yashsingh1/xdaforums huggingface dataset:
[Google Pixel 6 Pro] V0latyle:
Speaking of USNF 2.2.0, anyone have a link to that?

@Anonshe thanks for the insight, I'll let folks in the other forums know.
[Google Pixel 6 Pro] Golf c:
Thank you. I was thinking the same thing. Very confusing with out the proper terminology.
[Google Pixel 6 Pro] snovvman:
As of this writing, 2.2.0 is still in early release, accessible via https://www.patreon.com/posts/early-access-fix-58086319. I was planning on paying to get the file.
[Google Pixel 6 Pro] Anonshe:
Release v2.2.0 (Zygisk) · kdrag0n/safetynet-fix

Changes Ported module to Zygisk Fixed screen-off Voice Match in Google Assistant Fixed poor microphone quality with Voice Match enabled on Pixel 5 Fixed At a Glance weather display on Android 12 F...

patreon.kdrag0n.dev

It's early access at the moment or available by a monthly subscription to kdrag0n's patreon. From past patterns, he does an open and free release roughly 2-3 weeks after the early access is posted.

FWIW, I'm using it via Zygisk on the latest Magisk Canary and Safetynet passes just fine.
[Google Pixel 6 Pro] Annil:
Made a fresh wipe+install of current Android 12 .036 version.

However now CTS fails in YASNAC, previously in version .015 it worked.

Everything was done exactly same, though. Is this due to Magisk Alpha not fully working with .036 or did something go wrong? (although I would not know, what it could be)

Edit: Fixed, it was only required to Direct Install Magisk again.
[Google Pixel 6 Pro] V0latyle:
nice.jpg

Sorry for getting testy earlier, it's been pretty frustrating for me and others, so hopefully this clarification will make it a lot easier on folks.

What exact configuration are you using to pass SafetyNet? I assume DenyList on Google Play Services and Google Play Store, then USNF? Have you tested security and DRM sensitive apps such as GPay, banking, Netflix, etc?
[Google Pixel 6 Pro] xpdragon:
Just want to confirm that Magisk Alpha works fine on mine with .036.
[Google Pixel 6 Pro] Anonshe:
No worries, we're all adults here trying to keep up with Google's changes after all :)

With USNF, DenyList doesn't need to be enabled for Play Services. This prevents any breaking of Play Services. What I did was:

- Latest Magisk Canary

- Enabled Zygisk but keep DenyList turned off

- Flash the USNF module

- Reboot system and verify if Zygisk is shown as "Yes" in Magisk Manager

- Enable DenyList and select my bank apps

- Hid Magisk Manager by repacking it with a different name

Tested for SN and it passed. Netflix works. Banking apps mostly work with the exception of one which is worked-around by temporarily uninstalling only Magisk Manager. After I'm done with that bank app, a reboot brings back Magisk Manager.

Unfortunately, since I'm traveling, GPay isn't available here so I can't test it but it should work just fine. If you've a specific app you want me to test, link it and I'll post a screenshot.
[Google Pixel 6 Pro] V0latyle:
Huh. Using Magisk 23001 + Riru + USNF 2.1.1, I had to enable MagiskHide on both.

I assume you could fix this by using DenyList against that app?
[Google Pixel 6 Pro] Anonshe:
By right, if you used stable Magisk 23.0, Riru and USNF 2.1.1 are sufficient to get SN to pass along with MagiskHide Enabled via the toggle but not on the Play Services app entry. I had that working till yesterday before I switched to Canary and Zygisk.

Yup, DenyList isn't exactly MagiskHide but it functions somewhat like it. The bank app I was referring to is able to detect MagiskHide and DenyList so the only solution was a temporary uninstallation of Magisk Manager. Since Magisk is a dynamic app, it will re-appear after a reboot as long as the boot partition is patched.
[Google Pixel 6 Pro] snovvman:
Please do--I'm curious to hear your results. Thanks!
[Google Pixel 6 Pro] rester555:
I can't get bsdiff4 installed for setting up payload dumper. Can I use the boot image from the .036 factory image instead of extracting from the OTA?
[Google Pixel 6 Pro] Nekromantik:
New USNF does not need denylist for GPS or GP. So we just need to add bank apps but GPS can be left off.
[Google Pixel 6 Pro] snovvman:
I'm curious to understand the mechanism of vbmeta, wipe, re-root.

Do I have this right?

--On the first root, a wipe is needed because vbmeta was already enabled.

--After the vbmeta with flags, vbmeta is not re-enabled until the next update.

--After the first root and vbmeta disabled, immediately after an OTA sideload, the vbmeta flags *keep* vbmeta from becoming enabled so long as the phone does not boot after the update.

