Develop Bugs

[Q] Root available for ASUS MeMO Pad 10 (ME103K)?

Greetings!
First of all, I am sorry if this is on the wrong section of the forum. Nevertheless i've tried few rooting applications which are stated to be compatible with this ME103K model, but with no results.. Also many fake sites trying to lure you to purchase something.
Is there anyone who could provide me information on how to root my ASUS ME103K tablet? Should I also try every rooting application available out there or is this useless? Can I verify if they are compatible without all the way installing and running them on the device? (Sorry don't know much about this stuff =)! )
Thank you very much in advance

I rooted ME103K on my own - by compiling a custom kernel
Executive summary: Go to youtube and watch video with ID "gqubgQjqfHw" (I can't post links yet, sorry! ) - or search Youtube for "Rooting MemoPAD10 (ME103K) with my custom compiled kernel"
Analysis:
I hated the fact that my recently purchased MemoPAD10 (ME103K) tablet had no open process to allow me to become root. I don't trust the closed-source one-click root apps that use various exploits, and require communicating with servers in.... China. Why would they need to do that? I wonder...
I therefore decided this was a good opportunity for me to study the relevant documentation and follow the steps necessary to build an Android kernel for my tablet. I then packaged my custom-compiled kernel into my custom boot image, and the video shows how I boot from it and become root in the process.
Note that I didn't burn anything in my tablet - it's a 'tethered' root, it has no side-effects.
If you are a developer, you can read in detail about the steps I had to take to modify the kernel (and su.c) and become root - by reading the questions (and answers!) that I posted in the Android StackExchange forum ( can't post links yet, see the video description in Youtube ).
If you are not a developer, you can download my custom boot image from the link below - but note that this means you are trusting me to not do evil things to your tablet as my kernel boots and my /sbin/su is run
Honestly, I haven't done anything weird - I just wanted to run a debootstrapped Debian in my tablet, and succeeded in doing so. But I am also worried about the cavalier attitude I see on the web about rooting your devices - if you want to be truly safe, you must either do what I did (and recompile the kernel yourself) or absolutely trust the person that gives it to you. I do wish Google had forced a UI-accessible "become root" option in Android, just as Cyanogen does (sigh).
The image I created and used in the video to boot in rooted mode, is available from the link show in the Youtube video details.
Enjoy!

ttsiodras said:
Executive summary: Go to youtube and watch video with ID "gqubgQjqfHw" (I can't post links yet, sorry! ) - or search Youtube for "Rooting MemoPAD10 (ME103K) with my custom compiled kernel"
Analysis:
I hated the fact that my recently purchased MemoPAD10 (ME103K) tablet had no open process to allow me to become root. I don't trust the closed-source one-click root apps that use various exploits, and require communicating with servers in.... China. Why would they need to do that? I wonder...
I therefore decided this was a good opportunity for me to study the relevant documentation and follow the steps necessary to build an Android kernel for my tablet. I then packaged my custom-compiled kernel into my custom boot image, and the video shows how I boot from it and become root in the process.
Note that I didn't burn anything in my tablet - it's a 'tethered' root, it has no side-effects.
If you are a developer, you can read in detail about the steps I had to take to modify the kernel (and su.c) and become root - by reading the questions (and answers!) that I posted in the Android StackExchange forum ( can't post links yet, see the video description in Youtube ).
If you are not a developer, you can download my custom boot image from the link below - but note that this means you are trusting me to not do evil things to your tablet as my kernel boots and my /sbin/su is run
Honestly, I haven't done anything - I just wanted to run a deboot-strapped Debian in my tablet. But I am also worried about the cavalier attitude I see on the web about rooting your devices - if you want to be truly safe, you must either do what I did (and recompile the kernel yourself) or absolutely trust the person that gives it to you. I do wish Google had forced a UI-accessible "become root" option in Android, just as Cyanogen does (sigh).
The image I created and used in the video to boot in rooted mode, is available from the link show in the Youtube video details.
Enjoy!
Click to expand...
Click to collapse
Hello ttsiodras,
I had the same problem as OP and didn't want to go the "chinese route" either, especially since there seem to be conflicting reports on whether it works on the ME103k or not so I tried your solution - with mixed results...
Disclaimer: I'm totally new to Android (colour me unpleasantly surprised) and have little experience in Linux, so for further reference I would consider myself an advanced noob. Please keep this in mind when evaluating my claims or judging what I have done so far or am capable of doing by myself in the future.
What I did:
- become developer in the ME103k by tapping the system build repeatedly, then allowing debugging via USB
- use ADB to boot into the bootloader
- use fastboot to boot your boot.rooted.img
What happened:
- I did get root access
- the tab now always boots into the bootloader, even when told via ADB or fastboot to boot normally or into recovery. Pushing buttons etc doesn't seem to work either
- my attempts to do a recovery via the vanilla Asus method has failed due to the same fact that boot never gets past fastboot
Since you claimed in your description that there would be no side-effects since it is a tethered root I am somewhat puzzled as to what exactly happened. From what I understand - which admittedly isn't a lot - what should have happened is that your boot image is loaded, giving me root access until the next reboot without changing anything about the default boot process or image. I read somewhere else that this is how people test out different kernels with fastboot before deciding on which one they want to use on their devices. The whole boot process being changed and corrupted in a way that makes the tablet non-rebootable without having the cable and an adb- and fastboot-capable machine nearby is not really what I would have expected going by your description.
Of course it is entirely possible (and probably even rather likely) that I got something wrong along the way or there is a simple fix to my problem I am not aware of.
As for possible steps maybe you or someone else in the forum could point me to a way to return my tablet to factory settings before risking damaging it beyond repair. I'm assuming that it should be possible and rather straightforward to recover the original setup with the firmware provided by Asus (downloaded the newest version from the homepage) but to be honest I'm a bit scared to go ahead with it before knowing for sure how to do this safely.
One thing seems certain: I won't be able to do it the way Asus says I should unless I can somehow get into normal or recovery boot modes again. I do however still have root access and am able to run fastboot and ADB including shell on the tablet, so it should be possible.
I would certainly appreciate any help very much
Thanks

drsiegberterne said:
. . . From what I understand - which admittedly isn't a lot - what should have happened is that your boot image is loaded, giving me root access until the next reboot without changing anything about the default boot process or image. I read somewhere else that this is how people test out different kernels with fastboot before deciding on which one they want to use on their devices.
Click to expand...
Click to collapse
Your understanding is correct - that's exactly what should have happened.
I can assure you that the kernel I compiled is formed from the Asus sources with the 2 patches I made that have *nothing* to do with the bootloader - they patch the way that the kernel allows dropping privileges and thus allowing root level access.
Something else must have happened - did you by any chance "burn" the image? i.e. `(DONT DO THIS) fastboot flash boot boot.rooted.img` instead of `fastboot boot boot.rooted.img`?
I did not advocate for burning precisely because it is unpredictable - manufactures sometimes require signing images with their private keys before allowing a boot image to boot (AKA "locked bootloaders") which means that any attempt to burn may lead to weird configurations. . .
If you did burn it, maybe you can try burning the original "boot.img" from the Asus OTA (Over the Air) update .zip file (avaible as a big download at the ASUS site - "UL-K01E-WW-12.16.1.12-user.zip" )
I know of no way to help you with the current state of your tablet, except to "ease the pain" by saying that rebooting to fastboot is always "recoverable" - you can always boot into my own (rooted) kernel or the original (from the ASUS .zip file) with `fastboot boot <whatever_image>`. No "harm" can happen from this - as you correctly said, it's the way to try new kernels and images.
UPDATE - after more reverse engineering:
I had a look into the contents of the boot loader running inside the ME103K, and I am pretty sure that if you execute this at fastboot...
# fastboot oem reset-dev_info
# fastboot reboot
... you will get back to normal, un-tethered bootings of your ME103K.
Thanassis.

ttsiodras said:
Your understanding is correct - that's exactly what should have happened.
I can assure you that the kernel I compiled is formed from the Asus sources with the 2 patches I made that have *nothing* to do with the bootloader - they patch the way that the kernel allows dropping privileges and thus allowing root level access.
Something else must have happened - did you by any chance "burn" the image? i.e. `(DONT DO THIS) fastboot flash boot boot.rooted.img` instead of `fastboot boot boot.rooted.img`?
I did not advocate for burning precisely because it is unpredictable - manufactures sometimes require signing images with their private keys before allowing a boot image to boot (AKA "locked bootloaders") which means that any attempt to burn may lead to weird configurations. . .
If you did burn it, maybe you can try burning the original "boot.img" from the Asus OTA (Over the Air) update .zip file (avaible as a big download at the ASUS site - "UL-K01E-WW-12.16.1.12-user.zip" )
I know of no way to help you with the current state of your tablet, except to "ease the pain" by saying that rebooting to fastboot is always "recoverable" - you can always boot into my own (rooted) kernel or the original (from the ASUS .zip file) with `fastboot boot <whatever_image>`. No "harm" can happen from this - as you correctly said, it's the way to try new kernels and images.
Thanassis.
Click to expand...
Click to collapse
Hi Thanassis,
thanks for your quick reply and your efforts. I'm actually around 85% sure I did not flash the image but since I had no Linux on my computer at the time (I know shame on me) I used a Mac and the command line was a bit different. Since I had never used ADB or fastboot I relied on some guide that explained how to even get into the bootloader and might have gotten something wrong.
On the other hand I later read out the commands I used in the Mac shell and couldn't find anything other than the things I should have done and described earlier, so as far as I can tell this all should never have happened. It may be interesting to point out here that the "stuck in fastboot" mode happened immediately after the first time I loaded your kernel and I most definitely just wrote fastboot boot boot.rooted.img at that point.
As for fixing the problem now it's not only about the inconvenience of the whole thing. I also later (after I was already stuck in fastboot mode) installed some apps for helping me manage privileges of different apps (xposed framework and xprivacy) which turned out to not be compatible in some way or another. So now not only is my tablet not booteable in a normal way but its also cluttered with even more useless stuff than before and I would really like to just reset it before thinking about any other possibilities.
If I flash boot the original ASUS boot image found in the file you described and which i dowloaded already, shouldn't that fix the problem if I accidentally did flash your boot image? Or will there be even more trouble?
Alternatively isn't there a manual way to flash the whole zipped recovery image or am I misunderstanding what this ASUS file actually contains?
And which of the two options is safer to try first or in other words - which one might break the tablet once and for all?
Thanks again and sorry for my incompetence

