7/MagiskManager-v8.0.7.apk

8. install magisk manager on your phone

9. make a text file, I called mine magisk_channel.txt and put this in it

https://raw.githubusercontent.com/Lethany/magisk_files/0755a7d5f596dc2a351270120b31b665fb561294/stable.json

this is the "custom" channel we are using to force an older version of magisk that doesn't choke on our device like newer versions do.

10. use usb data transfer mode to copy the boot.img file we extracted from step 6 and the text file we created in step 8 to your phone's internal storage, I have a folder on the root of the internal storage directory called Z_Phone, but anywhere is fine as long as you know where it is and remember it later.

11. in magisk manager, click the gear in the top right and then select "update channel" > "custom channel"

12. use your duo's dank duo mode to open a file browser on the other screen, open the text file we made in step 9

13. copy and paste the custom channel text into the custom channel field under update channel in magisk so it has the text from step 9 in it. (the text file just saves us typing it out by hand)

14. go back to the magisk main screen, and click install next to "magisk"

14b. click next

14c. click "select and patch a zip file"

14d. browse to the location we uploaded boot.img to in step 9 and select boot.img

14e. click let's go

(this will create the patched boot.img, it'll be named magisk_patched_[some garbage].img)

15. open the internal storage on your PC again, and go to your phone's "downloads" folder, it'll have that patched boot.img (if you've tried this a bunch of times and don't remember which one we just made, feel free to delete all the old ones and do 14-14e again) copy this patched_boot.img to your computer, I just put it in that same folder as step 4

16. in powershell, cd back to that same working folder we've been using and run

.\adb.exe reboot bootloader

The phone will reboot to the bootloader and we can now try booting the patched image

16. in powershell, run

.\fastboot.exe boot .\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img

17. if your phone boots, that's a great sign and we're out of the woods, nothing else will probably go wrong from here, if it doesn't boot factory reset your phone and start at step 0.

18. open an adb shell prompt and make our boot partitions writable with the below 4 lines, run one by one. Right now we're "rooted" but we've booted off an image over usb, what we really want is to boot off the images on your phone so we need to.

.\adb.exe shell
su
chmod 777 /dev/block/by-name/boot_a
chmod 777 /dev/block/by-name/boot_b

19. write the patched boot image to your boot partitions with the below lines, again run one by one

adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_b

(my patched boot image is in a folder called "Z_Phone" and my patched image is called "magisk_patched_ks4OZ.img" so my commands look like:

dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_b

)

20. reboot your phone via the power button menu and if all went well, you're now rooted!

==== UPDATE WHILE ROOTED ====​

1. go here https://support.microsoft.com/en-us/surface-recovery-image put in your serial number (can be found in settings) and download the latest recovery image

2. download payload_dumper from here https://gist.github.com/ius/42bd02a.../48ffe1eee59af9a7da883d9ec7902d1507428dc4.zip

3. download the latest platform-tools from here https://developer.android.com/studio/releases/platform-tools

4. extract all three zips to the same folder, a folder on your desktop is fine, mine is just the name of the current MS zip archive (2021_314_91 at time of writing)

5. open powershell, and cd to that folder.

6. from the folder, run it like this

PS C:\wherever\your\****\is\2021_314_91> python.exe -m payload_dumper ./payload.bin

(this will extract a bunch of stuff, boot.img is all we care about today)

7. boot off of your old magisk patched boot image

.\adb.exe reboot bootloader
.\fastboot.exe boot ..\[LAST VERSION'S FOLDER]\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img

8. write the old, unpatched boot partition to your boot partitions with the below lines, again run one by one

adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/boot.img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/boot.img of=/dev/block/by-name/boot_b

(my unpatched boot image is in a folder called "Z_Phone" and my unpatched image in this example is called "boot.img" so my commands look like:

dd if=/sdcard/Z_Phone/boot.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/boot of=/dev/block/by-name/boot_b

)

9. reboot

10. run the OTA update on your now freshly stock phone

11. use magisk to patch the new boot image same as in the first root instructions (14a-14e)

12. copy this patched image off of the phone and into our working directory. leave a copy of this on the phone (I put it in my Z_Phone folder)

13. reboot to bootloader (in powershell, in that same working folder we've been using run)

.\adb.exe reboot bootloader

14. Boot your phone using the patched boot image (in powershell, run)

.\fastboot.exe boot .\magisk_patched_[WHATEVER_YOURS_IS_NAMED].img

15. write the patched boot image to your boot partitions with the below lines, again run one by one

adb shell
su
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_a
dd if=/sdcard/[PATH TO IMAGE]/[PATCHED BOOT].img of=/dev/block/by-name/boot_b

(my patched boot image is in a folder called "Z_Phone" and my patched image is called "magisk_patched_ks4OZ.img" so my commands look like:

dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_a
dd if=/sdcard/Z_Phone/magisk_patched_ks4OZ.img of=/dev/block/by-name/boot_b

)

16. reboot and you're updated and rooted!