Develop Bugs

Root & Rom Advice from the Ground Up

I need some help and I've looked all over but the information is fragmented and there is too many unfamiliar acronyms used which make it incredibly difficult for some like myself to catch up. So for the benefit of others who may be new I wanted to get some additional guidance.
I got the Pixel XL Google Version
Objectives:
1. Root with the ability to hide root so other apps will work
2. Native Mobile Hotspot
3. The ability to easily receive android updates without having to reflash etc..
4. Stay close to stock if possible, but willing to explore other options as long as security is trusted, and has good
compatibility.
5. Security is a concern, I tried a rom in the past with a Galaxy S4 and swear it had a backdoor installed in the rom.
What do you guys recommend? And how do I go about doing it?
Thank you!

If security is truly a concern you will not unlock your bootloader and root your phone.
Otherwise it all depends on which version phone you have, Verizon or Google?

1. You need magisk root for that.
3. No updates when you are rooted
4.5. Never heard of any custom rom with a backdoor. That's absolutely bull****. More likely it was an app you installed.
Unlocked bootloader is a security issue, so better to stay on full stock.
Root is a big security issue so better stay on full stock.
Jokes aside the only security issue is your phone gets stolen or you install apps outside playstore.
If you stay encrypted and use a hard pattern with fingerprint you are fine and there is always the way to delete your phone when it gets stolen.

mikaole said:
1. You need magisk root for that.
3. No updates when you are rooted
4.5. Never heard of any custom rom with a backdoor. That's absolutely bull****. More likely it was an app you installed.
Unlocked bootloader is a security issue, so better to stay on full stock.
Root is a big security issue so better stay on full stock.
I have the Pixel XL - Google Version
Jokes aside the only security issue is your phone gets stolen or you install apps outside playstore.
If you stay encrypted and use a hard pattern with fingerprint you are fine and there is always the way to delete your phone when it gets stolen.
Click to expand...
Click to collapse
My point about security really was that it's quite possible a ROM could have a backdoor. That a side..
Root is not a big security issue for me as long as the rom is trusted etc..
Shouldn't I be able to turn root off then be able to update and turn it back on again?

jadensmith said:
1. Root with the ability to hide root so other apps will work
Click to expand...
Click to collapse
It's possible to root to one slot with SuperSU while the other slot remains unrooted, and then the phone can be switched between slots with TWRP or fastboot commands. Kernels have been posted with safetynet patches, to hide that the bootloader is unlocked, but I'm not sure if any are available with the software version on my phone's current slot. As noted, Magisk can also hide root and that the bootloader is unlocked, so it's probably less hassle than trying to root and hide using SuperSU.
3. The ability to easily receive android updates without having to reflash etc.
Click to expand...
Click to collapse
FlashFire can use the OTA to update and stay rooted with SuperSU. The past couple months I've used FlashFire to update my phone, and it seems quicker and easier than the sideloading and reinstalling process I had been using. I'm not aware of anything similar to FlashFire for Magisk users, so to me it seems like you would have to decide if 1 or 3 is more personally important.
jadensmith said:
Shouldn't I be able to turn root off then be able to update and turn it back on again?
Click to expand...
Click to collapse
While reading I got the impression that I might be able to uninstall SuperSU and use the OTA update, but that didn't work with SuperSU the times I tried it, so I presume something SuperSU changed or something I did with root must have caused the update to fail. I haven't read the Magisk threads as much, yet I've seen that other SuperSU users also indicate that OTA updates no longer worked for them after rooting the phone.

alluringreality said:
It's possible to root to one slot with SuperSU while the other slot remains unrooted, and then the phone can be switched between slots with TWRP or fastboot commands. Kernels have been posted with safetynet patches, to hide that the bootloader is unlocked, but I'm not sure if any are available with the software version on my phone's current slot. As noted, Magisk can also hide root and that the bootloader is unlocked, so it's probably less hassle than trying to root and hide using SuperSU.
FlashFire can use the OTA to update and stay rooted with SuperSU. The past couple months I've used FlashFire to update my phone, and it seems quicker and easier than the sideloading and reinstalling process I had been using. I'm not aware of anything similar to FlashFire for Magisk users, so to me it seems like you would have to decide if 1 or 3 is more personally important.
That didn't work with SuperSU the times I tried it, so I presumed that something I did with root must have caused the update to fail to install.
Click to expand...
Click to collapse
Wow thanks for the great reply! It's so refreshing!
What do you mean by root one slot?