drsiegberterne said:
Hi Thanassis,
If I flash boot the original ASUS boot image found in the file you described and which i dowloaded already, shouldn't that fix the problem if I accidentally did flash your boot image? Or will there be even more trouble?
. . .
Alternatively isn't there a manual way to flash the whole zipped recovery image or am I misunderstanding what this ASUS file actually contains?
. . .
Thanks again and sorry for my incompetence
Click to expand...
Click to collapse
No, don't be sorry We are all either choosing to learn in this world (i.e. make mistakes and learn from them), or choose to remain stuck in ignorance. I applaud your efforts in properly rooting the tablet. . .
To the point - remember, you are root now ; whatever apps you installed, you can definitely uninstall them. You don't necessarily need to wipe it.
If you do want to, I'd suggest booting in recovery and doing it the normal way that Asus recommends. Since you said "buttons don't work", you may want to try using the original recovery .img - i.e. "fastboot boot recovery.img". I'd love to suggest a link from ASUS, but they don't host it (which is bad - they really should) - so instead go to "goo" dot "gl" slash "noegkY" - this will point you to a discussion where a kind soul is sharing his ME103K recovery.img.
Booting from the recovery will allow you to install the ASUS OTA update - and probably try cleaning cache partition, etc
Good luck!

ttsiodras said:
No, don't be sorry We are all either choosing to learn in this world (i.e. make mistakes and learn from them), or choose to remain stuck in ignorance. I applaud your efforts in properly rooting the tablet. . .
To the point - remember, you are root now ; whatever apps you installed, you can definitely uninstall them. You don't necessarily need to wipe it.
If you do want to, I'd suggest booting in recovery and doing it the normal way that Asus recommends. Since you said "buttons don't work", you may want to try using the original recovery .img - i.e. "fastboot boot recovery.img". I'd love to suggest a link from ASUS, but they don't host it (which is bad - they really should) - so instead go to "goo" dot "gl" slash "noegkY" - this will point you to a discussion where a kind soul is sharing his ME103K recovery.img.
Booting from the recovery will allow you to install the ASUS OTA update - and probably try cleaning cache partition, etc
Good luck!
Click to expand...
Click to collapse
The problem here is that he doesn't seem to have the same version as on my tablet. I have the newest version with Lollipop while this seems to be at least a couple of patches earlier with a completely different version of Android. Won't I risk breaking things even more if I try to apply this - as in trying to recover a recovery that is not on my tablet since certainly the recovery.img doesn't contain all the information needed since it's only 10 MB.
As you can probably guess the whole discussion in your link about what part of the system is broken and how to fix it goes right over my head. It also seems like they did not find a satisfactory solution in the end (short of sending the tablet to ASUS). As you can imagine I'm at quite a loss what to try and what not out of fear to make things worse. At least for now I can still use the tablet to do the things I need it to do.
Thanks for your help anyway, I will try to read up more on the topic and decide what to do next.

drsiegberterne said:
The problem here is that he doesn't seem to have the same version as on my tablet. I have the newest version with Lollipop while this seems to be at least a couple of patches earlier with a completely different version of Android. Won't I risk breaking things even more if I try to apply this - as in trying to recover a recovery that is not on my tablet since certainly the recovery.img doesn't contain all the information needed since it's only 10 MB.
Thanks for your help anyway, I will try to read up more on the topic and decide what to do next.
Click to expand...
Click to collapse
I understand how you feel - your tablet is operational now (OK, with the annoyance that you need to boot it in "tethered mode") - so you rightfully fear that you may mess things up with further steps.
Just to clarify something - the recovery img is something that works on its own ; it has no dependency on what kind of Android image is installed in the /system partition.
If you do decide to do it, "fastboot boot recovery.img" will bring you to a spartan menu, showing options that allow you to apply an update (i.e. the ASUS update you downloaded!), clean the /cache partition, etc.
Choose "install update from SD card" (use volume up/down to choose, power btn to select), and navigate to your SD card, where you will have placed the big .zip file from ASUS.
The recovery process will begin, and your tablet will be "wiped" with the image from ASUS. Reboot, and be patient while the tablet boots up - it will be just like the first time you started it (i.e. install from scratch).
Whatever you decide - good luck!

ttsiodras said:
I understand how you feel - your tablet is operational now (OK, with the annoyance that you need to boot it in "tethered mode") - so you rightfully fear that you may mess things up with further steps.
Just to clarify something - the recovery img is something that works on its own ; it has no dependency on what kind of Android image is installed in the /system partition.
If you do decide to do it, "fastboot boot recovery.img" will bring you to a spartan menu, showing options that allow you to apply an update (i.e. the ASUS update you downloaded!), clean the /cache partition, etc.
Choose "install update from SD card" (use volume up/down to choose, power btn to select), and navigate to your SD card, where you will have placed the big .zip file from ASUS.
The recovery process will begin, and your tablet will be "wiped" with the image from ASUS. Reboot, and be patient while the tablet boots up - it will be just like the first time you started it (i.e. install from scratch).
Whatever you decide - good luck!
Click to expand...
Click to collapse
Okay, a little update from the battlefront:
I tried the recovery image and did get into the menu, however the recovery failed with the same two error messages as in your earlier link ("footer is wrong" and "signature verification failed"). My output from fastboot getvar all is also very similar to the one from that guy except I have a different bootloader version than him (3.03).
Another thing I noticed is that if I boot the standard boot.img found in the ASUS zip it will recognize the internal sdcard normally, however when I boot your rooted image the internal memory doesn't seem to be recognized, at least not through the pre-installed file manager. Downloading a file to the internal storage also failed while rooted but all the apps and the OS itself so far seem totally unaffected otherwise.
My last resort at the moment is the fastboot flash boot boot.img but I have little hope it would change anything since in the thread you linked they proposed just that and if it had worked they probably would have mentioned it.
Can it theoretically break the tablet even more? I would hate to have to send it in because I completely bricked it...

drsiegberterne said:
Okay, a little update from the battlefront:
Another thing I noticed is that if I boot the standard boot.img found in the ASUS zip it will recognize the internal sdcard normally, however when I boot your rooted image the internal memory doesn't seem to be recognized.
Click to expand...
Click to collapse
Not the case for me - everything works fine (including internal and external sdcard), so it's definitely not my kernel causing this.
drsiegberterne said:
My last resort at the moment is the fastboot flash boot boot.img but I have little hope it would change anything since in the thread you linked they proposed just that and if it had worked they probably would have mentioned it.
Can it theoretically break the tablet even more? I would hate to have to send it in because I completely bricked it...
Click to expand...
Click to collapse
Flashing is always dangerous (from what you've said, I actually theorize that you did, actually, flash already...)
I doubt this will solve the boot issue, to be honest - if I were you, I'd continue to boot tethered (with my image when you need root access, and (maybe) the Asus image when you don't). Myself, I always boot my own bootimage, since I have zero problems with it, and it allows me to run a complete Debian distro in a chroot (thus making my tablet a full-blown UNIX server - e.g. I run privoxy on it to filter all stupid ads in all apps on the tablet, etc).
No matter what you decide, good luck!
Thanassis.

ttsiodras said:
Not the case for me - everything works fine (including internal and external sdcard), so it's definitely not my kernel causing this.
Flashing is always dangerous (from what you've said, I actually theorize that you did, actually, flash already...)
I doubt this will solve the boot issue, to be honest - if I were you, I'd continue to boot tethered (with my image when I need root access, and (maybe) the Asus image when I don't). Myself, I always boot my own bootimage, since I have zero problems with it, and it allows me to run a complete Debian distro in a chroot (thus making my tablet a full-blown UNIX server - e.g. I run privoxy on it to filter all stupid ads in all apps on the tablet, etc).
No matter what you decide, good luck!
Thanassis.
Click to expand...
Click to collapse
I already tried to flash the original boot.img yesterday but it didn't change anything as you correctly assumed so I guess for now there is nothing more to do. I might write to the Asus support and maybe send the tablet in if it is free of charge for me (which I doubt). The only other option is to spend the next months to get sufficiently versed in Android to actually fix the problems myself but even for that I would probably need some files or source code from Asus. I find it rather disappointing the way these "closed" systems work nowadays, with the advancement of Linux and Open Source I really would have expected the opposite to be true but apparently people care more about convenience than actually being able to use the tools they buy in the way they want to.
Getting these Android devices like buying a hammer that can't hammer things in on Sundays.

drsiegberterne said:
I find it rather disappointing the way these "closed" systems work nowadays, with the advancement of Linux and Open Source I really would have expected the opposite to be true but apparently people care more about convenience than actually being able to use the tools they buy in the way they want to
Click to expand...
Click to collapse
I share the sentiment - it's really sad.