--vbmeta is only enabled during the boot process, unless the flag was set prior to boot.

I'd just like to better understand how it works... Thanks.
[Google Pixel 6 Pro] Anonshe:
Yes

Yes, it isn't enabled unless it is flashed again. Both the OTA and full firmware packages do flash vbmeta hence it being re-enabled.

Since vbmeta would become enabled at boot-up after an update, running the fastboot command before boot-up keeps it disabled.

Yes, post update.

Here's some further reading, if you're interested.
[Google Pixel 6 Pro] V0latyle:
So it's only upon boot to system...meaning you could flash back and forth in bootloader, and as long as you started with verity/verification disabled, it wouldn't matter?
[Google Pixel 6 Pro] Anonshe:
You could enable/disable vbmeta in regular fastboot before booting up theoretically.

The bootloader (fastboot) is contained in the abl partition so, as long as the next stage of the boot process isn't reached, vbmeta doesn't get enabled. Before the system, the devices boots using the "boot" partition so if it gets to that stage, vbmeta is enabled.
[Google Pixel 6 Pro] Ghisy:
@Anonshe or @V0latyle, you guys are doing a great job so far! I appreciate your dedication!

I have my P6P sitting in its box for now, only unlocked the bootloader. Would any of you be so kind to write an idiot-proof guide to permanently root the P6P? I feel like information is all over the place in the P6P section...
[Google Pixel 6 Pro] snovvman:
Does booting between bootloader and recovery (and fastbood, adb sideload, etc.) use the boot partition? I presume not? Therefore, bouncing between bootloader and recovery would not trigger vbmeta to be enabled (previously disabled, after OTA sideload)? Thanks.
[Google Pixel 6 Pro] V0latyle:
K. Pixel 5, clean installed 210812.015 on Saturday. Using Magisk 23001 (this won't work for the Pixel 6). Patched boot image manually in case my live boot method doesn't work.

Sideloaded the OTA. Rebooted to bootloader.

Flashed /vbmeta with disable flags to both slots (this is an OTA so I didn't want to risk it)

Booted the previously patched image. Yay, still have root. Performed Direct Install in Magisk. Rebooted.

Root persisted.

thatwaseasy.jpg

Okay, now going to try this with the factory zip...actually with the Android Flash tool.

I'm back. Only hangup was booting the patched image, it hung up on the Google loading logo. Forced hardware reboot, let it boot and sit for a couple minutes, then rebooted to bootloader and booted the patched image. Temp root is good, performed direct install, rebooted, good boot and root retained.
[Google Pixel 6 Pro] Anonshe:
fastbootd and recovery reside in the boot partition so after the OTA update, if you didn't disable vbmeta but kept bouncing around, you risk vbmeta getting enabled.
[Google Pixel 6 Pro] Golf c:
Yes, same exact software. The method of installation is the only difference. I'm referring to the factory image and the FULL OTA image. Not the little one they send over the air.
[Google Pixel 6 Pro] V0latyle:
I'll update my guides in a bit, but just for you...this will be the Cliff Notes version, so if you need more detailed instructions, you'll have to wait a bit...

Without the SIM card in it, start your phone. Get through the setup by skipping as much as you can. If you want, connect to WiFi and install the latest update, because you'll be wiping when you unlock the bootloader. If you choose to do so, let the update complete once you get through setup.

While you're doing this, download the latest factory zip to your computer. Extract it and the .zip inside it.

Once you're at the home screen, go to Settings > About, scroll to the bottom and tap the build number several times until it says You are Now a Developer. Go back one screen, go to System > Developer Options, enable OEM Unlocking and USB Debugging. Reboot to bootloader.

Connect to PC via USB and open command line in platform tools. Unlock bootloader:

fastboot flash unlock

Confirm and allow your device to wipe. I don't remember if it gives you a choice, but don't reboot.

Disable dm-verity and vbmeta verification:

flash vbmeta --disable-verity --disable-verificaiton --slot=all vbmeta.img

where vbmeta.img will be in factory zip > build folder > device-image > vbmeta.img

Reboot to system. Install Magisk 23011. Copy boot.img from the same folder you find vbmeta.img in, to your phone (you'll have to enable File Transfer on your device)

Patch the boot image in Magisk (Select and Patch a File), then copy the patched image back to your computer. Reboot to bootloader.

Flash the patched boot image:

fastboot flash boot magisk_patched-23xxx_xxxxx.img

Reboot and enjoy.
[Google Pixel 6 Pro] ggkameleon:
Hi ! This Magisk modified work too for Pixel 4a 5g !