The phone has two "slots" for Android. The basic idea is that you have two copies of Android on the phone that share the same user data. On a stock phone it's intended to allow for less noticeable updates, and it also can allow the phone to fall back to the previous software version if something goes wrong with an update. On the May update my phone did automatically switch between slots, due to what is discussed in the second link below. The first link below gives some information and additional links to discussion about the slots on these phones.
http://www.androidpolice.com/2016/1...-partition-changes-and-new-fastboot-commands/
https://forum.xda-developers.com/an...signing-boot-images-android-verified-t3600606

Is it possible to keep stock or near stock and just have root with the ability to hide root, and hotspot?
That's all I really need. What would be the best way to to do this?

ctsProfile: false - Allthough not rooted

Hi there,
It might be a dumb question, but im kinda clueless.
I have my device not rooted and the SavetyNet-Check of Magisk says ctsProfile: false.
My bootloader is unlocked since the beginning. Could that be the reason for it? And if so how could I avoid it? Rooting or Relocking the bootloader?
Background:
Because I experience problems with a couple of banking apps that they dont start/crash on startup and one of them saying it might be of having my device rooted.
So thats why I thought maybe SafetyNet Check is not good and checked it and figured out one check is not passing.

wsjoke said:
Some kernels lack the feature needed to pass cts without magisk installed you can either
1. install magisk to pass CTS
2. Use a kernel that has the patch (loki and my own kernel "chunchunmaru" should have it but both are for Q only as off now)
Click to expand...
Click to collapse

First, in what rom you are? Why u install magisk manager if u don't have root? What apps don't open? We aren't magicians or clairvoyants, please always mention more details

wsjoke said:
Hi there,
It might be a dumb question, but im kinda clueless.
I have my device not rooted and the SavetyNet-Check of Magisk says ctsProfile: false.
My bootloader is unlocked since the beginning. Could that be the reason for it? And if so how could I avoid it? Rooting or Relocking the bootloader?
Background:
Because I experience problems with a couple of banking apps that they dont start/crash on startup and one of them saying it might be of having my device rooted.
So thats why I thought maybe SafetyNet Check is not good and checked it and figured out one check is not passing.
Click to expand...
Click to collapse
I assume that you are from stock. It is the problem from Mi A2 Lite's device fingerprint that somehow it is not certified. Probably for reasons:
1. Magisk manager is present
2. Unlocked bootloader
3. Usually, it will pass when fingerprint has the same value from 10.0.1.0. After that, it fails for no reason. One theory suggests it might have to do with vulnerabilities present from our device (the System Toolkit app, when you dial *#*#64663#*#*), thus revoking certification from Play Store.
If you're on custom ROM, that would be it, except from POSP that has passed CTS. Also it could be the GApps you are using.

Os_Herdz said:
First, in what rom you are? Why u install magisk manager if u don't have root? What apps don't open? We aren't magicians or clairvoyants, please always mention more details
Click to expand...
Click to collapse
Stock rom, I previously had my phone rooted, thats why I still have installed magisk.
Various Banking Apps doesnt work as intended. For example https://play.google.com/store/apps/details?id=de.commerzbanking.mobil&hl=de cant unlock with fingerprint anymore. https://play.google.com/store/apps/details?id=com.starfinanz.mobile.android.dkbpushtan&hl=de doesnt open at all and opens a website which says a rooted phone could cause this issue.

ok so updates...

Thought I read we getting a final December update.

We are, according to Google.
As for custom ROMs after the fact, most of the Android 11 versions seem to not want to include Active Edge support because it's proprietary. This is despite Active Edge functions being reverse engineered (which is, if I recall, totally legal). While a bit of a bummer, I'll have to get used to it: the 2020 Pixel models don't have Active Edge at all.