Undoing the tethered root
drsiegberterne said:
I already tried to flash the original boot.img yesterday but it didn't change anything as you correctly assumed so I guess for now there is nothing more to do. I might write to the Asus support and maybe send the tablet in if it is free of charge for me (which I doubt). The only other option is to spend the next months to get sufficiently versed in Android to actually fix the problems myself but even for that I would probably need some files or source code from Asus. I find it rather disappointing the way these "closed" systems work nowadays, with the advancement of Linux and Open Source I really would have expected the opposite to be true but apparently people care more about convenience than actually being able to use the tools they buy in the way they want to.
Getting these Android devices like buying a hammer that can't hammer things in on Sundays.
Click to expand...
Click to collapse
Hi drsiegberterne - I had a look into the contents of the boot loader running inside the ME103K, and I am pretty sure that if you execute this at fastboot...
# fastboot oem reset-dev_info
# fastboot reboot
... you will get back to normal, un-tethered bootings of your ME103K.
Hope this solves your problem!
Kind regards,
Thanassis.

[FIX] FED-Patcher v7 (ForceEncrypt Disable Patcher)

Hello everybody,
I created a tool for the nexus 9 that gets rid of the ForceEncrypt flag in a generic way (meaning it should work no matter what rom you are on). It does that by patching the currently installed boot.img.
Background
The Android CDD (Compatibility Definition Document) suggests that all devices SHOULD enable full disk-encryption (FDE) by default. Even though I support every step towards more security I have to criticize this approach. FDE comes at a price. Encryption takes time because some component has to de- and encrypt the stuff on the disk at some point and in the case of the nexus 9 (aka flounder) it's the CPU's task. Even though the nexus 9's CPU has 2 pretty fast cores you can still easily feel the difference between FDE in the on- or off-state. The I/O is faster and boot-times take only half as long. (I did not do any measurements)
There is an ongoing discussion about this topic in cyanogenmod's gerrit. Although it's a fun read it is pretty clear that this exchange of views is not going anywhere near a useful outcome.
Because performance is important to me and my tablet does not need the extra security I created the FED-Patcher (ForceEncrypt Disable Patcher)
How does it work?
FED-Patcher is a simple flashable ZIP that is supposed to be run in a recovery that has busybox integrated (like TWRP or CWM). This is what it does:
Checks if your device is compatible
Dumps the currently installed boot.img.
Unpacks the dump of your currently installed boot.img. The unpacking process is done via a self-compiled, statically linked version of unmkbootimg.
It patches the filesystem tables which include the force-encrypt flags. This process will change "forceencrypt" to "encryptable".
Then it patches the filesystem tables to not use dm-verity. This is done by removing the "verify" mount-parameter.
Creates a new boot.img. The unpacking process is done via a self-compiled, statically linked version of mkbootimg.
Flashes the modified boot.img
Supported devices
HTC Nexus 9 WiFi (flounder)
HTC Nexus 9 LTE (flounder_lte)
Motorola Nexus 6 (shamu)
Version History
v1 - Initial version with HTC Nexus 9 WiFi (flounder) support
v2 - Added Motorola Nexus 6 (shamu) support
v3 - Added support for HTC Nexus 9 LTE (flounder_lte)
v4 - Added support for signed boot-images
v5 - Changed error handling to compensate for missing fstab files. Some roms seem not to ship with the complete set of boot-files from AOSP.
v6 - FED-Patcher will enforce the same structure for the patched boot.img that the original boot.img had. Additionally, the kernel commandline will also be taken over. This should fix pretty much every case where devices would not boot after patching.
v7 - FED-Patcher will now disable dm-verity in fstab to get rid of the red error sign on marshmallow roms.
What do I need to make this work?
A supported device (Your nexus 9)
An unlocked bootloader
An already installed ROM with forceencrypt flag. (like cyanogenmod CM12.1)
A recovery that includes busybox (TWRP, CWM)
How do I use it?
Make a thorough, conservative backup of your data if there is any on your device
Go into your recovery (TWRP, CWM)
Flash fed_patcher-signed.zip
If your device is already encrypted (You booted your ROM at least once) you need to do a full wipe to get rid of the encryption. This full wipe will clear all your data on your data-partition (where your apps as well as their settings are stored) as well as on your internal storage so please, do a backup before. If you don't do a backup and want to restore your data... well... Call obama.
How do I know if it worked?
Go into your "Settings"-App. In "Security", if it offers you to encrypt your device it is unencrypted. If it says something like "Device is encrypted" it indeed is encrypted.
IMPORTANT: If you update your ROM you have to run FED-Patcher again because ROM-updates also update the boot-partition which effectively removes my patch. So, if you are on CM12.1 for example and you used my patch and do an update to a newer nightly you have to run FED-Patcher again. If you don't do so Android will encrypt your device at the first boot.
Is it dangerous?
Well, I implemented tons of checks that prevent pretty much anything bad from happening. But, of course, we're dealing with the boot-partition here. Even though I tested FED-Patcher quite a lot there is still room for crap hitting the fan.
Screenshot
Scroll down to the attached thumbnails.
Credits
* pbatard for making (un)mkbootimg (dunno if he is on xda)
* @rovo89 for his xposed framework - I used some of his ideas by reading the source of his xposed installer flashable ZIP for FED-Patcher.

Thanks for creating this! In theory, would this work for the Nexus 6 as well? It would seem like it's a similar process.

itlnstln said:
Thanks for creating this! In theory, would this work for the Nexus 6 as well? It would seem like it's a similar process.
Click to expand...
Click to collapse
Hey there,
yes, it would probably work because the process itself is pretty generic. The only real difference between devices is the device-path for the boot-partition as well as the path(s) for the fstab-file(s) inside the boot.img. Nothing that cannot be done - but I don't have a device for testing. If you feel adventurous I can do a nexus6 (shamu) version for you for testing. I will double check so it should not eff up your device .
EDIT: Not to forget, the nexus 9 is a 64bit device. mkbootimg as well as unmkbootimg are compiled for 64bit. I have to rebuild those two programs for 32bit to make them work for 32bit devices.

If you have time for a N6 build, that would be great. If not, it's not a big deal since there seems to be more support for that device.

itlnstln said:
If you have time for a N6 build, that would be great. If not, it's not a big deal since there seems to be more support for that device.
Click to expand...
Click to collapse
Well, it's pretty much done. Do you want to test a version that does not actually flash anything but do everything else - just to see if it works correctly?

Absolutely!

itlnstln said:
Absolutely!
Click to expand...
Click to collapse
Alright, here you go!
If no error occurs there will be the already modified boot.img file in your temp-directory of your nexus 6. You can send me this file to be completely sure that everything went according to plan. Here is the adb-command:
Code:
adb pull /tmp/fed_patcher/boot-new.img
If all goes well I will upload the new version with nexus 6 (shamu) support tomorrow.
Good night!

gladiac said:
Alright, here you go!
If no error occurs there will be the already modified boot.img file in your temp-directory of your nexus 6. You can send me this file to be completely sure that everything went according to plan. Here is the adb-command:
Code:
adb pull /tmp/fed_patcher/boot-new.img
If all goes well I will upload the new version with nexus 6 (shamu) support tomorrow.
Good night!
Click to expand...
Click to collapse
Thanks! It seemed to work OK. Here's the boot image.

itlnstln said:
Thanks! It seemed to work OK. Here's the boot image.
Click to expand...
Click to collapse
Thanks for your help! I just updated the flashable ZIP in the first post. Enjoy

gladiac said:
Thanks for your help! I just updated the flashable ZIP in the first post. Enjoy
Click to expand...
Click to collapse
You're the best! Thanks!

I noticed in op it says "4 pretty fast cores". This puppy only has 2 cores. Just throwing it out there for readers that don't know. I'm sure it was just a minor oversight.
Sent from my Nexus 9

madbat99 said:
I noticed in op it says "4 pretty fast cores". This puppy only has 2 cores. Just throwing it out there for readers that don't know. I'm sure it was just a minor oversight.
Sent from my Nexus 9
Click to expand...
Click to collapse
Hi,
you are right, thanks. I just fixed the text in the op.

Hey everybody,
I will enable support for the Nexus 9 LTE (flounder_lte) this afternoon in FED-Pather v3. If you want other devices to be supported please tell me. Is there a list of android devices that have forced encryption?

So this works great, leaving device unencrypted. But anyone having issues with apps crashing? Most especially Google Play Services?

femmyade2001 said:
So this works great, leaving device unencrypted. But anyone having issues with apps crashing? Most especially Google Play Services?
Click to expand...
Click to collapse
This problem is new to me. My patch only modifies the boot-image so that it does not enforce encryption. It is merely a flag in fstab that gets changed and should not have anything to do with crashing apps. Anyway, do you have a logcat?

