[GUIDE] Update to and Re-Root Android 12 **READ THE NOTES**

**********************************
Current status as of October 25: Data wipe seems to be required for permanent root if upgrading from Android 11. Patched boot image can be live booted for temporary root, as long as your /vbmeta and /boot partitions are not modified. Attempting permanent root (flashing vbmeta and boot image) after OTA or dirty flash results in bootloop ending up in recovery with "Unable to load Android system. Your data may be corrupted" message.

However, @HumorBaby was able to upgrade from 12 Beta 5 without a data wipe by manually sideloading the OTA, then flashing vbmeta and boot in fastboot. Please see his guide here.

We don't yet know what is causing this issue, although @ipdev discovered that Android 12 introduced Boot Image Header Version 4, although we still don't know exactly how this may be related to the issue.

I have posted a thread in the Magisk forum that will hopefully bring some attention to our boot issues from the developers there. Please don't post but feel free to check back for updates.
**********************************

With the Android 12 now here, I would like to make sure we have clear instructions on how to update with root.
This may seem redundant compared to other threads, but I wanted to consolidate the relevant information to one place.

WARNING: MANUALLY INSTALLING FACTORY UPDATES OR IMAGES REQUIRES AN UNLOCKED BOOTLOADER. If your bootloader is locked, DO NOT ATTEMPT THIS. You can, however, update using the OTA via ADB Sideload on a locked bootloader.

WARNING: MODIFY YOUR DEVICE AT YOUR OWN RISK. YOU ALONE WILL BE RESPONSIBLE FOR MALFUNCTION, DAMAGE, OR LOSS OF ANY KIND IF SOMETHING GOES WRONG.

Root will be done via Magisk. If you aren't already using it, download and install to your phone.

Warning: For the sake of simplicity, I frequently will use generalizations when referring to files ("[patched boot image]" instead of "magisk_patched-23001_xxxxx.img" for example). It is YOUR RESPONSIBILITY to ensure you are flashing the correct file. The easiest way to do this is type the command in the command line without the file itself, then drag and drop the file you want to flash into the command line window.


For those of you with a locked bootloader:
Simply install the update as usual via OTA, whether automatically through Android Update, or manually via adb sideload.

First, a bit of information on why you need to follow this guide (See this post)

Two new Verified Boot features implemented in Android 12 will interfere with attempts to root. A more detailed explanation is below if you would like.


To update to Android 12 via OTA with data intact and reroot: **AS OF 10/20, DATA WIPE IS REQUIRED for permanent root**


To update to Android 12 via factory image using Android Flash Tool: (Wipe required)

To update to Android 12 via factory image using ADB: (Wipe required)

Patch Boot Image:

For subsequent updates to Android 12:
Either install the update via OTA Sideload, then reflash vbmeta with disable flags set, or dirty flash the factory image with disable flags set.
Live boot your patched boot image from bootloader (as long as you're still on Android 12, the old kernel should work fine):In system, launch Magisk then select "Direct Install" to patch the stock image in /boot. >>>Given the issues we are currently dealing with, and the confusion as to why, we will update this guide when the next update is released.

Key reminders:
* The OTA does not have a way to set the disable flags for vbmeta, so if you update via OTA, you will have to reflash vbmeta with the disable flags every time you update.
* If you forget to do this and have a patched boot image, bootloader will return an error: "failed to load/verify boot image"
* The fastest and easiest way to update is via OTA, but remember you will lose root until you're able to reflash vbmeta and repatch the boot image.
* Manually patching the new boot image in Magisk via "Select and Patch a File" should be unnecessary every time you update. You can, instead, just keep the image you originally patched, boot it every time you update, and flash the stock image in /boot using Magisk.
* If, after flashing a patched boot image, you get the "unable to load/verify boot image", you probably didn't get the flags quite right. Just reflash vbmeta with the disable flags and that should fix the problem.

If you run into problems, or just want to share your results, please feel free to post your method and results in this thread.

optimumpro said:

Who is calling you stupid?!?! It's an American expression: for example, your costume is ruined by rain, so, you say: it's the weather stupid.