That happened rather silently, I was kind of expecting some sort of notification. Guess now I need to work out how to put a custom ROM on this thing so I get security updates, without disclosing its rooted thus breaking all my banking apps. Hopefully that's still an option, haven't rooted in years...

TheRealWhoop said:
That happened rather silently, I was kind of expecting some sort of notification. Guess now I need to work out how to put a custom ROM on this thing so I get security updates, without disclosing its rooted thus breaking all my banking apps. Hopefully that's still an option, haven't rooted in years...
Click to expand...
Click to collapse
Heres the basics of the steps forward
Going forwards only fastboot TWRP, do not install it
Backup your loved stuff on internal storage
1) unlock bootloader (instructions here)
2) reboot bootloader (at command prompt with platform tools installed: adb reboot bootloader)
3) at command prompt: fastboot boot twrp-xxxx.img
TWRP:
Walleye (Pixel 2)
Taimen (Pixel 2XL)
You want to download the latst .img file
4) wipe/factory reset accordign to ROM instructions and flash ROM (& G-Apps if needed - depending on ROM) and setup
5) reboot to bootloader adb reboot bootloader
6) fastboot twrp again fastboot boot twrp-xxxx.img
7) flash magisk (then enable MagiskHide in Magisk Manager - good enough for *most* banks - otherwise hide Magisk Manager itself, or other specific help in Magisk threads)
8) if need be (depending on ROM, some pass Safetynet out of box) use Magiskhide Props Config also in the magisk repo, to pass safetynet
9) if using Google Pay, theres a magisk module for that that i maintain. its NOT in the magisk repo (dont ask why)

TheRealWhoop said:
Guess now I need to work out how to put a custom ROM on this thing so I get security updates, without disclosing its rooted thus breaking all my banking apps.
Click to expand...
Click to collapse
You do know that installing a custom ROM doesn't require root? You simply need to unlock the bootloader, if you're not using a Verizon device that is.

Strephon Alkhalikoi said:
You do know that installing a custom ROM doesn't require root? You simply need to unlock the bootloader, if you're not using a Verizon device that is.
Click to expand...
Click to collapse
To pass safetynet and for banking (depending on the ROM), will probably need root....

Strephon Alkhalikoi said:
You do know that installing a custom ROM doesn't require root? You simply need to unlock the bootloader, if you're not using a Verizon device that is.
Click to expand...
Click to collapse
I did, long ago, but forgot Thanks for the reminder. Although as 73sydney says, sounds like I'm going to need root to get Google Pay and banking apps etc working.

TheRealWhoop said:
I did, long ago, but forgot Thanks for the reminder. Although as 73sydney says, sounds like I'm going to need root to get Google Pay and banking apps etc working.
Click to expand...
Click to collapse
I did say depending on the ROM, some ROM's will pass safetynet out of the box, others not so much

73sydney said:
I did say depending on the ROM, some ROM's will pass safetynet out of the box, others not so much
Click to expand...
Click to collapse
Interesting, was unaware of that, is this dependant on whether its a fork of the stock ROM or not? I was considering LineageOS, so presumably need the full works there.

TheRealWhoop said:
Interesting, was unaware of that, is this dependant on whether its a fork of the stock ROM or not? I was considering LineageOS, so presumably need the full works there.
Click to expand...
Click to collapse
HentaiOS, EvoX, ProtonAOSP.. all are rocking the safetynet hurdle in A11, LOS 17.1 for A10. All is not gloomy for Taimen for now atleast. However hardware-wise my device is showing its age - getting warmed up to IM apps and casual browsing , be it A10 or A11.

getting backl into custom ROMs now that the P2XL support is coming to an end - which ROMs are the most stable, most quick to be updated to the monthly security patch, and most stock-like update process (OTA-style ideally)?

2x4 said:
getting backl into custom ROMs now that the P2XL support is coming to an end - which ROMs are the most stable, most quick to be updated to the monthly security patch, and most stock-like update process (OTA-style ideally)?
Click to expand...
Click to collapse
LineageOS.