Hey everybody,
v3 is here with HTC Nexus 9 LTE (flounder_lte) support!
Enjoy

I'm getting an error with my N9 (WiFi). When I try flashing in TWRP, it throws this error:
! Unpacking failed
=> unmkbootimg return value: 0
E: Error executing updater binary in zip...
All I did was go into fastboot, flash the updated image for LMY48M, then go into TWRP to flash the fix. I even went back into fastboot to try re-flashing the boot.img.

itlnstln said:
I'm getting an error with my N9 (WiFi). When I try flashing in TWRP, it throws this error:
! Unpacking failed
=> unmkbootimg return value: 0
E: Error executing updater binary in zip...
All I did was go into fastboot, flash the updated image for LMY48M, then go into TWRP to flash the fix. I even went back into fastboot to try re-flashing the boot.img.
Click to expand...
Click to collapse
Hi, sorry to hear that. I will have a look into the boot.img that gets shipped with LMY48M. Not sure what is going on here.

itlnstln said:
I'm getting an error with my N9 (WiFi). When I try flashing in TWRP, it throws this error:
! Unpacking failed
=> unmkbootimg return value: 0
E: Error executing updater binary in zip...
All I did was go into fastboot, flash the updated image for LMY48M, then go into TWRP to flash the fix. I even went back into fastboot to try re-flashing the boot.img.
Click to expand...
Click to collapse
Alright - unmkbootimg fails because the boot.img that google ships has 256 Bytes of extra data (it is probably signed or something) at the beginning. If you strip that off it works correctly:
Code:
dd if=boot.img of=boot-stripped.img bs=256 skip=1
Well, this was unexpected. But nothing that cannot be dealt with. I will make my flashable ZIP search for the offset of the boot.img-signature inside the dumped boot.img and strip of the preceding data. The rest of the process should work as usual.

itlnstln said:
I'm getting an error with my N9 (WiFi). When I try flashing in TWRP, it throws this error:
! Unpacking failed
=> unmkbootimg return value: 0
E: Error executing updater binary in zip...
All I did was go into fastboot, flash the updated image for LMY48M, then go into TWRP to flash the fix. I even went back into fastboot to try re-flashing the boot.img.
Click to expand...
Click to collapse
Hi @itlnstln,
I just made a new version which should do the trick. I tested the new functionality to the best of my knowledge. If the script fails for some reason it wont flash anything - so the probability for actual damage is very low. Do you feel adventurous xD?
Please tell me if it worked for you or not.

NOST - Improved Version of OST LA 6.0.4 (v0.6, 02. Mar 2019)

"NOST" - short for "No Service Tool" (or "Nokia Service Tool" but that sounds too official and boring ) is a small hobby project I've been working on in the last couple of days.
It aims to make the service tool for Nokia 8 (and HMD Phones in general) more useable, user-friendly, and straigtforward to use, and after having to test it myself, and also
making a small beta test in the Telegram group for Nokia 8, I feel like posting it here so others can try it out too if they want.
First, to be clear: NOST is not completely my work. It is based on OST LA 6.0.4, which was made by HMD/Foxconn. Unlike the previous OST Patches, NOST does not replace
the executable with a hacked one, but instead wraps it and patches the methods that need patching at runtime. The result is that the changes are completely opensource
and readable by others, while the underlying OST files are not modified at all. I tried to base it on a different (i.e. newer) version of OST, but those are pretty much unpatchable,
at least not with a serious amount of reverse engineering, which brings not only time issues but legal ones as well.
NOST changes a couple of things, compared to the unmodified OST LA:
It removes the need for authentification against HMD/FIH servers (really, shoutout to the one who made the original hack, even though I could not use their code)
Moved the logs folder to the same folder as the application, as opposed to somewhere on the system to make debugging easier
The options for flashing firmware images appear reliable now. (At least for me they only appeared sometimes if not never on the original OST).
Removed one of the options that if it appeared crashed the flashing process ("Check System AP Status")
One user of the Telegram group had issues where OST would crash because it detects an invalid locale setting in Windows. NOST just catches that issue and defaults to english
Removed the "Edit Phone Information" button. It never worked and it's only purpose was to make the "Next" button appear, which works like it should now as well.
NOST refuses to flash your phone if your bootloader isn't unlocked critically. The old OST would just try to flash but never make any progress which confuses inexperienced users.
Perhaps the most important change: NOST allows to flash modified firmware images without the need to extract and modify them by hand.
With the original OST, people who wanted to reflash their phone had to download a firmware bundle, extract and edit it to be able to use it with OST LA 6.0.4, since the newer versions
had unpatchable issues that prevent using them. Repacking the images in a format OST expects wasn't possible either since that enabled some sort of signature algorithm on the modified
images and caused the flashing to fail. NOST solves this problem by allowing the use of a different packaging format. Those binaries still need to be extracted but it is done transparently in
the background without the user having to download any other tools. The formats that can be used in images are .zip and .qlz
.zip Firmwares:
.zip firmware files are simply archives of the (edited) files that would normally be extracted from an .nb0 file. This means, if you extract a .nb0 with the extractor found on XDA, the contents
of the *_unpacked folder it creates should be the contents of your .zip.
.qlz Firmwares:
.qlz files are based on QuickLZ compression, which gives them a small size but also a low decompression time.
The tool to generate them is called exdupe. Generating these images is pretty straigtforward. Assuming you are on windows, download the exdupe
tool from the link above (or take it from the NOST Tools/ folder) and copy it into the folder that contains the unpacked .nb0.
Code:
- exdupe.exe
- <nb0 name>_unpacked/
- <nb0 name>.mlf
- ....
Open a commandline in that folder, and run the following command:
Code:
exdupe.exe <name of the folder to compress> <name of the firmware file>.qlz
You should already see how fast it compresses the firmware folder now. As a reference: Compressing the latest Nokia 8 firmware (about 4GB) takes maybe 30 seconds and yields a 2GB file.
Repacked Firmware Bundles:
I created .qlz images of the May and November firmwares, as well as one of the various Pie Maintainance Releases.
You can find them here: https://tmsp.io/fs/xda/nb1/firmware
I already successfully reverted from December Security Patch to November using NOST, and then updated back using OTA Sideloading without problems.
As always when working with flashing tools, proceed with caution!
How to unlock to critical:
KonikoO said:
For those who wonder how to unlock into critical state :
Reboot into bootloader download mode and execute those commands :
fastboot flash unlock *unlock .bin*
fastboot flashing unlock_critical
Afterwards you should be able to flash provided .qlz with NOST.
Click to expand...
Click to collapse
Download:
The actual tool: https://github.com/StollD/NOST/releases
Drivers: https://github.com/StollD/nokia-driver-installer/tree/master/out
Source Code: https://github.com/StollD/NOST
License:
OST LA 6.0.4 is copyrighted by the respective authors. It is not modified permanently.
The custom NOST code is licensed under the GNU General Public License.
Icon by Freepik © Flaticon

I tried this is working,nice tool.
Thanks dev.

Thank you THMSP! very cool?
Sent from my TA-1004 using XDA Labs

Can flash the May and November update but cannot flash latest Pie with this tool. I flashed Pie but returned back to November update?

Lee Castro said:
Can flash the May and November update but cannot flash latest Pie with this tool. I flashed Pie but returned back to November update?
Click to expand...
Click to collapse
Yes, you can revert back from Pie to Oreo using this. What is the issue with Pie for you?

THMSP said:
Yes, you can revert back from Pie to Oreo using this. What is the issue with Pie for you?
Click to expand...
Click to collapse
What I mean is if I flash the Pie file you provided I just returned back to Android 8.1 Novemeber update no changes at all. Maybe there something wrong with the Pie file you uploaded. But the rests are all working fine with the tool.

Lee Castro said:
What I mean is if I flash the Pie file you provided I just returned back to Android 8.1 Novemeber update no changes at all. Maybe there something wrong with the Pie file you uploaded. But the rests are all working fine with the tool.
Click to expand...
Click to collapse
Thanks for the hint, I will take a look. Probably just derped when pulling partitions and renaming the images (might have worked in my November folder by accident).
EDIT: I repulled the images from Pie (I indeed somehow worked in my November folder when making the image), repackaged them and updated the version in the drive folder. You should now be able to flash Pie. Sorry for the mistake.

THMSP said:
Thanks for the hint, I will take a look. Probably just derped when pulling partitions and renaming the images (might have worked in my November folder by accident).
EDIT: I repulled the images from Pie (I indeed somehow worked in my November folder when making the image), repackaged them and updated the version in the drive folder. You should now be able to flash Pie. Sorry for the mistake.
Click to expand...
Click to collapse
Thanks again,This is really a big help.

Wow, this is something we've been all seeking for a long time now ! For those who wonder how to unlock into critical state :
Reboot into bootloader download mode and execute those commands :
fastboot flash unlock *unlock .bin*
fastboot flashing unlock_critical
Afterwards you should be able to flash provided .qlz with NOST.

hey there! wonderful tool to have. Thank u so much

Not working in my laptop say a software need a to update

Blackhacker07 said:
Not working in my laptop say a software need a to update
Click to expand...
Click to collapse
If you have dependency issues I would suggest to install OST LA 6.0.4 first, so you get its dependencies, until I can make a proper installer for NOST.

