yashsingh1/xdaforums huggingface dataset:
[Google Pixel 6 Pro] spida_singh:
Hey sn00x

At what point do you run this code? Im building this / following this guide for the first time, and just want to understand exactly 'when' you apply the following (im assuming i should do this first):-

DEVICE=cheetah
cd /path/to/android-build-top
source script/envsetup.sh
choosecombo release $DEVICE user

Im just wrapping up

the repo sync -j8

Using the Graphene guide and want to get this right.

At what steps do you run:-

AVBROOT=/path/to/avbroot.py
MAGISK=/path/to/Magisk-v26.1.apk
MAGISK_PREINIT_DEVICE=persist
cd $ANDROID_BUILD_TOP
if [ ! -f keys/$TARGET_PRODUCT/releasekey.pem ] ; then openssl pkcs8 -topk8 -inform DER -in keys/$TARGET_PRODUCT/releasekey.pk8 -out keys/$TARGET_PRODUCT/releasekey.pem ; fi
python $AVBROOT patch \
--input out/release-$TARGET_PRODUCT-$BUILD_NUMBER/$TARGET_PRODUCT-ota_update-$BUILD_NUMBER.zip \
--privkey-avb keys/$TARGET_PRODUCT/avb.pem \
--privkey-ota keys/$TARGET_PRODUCT/releasekey.pem \
--cert-ota keys/$TARGET_PRODUCT/releasekey.x509.pem \
--magisk $MAGISK \
--magisk-preinit-device=$MAGISK_PREINIT_DEVICE

Appreciate its a bit of a noob question, but i want to start building this myself, pre-rooted, with your Android Auto patch, and potentially see if I can get device integrity passing as part of the play integrity checks.

I believe it requires PS, GMS and GSF all to be system apps 'only', but i cant be sure until i start digging a bit deeper and understanding what it is about GrapheneOS that stops something like displax's USNF module from working.

Thanks, and thanks to FireRattus for the great guide, learning a lot! :)
[Google Pixel 6 Pro] Naturesretard:
Would you mind sharing a guide or quick'n'dirty process on how to implement this? I'm exceedingly more interested in AA than root. But I may have to follow you cuz integrated services sounds so much better then root on graphene
[Google Pixel 6 Pro] Venator3:
I'm trying to build from source, but I'm a little confused on what appears to be a a very recent change to tags. The newest release has a tag of just numbers (2023062800), so I tried using this as the tag name, but how do I find the build id now? Using the same number as the build Id says the image is not found, as expected.
[Google Pixel 6 Pro] FireRattus:
So where I am now finding the BUILD_ID is from here https://developers.google.com/android/images

The file name includes the BUILD_ID, for example 13.0.0 (TQ3A.230705.001, Jul 2023)

But according to the now updated official build guide (can obtain the correct BUILD_ID from build/make/core/build_id.mk)
[Google Pixel 6 Pro] dansand:
Has anyone managed to get ctsProfileMatch working at all for gpay/wallet. ive tried all the fixes i could find on a fresh gos and havent managed to get it working as of yet
[Google Pixel 6 Pro] FireRattus:
If you are using AVBRoot then when I pass the preinit device name is when patching the OTA

--magisk $MAGISK \
--magisk-preinit-device $MAGISK_PREINIT_DEVICE

Using a pre patched image like the ones I provide for the Pixel 6 and 6 Pro would eliminate the need to patch it yourself

although it's really quite simple to use AVBRoot to patch it yourself once you do it and know the process
[Google Pixel 6 Pro] Venator3:
I've built the whole OS now but got stuck on

script/release.sh raven

Where the output is: expected OUT in the environment

And I have not been able to resolve this, anyone know the solution here?
[Google Pixel 6 Pro] Rescue9:
Output should be here: $BUILD_NUMBER/Patched/
[Google Pixel 6 Pro] Venator3:
Are you saying that this is where the output of script/release.sh raven should be? For me the script fails and I get expected OUT in the environment, so I guess there is no output.
[Google Pixel 6 Pro] Rescue9:
It sounds like you $SOURCEROOT is not properly setup. If you can, ignore the script and just run the commands from the terminal. Then you can see exactly where it fails and you can backtrack from there to see what isn't properly setup.
[Google Pixel 6 Pro] FireRattus:
Are you successfully running all the commands in order according to https://grapheneos.org/build ?