Oneplus 5t security updates vs custom ROM newbie

Hi I've never wanted to root or custom ROM. I read the instructions and they are pages deep and the issues that come up and are discussed in threads have such confusing back and forth discussions using lingo and abbreviations that make my head spin.
However... Oneplus did their last update on my 5t my fourth oneplus phone... With an already old security update.
Is the only way to not throw away a perfectly working, phone with good Ram and a fairly new battery I paid to have installed just months ago?
If I'm wanting to hold on another year or 2 use the only option custom ROMs that contain security updates?
Is there a way to add security updates without a ROM? Or maybe at least just learn to root and then add just updates or is it only in ROMs?
I could probably happily use my phone as is but worried what effect no security updates really is to my use.
I really tried videos on doing so this myself I'm not comfortable if problems happen. Not very techy.
Any help appreciated

Unfortunately you can no longer get security updates once your device is deemed as old.
Your options will be to get an antivirus app on your phone, install a custom ROM (like LOS or pixel exp), or you can get a new phone.
Since you're new to this stuff I highly recommend you just get a new phone or simply install an antivirus.
Not sure which anti virus is better than which. But I'm confident in Avira, McAfee, and Norton. You may want to purchase their plan though.
Hope I helped.

Thanks alot for the reply. I'll start with an antivirus.

Hello,
I have similar issue, since I would need security patch update to keep running company mails and apps.
I have 2 doubts:
- if I root and install Android 11 custom ROM, security patches will be updated too?
- after this, would I be able to unroot and install company mail apps ( if rooted they will not work) ?
Thanks

Personally I think that your company has put an unfair burden on you to run company mail and apps on your personal phone while expecting you to have an updated phone at the same time. An updated phone should have been "given" to you.
That being said, you can actually flash and run a custom rom without root. Root is optional.
Process is as follows: (you'll need a PC for this)
1. Backup ALL your data
2. Unlock the bootloader
3. Install custom recovery and reboot to recovery
4. Wipe cache & system and format internal memory
5. Copy custom rom & gapps to internal memory
6. Flash custom rom & gapps and reboot system

miloinodense said:
Hello,
I have similar issue, since I would need security patch update to keep running company mails and apps.
I have 2 doubts:
- if I root and install Android 11 custom ROM, security patches will be updated too?
- after this, would I be able to unroot and install company mail apps ( if rooted they will not work) ?
Thanks
Click to expand...
Click to collapse
Yes if you install custom ROM you'll have security updates. It doesn't have to be Android 11 and you don't need root to install a custom ROM.
Also make sure to follow a precise guide about it so you don't encounter any issues. Always make a backup even if you're 100% sure you won't need it.
As far as I know mail apps don't check the integrity or do a SafetyNet check, so even if you root or don't it will work fine.
If you mean banking apps then you can install some modules to bypass the check or just completely remove root. Assuming that you rooted the device.

It shows my lack of knowledge never ever did I think you could Flash a ROM without being rooted.
Thanks

I successfully installed custom ROM w/o root.
But regarding company mail apps, I would need to hide bootloader unlocked status.
maybe it's impossible, if someone has a good idea...

miloinodense said:
I successfully installed custom ROM w/o root.
But regarding company mail apps, I would need to hide bootloader unlocked status.
maybe it's impossible, if someone has a good idea...
Click to expand...
Click to collapse
My banking apps working fine without root with crdroid 7.3 and flamegapps. Might work for your company mail app too.
Some roms readily hide bootloader status

Thanks for the hint, but these company mails apps are checking security patch date too. Last available for oneplus 5t are September 2020, and no further support from oneplus.

miloinodense said:
Thanks for the hint, but these company mails apps are checking security patch date too. Last available for oneplus 5t are September 2020, and no further support from oneplus.
Click to expand...
Click to collapse
Hence that's why the burden should be on the company to provide the "up to date" phone

miloinodense said:
Thanks for the hint, but these company mails apps are checking security patch date too. Last available for oneplus 5t are September 2020, and no further support from oneplus.
Click to expand...
Click to collapse
And that's why the burden should be on the company to provide the "up to date" phone

miloinodense said:
Thanks for the hint, but these company mails apps are checking security patch date too. Last available for oneplus 5t are September 2020, and no further support from oneplus.
Click to expand...
Click to collapse
I think if you change build.prop to some other phone with recent security patches you can bypass this.