THMSP said:
If you have dependency issues I would suggest to install OST LA 6.0.4 first, so you get its dependencies, until I can make a proper installer for NOST.
Click to expand...
Click to collapse
Could you perhaps figure out how to get rid of the unlocked bootloader message?

ironman38102 said:
Could you perhaps figure out how to get rid of the unlocked bootloader message?
Click to expand...
Click to collapse
Are you talking about the error message that appears when you press the Next button to start flashing?
If yes, your bootloader needs to be unlocked to critical, then the message won't appear.
If you are unsure if your bootloader is unlocked to critical, do "fastboot oem device-info", it will tell you.
If you mean the message that your phone displays when booting with an unlocked bootloader then sorry, I doubt that's possible (I think it is embedded into the bootloader).

THMSP said:
Are you talking about the error message that appears when you press the Next button to start flashing?
If yes, your bootloader needs to be unlocked to critical, then the message won't appear.
If you are unsure if your bootloader is unlocked to critical, do "fastboot oem device-info", it will tell you.
If you mean the message that your phone displays when booting with an unlocked bootloader then sorry, I doubt that's possible (I think it is embedded into the bootloader).
Click to expand...
Click to collapse
Actually its in splash.img that can be dumped. Its the hex editing possibly that might be a problem for someone not familiar with it

How to flash it's says this...

Blackhacker07 said:
How to flash it's says this...
Click to expand...
Click to collapse
What do you mean?

KonikoO said:
Wow, this is something we've been all seeking for a long time now ! For those who wonder how to unlock into critical state :
Reboot into bootloader download mode and execute those commands :
fastboot flash unlock *unlock .bin*
fastboot flashing unlock_critical
Afterwards you should be able to flash provided .qlz with NOST.
Click to expand...
Click to collapse
Thank you so much for this advice. I wouldn't have ever figured out how to unlock critical on my own and that was the thing that was preventing me from flashing. I tried searching the other OST LA flashing threads as well but this info seemed to have been missing, or then i completely missed it. Thank you so much anyways. If anybody else is trying to figure out why their OST LA or NOST is giving them the se_err_adb_cmd_get_fail_result error, this should help. I just used the unlock.key in place of the *unlock.bin* in your command and it worked.

Can you please upload Oreo December update stock and patched boot image. TIA

Yesterday I noticed that my Pie Image was still not quite useable, since it contained a corrupted system partition.
This seems to have happened because of my Magisk Setup and me only replacing the boot partition image and not uninstalling Magisk completely.
I rebuilt the image, to be fully stock, and also included the latest B07 update that @hikari_calyx uploaded yesterday. You can get it from the drive link in the OP.

How To Guide How to root C21 with locked bootloader

GitHub - bkerler/mtkclient: MTK reverse engineering and flash tool
MTK reverse engineering and flash tool. Contribute to bkerler/mtkclient development by creating an account on GitHub.
github.com
please note that I will make a proper procedure in this post shortly. but in the mean time, you WILL need linux to be able to root your phone, as windows process does not work.,
while using linux, need to change the commands to be python3 where it says python.
just abit snowed under at the moment, but will be done inthe next 48 hours

Hi, to complete what our friend previously said, we are at least three people to have used this tool and made it work. My phone REALME C21 is unlocked and rooted.
I used Windows, albeit it probably wasn't perfectly done.
The solution is to use the mtkclient tool produced on this github and follow each step of the guide on the github, under "Usage / Root the phone (tested with android 9-12)".
You must absolutely use the magisk App given on this github, the official one won't work, this is what prevented me previously to succeed. This magisk app has been patched for mediatek/realme phones.
Do not omit dumping steps, as it is your only way out if it doesn't work.
Also, for obscure reasons, I was unable to chain commands ; tool wouldn't work this way...
So each time I did and succeeded in doing one "mtk" command on the phone, I unplugged it, launched the next command, pushed vol up and vol down, and replugged it.
Maybe I missed something. (note that for the mtk tool to work, phone must be shutdown and then plugged the way I described or that it is described on the guide/tool itself)
Anyway, no guarantee for you here, but hey, it works .

Cherryblue said:
Hi, to complete what our friend previously said, we are at least three people to have used this tool and made it work. My phone REALME C21 is unlocked and rooted.
I used Windows, albeit it probably wasn't perfectly done.
The solution is to use the mtkclient tool produced on this github and follow each step of the guide on the github, under "Usage / Root the phone (tested with android 9-12)".
You must absolutely use the magisk App given on this github, the official one won't work, this is what prevented me previously to succeed. This magisk app has been patched for mediatek/realme phones.
Do not omit dumping steps, as it is your only way out if it doesn't work.
Also, for obscure reasons, I was unable to chain commands ; tool wouldn't work this way...
So each time I did and succeeded in doing one "mtk" command on the phone, I unplugged it, launched the next command, pushed vol up and vol down, and replugged it.
Maybe I missed something. (note that for the mtk tool to work, phone must be shutdown and then plugged the way I described or that it is described on the guide/tool itself)
Anyway, no guarantee for you here, but hey, it works .
Click to expand...
Click to collapse
Congrats
And i wanna point some thinks
Actually using windows for such job is a real pain, i used EndeavourOS.(Based on arch linux)
Magisk app actually not matter if you are on android 10, and actyally @smiley.raver used magisk app from original releases.
Therefore, i already asked differences here;
What is the benefit of pacthed magisk? · bkerler/mtkclient · Discussion #116
I used this tool today and my device was successfully rooted :-) However, I have a question in my mind; What is the differences of magisk app you provided and official magisk app? Why should we use...
github.com
I had not need to replug my phone for each command, but i dont exactly remember how i did, lol.

Does using this method it will erase data / formatting data?

Yes. At least, this is one of the steps in the github guide, and it probably would not work if you don't do it.

A12sma said:
Does using this method it will erase data / formatting data?
Click to expand...
Click to collapse
You should clear data, beacuse it bootloops without clearing data.
Before doing anything you can backup your files from recovery mode, adb can be run as root at recovery mode.

apokogies for not getting a more step by step guirde completed with a series of issues with my mental health..
Bootloader unlock can only be on Android 10 - as soon as you try upgrade to android 11 - fastboot stops working - . I have not yet found a work around for android 11 as of yet - but you can still use the mtkclient tool to flash files like you would fastboot.

do a full phone backup - with python mtk rl out or python mtk rf flash.bin - this will ensure that if you do something wrong, or wipe a partition or bootloop - you can always flash the out directory or the flash.bin file - I am using 2 at the moment - 1 as daily driver - the other i had to restore after screwing around with a few wrong files - but i keep the backup of python mtk r out - and have reflashed and bricked and reflashed it about 15 times in the last 24 hours trying to get fastboot to work with android 11

smiley.raver said:
do a full phone backup - with python mtk rl out or python mtk rf flash.bin - this will ensure that if you do something wrong, or wipe a partition or bootloop - you can always flash the out directory or the flash.bin file - I am using 2 at the moment - 1 as daily driver - the other i had to restore after screwing around with a few wrong files - but i keep the backup of python mtk r out - and have reflashed and bricked and reflashed it about 15 times in the last 24 hours trying to get fastboot to work with android 11
Click to expand...
Click to collapse
I am glad you finally become online after a long time
I have few think to say.

Trying to compile a twrp at same time.
Yeah it's been a rollercoaster of a ride the last few months. Had to put my dog down 2 days before Christmas. So this has been giving me a good distraction .
Found out a fair few things with this phone. Very weird and different to how it operates and upgrades/downgrades.
Been using a mix of sp flash tools, mtkclient and fastboot where applicable.
So what interedting things have happenef while I was away

smiley.raver said:
do a full phone backup - with python mtk rl out or python mtk rf flash.bin - this will ensure that if you do something wrong, or wipe a partition or bootloop - you can always flash the out directory or the flash.bin file - I am using 2 at the moment - 1 as daily driver - the other i had to restore after screwing around with a few wrong files - but i keep the backup of python mtk r out - and have reflashed and bricked and reflashed it about 15 times in the last 24 hours trying to get fastboot to work with android 11
Click to expand...
Click to collapse
Oh also if upgrading to android 11 make sure you have the correct firmware forthe correct region otherwise you get boot loop freezes and all sorts of wonderful $hit

Cherryblue said:
Yes. At least, this is one of the steps in the github guide, and it probably would not work if you don't do it.
Click to expand...
Click to collapse
As with any phone, unlocking bootloader erases all data. This is just android, you are always advised to backup all data prior to preform a bootloader unlock

