yashsingh1/xdaforums huggingface dataset:
[Google Pixel 6 Pro] Cares:
So you're failing Widevine?

I'm on alpha Magisk and still on L1. Downgrading to L3 is a huge pain in the ass. My 4XL even after reverting to stock couldn't get unflagged for L3. It was permanently stuck.
[Google Pixel 6 Pro] nycdiplomat:
i could not get root to persist after a reboot even after wiping and starting over. Safetynet passes, netflix shows up and banking apps work. I noticed I had issues with my keyboard glitching after switching from canary to the alpha which is why i decided to wipe and start over. Good to go now. Thanks for putting this together OP!
[Google Pixel 6 Pro] snovvman:
An equally important issue is to achieve permanent root each time after a patch update

without having to wipe

. Going forward, please report your experiences and any new procedures. I'm hoping there will be a new image tomorrow (Nov 1) for us to test.

Using @V0latyle's procedure, I have been testing by factory flashing to A4, root, then sideload OTA to C2, flash vbmeta and patched boot while in fastboot (not bootloader). Twice now, the phone boots fine but no root. If I go back to fastboot and re-flash vbmeta and patched boot, I get corrupted data. I'm still trying to figure out what is going on.
[Google Pixel 6 Pro] snovvman:
From what I can tell, after sideloading OTA, flashing vbmeta, the fastboot flash boot command flashes the patched boot to the inactive slot. This is why I don't have root. Trying again, I used the --slot all switch, but got an error when flashing to the other slot. After rebooting the phone and going back into fastboot, fastboot flash boot automatically flashes the active slot but triggers a need to wipe. Clear as mud, I know, but it's what I am seeing so far.
[Google Pixel 6 Pro] Anonshe:
Just to clarify, are you confusing fastboot and fastbootd? The former is the bootloader while the latter is the userland fastboot. vbmeta has to be disabled in fastboot aka bootloader; doing so in fastbootd isn't going to give the desired effect.
[Google Pixel 6 Pro] rester555:
You need to select show system apps in magisk to see the Play services. But it seems like if you follow the messages in the thread, you don't need to do that.
[Google Pixel 6 Pro] Olorin92:
This is what I was referring to - there's some more tips in there now as well 😄

Zygisk breaks Riru in new Canary Magisk · Issue #109 · kdrag0n/safetynet-fix

Just a heads-up really. While Riru and Zygisk (as well as USNF 2.x.x) were working nicely together in vvb2060 Alpha Magisk before todays builds, Riru is now is broken with Zygisk w/ latest TJW comm...

github.com
[Google Pixel 6 Pro] snovvman:
I was following these:

https://xdaforums.com/t/read-this-before-rooting-your-raven.4352531/post-85859133

https://xdaforums.com/t/read-this-before-rooting-your-raven.4352531/post-85859313

Note the writing "If you flash the images in bootloader, you will have to wipe." This has been my experience as well.
[Google Pixel 6 Pro] Anonshe:
Btw with USNF 2.2.0 being out as a Zygisk module, SN passes with Magisk Canary. It's an early access module

There seems to be some confusion in those posts.

Fastbootd is meant to flash contents of the super partition such as system, vendor, product. Due to dynamic partitions, those are now a part of a super partition which is flashed via regular fastboot aka bootloader.

Vbmeta is a low level partition too so it needs to be flashed via the bootloader. Data wipe is unavoidable the first time vbmeta and dm-verity are disabled but can be avoided during OTA updates.

So, for the first root attempt this is how things should go:

1. Get the latest boot.img of your device. If it's older than the firmware on your device, it is fine. Get the vbmeta image too.

2. Install Magisk Canary apk on device

3. Click Install -> Patch an image. Here select the boot image you've extracted in step 1. The patched image will be saved in `/sdcard/Download/`. Copy it over to your PC.

4. `adb reboot bootloader` to boot into fastboot

5. `fastboot flashing unlock` if BL hasn't been unlocked

6. `fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img`

7. `fastboot -w` the first time you're disabling vbmeta.

8. Reboot device once to ensure the system has been wiped and is bootable after disabling vbmeta

9. `fastboot boot magisk_patched.img`

10. You'll now be booted with temp root. Open Magisk and click Install -> Direct Install

We boot the patched image instead of flashing it so that you can root even if the latest stock firmware image isn't available yet.

For monthly updates, don't update via System Update but by using the OTA images released by Google.

