yashsingh1/xdaforums huggingface dataset:
[Google Pixel 6 Pro] jss11:
Sorry if I've misunderstood but that first repo has a recent commit but where are the releases? The second repo is the one I used but it's similar: recent commits but no recent releases since January. Am I missing something? Do I need to compile the source into an APK myself? I thought we are supposed to use the release tab?
[Google Pixel 6 Pro] FireRattus:
I mean, the fact they have recent commits shows they are not unmaintained, unmaintained to me means like actually abandoned with no commits

Yeah they are not on the latest magisk 27 yet but I expect that will be released in releases when it's ready, the original Kitsune Magisk repo doesn't even appear to provide any releases and you are expected to compile it yourself but HuskyDG has releases they have built and provided which is also why there is a delay between updates on Magisk Kitsune and Releases by HuskyDG
[Google Pixel 6 Pro] jss11:
Ok I understand now. Thanks for the help! Do you know any way to get lsposed to work on Graphene OS? Probably not but thought I'd ask.
[Google Pixel 6 Pro] organophosphate:
Unfortunately I have been unable to get Zygisk to work on P8P GrapheneOS build 2024071200 with any of the Kitsune Magisk versions mentioned (the one linked here, F2357DBC, or the more recent releases such as R6687BB53).

When using the avbroot magisk/preinit (sda10) approach, Magisk loads and root is functional, but Zygisk is not.

Attempting to patch the OTA boot.img via Kitsune app on the device & use that prepatch img with avbroot results in... nothing at all (no root).

I'd try rolling back to the GrapheneOS 2024062700, but it seems they pull the old release binaries very promptly.
[Google Pixel 6 Pro] jss11:
Have you tried to use Zygisk Next? I'm not entriely sure why Zygisk doesn't work with the new build of Graphene but Zygisk wasn't working on my android emulator and I flashed the Zygisk Next module and it started working.

Luckily I still have the old OTA downloaded but I won't upgrade just yet due to the issue you've mentioned.

Do you think a new build of Magisk will solve this for Graphene? Do you think I am making a big security risk not using the new Graphene build?
[Google Pixel 6 Pro] organophosphate:
No. GrapheneOS broke the method signatures as part of "hardening". There was a PR in Magisk to support this GrapheneOS quirk and Magisk rejected it. You can see how the issues are being closed on Magisk.

This is why the posts since the beginning of 2024 have been focusing on Kitsune/Magisk Delta, with a fork that apparently does support GrapheneOS' quirk.

Another open question is whether there is an LSPosed fork that works with that. Right now that is academic for me given I don't even have zygisk running.
[Google Pixel 6 Pro] organophosphate:
On avbroot issue #84: "Did run Magisk Delta app and it did ask to perform additional steps, same as Magisk (Stable). This time though it gave three options - following recommendation elsewhere (Magisk Delta thread on XDA), in-place option has been used and feeling was it was the closes to normal Magisk (as is more basic)."

That resulted in hard brick (i.e. permanent). It seems this was tacitly describing a process that involved direct install of Magisk, which of course corrupted the signatures. Concerningly enough, two people in that issue claim hard bricks from this while saying they had never disabled OEM unlocking (which would have allowed recovery).

I was already planning to never relock my bootloader, so at least the risk to my device would be less for trying such things.
[Google Pixel 6 Pro] i_bl00dy:
What do your Magisk Delta Logs say about zygisk? When I first ran into it I found the signature mismatch.

see EX

Spoiler content hidden.
[Google Pixel 6 Pro] organophosphate:
Thanks. Until I allowed Magisk to "perform additional setup" it wasn't loaded (though su worked).

However, the first time I allowed Kitsune to perform the additional steps, I had v26.4-kitsune-2 loaded via avbroot of the GrapheneOS 2024071200 OTA (I've tried about 5 different versions of Kitsune/Delta now, trying to get this to work)... this version was the first version with release notes that explicitly stated support for GrapheneOS. Despite stating support for GrapheneOS it gave the same errors your logs showed.

I rebuilt the OTA using R6687BB53-kitsune (debug) and now zygisk loads after I allowed the additional setup.
[Google Pixel 6 Pro] jss11:
Oh I was under the impression we had to use the old debug version. That is the newest one right?

Here:

So we just choose app-debug.apk and build the OTA with that one?
[Google Pixel 6 Pro] organophosphate:
Yes and yes, then let it do the "additional setup" Kitsune Mask prompts to perform, and reboot again.