Anyway, I am trying to help, so, there is no reason to seek insults where there isn't one.

It's just the way you worded it is all. I am born in America, and actually thought the same thing when I read it.
It's confusing to me though..

I would say, not "it's the weather, stupid"
but rather
"it's the stupid weather"

so reading "It's the bootloader stupid"
I feel should be,
"it the stupid bootloader"

but thank you for clearing up that you aren't passing insults.
And it's hard to tell through text whose being argumentative, and whose being helpful.
Glad you're the latter.

optimumpro said:

Well, it is relevant whether Google cares about things or not especially if you are only interested in stock, as there is a lot less you can do there.

It's the bootloader stupid. Apparently Android 12 bootloader requires AVB-2 and verity in orange state.

The reason it happens on newer Pixels only has to do with the Android version these devices came out originally. Devices that didn't come with Android 11 originally have legacy bootloaders. Such devices were converted to Android 11 with their bootloaders still backward compatible with Android 9. Pixels 4/5 probably came out with Android 11, so, they are only compatible with Android 10.

Anyway, the only thing you can do is try to extract Android 11 bootloader from stock and flash it on your device that has Android 12.

It works on Oneplus 6/6T, which were recently updated to stock Android 11. That update broke TWRP, However, when you flash Android 10 bootloader on stock Android 11, all problems disappear.

Click to expand...

Not sure if you're calling me stupid or the bootloader stupid, either way you should be careful about the insults.

My point on relevancy is that it doesn't change the issue we are dealing with - I agree in that I don't think Google is interested in preventing root, but I do think that they implemented new features that had the unintended effect of what we are dealing with here.

I don't think this is a bootloader issue, because the bootloader that shipped with 210812.015 (A12 initial public release) is the same as 210812.002 (A12 beta 5) - and as I mentioned previously, all we had to do on Beta 5 is flash vbmeta with the disable flags.

And, against my better judgement, I tried flashing the A11 bootloader. Unsurprisingly, I got the corrupted system error. I'm not sure where you got your information; bootloaders are typically backwards compatible, but systems are not - you can run an Android 9 ROM on an Android 11 bootloader, but you typically cannot do the reverse.

Not to be rude but it seems like you're basing your comments on incorrect information, or at least information that is relevant to a different device. In this specific case, the Pixel 5 bootloader only handles one part of AVB - verifying the kernel against vbmeta as it loads. If it doesn't match, and verification is not disabled, the bootloader will halt and display the "Unable to load/verify boot images" message.

But we aren't dealing with that. We already discovered this on the 12 beta and discovered that using --disable-verification and --disable-verity turns off this initial verification.

The issue we are running into now, as I have tried to explain exhaustively, is that the kernel begins to boot, but something in the kernel itself - probably dm-verity - finds some sort of mismatch, regardless of the bootloader state, has a kernel panic, reboots the device, and boots into recovery mode with the data corrupted error.

So what I believe we need to do is disable verity in the boot.img itself. I'm going to fire up a hex editor and use this guide, specifically Method 1, to see if I have any success.

For those of you who have not yet wiped data and are using unrooted Android 12:

As long as your system boots, you should be able to live boot a patched boot image and use that for temporary root:

fastboot boot patched_boot.img

If you are currently stuck at the "corrupted data" message in recovery, try sideloading the OTA or dirty flashing the factory image (with NO FLAGS). If that doesn't work, the only fix that I know of that works is to perform a factory reset...but if you get to that point, you might as well clean flash the factory image with both --disable flags:

fastboot --disable-verity --disable-verification -w update redfin_image.zip

at which point you should be able to flash and boot the patched boot image.

optimumpro said:

Who is calling you stupid?!?! It's an American expression: for example, your costume is ruined by rain, so, you say: it's the weather stupid.

Anyway, I am trying to help, so, there is no reason to seek insults where there isn't one.

I didn't seek one, I guess I misunderstood. I have never heard of that expression before, at least not in that context. I'm American too, and I've generally heard it like this:

"Hey, what's making that howling noise?"
"It's the wind, stupid!"

I digress.

I'll have to pick this up later; it's late, my wife is demanding....attention, and I want to enjoy the weekend.