yashsingh1/xdaforums huggingface dataset:
[Google Pixel 6 Pro] Namelesswonder:
I don't know why, but it could be because of this: https://blog.quarkslab.com/attacking-titan-m-with-only-one-byte.html

The time frame lines up, antirollback commit was implemented in the days after Google told the researcher they are developing a fix.

And it's pretty big, allowing the ex-filtration of the secret keys inside the Titan and doing arbitrary code execution right on the Titan, a complete permanent compromise of the device. This is probably why Google is trying to stop people from downgrading to Android 12. Understandable why this is the first time Google is doing this, someone can resell this permanently compromised device to anyone, or do this to someone's phone. It's too late though, any Tensor device not updated to Android 13 could be forever compromised, so really the security theater of Pixel devices has just been torn down. We'll see if the Pixel 7 or Titan M3 fares better. Previous Pixel phones do not implement these OTP bit checks inside their bootloaders so I believe they are never going to have to worry about being stopped from downgraded, although they are susceptible to compromise.

The average person should never brick their phone from this, the GrapheneOS tester only had this happen because they were testing GrapheneOS on Android 13 and were capable of flashing a borked ROM.

But yes if you're updating to Android 13 manually via fastboot just run

fastboot --slot all flash bootloader bootloader.img

fastboot --slot all flash radio radio.img

fastboot reboot bootloader

fastboot --slot all update image.zip

If using Magisk then use fastboot --slot all --skip-reboot update image.zip and select reboot to bootloader in fastbootd once fastboot is done flashing to flash your patched Magisk boot image.

If you are already on Android 13 then just perform steps 1-2-3.
[Google Pixel 6 Pro] rester555:
Worked like a charm for

Worked like a charm for me. Thanks for the inputs everyone. EDIT: As a side note, A13 voice to text is MUCH better than A12 and before.
[Google Pixel 6 Pro] LLStarks:
The Titan exploit certainly fits the bill for Google needing to use a firmware feature they normally hate using.

And this is on top of recent reports that the Pixel 6 was thoroughly defeated their security red team right before launch.
[Google Pixel 6 Pro] V0latyle:
Interesting. It sounds like this could potentially backdoor the new Play Integrity API as well because that relies on TEE and HKA.

Why not update both slots at the same time? fastboot update --skip-reboot --slot=all image-device-buildnumber.zip

I always get the message Warning: slot set to 'all'. Secondary slots will not be flashed. however it does flash both slots...

Spoiler content hidden.
[Google Pixel 6 Pro] Namelesswonder:
You are correct, it does flash correctly now. It was a habit from legacy A/B devices before dynamic partitions that fastboot didn't flash secondary slots correctly.
[Google Pixel 6 Pro] ExpertMC:
Any way to force taskbar on default DPI and not 600?
[Google Pixel 6 Pro] i42o:
cant we just flash through https://flash.android.com ?
[Google Pixel 6 Pro] roirraW "edor" ehT:
If you have an unlocked bootloader, or at least have OEM unlocking enabled (in the second case, the site will unlock the bootloader for you). And you make sure the "Wipe" option gets unchecked.

Some people like me like to have a little more hands-on approach.
[Google Pixel 6 Pro] V0latyle:
Additionally the online tool does not have the ability to flash external images, such as a Magisk patched boot image.
[Google Pixel 6 Pro] Lughnasadh:
Of course, there's also the Pixel Flasher, which can flash to both slots and keep root, among many other things.

📳🔥PixelFlasher for Google Pixel 6 Pro Support Thread.

This is the support thread of PixelFlasher (PixelFlasher is an open-source self contained GUI tool to facilitate Pixel phone device flashing/rooting/updating with extra features). Note: This thread is meant for issues and problems faced in...

xdaforums.com
[Google Pixel 6 Pro] i42o:
i am somewhat knowledgable on flashing process, but i am currently on Lineage 19.1 and will be jumping directly from LOS to android 13. i have to select wipe as my data is coming from custom oS no??? i would select force flash all partitions to ensure both slots get flashed??? this anti roll back thing has never worried me and i dont want to brick my 6 pro..... is the upgrade from coming from custom os???
[Google Pixel 6 Pro] Lughnasadh:
Since we're talking about security a bit, here's what LLStarks was referring to, I believe...

Google's Android Red Team Had a Full Pixel 6 Pwn Before Launch

Before the flagship phone ever landed in users’ hands, the security team thoroughly hacked it by finding bugs and developing exploits.

www.wired.com
[Google Pixel 6 Pro] roirraW "edor" ehT:
Yes, absolutely. In that case, I would also choose the Android Flash Tool's option to force flash all partitions, too.