XDHx86 said:
I think if you change build.prop to some other phone with recent security patches you can bypass this.
Click to expand...
Click to collapse
Today, I was thinking that this could be good way.
Root, change build.prop, and then unroot.
If you have a link for a good tutorial on change bulid.prop would be nice, thanks.

miloinodense said:
Today, I was thinking that this could be good way.
Root, change build.prop, and then unroot.
If you have a link for a good tutorial on change bulid.prop would be nice, thanks.
Click to expand...
Click to collapse
Just for update:
I tried to Root a stock ROM, edit build.prop (security patch date), unroot, and then lock bootloader.
But even if it was a stock ROM, OP5T was not booting.
Booloader was stopping boot since it was detecting a non-stock ROM.
Indeed, I had to unbrick OP5T since I was not possible to unlock bootloader.
So, still not solved

miloinodense said:
Just for update:
I tried to Root a stock ROM, edit build.prop (security patch date), unroot, and then lock bootloader.
But even if it was a stock ROM, OP5T was not booting.
Booloader was stopping boot since it was detecting a non-stock ROM.
Indeed, I had to unbrick OP5T since I was not possible to unlock bootloader.
So, still not solved
Click to expand...
Click to collapse
Just edit build.prop and use magisk hide module from magisk manager.

XDHx86 said:
Just edit build.prop and use magisk hide module from magisk manager.
Click to expand...
Click to collapse
Edit build.prop w/o root and unlock bootloader is not possible...
Moreover, hiding root will not work with more recent android updates and for sure it will not hide unlock bootloader.

miloinodense said:
Edit build.prop w/o root and unlock bootloader is not possible...
Moreover, hiding root will not work with more recent android updates and for sure it will not hide unlock bootloader.
Click to expand...
Click to collapse
Yeah I assumed you would know that you should root first. But seeing you even attempted to lock bootloader after modifying the device, seems I assumed wrong.
Magisk hide is working fine on later android versions like 8+. And for the bootloader it only trips CTS if your bootloader is using hardware backed key - Which is the case with OP5 - as CTS check also has hardware attestation. But it is possible to bypass said check by using SafetyNet Fix module, of course you will also install that from magisk manager.

Question : widevine, mcdonalds, banking app and root?

Hello!
I will receive a oneplus 9 pro next week and wonder if i shall root it or not. I want to use titanium backup and a few other apps that need root permission, but i also dont want to loose widevine level 1 for netflix and amazon video in hd, want to use my banking app and mcdonalds app.
i havent followed the magisk/root discussion for maybe a year or two (used a unrooted stock phone), so i am not up to date how things are at the moment.
just to be clear, please can someone answer the following questions:
1.) is unlocking bootloader (no root afterwards) enough to loose widevine level 1? can level 1 be gained again when bootloader is locked again or is lost permanent (like triggering knox with samsung).
2.) any problems with mcdonalds app and magisk? google pay?
after reading to the internet on the subject totday, i get the impression that rooting nowadays causes more problems thn benefits, but maybe i get a wrong impression.

flotsch1 said:
Hello!
I will receive a oneplus 9 pro next week and wonder if i shall root it or not. I want to use titanium backup and a few other apps that need root permission, but i also dont want to loose widevine level 1 for netflix and amazon video in hd, want to use my banking app and mcdonalds app.
i havent followed the magisk/root discussion for maybe a year or two (used a unrooted stock phone), so i am not up to date how things are at the moment.
just to be clear, please can someone answer the following questions:
1.) is unlocking bootloader (no root afterwards) enough to loose widevine level 1? can level 1 be gained again when bootloader is locked again or is lost permanent (like triggering knox with samsung).
2.) any problems with mcdonalds app and magisk? google pay?
after reading to the internet on the subject totday, i get the impression that rooting nowadays causes more problems thn benefits, but maybe i get a wrong impression.
Click to expand...
Click to collapse
Use the canary builds of Magisk, enable MagiskHide, and toggle the apps in question, and you're golden. Also, just to be sure, toggle it on for Google stuff like the Google app, Google Play Store, Google Play Services, Google Services Framework, Netflix, McDonald's, GPay, and any other banking or streaming subscription apps. Might want to have Magisk hide its self by changing the app name and signature as well.