Still having no luck with LSPosed_mod 1.9.3 though... I have little use for zygisk if I can't get an XPosed.
[Google Pixel 6 Pro] GOSrooter:
so i managed to figure out this whole process on my own (AVB instructions were very helpful), except step 7 which i realize i didn't do until i found your post. can you explain what it does and whether i should go back and do that as well?

seconded
[Google Pixel 6 Pro] organophosphate:
Okay, I got a canary build of LSPosed_mod working and so XPosed modules are functioning.

You can install the zygisk-debug version here. The LSPosed notification "tap here to open manager" remains broken. I had to install the manager manually from the zip file. However, once that was performed I could launch the manager directly and everything seems fine. Modules are working.

This is all incredibly tenuous, of course. The next OTA may break everything entirely with no recourse.
[Google Pixel 6 Pro] organophosphate:
I'd recommend extreme caution on that step 6 "use direct install as recommended". If you are doing a Magisk install via the "Install" method and choose "Direct Install (recommended)" that is how several people perma-bricked their devices. I have Magisk/zygisk up and running and the Kitsune Mask app still offers me this option.

If you want to try it, triple check that (at least) OEM Unlocking is enabled so you can try to bail out if/when your device is rendered unbootable.

Personally, I prefer the unlocked bootloader approach, though GrapheneOS zealots may call in a Hellfire missile drone strike on me for endorsing such heresy.
[Google Pixel 6 Pro] GOSrooter:
ouch! yeah i didn't use the direct install method luckily.

knowing them i'll put big money on them actually doing so given the chance :D

will try out the canary lsposed_mod and report back
[Google Pixel 6 Pro] GOSrooter:
canary lsposed_mod doesn't work for me unfortunately, having any xposed module active will break the systemui
[Google Pixel 6 Pro] User.Hemlock:
Did you have a chance to do this writeup? I have a Pixel 7 with Graphene, and I'm very interested in reflashing it to get root/magisk. But this would be my first time rooting a phone, so I'm pretty out of my depth here! A guide would be fantastic, if you have one
[Google Pixel 6 Pro] FireRattus:
You don't need to build graphene from source, you can pretty much just follow the steps for AVBRoot to patch the Graphene OTA and just flash that, I have already updated the first post to help people with this simpler method
[Google Pixel 6 Pro] shoey63:
@FireRattus

Can this method be used on stock pixel 6 ota's?

Or Graphene only?
[Google Pixel 6 Pro] FireRattus:
AVBRoot is not made for GrapheneOS, I believe it should work perfectly fine on the Stock OTA's or other ROMs
[Google Pixel 6 Pro] User.Hemlock:
Thanks! If you don't mind a few clarifying questions, since again this is all new to me, and the last thing I want to do is miss something basic and end up with an $800 brick...

So, just following the steps with AVBroot will result in a rooted, Magisk-installed GrapheneOS with a locked bootloader, yes?

Do these steps work identically for Pixel 7, or do they have to be modified like @holofractal implied?

Do these steps include the "safetynet fix" you mentioned to pass basic attest?

When you said "GrapheneOS does not pass the profile integrity check", is that true for ALL Graphene including the official build, or just for this rooted version?

Will this receive automatic OTA updates from Graphene just like the unrooted OS would?

Does Xposed also work with this, or only Magisk?

Thank you for your hard work!
[Google Pixel 6 Pro] FireRattus:
Yes essentially, You just use the official OTA, patch and install that then you will have a magisk patched build installed where if everything was done correctly with AVBRoot you would be able to lock your bootloader with root

There has been different updates to AVBRoot and looking at all the comments and updates it does look like it should support all pixel devices including older and newer ones, but I do not have a pixel 7 to test it

https://github.com/chenxiaolong/avbroot/issues/5

the SafetyNet fix is this https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-3-1.4217823/

it wasn't being developed for a long time but recently has had a pre-release which should work for the pixel 7 to pass safetynet, Although I don't know if this will even work on Graphene

It is true for the official GrapheneOS https://grapheneos.org/usage#banking-apps

If you patch and use say the official grapheneOS then when it updates, your device will want to download and install the OTA they provide, except the OTA they provide is unpatched, and so if you do install official updates they will remove root, If you patch each update before installing it, then you shouldn't have a problem

Xposed is quite old afaik and not really something you should use at this point

Things like LSPosed have essentially replaced it as far as I understand and LSPosed dos work