If yes I'm Rooted with Magisk canary Alpha the last without Hide. Do just install the modified Magisk on manager install directly ? Do install the Magisk manager too on Telegram canal ?

Thanks
[Google Pixel 6 Pro] bc Yume:
I want to add that it's not necessary to factory reset the device when data may be corrupted is shown. Just use Google's Android Flash Tool, tick both "Disable Verity" and "Disable Verificaiton" and flash the image.

Yes it means taking 2x the time to download the factory image, but it does not reset the phone, AFAIK.

Edit: Nevermind this trick doesn't seem to work.
[Google Pixel 6 Pro] Olorin92:
Thanks for the write-up - so should this theoretically work for the P6/Pro (using the 23011 Magisk instead though obviously)?
[Google Pixel 6 Pro] Lughnasadh:
What if you are disabling vbmet for the first time during a monthly update?

Scenario:

1. On November build with never having rooted or disabled vbmeta.

2. December build comes out.

3. Sideload December OTA in recovery (do not boot). Reboot into bootloader and flash vbmeta with flags disabled and patched boot image.

4. Boot

If I'm understanding how this works, you would not have to wipe data/factory reset before booting because you are installing a new build and as long as you don't boot the new build into system before disabling vbmeta you won't have to wipe because you never actually booted the new vbmeta with it enabled.

But on the other hand, if I were just trying to root on the same build that I already booted with vbmeta enabledI would have to wipe.

Is this correct?

And if this is correct, then basically you only have to wipe when you have booted at least once the build you are trying to root with vbmeta enabled?
[Google Pixel 6 Pro] V0latyle:
Yep.

No. Following the scenario as you describe it, attempting boot will result in the device going into Rescue Party (recovery mode screen with "Try Again / Factory Data Reset" options).

Data wipe is required the first time you disable verity and verification; it will also be required if the system is allowed to boot after /vbmeta has been written WITHOUT the disable flags.
[Google Pixel 6 Pro] HereticBG:
Anyone have issues with Play Store/installing apps after unlocking/rooting?

I unlocked bootloader, flashed the .019 firmware using the factory image script file and then flashed the patched boot/vbmeta. Root was there.

From there, I had to factory reset 3 times trying to transfer stuff over because Play Store would get all my apps from my old Pixel 2 and then just stall on "Installing" on the first app it tries to download. I reset 3 times and each time it would just freak out and refuse to finish "Installing" the app and move on unless I reboot or kill the Play Store.

So I reset 3 times, same time each story. 4th time before I transferred stuff over, I flashed the USNF 2.2 version and confirmed SafetyNet passing. Then I did the Transfer and it worked better. All my apps from my old phone came over but it would still hiccup on some app installs.

But even now, if I install an app from the Play Store, I have to kill the Play Store once I see it stuck on "Installing" for it to show up in my App Drawer. Furthermore, installing APKs manually I have to do it twice for it to finish up as well as the first time it just spins. Plus I can't even hide Magisk App. It just spins and spins. I reboot, and the app is there but the original Magisk app doesn't disappear.

Should I dirty flash the whole .036 system image and re-do the root/USNF? Can we do that with the vbmeta stuff without having to wipe?
[Google Pixel 6 Pro] go_roy:
So, going forward, should we be using the alpha linked in the OP or official Magisk 23011 (the canary one I guess, the debug apk from GitHub)? I am currently still on .015 with the a3eafdd2 alpha Magisk.

To update successfully, should I re-install the canary Magisk manager, patch the .036 boot.img with the canary manager and perform the flashing steps, then use Riru and USNF 2.1.1 (and in the future, Zygisk and USNF 2.2.0 when it's out of early access) for SafetyNet? Or will the canary only work for SafetyNet bypass when USNF 2.20 and Zygisk are used?
[Google Pixel 6 Pro] Lughnasadh:
Why is wiping required the very first time you disable verity and verification even if you have never booted that particular build with vbmeta enabled?
[Google Pixel 6 Pro] mkhcb:
Dumb question time... But can we just replace the OTA boot and vbmeta files prior to flashing?

Or can we delete the vbmeta and have it flash the rest?
[Google Pixel 6 Pro] V0latyle:
Because it's an Android 12 thing. I'm not sure about upgrading from Android 11, but that doesn't apply to the Pixel 6 so the point is moot.

I don't know if there is a way to repack the OTA zip. This could be done with the factory zip, but for the effort it would take, it's just easier to reflash those two images.