1. Download the OTA package to PC.

2. Use payload dumper to get the latest boot image for patching as steps above. Extract the vbmeta image too.

3. `adb reboot recovery`

4. Install update via adb sideload. It's imperative, the device isn't booted into system upon completion.

5. Reboot to bootloader from the menu in recovery

6. `fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img`

7. `fastboot boot magisk_patched.img`

8. Direct Install from within Magisk Manager.
[Google Pixel 6 Pro] mac796:
Ok so I followed your guide to root. I'm to the point where I boot magisk, when I try to direct install in the app, when I boot back up it doesn't stick, should I try to flashing it. I'm on the newest firmware using that boot img, that was posted. I patched it with the latest canary. Thanks.

Edit ok I finally got it. I had to fastboot flash boot magisk name.img. I couldn't get it to stick with the app.
[Google Pixel 6 Pro] snovvman:
Same with me, tried it twice, boot did not stick. I next flashed the patched boot in bootloader and it stuck.
[Google Pixel 6 Pro] snovvman:
Thanks. I read about the 2.2.0 working and sounding promising. Looking forward to trying it.

Appreciate the explaination. It's helpful.

Question regarding boot the patched image rather than flashing it. If the boot.img was available to be patched, does it not mean that the firmware image is available (along with the OTA image)? Also, could I just flash the boot in bootloader rather than direct install? Are there other reasons or advantages using direct install?

Please see my post above. The direct install did not stick, but flashing the boot worked. I read about .36 update causing some issues with booting a patched image, I hope it's an anomaly. In any case, thanks for the information. It's working at this time (with the exception of the direct install not sticking).
[Google Pixel 6 Pro] rester555:
So did you guys follow all the steps and then flash the patched boot. Or did you just skip to the part where magisk was supposed to be booted and flash it?
[Google Pixel 6 Pro] V0latyle:
Vbmeta can still be flashed via fastboot. In fact, this is the recommended way to update without having to wipe:

* Sideload the OTA, when complete you'll be in recovery

* Select "enter fastboot"

* Reflash /vbmeta (with disable flags) and /boot

* Reboot

It should be noted that when in fastboot, you can only flash the inactive slot, as fastboot (and recovery) both live in /boot. You can flash both slots from bootloader...but if you reflash vbmeta from bootloader, you'll get put into Rescue Party and have no choice but to either reflash to stock, or wipe.
[Google Pixel 6 Pro] rester555:
How do you know which is the inactive slot? Is it the slot that is not called out in bootloader?
[Google Pixel 6 Pro] V0latyle:
Yes

If "active slot: b" then you know A is the inactive slot
[Google Pixel 6 Pro] snovvman:
Thank you.

I am looking for some clarity regarding vbmeta flash, whether as above "Vbmeta can still be flashed via fastboot [via recovery]. In fact, this is the recommended way to update without having to wipe" or as below "Vbmeta is a low level partition too so it needs to be flashed via the bootloader."

Also, regarding "but if you reflash vbmeta from bootloader, you'll get put into Rescue Party", by "reflash", do you mean after subsequent OTA sideload updates?

My experience from yesterday using @Anonshe's procedure, flashing vbmeta in bootloader did not cause me having to wipe or reflash. I started with a fresh image flash A4, rooted, wiped, then OTA sideloaded to C2, flashed vbmeta in bootloader, then patched boot, and did not have to wipe. Of course, don't know what will happen next time.

Am I missing something? Again, thank you to @Anonshe and @V0latyle.
[Google Pixel 6 Pro] diesteldorf:
I'm currently using the forked Alpha version of Magisk and am running the stock build with no OTA updates installed.

I went into Fastboot mode.

I flashed vbmeta before flashing (not booting) the patched boot.img to slots A & B.

After I rebooted and verified that I was permanently rooted. I installed RIRU and an the current public release of Universal SafetyNet. Everything works great.

When the newest version of Universal SafetyNet Fix is released, I plan to revert to one that supports Zygist.

Just want to verify the steps.....

1. Uninstall the Alpha Version of Magisk

2. Reboot.

3. Install latest Canary Version of Magisk that is Zygist compatible.

4. Patch the boot.img

5. Go into fastboot and flash vbmeta with disable flags and then flash the new patched boot file.

6. Reinstall RIRU and Universal Safety Net fix.

Just want to avoid wiping all data, but if that happens, it isn't a big deal.
[Google Pixel 6 Pro] snovvman:
With my limited knowledge, the USNF 2.2.0 supports Zygist, which means Riru is not needed.

