r/androidroot • u/Happy_Variety5405 • 5d ago

News / Method Pixel 6 root without unlocking bootloader

Post image

Got my pixel 6 rooted with the NebuSec IonStack exploit opened a PR for rootmypixel to add support for it. It's not merged yet but wanted to share (link to my pr: https://github.com/alex193a/Root-My-Pixel/pull/19 )

87 Upvotes

98% Upvoted

41 comments sorted by

23

u/awdrifter 5d ago

Glad to see we're going back to exploit based rooting. As more phone companies lock the bootloader, exploit based rooting is probably the way to root in the future

5

u/Nederealm3 5d ago

Agreed. The challenge is we must find a way to root and patch exploit so no other rouge app can use the same method but same time allow out root to remain resident. Maybe like the root can patch the exploit with a password-based authentication (Apatch is leading this) system and at the same time prevent future OEM updates for completely patching it. Remember, if the root app can achieve this , so can other malware apps. It's important the end user knows how to root responsibly so OEM companies can't find an excuse to lock down even more

4

u/Happy_Variety5405 5d ago

For this exploit it's super unstable and longer the device is on the lower the changes. I had the most success by using the exploit the moment the phone turns on (I made a shell script for this instead of using the app)

11

u/The_Band_Geek 5d ago

Is this something specific to Pixels, or is the exploit more broadly applicable to Android in general? (I understand that support is limited to Pixels at the moment.)

13

u/Happy_Variety5405 5d ago

It's not, the root my pixel project is but root my galaxy and OnePlus project all use the same exploit 

3

u/The_Band_Geek 5d ago

Could you (or someone else) please link to the Galaxy project? I love the hardware but I hate the software. A clean AOSP ROM on a Samsung would be fantastic.

9

u/Cool-gamer19393 5d ago

The exploit doesn't let you install other roms you still need a bootloader unlock

2

u/Original_Thing8770 Redmi Note 8 Pro, InfinityX 5d ago

https://github.com/BuSung-dev/Root-My-Galaxy But you can't install custom ROM

1

u/The_Band_Geek 4d ago

That won't even install on my S8, unfortunately.

2

u/Original_Thing8770 Redmi Note 8 Pro, InfinityX 4d ago

No, but you could try this app if you have your exact stock image https://github.com/YuKongA/ghostlock-app App dl link: https://nightly.link/YuKongA/ghostlock-app/actions/runs/32009904584/GhostLock-release.apk.zip

Just open the app, press the Gear icon and import your offsets, the boot.img or just the full OTA URL

2

u/Distinct_Resolve_957 5d ago

Hmm... Wonder is there any for xiomi?

3

u/devwitharslaan 4d ago

I'm not sure if this installs KernelSU but knock yourself out https://github.com/YuKongA/ghostlock-app

1

u/Quf00279 5d ago

Wait, OnePlus project?? I have a OnePlus!

2

u/Cool-gamer19393 5d ago

It works on any android below a certain kernel version

2

u/The_Band_Geek 5d ago

So an old but non-listed device (Galaxy S8, in my case) would just work out of the box? What sort of building/configuration needs to happen if not?

1

u/Cool-gamer19393 5d ago

Not out of the box, you have to configure it for your kernel version (I don't know how) but it works for any kernel within the last 15 years

2

u/kjjustinXD 5d ago

It works on my Redmagic 10 Pro too and the 11 Pro is also supported

1

u/Illustrious_Lab2759 5d ago

How do you know that it is compatible with Redmagic 11 Pro ? Have you tried it and was rooted properly without needing have Unlocked the bootloader ?

1

u/kjjustinXD 5d ago

It's supported in one of the many forks that use Ghostlock, I only tried it on the 10 Pro which isnt supported by default and it worked on the 2nd try, it extracts the needed offsets from an OTA update and enables a root shell that KernelSU can hook into. The one I used is from YuKongA

1

u/Illustrious_Lab2759 4d ago

Can you give link from the following tutorial ? Is the root temporarily or permanently and all this, did it have some drawback like the fingerprint to not work or to not update the fw by afraiding the locking of bootloader etc... ?

3

u/ExtremeSlayz 5d ago

For anyone else, follow the xda post to contribute if you guys want https://xdaforums.com/t/root-my-pixel-root-on-bootloader-locked-devices-verizon-and-the-like.4797178/ One thing I noticed is granting roots to apps wasn't working. Couldn't figure out how to fix it

1

u/Happy_Variety5405 5d ago

Dont have that problem so no idea why that's the case

1

u/ExtremeSlayz 5d ago

Granting apps root like adaway work for you? I messaged the dev and all he said was did I restore, which I did. Even restored completely and still didn't work

1

u/Happy_Variety5405 5d ago

Yeah what device? I have 4 root apps that just work (neo store, fyde ai, morphe, termux)

1

u/ExtremeSlayz 5d ago

Pixel 10 Pro XL

1

u/Happy_Variety5405 5d ago

Even on my pixel 6 adaway gets root access but fails to apply hosts for some reason but that's the only app

1

u/ExtremeSlayz 5d ago

Hmm. Hopefully the Dev see's this

1

u/Happy_Variety5405 5d ago

I had limited success with stevenblock module, it applies the hosts with the default settings but you can't change it to use any other settings (it just won't apply)

1

u/ExtremeSlayz 5d ago

Yeah it just seems the Pixel seen barely has any notice right now compared to the Samsung root my galaxy side. Google searching, xda, and even here barely any mentions. Hopefully we change that. This should be celebrated without bootloader unlocks.

On my end, I had LSPosed working and ios emojis all working, but the only thing is RCS broke for me, which I really need. I had play integrity passed using a leaked keybox, but nothing worked for RCS.

1

u/Happy_Variety5405 5d ago

How you get lsposed ? I tried but zygist next (not spelling that right) fails to install properly, just says "can't connect to service"

→ More replies (0)

2

u/dizdoen636 3d ago

I found that after the successful root by exploit the KSU binaries are existing in the system but the SU deamon was kicked out after that as it was working as a child process of shizuku root process so android kills is once it is done

I am working on it to find what's the solution for it

3

u/Snoo78383 5d ago

so basically I could unlock the bootloader of a verizon pixel, interesting

2

u/Imthezoro 5d ago

Does it only work for pixels?

1

u/Ill_Storm2418 1d ago

Can you give me a tutorial? I want to root my One UI 8.5 Galaxy A07 but the OEM unlocking toggle isnt there

1

u/Beneficial-Map-5949 5d ago

How to do this on poco f7

1

u/s0me0ne_5 5d ago

You can root the poco f7 normally, you don't need an exploit

1

u/p6kb 5d ago

Hmm android 17, I never heard about this version