I believe the OUT it's talking about is the out folder where the temporary and final build files are all located

if you have successfully run the previous commands without error before you get to the step of running the release.sh script, then you should already have an OUT folder with the correct files in it for the build to complete
[Google Pixel 6 Pro] Venator3:
I believe so yes, didn't notice any errors, and the directory out/ does exist, with lots of files inside.
[Google Pixel 6 Pro] FireRattus:
You can try doing what Recue9 suggested, you can also try using Graphenes official channels or forum for support with building it from source, just don't mention that you want to root it, they don't like that
[Google Pixel 6 Pro] sn00x:
Meanwhile I've created a new one. With the help of this patch it is possible to run Android Auto as user app(!) under GrapheneOS (and probably other Android 13 roms, cause it doesn't rely on GrapheneOS itself).

It also provides a layer for Screen2Auto that only grants invasive permissions (draw over other apps, accessibility service) while connected to a head unit or screen sharing. That means you can watch Netflix on your head unit and even use it as a touch screen while not granting any of those permissions to Screen2Auto when they are not needed.

Follow these basic instructions to build
[Google Pixel 6 Pro] Venator3:
Finally got everything to compile correctly and successfully flashed the OS. However, I have run into a bit of an issue with magisk, where upon opening the app I get:

Your device needs to re-flash Magisk to work properly. Please reinstall Magisk within app, recovery mode cannot get correct device info.

However, if I do direct install, upon reboot I get an error that there is no operating system. Not sure if I did something wrong still? I reflashed and everything seems to work fine, including granting root permission to apps, but still get this error in magisk.

EDIT: this was caused by a mismatch of the Magisk version, installing 26.1 on my phone fixed the issue (this is the version I used during compile). This leaves the question of how to update magisk? If I go to 26.3 and direct install, I again get a no os warning, which I presume is due to the locked bootloader.
[Google Pixel 6 Pro] FireRattus:
You cannot update magisk with magisk itself unfortunately

You will need to use AVBRoot to patch a future OTA Update zip which you can then flash

This is required with a locked bootloader because installing magisk normally will change the signatures that the bootloader checks
[Google Pixel 6 Pro] shark12345:
I have a question so I installed graphene OS on my google pixel 6a. And at the end I locked it. But I tried to unlock it again and turn back to android which I succed.So my question is what should I do to lock that graphene OS forever? So I want to do that to lock it forever so if someone wants to do something they can not do anything except to throw it in the garbage?? Thanks
[Google Pixel 6 Pro] FireRattus:
You should not do this because it can risk turning your own phone into a brick, your data on the phone should be inaccessible if you used a secure password or pin, and they would need to factory reset the phone to be able to use it

If you have Enable OEM Unlock Disabled in the developer settings then it would not be possible to unlock the bootloader without first enabling OEM Unlock ( to my knowledge )
[Google Pixel 6 Pro] Saw26:
Hey, FireRattus! Tried to follow the simple method from your guide to patch OTA but ran into problems.

What I've done:

1. Installed GrapheneOS using the web installer. Locked the bootloader in the end. And I believe I booted once.

Followed the AVBRoot guide:

2. Generated keys and cert (section "Generating Keys")

3. Patched the full OTA ZIP (oriole-ota_update-2023100300.zip) via

.\avbroot.exe ota patch --input oriole-ota_update-2023100300.zip --privkey-avb avb.key --privkey-ota ota.key --cert-ota ota.crt --magisk magisk.apk --magisk-preinit-device metadata --output oriole-ota_update-2023100300-patched.zip

I'm not exactly sure if --magisk-preinit-device is correct. I've got it by flashing your Magisk patched build and following the AVBRoot guide (patched the boot image via the Magisk app). Can someone confirm if metadata is the correct value?

Also magisk.apk is the latest (v26.3).

4. Unlocked the bootloader.

5. Then flashed the patched OTA in recovery mode:

adb sideload oriole-ota_update-2023100300-patched.zip

At this point I've got the "Signature Verification Failed" error.

Then I tried again after redoing steps from AVBRoot guide, but with the same result.

What am I doing wrong? Maybe I misunderstood your instructions and it should be done the exact following way:

1. Unlock the bootloader.

2. Flash the official GrapheneOS build.

3. Reboot into recovery without locking bootloader.

4. Flash my patched OTA.

5. Then

fastboot erase avb_custom_key
fastboot flash avb_custom_key avb_pkmd.bin

6. And only then lock the bootloader

Is that it?

I didn't try it this way and tbh after running into couple more errors I'm afraid to brick my phone, and just want to confirm what I'm doing.