My plan, to reduce risk of having to wipe and make my life simpler, is that once I have a reliable non-wipe update procedure (to be tested by using the Nov update), is to patreon @kdrag0n and get 2.2.0 from the get go. I am just using my P4XL and testing w/ P6P until I am ready to migrate.
[Google Pixel 6 Pro] V0latyle:
@Anonshe is incorrect, /vbmeta can be flashed from fastboot, not just from bootloader.

Yes...Or at any point. If you flash /vbmeta from bootloader with verity and verification disabled, you will have to wipe data. Reflashing without the disable flags doesn't always work either, the last time I experimented with this my only option to recover was by wiping data.

This is the ideal method for update that won't result in having to wipe.

Unfortunately, until someone figures out how to get around this issue, users wishing to root their Android 12 devices must understand a couple things:

* The only way to update and reroot is via OTA sideload. I say "reroot" instead of "not losing root" because sideloading the OTA writes both /vbmeta and /boot, so a patched image does not survive the update. Therefore, it's necessary to reflash /boot with the new patched image.

* Anyone trying to root an Android 12 device should be aware of the very real possibility that they may lose data, and there may be absolutely no way to recover it if something goes wrong. I say this because the process to retain data *and* reroot after an update is very specific, and this new issue we are dealing with doesn't take much to get into trouble.

For example:

If you sideload the OTA, you have ONE CHANCE and ONE CHANCE ONLY to immediately flash /vbmeta and /boot in fastboot, without having to wipe afterwards. If you reboot, your chance is gone. So, if you got excited and forgot to download the factory zip and patch the new boot image before you sideloaded the OTA, you're screwed - the best you can do is boot into unrooted system and make sure your data is backed up.

You can't sideload the OTA on the same or newer firmware, so you can't just "do it again". Going back into fastboot after a reboot and trying to flash those partitions won't work, either. You can dirty flash the factory image as long as it's the same version, but if you touch /vbmeta you'll end up in Rescue Party.
[Google Pixel 6 Pro] dimm0k:
I take it going forward no more flashing of the full image without a wipe?

EDIT: looks like this was just answered
[Google Pixel 6 Pro] V0latyle:
Nope. If you want to update bootloader and radio, you will have to do so separately.
[Google Pixel 6 Pro] Anonshe:
Direct install should stick but since flashing worked, I guess that's the method you should stick to. My P6P has been delayed by Google so all I can experiment on right now is my P5.
[Google Pixel 6 Pro] snovvman:
Thanks for taking the time to reply in detail.

This is what was confusing--I was able to flash /vbmeta with verity and verification disabled in bootloader (along with patched boot) after sideloading OTA and was able to boot with data preserved. In my case flashing in bootloader did not cause a wipe. Any thoughts?

Good tips. If I recall correctly, I made sure to never boot, then I can dirty flash .A4, then OTA to B1, C2, or C4. If something went wrong, I just dirty flash to .A4 image again and OTA to a later-versioned build. I see that the November builds .036 and .036.A8 are posted. More testing!
[Google Pixel 6 Pro] Anonshe:
The fastboot you're referring to is "fastbootd". By referring to it as fastboot, you're mixing things up as fastboot mode is what the bootloader loaded off the abl is known as.

As stated in the official docs, fastbootd is a userspace fastboot that's handy for flashing contents of a super partition. Vbmeta and boot images should be flashed via the bootloader aka fastboot mode for the simple reason, that's when the device is booting off the "abl".

The userspace fastboot is stored in the same partition as the recovery so when you're flashing via it, you've already loaded the boot image of the current slot. This causes the issue of being able to flash vbmeta and boot only to the inactive slot.

If you were in bootloader aka the abl fastboot, simply running a "fastboot --disable-verification --disable-verity flash vbmeta vbmeta.img" command would disable vbmeta of the current slot. No slot shenanigans thus required.

- Sideload OTA

- Reboot to bootloader

- Disable vbmeta and flash patched boot image

- Reboot system

This keeps vbmeta disabled post-update and is way better than flashing stuff to the inactive slot and doing a slot switcheroo.
[Google Pixel 6 Pro] Anonshe:
This is the intended behaviour of the steps you did so do future OTAs the same way to keep your data.
[Google Pixel 6 Pro] V0latyle:
Except it doesn't work. Trust me, I've tried. You CAN flash partitions while in fastboot, just as you can in bootloader - the difference being, you can only flash to the inactive partitions.