Vbmeta must be flashed. It cannot be from another build as far as I know, and the partition cannot be empty, or the device won't boot.
[Google Pixel 6 Pro] Lughnasadh:
Yes, I understand it's an Android 12 thing. I'm trying to understand what the mechanism is that requires this. Why is it that you have had to have wiped at least once even if the vbmeta image you are about to use has never been booted or enabled? What is it about this first wipe that allows you to proceed later on?
[Google Pixel 6 Pro] V0latyle:
Think of it as a locking/unlocking thing like the bootloader, only less deliberate. I'm not sure if any of us knows why, and if we did, we would be working on a way to disable it.
[Google Pixel 6 Pro] Zilla0617:
I followed these steps:

Patched nov boot image with Magisk alpha

boot in adb revovery

adb sideload nov firmware

use the menu to go back to bootloader

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

fastboot flash boot magiskopatched...

rebooted

now in bootloop where it keeps restarting itself

How did this happen? I was rooted with October patch. Is there anyway i can salvage my data really not trying to start from scratch again. Thanks
[Google Pixel 6 Pro] mkhcb:
Ok, another dumb question... Can we just have a batch file script that we can place the update in a folder, where the script is located and have the script flash the update the update for us, without us accidentally rebooting when we shouldn't?

Do you think this is something you would be interested in helping us make?
[Google Pixel 6 Pro] snovvman:
No idea why, but you could try flashing the patched boot again and see if it boots. If not, flash the unpatched boot, then try direct install and/or repatch boot and try again?

I'm about to do the same. I'll report back if it does not work.
[Google Pixel 6 Pro] Zilla0617:
I tried both methods, reflashing magisk-patched boot image and stock boot image. Neither worked, still in bootloop...
[Google Pixel 6 Pro] snovvman:
Try flashing the image without -w and add --skip-reboot, while still in BL, disable verity and re-flash patched boot? I'm just grasping.
[Google Pixel 6 Pro] Zilla0617:
So i have download the factory image, edit the bat file and add --skip-reboot, while in BL. Can anyone else confirm that this will work, at my witts end.
[Google Pixel 6 Pro] Zilla0617:
I just thought of something, does it matter if the boot image and vbmeta.img is from an ota or factory? I use the files from the ota
[Google Pixel 6 Pro] snovvman:
I just did the same and my phone booted fine. On .A8 and perm root.
[Google Pixel 6 Pro] Zilla0617:
Hmmm...I can figure out why im in a bootloop following the same steps

Edit: I have the android flash tool up and the selected build listed is .015 but before i attempted to update i was on .019
[Google Pixel 6 Pro] diesteldorf:
Thanks for posting. Last night I had the forked Alpha version of Magisk installed with RIRU and the public release of USNF 2.1. Passed Safetynet and everyting was working well, but decided I'd feel better using the latest non-forked Zygisk compatible Magisk 23011

1. I uninstalled Magisk Alpha from within the app--first restoring images and then doing a complete uninstall.

2. Installed the latest Magisk 23011 and pattched the boot image.

3. Copied magisk-patched.img to my computer

4. adb reboot bootloader

5. From bootloader I typed:

fastboot flash --disable-verity --disable-verification vbmeta vbmeta.img (enter)

fastboot flash boot_a magisk-patched.img (enter)

fastboot flash boot_b magisk-patched.img (enter)

fastboot reboot

I'll be honest, I've been reading other posts stating that one should boot magisk-patched.img instead of flashing it.

I tried that once and couldn't get it to work. It would just reboot to my home screen., so I began flashing the patched boot.img to both slots immediately after flashing vbmeta

I've never had any trouble.

Once I verified Magisk 23011 was properly installed and verified root, I installed USNF 2.2 early release, following Anonshe's instructions.

SafetyNet failed initially, but I cleared cashe and data for Google Play Services and Play Store and now everything passes

Definitely don't regret throwing kdrag0n a few bucks. USNF 2.2 does everything expected. https://kdrag0n.dev/patreon/

I'm currently on the $5 monthly plan, but he also offers a one-time $5.99 charge for early access to USNF 2.2.

Hopefully we can always manage to stay ahead in this cat and mouse game!!
[Google Pixel 6 Pro] V0latyle:
Funny you should mention that.

In the factory zip, there is a batch file - flash-all.bat. Edit it, you will see a line that reads

fastboot -w update image-redfin-rq3a.211001.001.zip

Assuming you're just trying to update and you don't want to wipe, but you want to be able to root, change it to read this:

fastboot update --disable-verity --disable-verification --skip-reboot image-device-buildnumber.zip

You would then copy the image, bootloader, radio, and flash-all.bat files to your Platform Tools folder, and run the flash-all.bat there.

