[OnePlus 12] spatterlight:
What it is:

This guide will cover how to take a phone from fresh out of the box to rooted and passing Safetynet.

It assumes you have at least a basic knowledge of how to install and use android-tools for instances where adb and fastboot are required. It also assumes knowledge of how to do generic tasks like enabling/using USB debugging, and other high level tasks (to save space).

Each section must be completed in order.

This guide will NOT cover recovering from a brick, restoring to stock, or re-locking the bootloader.

Unlocking the Bootloader:

1. Enable Developer Options

2. Enable OEM Unlocking

3. Enable USB Debugging

4. Reboot to bootloader

1. adb reboot bootloader​

OR​

1. Poweroff​

2. Power-on while holding down the VOLUME-DOWN button​

3. Release the POWER button while continuing to hold the VOLUME-DOWN button when the OnePlus logo appears​

5. fastboot flashing unlock

6. Follow the prompts to WIPE system

Rooting the Phone:

1. Download your phones firmware from an OFFICIAL source. While unlikely, downloading from a non-official URL could be dangerous as firmware could have malicious modifications

I got my firmware from myoas.com -- an official OnePlus/OPPO/ColorOS website -- but the URLs are now dead. When the URLs have been restored to functionality (or replaced) I will update them here​

​

[/INDENT][/INDENT][/INDENT][/INDENT]
[INDENT][INDENT][INDENT][INDENT]PASSWORD: OnePlus 2021[/INDENT][/INDENT][/INDENT][/INDENT]
[INDENT][INDENT][INDENT][INDENT]EU: https://sbox.myoas.com/preview.html?fileid=1713814489&ispublish=true&code=B14e8e287d80a1830[/INDENT][/INDENT][/INDENT][/INDENT]
[INDENT][INDENT][INDENT][INDENT]IN: https://sbox.myoas.com/preview.html?fileid=1713842973&ispublish=true&code=B14e8e287d80a1830[/INDENT][/INDENT][/INDENT][/INDENT]
[INDENT][INDENT][INDENT][INDENT]US: https://sbox.myoas.com/preview.html?fileid=1713798226&ispublish=true&code=B14e8e287d80a1830

​

2. Extract init_boot.img from payload.bin, I reccomend using a tool like payload-dumper-go or FastbootEnhance -- whatever you use should be open-source

3. Transfer init_boot.img to the phone, via adb push or some other method

4. Install Magisk Canary

5. Click 'Install' -> 'Select and Patch a File' -> Select init_boot.img

6. Transfer your patched image, magisk_patched_boot.img, to your computer via adb pull or some other method

7. Reboot to bootloader

8. Flash your patched image, fastboot flash init_boot magisk_patched_boot.img

​

9. Reboot & Follow Magisk Prompts

Passing Safetynet:

There are alot of different ways to fool safetynet, with multiple different avenues and forks of forks to use. My setup works, but isn't perfect, if you have any ideas please comment!

1. Enable Zygisk in Magisk

2. Download & Install Zygisk LSPosed as a Magisk module

3. Download & Install Shamiko as a Magisk module

4. Download & Install playcurl as a Magisk module

5. Download & Install PlayIntegrityFix by chiteroman as a Magisk module

6. Add any apps you want to fool to Magisk's denylist -- but do not select 'Enforce Denylist'. Instead of the denylist being enforced by Magisk's built-in tool, we are using Shamiko which reads this list.

View attachment 6064059View attachment 6064060

With this setup I am able to pass basic & cts -- but not 'strong integrity' -- if anyone has a method for this please comment.

References:

1. https://droidwin.com/how-to-unlock-bootloader-on-oneplus-12/

2. https://droidwin.com/download-oneplus-12-stock-firmware-rom-coloros-oxygenos/

3. https://droidwin.com/how-to-root-oneplus-12-via-magisk-patched-init-boot

4. https://xdaforums.com/t/rooting-op12.4653224/

5. https://github.com/daboynb/PlayIntegrityNEXT/tree/main/Fp_Downloader.apk to use with play integrity by chiteroman