If you try to flash vbmeta in bootloader, you WILL get dumped into Rescue Party when you boot, and aside from dirty flashing the system image to recover to rootless system, your only option will be to wipe.

I have no idea why there is a difference, but there is. The ONLY way to be able to reroot when updating is to do exactly as I described: sideload the OTA, select Enter Fastboot, then flash vbmeta and boot. If you reboot to bootloader, you may as well just start system, because you've lost your chance to disable verity and verification while retaining data.

I'm not above being proven wrong, though, so if flashing /vbmeta and /boot in bootloader after OTA actually works....then the biggest issue we've been facing is officially settled.
[Google Pixel 6 Pro] Anonshe:
In the flash-all script, remove the "-w" flag in the last step and add "--skip-reboot". Disable vbmeta then reboot system to keep your data after flashing a full image. That's how I upgraded between one of the Beta fws but to ensure it still works, I'll be updating my P5 tomorrow and will post my findings.
[Google Pixel 6 Pro] Cares:
To use Payload Dumper it says Python is required. Is there something similar that we can use to extract boot and vbmeta images? This would help me save time from downloading both full factory images and the OTA.
[Google Pixel 6 Pro] Anonshe:
With all due respect, this is incorrect. Not only have I done this multiple times (in bootloader not fastbootd) but so have others on the Pixel 5 telegram channels. You can ALWAYS flash partitions to the current slot successfully.

Again, this is incorrect. I've done it, and so has snovvman in the post above yours. Your issue seems to be occur from something you've been doing wrong unfortunately.
[Google Pixel 6 Pro] Anonshe:
Payload Dumper can be used on the OTA zip to extract the images. You don't need to download the full factory image.
[Google Pixel 6 Pro] dimm0k:
attempting to flash the OTA image, but not able to get adb to connect in recovery. am I missing something? I'm able to see the device while the phone is up and running with adb devices, but booting into Recovery with adb reboot recovery I get the message that the device is unauthorized. I've tried revoking adb while the phone is up and running, but still no go!
[Google Pixel 6 Pro] Cares:
Right, I'm asking if there's a version of Payload Dumper or something similar that doesn't need Python.
[Google Pixel 6 Pro] Anonshe:
Did you get to the recovery menu where you've to select "Update via ADB"? The droid with an exclamation mark is recovery mode but you've to enter the recovery menu by doing the following:

On your screen, “No command” is displayed. Press and hold the Power button. While you hold Power, press the Volume Up button and let go of both buttons quickly.

Adb will be authorised only after you've selected the option to sideload an OTA package.
[Google Pixel 6 Pro] Anonshe:
Not that I'm aware of. Sorry.
[Google Pixel 6 Pro] V0latyle:
Never said you couldn't. You can flash partitions to your heart's content in bootloader, so long as the bootloader is unlocked.

I first came across this problem when the October Android 12 stable release hit the Pixel 5.

Previously, on the 12 Beta, all we had to do was flash /vbmeta with the disable flags. One would think this should be unnecessary, as unlocking the bootloader should disable AVB, but I digress.

However, when the stable release hit, everyone who was upgrading discovered that attempting to use the same process as we had before didn't work anymore. This was true regardless of how the update was performed. I personally took the automatic OTA, and as expected, lost root after the update. Others sideloaded the OTA, while yet others still dirty flashed the system image. In all cases, if we only updated and did not modify anything, we were able to successfully boot, albeit without root.

It was when we tried to follow the same root process as had worked on the 12 Beta that we ran into this new issue.

If /vbmeta was reflashed in bootloader with the --disable flags, the device would invariably bootloop once, and end up in Rescue Party - regardless of whether the boot image was stock or patched. The only way to recover was to reflash /vbmeta without flags, and of course the stock boot image too. The only option to gain permanent root was to wipe /data, at which point the device would boot just fine with verity/verification disabled and a patched boot image.

The only exception to this was updating as I described - another user, @HumorBaby actually discovered this - to sideload the OTA, immediately enter fastboot (fastbootd to you), and flash /vbmeta and /boot there.

I'm not looking for a pissing match with anyone, and I'm not just sharing anecdotal evidence. This has been confirmed by many other users on the Pixel 4a 5g, 5, and 5a, and we have been fighting with this issue for nearly a month until the Pixel 6 was released.
[Google Pixel 6 Pro] foobar66:
Boot phone normally. Then type (from a Linux shell or Windows command prompt):

> adb shell
$ getprop | grep slot

That should display the currently active slot.
[Google Pixel 6 Pro] V0latyle:
@Anonshe I'm rather confused. You just directly contradicted yourself:

So you confirmed what I've been saying, what @HumorBaby discovered - the only way to update and reroot without wipe is exactly thus. Unless you're trying to say this isn't true for the Pixel 6.