Cherryblue said:
Hi, to complete what our friend previously said, we are at least three people to have used this tool and made it work. My phone REALME C21 is unlocked and rooted.
I used Windows, albeit it probably wasn't perfectly done.
The solution is to use the mtkclient tool produced on this github and follow each step of the guide on the github, under "Usage / Root the phone (tested with android 9-12)".
You must absolutely use the magisk App given on this github, the official one won't work, this is what prevented me previously to succeed. This magisk app has been patched for mediatek/realme phones.
Do not omit dumping steps, as it is your only way out if it doesn't work.
Also, for obscure reasons, I was unable to chain commands ; tool wouldn't work this way...
So each time I did and succeeded in doing one "mtk" command on the phone, I unplugged it, launched the next command, pushed vol up and vol down, and replugged it.
Maybe I missed something. (note that for the mtk tool to work, phone must be shutdown and then plugged the way I described or that it is described on the guide/tool itself)
Anyway, no guarantee for you here, but hey, it works .
Click to expand...
Click to collapse
Just to clarify, the magical app is not patched as such, it is an alpha branch, which encorporates extra coding/coding that is removed from the normal magisk, and. Can still be used on other phones as well, (it is hard to understand what most changes are as I can not read (assumption Chinese) that magisk alpha is mainly change logged as .
But yes that was one of the issues I faced being that didn't use the magisk alpha app originally.
Under Linux I didn't have to unplug each command. But under windows yes you need to run the command and then plug the phone in under Brom/download mode. You don't have to restart the phone after each command. Just need to unplug and run next command and then plug phone in

smiley.raver said:
Trying to compile a twrp at same time.
Yeah it's been a rollercoaster of a ride the last few months. Had to put my dog down 2 days before Christmas. So this has been giving me a good distraction .
Found out a fair few things with this phone. Very weird and different to how it operates and upgrades/downgrades.
Been using a mix of sp flash tools, mtkclient and fastboot where applicable.
So what interedting things have happenef while I was away
Click to expand...
Click to collapse
We have TWRP, please get in touch with me from telegram.
I had sent you my telegram profile link from privatebmessage

MrMiyamo said:
We have TWRP, please get in touch with me from telegram.
I had sent you my telegram profile link from privatebmessage
Click to expand...
Click to collapse
Ok. Is it working. Because the ones I found were t working and setup for different phone.
Will jump on telegram tonight. Just busy today

smiley.raver said:
Ok. Is it working. Because the ones I found were t working and setup for different phone.
Will jump on telegram tonight. Just busy today
Click to expand...
Click to collapse
We have working twrp for RUI1, but not fully tested.
Booting and decryption works though.
I didn't install the android 11 update on my phone in time,
And I can't find the RUI2 firmware anywhere right now.
(Sofware update center does not show RUI2 update anymore)
So if you have RUI2, we can build twrp for it.
I am looking forward for your message on telegram

How To Guide June 20, 2023 TQ3A.230605.010.A1 T-Mobile/MVNOs / June 13, 2023 TQ3A.230605.010 Global - Root Pixel 6 Pro [Raven]