My setup:

Pixel 6

Windows 10

PowerShell
[Google Pixel 6 Pro] FireRattus:
You do not lock your boot loader before you flash the patched OTA And the custom AVB Key

I believe you are experiencing the Signature Verification Error because you have not completed the initial steps that are recommended by AVBRoot in the Usage Section https://github.com/chenxiaolong/avbroot#usage

that is Steps 7 - 9

If you had graphene installed on your phone, then used Magisk to patch the boot image of grapheneOS and it told you that the pre-init device name is metadata then I would believe that is correct

I slightly updated the instructions in the first post to try to make it more clear
[Google Pixel 6 Pro] Saw26:
Oh, now I get it. Thanks for the quick response!

Could you please help me with rewriting step 7 into a Powershell script, please?

# Flash the boot images that were extracted
for image in extracted/*.img; do
partition=$(basename "${image}")
partition=${partition%.img}

fastboot flash "${partition}" "${image}"
done

I beleive it's something like this:

foreach ($image in Get-ChildItem extracted/*.img) {
$partition = $image.BaseName

fastboot flash $partition $image.FullName
}
[Google Pixel 6 Pro] FireRattus:
My Pleasure. You don't need to use the script they share, you just need to flash the images using fastboot

So if you reboot your phone to the bootloader screen then enter these commands from the flash-all.sh then it should flash all the appropriate files

fastboot flash --slot=other bootloader bootloader-name.img
fastboot --set-active=other
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash --slot=other bootloader bootloader-name.img

Do this to flash All the images you extracted in step 6

(Using the flash-all.bat from the grapheneOS full install build just as an example of the commands)
[Google Pixel 6 Pro] Saw26:
del
[Google Pixel 6 Pro] Saw26:
Okay, I'm an idiot.

fastboot flash --slot=other boot boot.img
fastboot --set-active=other
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash --slot=other boot boot.img

fastboot flash --slot=other vbmeta vbmeta.img
fastboot --set-active=other
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash --slot=other vbmeta vbmeta.img

fastboot flash --slot=other vendor_boot vendor_boot.img
fastboot --set-active=other
fastboot reboot-bootloader
ping -n 5 127.0.0.1 >nul
fastboot flash --slot=other vendor_boot vendor_boot.img

Edit: there was a PEBCAC problem :D

Thank you very much for your help, FireRattus!

One more question though:

How to flash update to both slots? Doesn't adb sideload ota.zip do this itself?
[Google Pixel 6 Pro] FireRattus:
My Pleasure :)

Yeah I haven't had any issues just doing "adb sideload ota.zip" from recovery and then rebooting to system

The flash to both slots is mostly just standard info provided by people, just like the flash-all script flashes it to both slots, it's not necessarily required but it helps to prevent any issues
[Google Pixel 6 Pro] Saw26:
Got it.

Thanks again, FireRattus :)

Have a good day!
[Google Pixel 6 Pro] :
I've been trying to make this all work for a MONTH! I'm not a coder or a dev and the instructions are missing key information for people like me. The commands don't work because the computer doesn't recognize any of them. What command processor are you using? I only know powershell and it doesn't like any of the commands either. This is why I do it with magisk. Extract the boot image, copy it to the phone, patch it, then flash it. Simple. Works every time. Probably quicker too. I really don't need to lock the bootloader THAT badly!
[Google Pixel 6 Pro] FireRattus:
You should be using Linux for the commands provided by AVBRoots instructions

If you don't need to lock the bootloader then there is no need to be using AVBRoot and you can just use Magisk itself

it is much quicker and easier to just use Magisk, but then you don't have the security of a locked bootloader

I have been thinking about making a instructional video using Windows to patch a rom using AVBRoot but idk I may not end up doing it
[Google Pixel 6 Pro] FireRattus:
Okay I did it sooner than I expected, Here is a video showing start to finish me using AVBRoot on Windows to patch an OTA, install it to my phone, lock the bootloader and install magisk

Let me know what you think of the video, I welcome feedback, I tried to use copyright free music but youtube flagged pretty much every track so idk what will happen there
[Google Pixel 6 Pro] FireRattus:
-snip-
[Google Pixel 6 Pro] lichtblitz:
Hi, I'm trying this for my Pixel 7 Pather. GrapheneOS is installed (panther-factory-2023101300.zip). So I followed the guide. After flashing extracted files:

fastboot flash boot init_boot.img
Sending 'boot_b' (65536 KB) OKAY [ 1.565s]
Writing 'boot_b' OKAY [ 0.122s]
Finished. Total time: 1.701s

fastboot flash vbmeta vbmeta.img
Sending 'vbmeta_b' (8 KB) OKAY [ 0.001s]
Writing 'vbmeta_b' OKAY [ 0.039s]
Finished. Total time: 0.042s

fastboot flash vendor_boot vendor_boot.img
Sending 'vendor_boot_b' (65536 KB) OKAY [ 1.638s]
Writing 'vendor_boot_b' OKAY [ 0.120s]
Finished. Total time: 1.760s

fastboot erase avb_custom_key
Erasing 'avb_custom_key' (bootloader) avb custom key: erase done
OKAY [ 0.057s]
Finished. Total time: 0.058s