Ha! I was writing before I finished reading. Yes.

Is there supposed to be another word in there, such as "safe"?

Like: is the upgrade safe from coming from custom os???

If that was your intended question, I have no idea from personal experience on the Pixel 6 Pro. Presumptively, yes, it's as safe as flashing stock from any custom OS I've ever used in the last 12 years has been. I don't definitively answer Yes to a scenario I haven't actually experienced myself unless it's brought up so often in the forum threads I visit that I know the answer without a doubt.

For what it's worth, I don't think the Android 13 bootloader not being able to be downgraded will have any effect on your process, since that's not what you're doing.

Hope that helps.
[Google Pixel 6 Pro] roirraW "edor" ehT:
Glad to know they ran *some* aspects of the P6/Pro through the relative wringer before launch! :D

That must be why they ran out of time fixing everything else. Yeah, that's it. 🙃 © @Lughnasadh
[Google Pixel 6 Pro] djo_5296:
i updated to A13 but it seems my pixel launcher crashes every time. I can somehow open Settings and launch apps via Settings but anything from home page, app drawer, or even the recents screen of the Pixel Launcher crashes (the launcher, but the app doesnt launch this way. only via Settings). Any way to fix this? I've tried re-flashing the full image again but it still comes up like that
[Google Pixel 6 Pro] roirraW "edor" ehT:
Try wiping the Pixel Launcher app's cache and data.
[Google Pixel 6 Pro] LLStarks:
I haven't seen a transparent anti-roll back like this ever. And I'm sure roms can work around it.

I remember when the Verizon Galaxy S3 had multiple updates that increasingly reduced the ability to flash recoveries, boots, roms. And then there was a point of no return which I made sure not to cross.
[Google Pixel 6 Pro] djo_5296:
clearing storage didnt seem to help. i actually tried this line `fastboot update --skip-reboot --slot=all image-device-buildnumber.zip` in the bat file at the same time but i think the syntax is incorrect (yes, the proper file name was used not that placeholder haha) since post-flash, it only boots to bootloader

i reverted to the original flash command without `-w` and my phone boot properly and pixel launcher is back to working again. but after flashing my magisk patched boot image, thats when my pixel launcher stops working. i'll try a fresh magisk patched boot img i guess
[Google Pixel 6 Pro] Lughnasadh:
Got any Magisk mods that may be interfering?
[Google Pixel 6 Pro] djo_5296:
it seems that it was a module, QuickSwitch. idk what happened in my latest flash but i lost my home screen configuration, but a minor loss compared to a full wipe. well, i removed QuickSwitch for now and will wait for an update. thanks for helping me out!
[Google Pixel 6 Pro] Lughnasadh:
No problem 👍
[Google Pixel 6 Pro] Homeboy76:
@Lughnasadh

I inserted one penny in the Flash Factory Machine. The machine flashed the factory image to slot a.

I inserted the other penny in the Flash Factory Machine.

The machine flashed the factory image to slot b.

Thanks for the two pennies. :)

fastboot flash boot magisk_patched...img --slot all

Rebooted

Phone looping back to Start.

I fixed by reflashing the factory image.

to both slots.

I checked the magisk_install...log has several cp errors i.e.,

cp: can't preserve ownership of 'busybox': Operation not permitted

What does this error mean and how do I fix it?

I used Magisk Canary 25201 to Patch Android 13 boot image.
[Google Pixel 6 Pro] Namelesswonder:
The real question is whether the antirollback is implemented as a specific version stop to simply just prevent flashing back to an exploitable bootloader or is implemented as complete rollback prevention to stop downgrading at all. We won't find out until next month.

We still don't know if the bootloader has implemented a kernel version check.

If the bootloader doesn't have a kernel version check then there is no issue, we already know it can boot Android 12. If the bootloader does have a kernel version check then all that has to be done is to spoof it to get a custom Android 12 kernel booted.

Nobody has flashed the Android 12 images after booting Android 13, so we don't know yet.

GrapheneOS has already reverted the commit that enables the ARB bits, but that only stops the bits from being set on devices that have never booted Android 13. ROMs can do this to prevent untainted devices from being tainted, but for what?

I'm more concerned if it's a complete rollback prevention and this marks Google abandoning freedoms in the vain of security. We already know that the Titan internally is a mess. They implemented ARB in the firmware of the Titan, to prevent downgrade attacks, but then just never used it. Then a downgrade attack was performed on the Titan. If Google is now moving towards locked down security then they're going to take measures to block any bypasses.