Pixel 6 Pro [Raven]​
Updated May 13, 2023
Note that more than three users have said that 34.0.1 (even May 10, 2023's binary update of 34.0.1) did not work correctly for them. I recommend sticking with 33.0.3 (just below these quotes)
Someone reported it to Google (added a comment about 34.0.1 to the existing 34.0.0 report).
Spoiler
b0uNz said:
tried to flash the latest build of AncientOS with it, did not work. Back to r33.0.3 and it worked fine
Click to expand...
Click to collapse
Aphex13 said:
platform-tools_r34.0.1-windows is not functioning properly. Back to 33.0.3 we go...
Click to expand...
Click to collapse
budmannxx said:
Add me to the list of users that had a problem with platform-tools 34.0.1. I got into a bootloop after running flash-all.bat. Downgraded to 33.0.3, reran the new (old) flash-all.bat, and was all good.
Using 34.0.1, the phone never even got to the fastbootd part of the process
Click to expand...
Click to collapse
May 10, 2023 binary update of 34.0.1:
Homeboy76 said:
Update
I tested SDK Platform-tools r. 34.0.1 it is not fixed. There are still problems with fastbootd. Use SDK Platform-tools r. 33.0.3
Click to expand...
Click to collapse
Namelesswonder said:
Anyone that updated their platform tools and needs to downgrade can use these links.
Windows
https://dl.google.com/android/repository/platform-tools_r33.0.3-windows.zip
Mac
https://dl.google.com/android/repository/platform-tools_r33.0.3-darwin.zip
Linux
https://dl.google.com/android/repository/platform-tools_r33.0.3-linux.zip
Click to expand...
Click to collapse
Factory Images for Nexus and Pixel Devices | Google Play services | Google for Developers
developers.google.com
Google Pixel Update
Android Security Bulletins | Android Open Source Project
source.android.com
Regarding Developer Support Android 12 images, see @Lughnasadh's post here.
I am not linking directly to the Developer Support Android 12 images because I don't want them to be confused with Stable Android 12, and since the Developer Support images won't receive any OTAs...ever. They likely also will never be manually updated on the Developer Support images site, so they will forever be stuck with the security patch level they're currently on, which will become further out of date every month. You can Google search Developer Support Android images if you want to find them.
TL;DR regarding the PSA. If you update one slot to Android 13, you can fastboot reboot bootloader after and then fastboot --set-active=other to change slots in order to flash Android 13 to the new slot, but IF you have Android 13 on one slot and still have Android 12 (including Android 12 bootloader) on the other slot and you try to fully boot into Android 12, you will be permanently bricked and have to seek repair from Google. No one has yet found a way to repair this on our own. I will update if there is any progress. At least a small handful, and probably more, people have done this already.
At a minimum, do this first: fastboot flash bootloader --slot all bootloader-devicename-slider-1.2-3456789.img (change the name of the bootloader file to the one for your device), then you *should* be much safer than without doing that first. Also note that the bootloader is NOT the same as boot.img (kernel). The bootloader image file has "bootloader" in the filename.
IF you have already bricked your phone and the screen is blank - there is likely nothing we can do to help. You should seek to get a repair from Google, possibly under warranty.
You CANNOT go back to Android 12 Stable. It *seems* as if you can, but Android 12 will not work 100% correctly after updating to the Android 13 bootloader.
My tiny, early, very mini-review of Android 13 is here.
Note that this is mainly for the officially listed "Unlocked" Pixel 6 Pro, available directly from the Google Store. All of this will also apply to any other (carrier-specific) variant of the Pixel 6 Pro which you can achieve an unlocked bootloader on. This includes T-Mobile and AT&T variants. It's likely Verizon variants will never be able to unlock their bootloader, or if so it will require paying the right person to do so.
Feel free to ask about general questions, but for anything that's specific to your variant, you should use one of the other already existing threads. You'll find Verizon, AT&T, and T-Mobile-related threads in those respective search results.
Click to expand...
Click to collapse
Here there be dragons. I am not responsible for anything at all.
Spoiler: Warnings / FYI
Unlocking or locking the bootloader will wipe the device every single time, so be sure to have your data backed up before doing so, or better yet, just unlock it as soon as you get the device.​
Click to expand...
Click to collapse
Keep in mind that unlocking the bootloader or rooting might affect your phone's capability to use banking apps such as Google Pay, your local bank's app, or even the ability to install some apps like NetFlix. See @Pekempy's thread Working SafetyNet with Pixel 6 Pro Android 12​
Click to expand...
Click to collapse
If you're going to re-lock the bootloader, make sure the ROM you have on your phone is completely stock (by flashing the latest official firmware) BEFORE re-locking it.​
Click to expand...
Click to collapse
There are no negative consequences if you unlock or re-lock the bootloader other than it will wipe your phone, and while unlocked you get a brief screen when you boot the phone telling you (and anyone who sees your phone at the time) that the bootloader is unlocked. You will also continue to receive updates (if you've merely unlocked the bootloader, you can take updates as normal) unlike Samsung, Sony, et cetera, which have permanent major consequences with reduced functionality even if you un-root and re-lock your bootloader. If you're actually rooted (not just bootloader unlocked), you'll have to perform extra steps to manually update each month, and to keep root/re-root.​
Click to expand...
Click to collapse
All posts about Google Pay or banking will be reported to be deleted. Please keep this thread on-topic. There are at least one or two other How To Guide threads in this section in which folks discuss how to get around banking app restrictions when you're rooted or just have an unlocked bootloader. See @Pekempy's thread Working SafetyNet with Pixel 6 Pro Android 12
Click to expand...
Click to collapse
If users persist in discussing banking apps in this thread, I will have this thread locked and only update this first post when there is new and updated information regarding the subjects of the title of the thread: Unlocking the Pixel 6 Pro bootloader, rooting, and TWRP. See @Pekempy's thread Working SafetyNet with Pixel 6 Pro Android 12
Click to expand...
Click to collapse
Honorable mention to @Jawomo's aodNotify - Notification Light / LED for Pixel 6 Pro! (XDA link) / Notification light / LED for Pixel - aodNotify (Play Store link), which in my opinion restores useful functionality missing in most phones these days. It also solves some subjective issues some folks have with AOD (Always On Display), and/or solves/works around the problem where AOD is required for the optical fingerprint reader to work without the screen being on.​
Click to expand...
Click to collapse
Check warranty status - *may* reveal if a phone is refurbished, only if the phone was refurbished through Google - thanks to @Alekos for making me aware of the site.
Official Google Pixel Update and Software Repair (reported as of January 23, 2022 to still not be updated for the Pixel 6/Pro yet)
Google's Help Page for Find problem apps by rebooting to safe mode - this can be a lifesaver and keep you from having to do a restore to 100% complete stock or even from having to do a factory reset. This will deactivate all Magisk modules, and they'll remain deactivated even after you boot normally after briefly booting to safe mode. You can reenable the Magisk modules as you wish to try to narrow down the problem if it was caused by a Magisk module. This can even get things working again after a Magisk Module wasn't finished installing and potentially causing a bootloop.
Official Google Pixel Install fingerprint calibration software (also available at the bottom of the Update and Software Repair page above) - I believe this is only helpful if you've replaced the screen
Official Google Android Flash Tool (OEM Unlocking needs to be toggled on - you may not have to manually unlock the bootloader - the "site" will do that on its own)
Lughnasadh said:
OEM unlocking in developer options needs to be toggled on. I don't "believe" you have to actually do the "fastboot flashing unlock" command.
Click to expand...
Click to collapse
ADB/Fastboot, Windows Drivers, and unlocking the bootloader (thanks @sidhaarthm for confirming unlocking the bootloader works as intended, be sure to thank him in his post)
You'll need this if you're going to unlock the bootloader on your Pixel 6 Pro: SDK Platform Tools (download links for Windows, Mac, and Linux). Note that you can find links to download the tools elsewhere, but I wouldn't trust them - you never know if they've been modified. Even if the person providing the link didn't do anything intentionally, the tools could be modified without them being aware. Why take a chance of putting your phone security further at risk?
You can alternately use the tools from the SDK Manager, but most of us will want to stick to the basic tools-only without the complications of the full development manager.
For Windows, get Google's drivers here Get the Google USB Driver (ADB will likely work while the phone is fully booted, but if you're like me, you'll need these drivers for after you "adb reboot-bootloader", to be able to use ADB and Fastboot.
Thanks to @96carboard for posting the details of unlocking the bootloader, be sure to thank him in his post. Unlocking or locking the bootloader will wipe the device every single time, so be sure to have your data backed up before doing so, or better yet, just unlock it as soon as you get the device. Keep in mind that unlocking the bootloader or rooting might affect your phone's capability to use banking apps such as Google Pay, or your local bank's app. If you're going to re-lock the bootloader, make sure the ROM you have on your phone is completely stock (by flashing the latest official firmware) BEFORE re-locking it. My experience on my Pixel 1 was that there were no negative consequences if you unlock or re-lock the bootloader other than it will wipe your phone, and while unlocked you get a brief screen when you boot the phone telling you (and anyone who sees your phone at the time) that the bootloader is unlocked. All of this should still be the case. You will also continue to receive updates. Unlike Samsung, Sony, et cetera, which have major consequences with reduced functionality even if you un-root and re-lock your bootloader. If you're actually rooted (not just bootloader unlocked), you'll have to perform extra steps to keep root/re-root.:
The unlock process works like this:
1) Take brand new fresh phone out of box. Do NOT put sim card in it, just power it on (you can put a SIM card if you want, you just don't have to).
2) When it starts harassing you to join Google, hit "skip" and "remind me tomorrow" as applicable until you reach home screen. YOU DO NOT need to plug in a google account.
3) Settings --> About --> Build number. Repeatedly tap it until it says you're a developer.
4) Back --> Network --> WiFi and connect it.
5) Back --> System --> Developer --> OEM unlocking (check), USB debugging (check), plug in USB, authorize on the phone when requested.
Using the Platform Tools previously mentioned in command line/terminal:
6) #
Code:
adb reboot-bootloader
7) #
Code:
fastboot flashing unlock
Now that you've unlocked it, it has been wiped, so repeat 1-4, then disable all the google spyware, and go ahead and start using it while waiting for aosp and root.
Official Instructions for Locking/Unlocking the Bootloader
Click to expand...
Click to collapse
roirraW edor ehT said:
Personally, I would always use the official drivers Google provides unless they just don't work for whatever reason: Get the Google USB Driver (this is for Windows). They work for me. They are rarely updated, but they are every once in a great while, sometimes years in-between.
Click to expand...
Click to collapse
Alekos said:
I agree with this. be careful using drivers or adb/fastboot tools. Some are fine, but there's no need for it really anymore. Google has made it very easy to install drivers and Platform-Tools (adb/fastboot tool).
Google provides the Fastboot/ADB tool (Platform-Tools) and Google USB Drivers (adb/fastboot interface). This will allow any Pixel to interface with Windows using the fastboot/adb protocol. Official Google USB Driver includes support for both the Fastboot and ADB driver interface. There are 3 main drivers (Fastboot, ADB and MTP/Portable File Transfer). The MTP/Portable File Transfer driver is built-in to Windows 7-11.
Fastboot/ADB Driver Interface - Official Download Link:
When flashing a full image or unlocking your bootloader, the fastboot interface is being used.
First Download official Google USB Drivers (it's a zip file). Extract the zip (important!). Right-click on the android_winusb.inf file and hit install. You can then restart your phone to the Bootloader Screen (hold vol-down while it restarts or turns on). When you plug in your phone, Windows Device Manager will show a new device at the top: Android Device: Android Bootloader Interface.
Using the ADB interface: It's the same driver. Enable USB Debugging on your phone, then plug it in to your computer. A prompt will appear on your phone (to allow USB Debugging). The driver in Device Manager will appear as Android Device: Android Composite ADB interface.
Now you can download and use Platform-Tools to flash an Android Image, OTA or run adb/fastboot commands.
Official Download Page
"Android SDK Platform-Tools is a component for the Android SDK. It includes tools that interface with the Android platform, such as adb, fastboot, and systrace"
It's best to make Platform-Tools available system-wide. Download Platform-Tools from the above link and extract it to your C:\ drive - that way you will have a folder to add to the PATH Environment under Window System Properties Menu, Advanced, Environment Variables, System Variables, PATH (google how to do this, very easy). What this does is allow adb/fastboot commands to be run from anywhere in the system, so you don't have to be in the platform-tools folder to run adb/fastboot commands and flash an Android Image (Official or Android Fork such as ProtonAOSP).
Click to expand...
Click to collapse
Rooting-related​
@Az Biker's thread [How To Guide] [Pixel 6 Pro] Easy STEP BY STEP Unlock-Root.​
OR
@V0latyle's thread [How To Guide] Root Pixel 6 Pro with Magisk
Click to expand...
Click to collapse
No longer applies - Things that make rooting more complicated on Android 12
@V0latyle posted a new thread with some very important and fascinating information about the increased difficulty to root Android 12: Read this before rooting. Be sure to thank him there.
Click to expand...
Click to collapse
A list of the other important guides - be sure to thank the respective OPs
For all relevant guide threads just click the yellow "How To Guide" quick filter above the list of threads in the Pixel 6 Pro section.
Here's the Magisk section of XDA's forums, for rooting. Magisk on GitHub. The most recent Magisk Stable is what's recommended these days.
@sean222's thread Restore WiFi and Cellular Data in Quick Settings (Root Required)
@rickysidhu_'s thread HBM (High Brightness Mode)
@gururoop's thread Probable method to upgrade every month, without wiping data and retaining root
@rickysidhu_'s thread Limit Charge
@Typhus_' thread [MOD][MAGISK][ANDROID 12] Addon Features for Pixel Devices - Pixel 6 Pro Thread
@siavash79's thread [MOD][Xposed+Magisk][Pre-Release] AOSP Mods - System modifications for AOSP-based Android 12+ - a mod that compliments @Typhus_' mod above, and may eventually completely replace it.
@TotallyAnxious' thread [MOD] Collection of "Anxious" Modules for Pixel 6/Pro Series
Every single one of @foobar66's posts.
TWRP (not made for the Pixel 6 Pro yet - will update when it has)
I would guess that this should be the appropriate URL for official TWRP custom recovery for the Pixel 6 Pro, but who knows when/if that will actually be made available, and it may become available unofficially in these forum sections before being made official. I'll adjust this URL as needed. https://twrp.me/google/googlepixel6pro.html.
Click to expand...
Click to collapse
Custom kernels for stock ROM(s)
@Freak07's Kirisakura-Kernel for the Pixel 6 Pro (and possibly the Pixel 6)
@DespairFactor's Despair Kernel (I believe also for both the P6P and P6)
@tbalden's CleanSlate Kernel
@acuicultor's Radioactive Kernel
Click to expand...
Click to collapse
Factory Images (requires an unlocked bootloader)
It's also handy to have to the full official firmware available, whether it's to recovery from accidents or for actual development. Note the official link to the general Factory Images for Nexus and Pixel Devices page. The following link goes directly to the Pixel 6 Pro (Raven) section: Pixel 6 Pro Factory Images. I prefer to actually bookmark a link to the device listed immediately below the device I want the firmware for, because Google dumbly (in my opinion) puts the latest firmware at the bottom of the list for each particular device, and that ends up making you scroll a lot after a year or two of monthly updates.
Note: You can still get the December 2021 Factory Images and OTA from this thread, if you need them for any reason: Alternate links to December - all full factory images and OTAs available
Click to expand...
Click to collapse
Full OTA Images (doesn't require an unlocked bootloader)
Full OTA Images for Nexus and Pixel Devices
Click to expand...
Click to collapse
The usefulness of having Verity and Verification enabled (now that it's not needed for root) - post #2 below.
Regarding P6P 5G model numbers and capabilities - post #3 below.
List of all Pixel monthly security bulletins and Play System Updates - post #4 below.
How I root and update (which is identical whether rooting the first time or updating):
Use the latest Magisk Stable (in my case, I keep the app "hidden" / renamed)
Used the full firmware zip, extracted to the same folder as the latest Platform Tools (S:\platform-tools)
Extracted the new boot.img
Copied new boot.img to the phone
Patched the new boot.img with Magisk Stable
Renamed Magisk'd boot.img so I know what version of firmware it's for
Copied the Magisk'd boot.img back to the computer
Disabled all my Magisk Modules
Removed the "-w " from the flash-all.bat
Re-edited the flash-all.bat to verify I saved it with the "-w " taken out
Open a Command Prompt, navigated to S:\platform-tools
adb reboot bootloader
flash-all.bat
Let phone boot, unlock it, check that it's working, allow the update process to finish (gave it five minutes or so)
adb reboot bootloader
fastboot flash boot kernel.img (renamed Magisk'd boot.img)
fastboot reboot
Unlock, check everything's working
Re-enabled the most basic Magisk Modules which I was sure wouldn't cause a critical issue
Reboot, unlock, made sure everything's working
Back to modding!
Click to expand...
Click to collapse
I may append these first four posts with further useful information or links as needed.
Click to expand...
Click to collapse