Another more fool proof method is to use the Android Flash Tool. Just make sure USB debugging is enabled and your computer is authorized on your phone. Select the options you want (in this case,

only

check Disable Verity and Disable Verification), and away you go. Your phone will reboot, but that's OK - you can just reboot back into bootloader and flash the patched boot image.

Remember...The most important thing is this:

VBMETA MUST be flashed with --disable-verity --disable verification BEFORE the phone reboots after updating.

If you update using the factory zip as described above and include the --disable flags, this does it for you.[/code]
[Google Pixel 6 Pro] Zilla0617:
I give up ill use android flash tool to wipe my device and start over.
[Google Pixel 6 Pro] Golf c:
Full OTA and Factory image are identical except for the installation method. The small over the air Google sends monthly is a different animal. Maybe full OTA didn't unpack correctly? I would use factory image. Much cleaner process.
[Google Pixel 6 Pro] HereticBG:
Can confirm this works perfectly and allowed me to dirty flash the .036 update.

Unfortunately, Play Store still refuses to update any apps and just spins all apps as pending. Plus it still won't let me hide Magisk app. I wonder if it's because Magisk was hidden on my old Pixel 2 and it screwed something up when I transferred everything over?

Maybe I'll try resetting and manually restoring everything instead of transferring from my old phone.
[Google Pixel 6 Pro] rester555:
I have my unlocked phone on Verizon. Will flashing the Verizon A8 image cause a problem for my unlocked bootloader on Verizon? Or is that no longer a problem with Pixel?

It looks like others have succeeded, but I wanted to be very specific on how I did the following:

So I had to go through hoops to go from rooted magisk alpha .015 to rooted .036.A8 (Verizon since that's my ISP) with magisk canary 23011 on P6 Pro... Here are the steps I followed to obtain root and dirty flash to .036.a8 with no wipe.

1.) Uninstalled magisk alpha by restoring images, rebooting

2.) uninstalled magisk completely

3.) Installed magisk 23011.

3.) downloaded the OTA for P6 Pro verizon .036.A8

4.) extracted the vbmeta and boot image from factory image. (Can't get payload dumper to work)

5.) Patched magisk boot image with magisk 23011.

6.) adb reboot recovery

7.) selected sideload with adb in recovery

8.) Hit power and volume up to get into recovery.

9.) adb sideload OTA_image.zip (OTA for whatever image your phone requires)

10.) after OTA downloaded, selected go to fastboot (fastbootd).

NOTE: I didn't select reboot to bootloader since I was worried the vbmeta flags would have been tripped/set/reset and the phone usually reboots at this point if you select reboot to bootloader)

11.) did fastboot vbmeta with disable flags

12.) fastboot flash patched magisk image to both slots.

NOTE: realized I could only flash to active slot and not inactive slot since I was in fastbootd. I realized this by using the command fastboot flash --slot=all boot magisk_boot.img and the same command with slot_b since slot_a was active and it said error could not flash.

13.) adb fastboot reboot. (Felt comfortable now since I was able to send vbmeta disable flag command).

14.) Device did not boot and failed to bootloader and had message verify boot failed.

15.) reflashed vbmeta disable flags

16.) reflashed magisk patched boot to both slots using --slot=all

17.) rebooted device and obtained root on .036.a8 with no wipe.

18.) verified root was permanent by restarting my device and root held.

To get adblock adaway, USNF, Safetynet, and GP store certified to pass I did the following:

1.) Went into magisk 23011 and enabled systemless hosts.

2.) Followed steps below provided by @Anonshe. Installed the USNF 2.20 early access (paid) version developed by kdrag0n when @Anonshe said to Flash the USNF module in steps below.

3.) Finished by clearing cache and data on GP store, play protect services, GP services.

NOTE: I used 31.0.3 sdk platform tools in windows 11 environment with a USB A to USB C cable.
[Google Pixel 6 Pro] Anonshe:
Use the android flash tool to flash the update with disable verity and disable verification checked. Don't check wipe data or lock BL.

Since you're bootlooping and not at the stage where it says system is corrupt, you can recover it while keeping your data.
[Google Pixel 6 Pro] Anonshe:
To go from alpha back to Canary, simply uninstall Magisk Manager and flash a Magisk patched image in fastboot. Restoring stock boot isn't required.

In fact, fastbootd is a later boot stage than regular fastboot so if you rebooted to bootloader, the flags wouldn't be set yet. They get set after the abl stage.

Just offering an explanation of things so that it's easier to visualise it for the future.
[Google Pixel 6 Pro] rester555:
Does your knowledge on boot sequences come from using other devices with the same boot up sequencing? Or other pixel devices? Curious?