My pleasure, I am glad it is appreciated
[Google Pixel 6 Pro] User.Hemlock:
Thanks so much! Are you familiar with this thread [GUIDE] Pixel 6 "oriole": Unlock Bootloader, Update, Root, Pass SafetyNet? It describes some stuff about safetynet that I'm not sure whether it's the same as what you've done, or if it's better/worse. Regarding OTA updates, it says:

Will those steps also work with automatic official Graphene OTA updates if I rooted it by following your guide? (If not, how would I be able to patch and flash updates with a locked bootloader?)
[Google Pixel 6 Pro] FireRattus:
I don't think that will work because with a locked bootloader it enforces AVB (Verified Boot)

When you install Magisk that way it patches the boot image and breaks the signature so verified boot fails

You need to patch the OTA with AVBRoot so that it's signed and you will pass the AVB Verified Boot protections

the steps in that thread are for an unlocked bootloader only

If you want to flash updates with a locked bootloader, it's as simple as using AVBRoot on the latest OTA update, and using the same keys you used the first time

Then of course flashing that patched OTA with adb sideload

As I explain in the guide, near the end, Once you have patched the OTA with AVBRoot just follow the official instructions for updating https://grapheneos.org/usage#updates-sideloading
[Google Pixel 6 Pro] Tresans:
Hello all,

Is there also a build for Pixel 6a ?

So with magisk + Graphene + updateable ?

Kindly regards

I have not a decent Pc to build one myself.
[Google Pixel 6 Pro] FireRattus:
If you follow the simple guide and just use AVBRoot on the official graphene releases it should work for you and you won't need a powerful computer

The Guide at the moment I have split into the simple way and the better more complicated way
[Google Pixel 6 Pro] Artem Pisarenko:
Spoiler content hidden.
[Google Pixel 6 Pro] Artem Pisarenko:
I was able to get rooted stock ROM (latest OTA from Google) with locked bootloader on Pixel 6a using this guide (slightly modified).

Some thoughts:

In initial setup firmware needs to be flashed to both slots (although guide seems to be targeted for any device, but it mentions A/B partitioning and Pixel phones without implementing such an awareness in instruction). It doesn't seem (for me) to be specific for stock ROM, so I wonder if anybody was able to get success even with GrapheneOS without modification. I don't remember exactly why it didn't work for me, because I tried various combinations, but I started with not being able to lock bootloader. It seems that both slots should better be flashed consistently with either stock ROM, or custom/rooted OS + custom key. Firstly, flashing must be done in this way:

fastboot --slot=all flash boot extracted/boot.img
fastboot --slot=all flash vendor_boot extracted/vendor_boot.img
fastboot --slot=all flash vbmeta extracted/vbmeta.img
fastboot erase avb_custom_key
fastboot flash avb_custom_key /path/to/avb_pkmd.bin

Secondly, OTA must be sideloaded two times (to occupy both slots).

Python 3.9 required. No older, no newer. Only 3.9.x versions. Python >= 3.9 required. At least in current avbroot version. Also python ... invokations should be better to be replaced with python3 ....

Preparing build environment isn't simple for newbies, especially on Windows. Now I'm trying to put avboroot into virtual machine to simplify this process. It found to be quite challenging to make it compact (both in its size, RAM usage and overall space required on host hdd)...

Thanks @FireRattus for this wonderful tool!
[Google Pixel 6 Pro] FireRattus:
This is true but the way I do it with the patching the official factory build, the flash-all.sh does flash it to both slots

fastboot --set-active=other
fastboot reboot-bootloader

by setting the active partition to other and then rebooting to flash everything again on the other slot, you don't have issues

Once you have gotten a working patched build with a locked boot loader, then updating is quite simple and you just need to do what it explains here https://grapheneos.org/usage#updates-sideloading

I have never needed to sideload the OTA two times, it always seems to update successfully after just side-loading one time

It's not meant to be used on Windows, it's meant for a linux environment afaik and I wouldn't recommend trying to do it on Windows, a virtual machine is a solution that would work but you can just run linux from a USB and it would be much faster than in a VM

I do appreciate it also but I am not the developer of AVBRoot

I highly recommend you open a github issue or do a pull request if there is changes or improvements you would like to see be done in AVBRoot

Edit: It looks like the dev has recently updated AVBRoot to work on windows
[Google Pixel 6 Pro] Artem Pisarenko:
OUTDATED!

See new post with updated version.