Disabling Verity and Verification isn't required except for use with some custom kernels, but just rooting those custom kernels with the latest Magisk Stable v24.1 or higher should make them not require disabled Verity and Verification anymore.
A reminder that disabling Verity and Verification, at least if you've never disabled them before, will cause you to need to factory reset the device otherwise there will be corruption.
prokiller1199 said:
if you didnt disable before then it is enabled since the beginning. Disabling requires a full wipe.
It will show this image if you try to disable.
You can also verify it using adb shell with:
adb shell
su
avbctl get-verity
avbctl get-verification
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Click to expand...
Click to collapse
The usefulness of having Verity and Verification enabled (now that it's not needed for root but IS still required for some custom kernels):
jwoegerbauer said:
1. DM-Verity ( VB 1.0 ) verifies /system and /vendor - it was introduced with Android 4.4, modified with Android 7
2. Android Verified Boot ( VB 2.0 aka AVB ) additionally verifies /boot - it was introduced with Android 8, works on Project Treble enabled devices
Both are running a hash on the memory blocks mentioned of your device to ensure the integrity of your software and help prevent rootkits and the like.
If you disable VB 1.0 and/or VB 2.0 your Android device becomes vulnerable to malware of any type: IMO only those do it who do not care about the built-in protection.
Click to expand...
Click to collapse
V0latyle said:
Yes - this is covered on Android Source.
The basics:
Android Verified Boot ensures that the boot code is legitimate, by using a boot image "signature" compared to a signature stored in the key registry.
Dm-verity is a method by which the code on the block devices is hashed; this hash is then compared to a reference hash to determine its authenticity before the image is loaded, thereby preventing rootkits from declaring themselves legitimate.
Vbmeta verification is a method of storing those reference hashes to which the generated hashes are compared. This can be and often is used for any critical partition, such as /boot and /system.
These aren't new concepts and indeed have been integral to Android for some time. What is new is how the Android 12 AVB headers were handled.
We still don't know exactly where in the process the problem occurred when trying to run custom boot images with Android 12. I suspect that the issue wasn't custom software itself - after all, you could still flash a custom ROM and run it without issues - but rather, trying to use a modified boot image with otherwise stock Android 12 system. Don't take my word for it, though, because I don't know for sure.
Click to expand...
Click to collapse
Freak07 said:
It has nothing to do with the kernel itself. The anykernel.zip uses magiskboot to "repack" the kernel during the flashing kernel.
Click to expand...
Click to collapse

Regarding P6P 5G model numbers and capabilities:
There are three hardware versions:
G8VOU (AU, US); also listed as G8V0U - zero instead of "oh" on some sites, Google shows the former, G8VOU) - has mmWave 5G support
GF5KQ (JP) - has mmWave 5G support
GLUOG (CA, DE, FR, GB, IE, TW) - no mmWave 5G support
For instance, my factory unlocked direct from Google in the United States Pixel 6 Pro 512 GB is a G8VOU. As far as I know, all other variations in each individual phone are controlled by software (which firmware is loaded) and over the internet (which IMEIs are Carrier Unlocked or not, and OEM Unlockable or not).
Check carriers, their 5G networks & their 5G roaming support for Pixel phones. Make sure and choose your country from the drop-down to see the list of carriers beneath.
There's also the section above that Learn which Pixel phones can work with which kinds of 5G.

My personal advice for how to get your device back up and running like you had it previously after a factory reset:
I use Nova Launcher Prime, so I do backups anytime I change my home screen or app drawer/tabs setup, so widgets and app icons and other Nova-specific configurations are easier to restore.
Go to Android Settings and use Settings' search box for Backup. Make sure that your Google account is set up to backup your apps (and app data for the apps that developers have configured to use Google's Backup API). Make sure things are backed up. Note, this doesn't backup the apps themselves, only the list of apps, so only applies to apps installed from the Play Store. As I said in parentheses, developers have to choose to integrate Google's Backup API into their app, and those apps only will get their app data backed up into Google's cloud.
If you're rooted also, then you could use something like Swift Backup to backup to the cloud. I do so, although I still restore as much as possible through Google's backup, and I only restore through Swift on a case-by-case basis, as needed when I discover an app that's tough to set back up doesn't have it's data restored by Google.
If you've used Google Photos to backup your photos to Google's cloud, then hit the button in Google Photos to free up space. This will automatically and only delete your local copies of photos and videos that it's already backed up.
Once that ^ is done, look at your internal storage with your favorite File Manger and see if there's anything left that you want to back up manually, since a factory reset will wipe everything. Copy them to your computer or a flash drive.
When you're just starting the out of the box setup after the reset, when it asks you if you want to use a cable to restore things from an old phone, choose No, and that will lead you to Google's cloud backup where you can choose to restore everything, or you can select what you want to restore.
I think you can figure out the rest.

Reserved.

Reserved.

Reserved.

Reserved.

If you have any reputable youtube links that you think might be of help as well for complete noobs like me, that would be great.

dj24 said:
If you have any reputable youtube links that you think might be of help as well for complete noobs like me, that would be great.
Click to expand...
Click to collapse
This one's kinda long for what it is, and this is for the Pixel 1, but it should be similar for the Pixel 6/Pro. I won't add it to the first post just yet in case there are differences, and I don't want to recommend something I can't actually try on the 6 Pro (since I won't get mine for likely another two days). Unlocking the Bootloader of the Pixel and Pixel XL
Good luck!

roirraW edor ehT said:
This one's kinda long for what it is, and this is for the Pixel 1, but it should be similar for the Pixel 6/Pro. I won't add it to the first post just yet in case there are differences, and I don't want to recommend something I can't actually try on the 6 Pro (since I won't get mine for likely another two days). Unlocking the Bootloader of the Pixel and Pixel XL
Good luck!
Click to expand...
Click to collapse
This is great. I won't be getting mine for a while as well so please come back and update this thread.

dj24 said:
If you have any reputable youtube links that you think might be of help as well for complete noobs like me, that would be great.
Click to expand...
Click to collapse
Generally YouTube video guides for software related things aren't particularly helpful, as they can often get outdated very quickly; especially in the early days of a device as they can't be updated when new things are found out.
It would probably be best to carefully read through guides

@sidhaarthm reports here (be sure to thank him on his original post):
Bootloader successfully unlocked. I will just run everything stock for now - this is just so I don't have to wipe the device later after I have completed full setup and transferred all my data.
View attachment 5441915
Click to expand...
Click to collapse

dj24 said:
This is great. I won't be getting mine for a while as well so please come back and update this thread.
Click to expand...
Click to collapse
FYI, I'm reminded by several members in these forums that unlocking the bootloader (the first step before being able to root your Carrier-Unlocked Pixel 6 Pro) wipes the device - so does re-locking it. So I highly recommend unlocking it as the first step when you get the phone, otherwise, you'll have to back up anything that doesn't normally get backed up, and go through the initial setup process again. Not a big deal for some, but would likely not be optimal for a new user.
Instructions for Locking/Unlocking the Bootloader (note that unlocking or locking the bootloader will wipe the device every single time, so be sure to have your data backed up before doing so, or better yet, just unlock it as soon as you get the device).
Click to expand...
Click to collapse

roirraW edor ehT said:
FYI, I'm reminded by several members in these forums that unlocking the bootloader (the first step before being able to root your Carrier-Unlocked Pixel 6 Pro) wipes the device - so does re-locking it. So I highly recommend unlocking it as the first step when you get the phone
Click to expand...
Click to collapse
This! It's the first thing you should do out of the box if you plan on rooting later.

@V0latyle posted a new thread with some very important and fascinating information about the increased difficulty to root Android 12: Read this before rooting. Be sure to thank him there.

That's great news about Unlocking the bootloader! I'll be doing that first thing to be ready for the future...

Does this mean to say there is no OEM unlocking switch in the developer options screen?

biTToe said:
Does this mean to say there is no OEM unlocking switch in the developer options screen?
Click to expand...
Click to collapse
There is, its there and you need to flip it.

The unlock process works like this;
1) Take brand new fresh phone out of box. Do NOT put sim card in it, just power it on.
2) When it starts harassing you to join google, hit "skip" and "remind me tomorrow" as applicable until you reach home screen. YOU DO NOT need to plug in a google account.
3) Settings --> About --> Build number. Tap it until it says you're a developer.
4) Back --> Network --> Wifi and connect it.
5) Back --> System --> Developer --> OEM unlocking (check), USB debugging (check), plug in USB, authorize when requested.
6) # adb reboot-bootloader
7) # fastboot flashing unlock
Now that you've unlocked it, it has been wiped, so repeat 1-4, then disable all the google spyware, and go ahead and start using it while waiting for aosp and root.