GuyInDogSuit said:
Use the canary builds of Magisk, enable MagiskHide, and toggle the apps in question, and you're golden. Also, just to be sure, toggle it on for Google stuff like the Google app, Google Play Store, Google Play Services, Google Services Framework, Netflix, McDonald's, GPay, and any other banking or streaming subscription apps. Might want to have Magisk hide its self by changing the app name and signature as well.
Click to expand...
Click to collapse
thank you for the information.
so i will definitely not loose widevine l1 with unlocking bootloader and root?
to hide magisk itself (change name and signature), i just need to turn this option on in magisk and not need to do this in a manual way?

flotsch1 said:
thank you for the information.
so i will definitely not loose widevine l1 with unlocking bootloader and root?
to hide magisk itself (change name and signature), i just need to turn this option on in magisk and not need to do this in a manual way?
Click to expand...
Click to collapse
Correct, by default it will change to a "default" app icon and rename itself to "Settings" but you can easily still tell it from the device's own system Settings app.

one last question.
following this root instruction https://forum.xda-developers.com/t/guide-magisk-unlock-root-keep-root-oos-11-2-7-7.4252373/ , do i have to use the provided boot images? i feel safer to download the full ota from oneplus official site and extract payload.bin and then use payload dumper to get a boot.img.

flotsch1 said:
one last question.
following this root instruction https://forum.xda-developers.com/t/guide-magisk-unlock-root-keep-root-oos-11-2-7-7.4252373/ , do i have to use the provided boot images? i feel safer to download the full ota from oneplus official site and extract payload.bin and then use payload dumper to get a boot.img.
Click to expand...
Click to collapse
If you are leery of using someone else's boot.img, feel free to do that if you'd like. But regardless, be sure to boot the image, don't flash it. Booting it not only gives you the temporary root access to install Magisk yourself, but also ensures that the patched boot.img is actually valid.

v23 has a fix for SafetyNet API. It looks like that supersedes anything from the last canary/debug builds, so it's probably safe to stick with that. Everything else is the same, though.

GuyInDogSuit said:
v23 has a fix for SafetyNet API. It looks like that supersedes anything from the last canary/debug builds, so it's probably safe to stick with that. Everything else is the same, though.
Click to expand...
Click to collapse
V23?

flotsch1 said:
V23?
Click to expand...
Click to collapse
Latest stable Magisk build. I'm saying you won't need to mess with canary/debug.

When you turn on hide then hide the app the in the settings then your allowed to do anything you like but also hide it in the menu of magisk then your all done don't flash to much crap and magisk hide module is not really finished yet for this device good luck
I rooted it the second i got it
And don't use canary builds of magisk only if you want to run your phone very unstable i recommend the stable version

thanks alot for the information.
i still hazzle to root. i had a oneplus 3 2 years ago and had magisk root/custom rom/twrp, but i also had issues on regular basis and spent alot of time on xda and with flashing. dont know if i want this again or just a phone that works.
and just to be sure:
in case i loose my widevine level 1 because of root or bootloader unlock: will it come back when locking bootloader again and/or unroot. or will it be level 3 forever?

Wildvine L1 is not always retained when unlocking the bootloader. If I unlock mine, I go to L3 every single time, but when I lock it back, I go back to L1. I've tested this 3 times and it happened all 3 times.

flotsch1 said:
thanks alot for the information.
i still hazzle to root. i had a oneplus 3 2 years ago and had magisk root/custom rom/twrp, but i also had issues on regular basis and spent alot of time on xda and with flashing. dont know if i want this again or just a phone that works.
and just to be sure:
in case i loose my widevine level 1 because of root or bootloader unlock: will it come back when locking bootloader again and/or unroot. or will it be level 3 forever?
Click to expand...
Click to collapse
Well to be honest I never had that problem and i need to have my binance hidden as well and everything works well but with some games like slime hunter i really need to hide magisk it self too from the settings but when you do they everything will be working okay. And so far I have seen with magisk hide module what you can download is that there are no keys yet for using in op9p (could be changed didn't check it for a while now)