I got slightly different response while flashing avb key:

fastboot flash avb_custom_key avb_pkmd.bin
Warning: skip copying avb_custom_key image avb footer (avb_custom_key partition size: 0, avb_custom_key image size: 1032).
Sending 'avb_custom_key' (1 KB) OKAY [ 0.001s]
Writing 'avb_custom_key' (bootloader) avb custom key: flash done
OKAY [ 0.059s]
Finished. Total time: 0.061s

and now I'm stuck at fastboot (unlocked). The following command bings my phone always into fastboot:

fastboot reboot recovery
Rebooting into recovery OKAY [ 0.000s]
Finished. Total time: 0.001s

Any suggestion what I did wrong?
[Google Pixel 6 Pro] FireRattus:
Try flashing the patched OTA zip before you flash the avb custom key to see if that helps

Did you have grapheneOS already installed on your phone before you started the process?
[Google Pixel 6 Pro] lichtblitz:
Correct. GrapheneOS was already installed (panther-factory-2023101300.zip)
[Google Pixel 6 Pro] FireRattus:
What you can also try for GrapheneOS

with the Factory installer / full install build

Extract the folder inside it containing the full contents of the zip

delete and replace the avb_pkmid.bin with the one created with AVBRoot

then open the image-<device>-<build>.zip

In this zip you will want to delete and replace the images that you extracted from the patched OTA using AVBRoot

Install the Factory build using the install bat / sh then install the Patched OTA via adb sideload in recovery
[Google Pixel 6 Pro] FireRattus:
so I think the problem is that the command fastboot reboot recovery itself may just not be working as apparently it's not standard although some devices respond to it

have you tried rebooting into recovery by selecting it?

you can also try fastboot boot image.img

and passing the recovery image for grapheneOS

Source https://android.stackexchange.com/questions/201212/how-can-i-reboot-into-recovery-from-fastboot
[Google Pixel 6 Pro] lichtblitz:
Well what I did so far:

1. re-flashed panther-factory-2023101300. It worked so I could boot into the system

At this point 'fastboot reboot recovery' & 'adb reboot sideload' work like intended.

2. After flashing again init_boot.img, vbmeta vbmeta.img and vendor_boot.img I can't reboot into recovery -> stuck with fastboot

Strange thing is that can't test Magisk while booting with a magisk-patched init_boot.img into system. 'fastboot boot init_boot.img' . System boots but Magisk still says not installed.

Btw which img container shall be patched? boot.img 67,1 MB or init_boot.img 8,4 MB?
[Google Pixel 6 Pro] lichtblitz:
Yes pixel7 does do it but only with a standard GrapheneOS

I did it always with twrp and my old oneplus devices. It seams that Pixels do not support this: https://github.com/grapheneos/platform_bootable_recovery
[Google Pixel 6 Pro] lichtblitz:
OK I found the error. The correct commands are:

fastboot flash init_boot init_boot.img
fastboot flash vbmeta vbmeta.img
fastboot flash vendor_boot vendor_boot.img
fastboot erase avb_custom_key
fastboot flash avb_custom_key avb_pkmd.bin
fastboot reboot recovery
adb reboot sideload
adb sideload ota.zip.patched
adb reboot

I did not lock the bootloader yet. But I'm confident it will be only cosmetics. :)

Flashing init_boot.img as boot seems to be wrong. Nevertheless thanx for support.

Tested on debian12 (nuc12i5) and macOS Ventura (MacStudio m2)
[Google Pixel 6 Pro] FireRattus:
I would use the boot image not the init boot, I don't think you are supposed to be patching the init boot with magisk

That is useful to know, thank you

I am very glad that you found a working solution, Could you also have selected Recovery as a boot option from the bootloader as well? so you don't need to first boot system then ADB reboot to recovery
[Google Pixel 6 Pro] lichtblitz:
Me too. However, the commands:

./avbroot ota patch \
--input ota.zip \
--key-avb avb.key \
--key-ota /ota.key \
--cert-ota ota.crt \
--magisk Magisk.v26.3.apk \
--magisk-preinit-device persist

followed by:

./avbroot ota extract \
--input ota.zip.patched \
--directory extracted

produce:

ls -lah ~/panther/extracted
--
-rw-r-r 1 foo bar 8,0M 17 Okt 11:40 init_boot.img
-rw-r-r 1 foo bar 8,0K 17 Okt 11:40 vbmeta.img
-rw-r-r 1 foo bar 64M 17 Okt 11:40 vendor_boot.img
--

However, in the GrapheneOS / Android 14 factory you will find them both

-rw-r-r 1 foo bar 64M 18 Okt 09:12 boot.img
-rw-r-r 1 foo bar 8,0M 18 Okt 09:12 init_boot.img

I don't think I should flash the init_boot.img into boot partition..?