Spoiler content hidden.
[Google Pixel 6 Pro] shoey63:
Getting stuck on this step

Running on Linux Mint cinnamon 20.3

Anyone have a solution?
[Google Pixel 6 Pro] Artem Pisarenko:
Python version >= 3.9 required.

BTW. I written earlier in this thread that version should be exact 3.9.x, but it was my mistake (I've just messed with several python installations.)
[Google Pixel 6 Pro] Artem Pisarenko:
{Mod edit: Quoted post has been deleted. Oswald Boelcke}

This thread and my personal experience prove that it is NOT true ;). Your statement would be (almost) true given that words "locking bootloader" mean procedure targeting moving device into "green" verified boot state according to android documentation. The subject we discuss here is moving device into "yellow" state. Both green and yellow states require bootloader to be in "LOCKED" state, but requirements are different. I'm not sure what you mean with "softlock". Turning device into "hardbrick"? My experience with Pixel 6a showed that my failed attempts to lock bootloader (before I did everything right) wasn't ended so dramatically. When I issued "fastboot flashing lock' and phone wasn't satisfied with flash contents, it just rejected attempt (command returned FAIL with message I don't remember now). I guess, phone (after receiving the command) performs check and ensures that it can boot after locking, and if so, it accepts the command and asks user an confirmation via device screen and power button. But, of course, it would be better not rely on such phone behaviour and be careful. Therefore, yes, procedure maybe dangerous in general.
[Google Pixel 6 Pro] FireRattus:
{Mod edit: Quoted post has been deleted. Oswald Boelcke}

When locking or unlocking the bootloader it will trigger a wipe of all the user data but your phone will still be usable after, It does not turn it into a brick in my experience, you will need to have flashed a properly signed build signed with your own custom avb keys as instructed by AVBRoot
[Google Pixel 6 Pro] LukasKarer:
Any chance of doing this with the stock OS?
[Google Pixel 6 Pro] FireRattus:
I believe you can use AVBRoot with the stock OS
[Google Pixel 6 Pro] shoey63:
Can confirm. I achieved it on stock January firmware for pixel 6.
[Google Pixel 6 Pro] morphvale:
Yup, just did this today on P6 with January firmware.
[Google Pixel 6 Pro] LukasKarer:
Is your phone with locked bootloader with magisk installed eligeable for DRM L1 or does it go to L3?
[Google Pixel 6 Pro] morphvale:
Locked bootloader, Magisk 25206, DRM L1, Basic integrity and CTS profile match Pass, Device certified in Play Store.
[Google Pixel 6 Pro] LukasKarer:
Can you recieve updates for the OS when having Magisk installed with locked Bootloader without root access vanishing?
[Google Pixel 6 Pro] FireRattus:
Since you are only able to lock the bootloader if the boot partition etc are properly signed with the keys that you flash to your phone as the avb_pkmd.bin

the official OS update will have a bootloader which is signed by a different key

Now I don't know exactly what will happen if you do this with the official OS

but with Graphene OS or any other non google official rom, I believe your phone would likely not be happy with installing an update that is not signed by the key it is expecting
[Google Pixel 6 Pro] LukasKarer:
But can I somehow sideload the update if I sign it with my keys?
[Google Pixel 6 Pro] FireRattus:
Yes exactly, you just follow the instructions for AVBRoot, they also have the instructions for updating

As long as the update you flash is signed with your keys then you should have no problems with sideloading it

You can also follow the instructions here https://grapheneos.org/usage#updates-sideloading it's basically the same instructions with any OTA but just use the OTA you patched with AVBRoot
[Google Pixel 6 Pro] cb474:
Hi, thanks for this guide. I'm thinking of doing this on a Pixel 5a. My main interest is just so that I can use Titanium or another root based backup app, in order to migrate data for some apps from an older phone to the 5a. After that, I won't need root.

So would it be safe to follow the guide, when I set up the phone, and then just let GrapheneOS update normally, once I don't need root anymore, thereby eliminating root?

Also, if I wanted to root again later, for some reason, would that mean I would have to unlock the bootloader and, effectively, wipe the phone and then set it up all over again?