I don't think they are, but we'll see.
[Google Pixel 6 Pro] Divine Bicycle:
Do I need to do the slot change if I usually use the Android Flash Tool to upgrade to Android 13?
[Google Pixel 6 Pro] djo_5296:
anyone else experience this?

when a notification pops up, the keyboard closes which prevents you from typing. While the notif is present also, i cant do a Back gesture and exit the current screen im on, unless i click on an already existing back button.

dont think its my modules again since it's just ACC and the VoLTE one aside from the default magisk modules

edit: this seems like the only search result i could find that describes my issue https://issuetracker.google.com/issues/193920125?pli=1 and it seems like its been around since last year D:
[Google Pixel 6 Pro] roirraW "edor" ehT:
I doubt it.
[Google Pixel 6 Pro] Lughnasadh:
A penny saved is a penny earned.

Two pennies saved and you have doubled your fortune.

--Old Pagan proverb 🙃

Weird about the bootloop but sounds like you're all sorted out and ready to fly 🕊️😁
[Google Pixel 6 Pro] Lughnasadh:
For what it's worth...

https://twitter.com/i/web/status/1559786740050644992
[Google Pixel 6 Pro] roirraW "edor" ehT:
I posted the following elsewhere.

Personally, I think Android 13 is much smoother than Android 12, and when I reboot the phone, the home screen loads noticeably faster the first time I unlock it. I've been withholding full judgment one way or another on 13 because it takes time to observe all the overall differences objectively, and sometimes there is also a placebo effect with a new shiny Android version, but my general impression is that Android 13 compared to 12 is like Android 5.11 compared to 5. But honestly not as big a difference as the 5->5.11 changes - just reminiscent of that situation, although Android 5.x was when I was still using non-Google OEM phones.

Since the other user's questions led me to write a tiny very early mini-report on Android 13, I figured I might as well share it here as well.

I will add that I don't consider the bootloader not being able to be downgraded to the one from Android 12 a problem at all. I certainly don't plan on trying to jump back to 12. I like the improvements in 13 that I've noticed so far.
[Google Pixel 6 Pro] Bunnehbunn:
I've been following the android 13 upgrade postings and I'm surprised not more people know this.

If you add --force to fastboot update "fastboot --force update image-*" you can downgrade back to Android 12 as long as you wipe data.

I tried this as soon as I upgraded to 13 and yes you can downgrade down to Android 12 after upgrading with no noticable issues. The radio and every other image but the bootloader can be downgraded. But I only tried 003, 004 July images for oriole so I don't know about anything lower personally.
[Google Pixel 6 Pro] roirraW "edor" ehT:
Thanks! I have linked to/quoted your post in the OP for reference. It was suspected as possible but no one had yet been willing to test and report back, including me, and which I didn't blame anyone else for not wanting to. 😂

@V0latyle The news you were waiting on hearing. 😎
[Google Pixel 6 Pro] Bunnehbunn:
I've known about this since the Pixel 3XL Android 9 days. You could edit the android-info.txt in the image*.zip to match the updated bootloader if you didn't want to add --force but --force will ignore the bootloader version check for the factory image and it's just easier. I will assume though that android 12 otas will be useless even on custom roms though (you could do the same technically if you use payload dumper and replace the output of that with what's in the factory image and do the same, another thing that's worked in the past on the Pixel 3 at least)
[Google Pixel 6 Pro] roirraW "edor" ehT:
https://twitter.com/i/web/status/1559893884120928256
[Google Pixel 6 Pro] gpvecchi:
There's a thing I didn't understand: my phone has got the update throught the OTA. So, have I the bootloader flashed just to one slot?

If so, if my OS becomes corrupted, my phone will die.

Is this correct?
[Google Pixel 6 Pro] V0latyle:
AFAIK the factory image doesn't need a specific bootloader version, it just needs a bootloader that's the version it shipped with or newer. Did you try flashing without the --force argument?

Potentially, although it does seem the brick happened in a rather specific situation. To be safe, you can flash the new bootloader to both slots.
[Google Pixel 6 Pro] roirraW "edor" ehT:
OTAs update the slot that you weren't currently using, and then when you reboot the phone, it boots into the new updated slot and proceeds to apply the OTA to your remaining slot. That was the whole purpose of the A/B slot deal, so you could update without being kept from being able to use your phone, ideally reboot and it reboots right into the updated slot, then proceeds to update the old slot.
[Google Pixel 6 Pro] roirraW "edor" ehT:
@Homeboy76 try

Official Google Android Flash Tool

(OEM Unlocking needs to be toggled on - you may not have to manually unlock the bootloader - the "site" will do that on its own). It has fixed many user's issues including my own, when no other method including flashing the full factory image, didn't help.