I could of course patch boot.img manually, pass it to avbroot and flash as boot partition, but then avbroot might need to be fixed...

It might be Android 14 specific due to the hint: https://xdaforums.com/t/how-to-fix-bootloop-after-updating-and-root-to-a14.4636134/

I dunno.
[Google Pixel 6 Pro] FireRattus:
I think you are correct, I saw that AVBRoot recently did have some updates for android 14 support but it's likely there could be some issues with it, or it's just how android 14 is

I think the easiest solution to get a signed patched boot image would be to patch the boot image extracted manually from the factory installer

and then pass that prepatched image to AVBRoot using the pre patched image option

Then when you do the extract command it should extract that boot image

Unless I just don't understand it correctly which is very likely

It seems that you have gotten it working just by flashing the init_boot image, it is likely that AVBRoot does present all the correct images you need to flash, as I have noticed for my OnePlus I didn't have to flash the vendor_boot.img
[Google Pixel 6 Pro] jemail:
Trying your guide for a Pixel 6a with GrapheneOS and I have questions.

When generating keys you are asked for a passphrase, If I add a passphrase will that passphrase be asked for when I boot my Pixel 6a? Will the passphrase ever be required when using GrapheneOS on my Pixel 6a.

Also, can I apply the avbroot method to the GraphenOS factory image as well as the OTA?

Thank you for your excellent work on this.
[Google Pixel 6 Pro] i_bl00dy:
Small update. I have successfully upgraded to Android 14 on my Pixel 4a5G.

Not sure what is going on, but every time that I reboot, I seem to have 3-5 apps optimizing. Phone works just fine otherwise. I will try flashing rootless to see if it will ever finish optimizing soon (tm). I have used the latest Magisk v26.3 (26300) and the latest AVB as of 2 days ago (not sure if 2.2.0 or 2.3.0). Took me a little while to figure out AVB to convert to the new executable in the release.

Not sure if I'm correct, but I think that the passphrase is just used to encrypt the keys while the files are at rest. So you will need to use the passphrase(s) when making a patched OTA with AVB. The passphrase is never used on the phone.

according to avbroot github

its just for OTA's

The conventional method has been to flash the factory Image, then your custom key.bin, and then the custom OTA overtop (twice for both a_boot and b_boot)

PS. you can pass the argument --rootless instead of --magisk and AVB will just replace the keys and otherwise leave the OTA alone if you have any issues with root.

PPS. There is a Magisk clone called Magisk Delta that you can use to recover from a bootloop. source I have not personally tried it, but others have reported success.
[Google Pixel 6 Pro] FireRattus:
I made the Factory images I shared by extracting files from the patched OTA using AVBRoot and then replacing those files in the Factory image with the patched ones as well as the AVB key

See here for the detailed commands I used https://xdaforums.com/t/guide-to-lo...-grapheneos-magisk-root.4510295/post-88791053

You can do it manually with 7zip instead of using commands

You should only do this with matching OTA and Factory versions

I am not even sure if this will work because I have only done this with my own builds and not the official ones

edit:

echo Extract Patched files to patch factory image
python avbroot.py \
extract \
--input $SOURCEROOT/out/release-$DEVICE-*/$DEVICE-ota_update-*.zip.patched \
--directory $BUILD_DIR/TempOut/$DEVICEU
echo testing replacing zip files
cd $BUILD_DIR/TempOut/
echo Unzip Factory Build
unzip $DEVICE-factory-$BUILD_NUMBER.zip
echo Add Correct AVB Key to Extracted files
cp ../avb_pkmd.bin $DEVICE-factory-$BUILD_NUMBER/avb_pkmd.bin
cd $DEVICEU
echo Replace old image files with magisk patched files
zip -u ../$DEVICE-factory-$BUILD_NUMBER/image-$DEVICE-$BUILD_NUMBER.zip *
cd ..
echo zip together all patched and updated files
zip -r GrapheneOS-$DEVICE-factory-patched-$BUILD_NUMBER.zip $DEVICE-factory-$BUILD_NUMBER/*