Unrelated to that, I'm wondering, why do you say building grapheneOS oneself, rather than patching the official graphene OTA, is more secure? (I have a really old computer, so I don't think it's up to the task of compiling a ROM.)
[Google Pixel 6 Pro] FireRattus:
You would be able to follow the guide and then update grapheneOS normally but only if you do not lock the bootloader, official grapheneOS uses different keys to the ones you will make and use in the guide

so you won't be able to switch from your custom patched build to an official build without unlocking the bootloader

The main reason for building it yourself instead of trusting official sources is that you cannot always be certain the official builds are actually the same source as what is provided, it's possible for malicious updates to be provided from their update server, although this is extremely unlikely, their keys could be stolen or leaked or just one of the people working on graphene goes rogue or gets hacked etc

Using your own keys and building it from source yourself means you have much more control

If say law enforcement was able to coerce the cooperation of grapheneOS to provide a signed file which allows them to easily brute force or unlock the phones somehow, they wouldn't be able to do this if you use your own keys, there are several reasons why it's a good idea to build from source instead of trusting precompiled builds
[Google Pixel 6 Pro] cb474:
I see. So there's no real advantage to the AVBroot method, in the scenario I outline. If I have to leave the bootloader unlocked, I could just root GrapheneOS the normal Magisk way.

Oh, okay. So your recommendation to build from source is not specific to rooting grapheneOS and relocking the bootloader. It really applies to using any custom ROM. It's always more secure to build it oneself.

Thanks for the reply and the explanations.
[Google Pixel 6 Pro] pixel7:
Did anyone tried this to bypass cts profile check :

Pixel 7 Pro CTS profile fail · Issue #224 · kdrag0n/safetynet-fix

Hello I am getting CTS profile fail and I tried the modded version also. Is there a way to fix this?

github.com

Somebody commented how he bypassed it ( idk about grpaheneOS )
[Google Pixel 6 Pro] baraasoliman:
Can I also do that with calyx os?
[Google Pixel 6 Pro] baraasoliman:
Can I also do that with calyx os ?
[Google Pixel 6 Pro] FireRattus:
never tried it, but I assume it should work

AVBRoot should work with any rom you can lock your bootloader with
[Google Pixel 6 Pro] i_bl00dy:
On a Pixel 4a5G. using the Graphene OS = factory-2023020200, ota_update-2023030400. Magisk = v25.2 (25200)

I got it working after much frustration. Thanks for your instructions.

What version of Magisk are you using? @FireRattus

I ran AVBroot in a virtual machine to get all the files I needed. Just follow steps 1-5,7 from https://github.com/chenxiaolong/avbroot

EDIT: copy from my other post:

I just made a new VM using ubuntu 22.04

Spoiler content hidden.

/EDIT

For whatever reason my environment variables didnt work out, so I used the local command invoke of fastboot and adb.

My process to help others:

First get to the fastboot menu by turning on the phone while holding the Vol down button.

Spoiler content hidden.

Spoiler content hidden.

Use the Vol up to select recovery, then use the PWR button to select.

After the Android man has his guts exposed, hit the PWR + Vol up to expose commands.

select apply update from ADB using Vol down and then PWR.

Spoiler content hidden.

If the phone displays "Install from ADB completed with status 0" then it worked.

reboot the phone to fastboot again. then lock the bootloader.

Spoiler content hidden.

After you boot into the phone, before connecting to wifi, disable auto system updates using developer mode, and disable app updates in the APPS app manager. Install the Magisk app, open the app, and hit OK to complete the setup.

If at that point you can reboot/boot into the OS you have a rooted phone with a locked bootloader.

PS: I took most of these commands from the Graphene OS installer flash-all.bat if you have a different phone.
[Google Pixel 6 Pro] FireRattus:
My Pleasure, I use the latest version (25.2)

You only need to do the commands

.\fastboot erase avb_custom_key

&

.\fastboot flash avb_custom_key ".\Path\To\avb_pkmd.bin"

to flash the custom AVB Key, Re-flashing all those files is not required if you flash the patched OTA
[Google Pixel 6 Pro] i_bl00dy:
The first 2-3 times I tried it, the patched OTA wouldnt flash for what ever reason. so I combined step 8 from AVBroot and the --slot=other from the graphene OS flash_all.bat to flash all the things to make sure I didnt miss anything.

# Flash the boot images that were extracted
for image in extracted/*.img; do
partition=$(basename "${image}")
partition=${partition%.img}

fastboot flash "${partition}" "${image}"
done

# Flash the AVB signing public key
fastboot erase avb_custom_key
fastboot flash avb_custom_key /path/to/avb_pkmd.bin

I'll try slimming it down on my next phone. Dont want to mess it up now that things are working :P. I bought this one to confirm that I can have both root and a locked bootloader before jumping at the newer ones.