I guess I was under the impression you fixed the issue.
[Google Pixel 6 Pro] Bunnehbunn:
Yes, without --force it requires the older bootloader
[Google Pixel 6 Pro] 96carboard:
Its not a suicide fuse, its a counter fuse.

Somewhere in the bootloader code is says "if (counter > x) halt_execution();"

The issue that is happening is that when you have a certain number of FAILED BOOTS, it automatically switches to the other slot. So if you have ONE SUCCESSFUL BOOT, it increments the counter, and then if you have a bunch of FAILED boots, it switches to the other slot with the old bootloader, which bails.

There's probably an error in the code. Its probably supposed to go into some kind of restoration mode when that happens, but that doesn't seem to be happening, unless maybe its something else like UART?
[Google Pixel 6 Pro] V0latyle:
Now we know!

So to avoid this, it would be good practice for everyone on the P6 / P6Pro / P6a to update both bootloader slots, so that in the event that boot fails and it "recycles" to the old slot, there won't be an issue.
[Google Pixel 6 Pro] roirraW "edor" ehT:
Thanks, I'll update the OP again just as soon as I can.
[Google Pixel 6 Pro] V0latyle:
Thing is, this only works for those with unlocked bootloaders. Do we know for sure the brick only happened in an isolated circumstance? I imagine there's going to be more than a few "normal" users who update via OTA, whose phones recycle back to the old slot...
[Google Pixel 6 Pro] Homeboy76:
I only fixed the boot loop.

I want to Root but the errors in the magisk_install...log indicates there is a problem with the magisk_patched...img
[Google Pixel 6 Pro] roirraW "edor" ehT:
Good question, but no idea. I try not to speculate about theoretical situations.

Try

Official Google Android Flash Tool

. Then re-root. If you want to try the site without wiping data, make sure and uncheck the option to wipe data, and uncheck the option to force flash all partitions. However, with your issue, it might be necessary to do both. Try one way and then try the other.

Note that Force Flash All Partitions alone will also wipe the device.
[Google Pixel 6 Pro] Homeboy76:
This may be a very dumb question, but how will using the flash too fix the Magisk problem?
[Google Pixel 6 Pro] 96carboard:
Yes!
[Google Pixel 6 Pro] roirraW "edor" ehT:
If I knew that, then I'd probably be in a different profession and making much more money. 🤣

As I said, the

Official Google Android Flash Tool

has solved many users' issues, including my own, that nothing else would solve including flashing the factory image. You may be surprised. I was when it fixed whatever issue I had many months back, and very many users in this section were equally surprised it solved their particular issues, too.

I don't know what else to suggest in your situation. If you don't try it, you'll never find out if it'll solve your issue.

I have no idea why or how it can solve something that the full factory image doesn't, but I like that it does.
[Google Pixel 6 Pro] Homeboy76:
Thanks.

Your "If I knew that, then I'd probably be in a different profession and making much more money."

Made my day! :ROFLMAO::ROFLMAO::ROFLMAO:

Thanks again!
[Google Pixel 6 Pro] roirraW "edor" ehT:
LOL! You're welcome, I hope it helps.
[Google Pixel 6 Pro] allenjthomsen:
ahh got you if you see anyone that has a tmobile device in this thread can you let them know to try that and see if it works to make the oem unlock work ill try to keep up and see if anyone does myself
[Google Pixel 6 Pro] Olorin92:
Yep I've gotten about as far - rooted my 6 pro fine, however safetynet is the sticking point. Have tried USNF + MHPC with no luck.
[Google Pixel 6 Pro] bd177:
BL unlocking breaks Gpay.
[Google Pixel 6 Pro] aygul12345:
Totally argee, Ive seen so much SafetyNet Workarrounds, but its not working.
[Google Pixel 6 Pro] mkhcb:
Stupid question time: I know OnePlus still honors your warranty if you unlock your phone. Will Google do the same? I doubt they would, but I figured I should ask.
[Google Pixel 6 Pro] loxacodito:
There are no official sources, but based on peoples' anecdotal experiences, it seems that un-rooting and re-locking the bootloader will preserve warranty.
[Google Pixel 6 Pro] Nekromantik:
Anyone actually got SaftyNet to pass using forked version of Magisk with MagiskHide and Universal SaftyNet module?
[Google Pixel 6 Pro] 96carboard:
It has absolutely NO IMPACT on the hardware warranty. Software warranty sure. In fact, as an American company, Google is legally forbidden from cutting your warranty. Its a US federal law called the Magnuson-Moss Warranty Act: https://en.wikipedia.org/wiki/Magnuson–Moss_Warranty_Act