So which is it?
[Google Pixel 6 Pro] rester555:
So then going off of these instructions so I understand, you have to go to the recovery fastboot, sideload the OTA, then go to bootloader, reflash the vbmeta with disable flags, but only to the inactive slot? and patched boot to the inactive slot? then reboot... Is that correct?
[Google Pixel 6 Pro] diesteldorf:
Thanks for the reply. I made an Early Access donation and got USNF 2.2. I'll probably play around with it tonight.

The phone is great, but reminds me of holding a bar of soap.

Unfortunately, my case just shipped from California, so I'll be using my 4 XL for at least another week---USPS can be slow.
[Google Pixel 6 Pro] V0latyle:
No. I thought I made it pretty clear.

When the sideload update completes, you will be in recovery mode. DO NOT REBOOT, instead select "enter fastboot".
[Google Pixel 6 Pro] dimm0k:
just did this and disabled vbmeta while in fastbootd, rebooted into bootloader and disabled vbmeta again to be sure before booting with magisk and then doing a direct install. I take it I probably didn't need to disable vbmeta a second time in the bootloader and could have flashed the patched magisk boot image instead of booting off of it and doing the direct install?
[Google Pixel 6 Pro] Anonshe:
You said one can only flash to inactive partitions which is false.

Disabling vbmeta for the first time even on the Beta fws required a compulsory wipe. It has not changed. Subsequent disabling of vbmeta do not require a wipe provided the device hasn't been rebooted after flashing a new fw.

Because vbmeta became enabled the moment you flashed a firmware and rebooted the device. It can't be disabled after that without a wipe no matter what you do.

I'm not interested in a pissing match and this isn't a new "discovery". Other devices from other OEMs have had to do this for years hence my telegram post two days before your entire thread of the discovery.

Since you've posted a follow-up saying I've contradicted myself; what is the contradiction?

For the last time, here's a simple summary:

- Patch boot image and extract vbmeta from the OTA

- Reboot to recovery

- Update via sideload

- Reboot to bootloader

- Disable vbmeta

- Flash patched boot image

- Reboot system
[Google Pixel 6 Pro] Anonshe:
Yes, using fastbootd is redundant. Flashing vbmeta in the bootloader aka fastboot is all you needed to do.
[Google Pixel 6 Pro] Sh0X31:
Do update with "fastboot update image.zip" to .36 breake disabled verification and do I need to wipe again?
[Google Pixel 6 Pro] V0latyle:
Well, I will try this when I get home.

By this logic, one could also flash the factory image:

fastboot update --disable-verity --disable-verification --skip-reboot device-image.zip

Then simply boot patched boot image, Direct Install Magisk, and be good to go, yes?

Or, flash the patched image....

Or, boot without root, patch the image, reboot into bootloader, and flash /boot in case you were a dumbass and forgot to patch the boot image before you started?
[Google Pixel 6 Pro] Anonshe:
It should work but what I've usually done is:

fastboot --skip-reboot update image.zip
fastboot reboot bootloader
fastboot --disable-verification --disable-verity flash vbmeta vbmeta.img

Flashing/booting the patched image can be done anytime after that. The one and only important thing is to disable vbmeta between updates without booting up in between.
[Google Pixel 6 Pro] B1nny:
I have been reading a couple of threads and haven't found an answer to what actually happens when you boot without disabling the verity & verification on vbmeta. Do you have any insight in that? Or perhaps a link to somewhere that describes it.
[Google Pixel 6 Pro] rester555:
Since the OTA and factory images are released now for .036, is the boot image for the factory image different from the OTA boot image?
[Google Pixel 6 Pro] Anonshe:
Without disabling vbmeta, Verified Boot remains turned on which won't allow you to flash/boot a patched boot image containing magisk. To root A12 on newer Pixels, vbmeta needs to be disabled.

Disabling vbmeta requires a data wipe and that's unavoidable the first time one disables it. After an OTA, disabling vbmeta before the first boot allows us to skip wiping the data.
[Google Pixel 6 Pro] snovvman:
I carry both an iPhone and Pixel. iPhone 12 Pro Max and 13 are even more "soapy". They are wider than the P6P. But yea, I know what you mean.

Please do report your experience with 2.2.0. I will be doing the same in a day or two.