In addition to that, Google is also in a position where making software changes of this nature are actually part of the *explicitly intended use* of the device, since its configuration is specifically designed to allow you, the purchaser, to unlock the firmware, and build and install your own -- which they provide on their own website https://android.googlesource.com/

Its impossible for them to claim that you are not using the device as intended when they facilitate that specific use.
[Google Pixel 6 Pro] Freak07:
you can find boot and vbmeta.img for rooting SD1A.210817.036 here:

https://xdaforums.com/t/boot-vbmeta-imgs-for-november-firmware-sd1a-210817-036.4353807/

​
[Google Pixel 6 Pro] Deeglifsay:
so I have the pixel 6 (not the pro) but I'm posting here bc my respective forum is sorta dead. this is where all the action is. any word on unlocking a bootloader for a pixel 6 acquired from T-Mobile US? I didn't even think about the possibility of my bootloader being locked by my carrier bc I always went through Google prior to this one
[Google Pixel 6 Pro] roirraW "edor" ehT:
I know there was someone in this forum who had a suggestion to try for T-Mobile to get the OEM Unlocking ungrayed, but I don't know who it was, which thread it was in, or what exactly was suggested, other than I believe something using ADB to disable something. I think they didn't have their own T-Mobile 6 Pro yet and were waiting for it, so they were trying to see if others with the T-Mobile 6 (Pro) were able to test their idea in the meantime. I'm afraid you'll have to do some searching or just read a lot to find it unless some other folks remember what or where exactly it was.

Good luck!
[Google Pixel 6 Pro] lucky_strike33:
will this work with verizon?
[Google Pixel 6 Pro] V0latyle:
For those of you trying to pass SafetyNet, this is what I recommend:

Patch the boot image using 23011 if previous versions don't work. Remove 23011 and go back to 23001. Root will still work, and you'll be able to use the "old" method of Riru + Universal SafetyNet Fix 2.1.1 + MagiskHide Props Config 6.1.1.. This doesn't work on Pixel 6

This is working on my Pixel 5 running build SP1A.210812.015. Zero issues with banking, GPay, DRM, etc. For some reason Play Store doesn't think Hulu is compatible with my device though. Make sure you use MagiskHide on Google Play Store too.
[Google Pixel 6 Pro] roirraW "edor" ehT:
I don't think anyone with the T-Mobile or Verizon variants of the 6 Pro know if it work yet, or at least I haven't seen anyone report back either way.

@Deeglifsay, this is the suggestion I was referring to: https://xdaforums.com/t/unlocking-t...rate-fingerprint-reader.4352027/post-85850095
[Google Pixel 6 Pro] lucky_strike33:
I should be getting the verizon variant today and will try it out
[Google Pixel 6 Pro] V0latyle:
If the phone is bought from Verizon or from Google specifically for Verizon - no. Bootloader unlock is required for root. I don't know about TMobile though.

I doubt that will have any effect on whether the bootloader can be unlocked. See here:

That flag is what determines if OEM Unlocking is enabled.
[Google Pixel 6 Pro] roirraW "edor" ehT:
Cool. Let us know either way and I'll add what you find out works or doesn't work for the Verizon variant to the OP. I suggest not taking the OTA if you get offered it. Thanks and good luck!

I, too, doubt if it will work for either variant, but unless you're saying it's definitely been tried using this method I figure it doesn't hurt to know. Then I can at least explicitly report that it doesn't work if so.
[Google Pixel 6 Pro] Pekempy:
Just tried this, unfortunately the 'Magisk Hide' toggle unchecks itself after I leave the settings screen, and I don't get any magisk hide options anywhere. I can't patch boot image or use direct install as 23001 fails to patch boot image on P6P.

Hopefully someone else has better luck than me with this
[Google Pixel 6 Pro] mang0:
On T-Mobile variants, the OEM unlock toggle is generally greyed out if the phone is sim locked (on EIP). The command on i.e. the N200 allowed the OEM unlock to be toggled to on without getting the device unlocked thru T-Mobile.
[Google Pixel 6 Pro] V0latyle:
@Homeboy76 what version of Magisk? You've been doing this long enough that I know to not offend you by asking if you're using the right image lol
[Google Pixel 6 Pro] Homeboy76:
Magisk Canary 9b61bdfc(25201)
[Google Pixel 6 Pro] V0latyle:
Hmm. Get a screenshot of the Magisk log when you patch the boot image and post it here, the Magisk gurus such as @pndwal and @ipdev can probably be more help