rooting-oneplus11.md

Root OnePlus 11 - PHB110/CPH2447/CPH2449/CPH2451

Here is a guide on how to root the OnePlus 11. It should work with any model of OnePlus 11. This should also work for other OnePlus 11 ROMs but is not guaranteed.

This process, if done correctly and in order, takes less than an hour, sometimes faster if you're familiar with the process. Back up all of your data. I repeat, back up ALL of your data, just in case!

This article covers:

• Rooting OnePlus 11
• Flashing OnePlus 11 with Magisk
• Backing up OnePlus 11
• Updating OnePlus 11 with OTA updates
• Hiding root from apps
• Fixing Netflix and other DRM issues
• Unbricking OnePlus 11

DISCLAIMER: Following these instructions is at your own risk and not the fault of the guide creator if your phone is bricked. Please see the disclaimer at the end of the article for details.

OnePlus 11 Model Numbers

OnePlus 11 comes in several model numbers for different regions:

• PHB110: China
• CPH2447: India
• CPH2449_EEA: EU
• CPH2449_GLO: International
• CPH2451: North America【32†source】.

Important Notes

If you have a new OnePlus 11, do NOT attempt to change the active slot - you will find that there is not another working slot! Doing so may result in a soft/hard brick and you will have to use EDL mode to restore the data. Unfortunately, the MSM tool doesn't work with OnePlus 11 anymore. So if this happens, you can either get ahold of OnePlus support (may have to send the phone back) or use NCUnlock.com's remote service to fix. See Unbrick section below for details.

As long as you don't change the active slot, the process listed on this page should work fine. I've done it on my own phone and helped another do the same without issue. Just don't change the active slot!

Once you get temporary root access with KernelSU, I recommend immediately backing up the clean boot files before you flash them, and backing up the patched Magisk boot files after you patch them with Magisk.

Phase 1: Unlocking the bootloader

WARNING: This will erase all data on your phone. Always always always make a backup of ALL of your data. If you already have root, use a tool like Swift Backup to back up your app data so you can easily restore all of your apps.

1. Complete the initial setup. Don't waste time signing into anything.
2. Go to Settings -> About Device -> Version.
3. Tap 7 times on Build number.
4. Go back to settings -> Additional settings -> Developer options.
5. Enable OEM unlocking and USB debugging.

Phase 2: Installing drivers

If you don't already have adb, fastboot, and the OnePlus drivers, download and install the drivers and tools (if you don't already have adb/fastboot/drivers) from this link.

Don't install OPLocalUpdate_For_Android12.apk.

Phase 3: Recognizing the phone and unlocking the bootloader

1. Connect the phone to the PC and accept the prompt on your phone.
2. Open PowerShell or CMD on your computer.
3. Enter the command adb devices. This command will print a list of all attached devices with USB Debugging enabled and return the serial number and state of the device【40†source】. It should return something like this:

List of devices attached
    6g73s2t1        device

4. Reboot to bootloader using the command adb reboot bootloader. Sure, continuing from where we left off:
5. Once in the bootloader, enter the command fastboot devices. This command is similar to adb devices; it prints a list of all attached devices in fastboot mode. In response, it returns the serial number of the device.
6. WARNING: This will wipe all of your data!!!!! To unlock the bootloader, use the command fastboot flashing unlock.
7. Allow your phone to proceed with the unlocking process. Do not be alarmed by the Orange State warning message that appears after your phone restarts; this is a standard part of the process.
8. Begin setting up your phone. Don't set up any accounts or anything that isn't absolutely necessary until you have successfully set up a pin or password due to a known issue with OnePlus devices.
   • If you can set up a pin or password, skip to Step 10.
   • If your device hangs during the second entry, proceed to Step 9. WARNING: This is very important! If you cannot set a password successfully, you need to fix this BEFORE you continue to root. Do NOT root before fixing this. 😊 Otherwise it could cause problems and result in a soft/hard brick and having to restore via EDL mode or sending it back to OnePlus to repair!!!!!!!!!!!!!!!!!
9. This is the tedious part.
   • You may need to lock and unlock the bootloader multiple times until the pin or password setup works.
   • You might also need to toggle the OEM unlocking switch in the Developer Options between lock and unlock cycles.
   • To lock the bootloader, use the command fastboot flashing lock then repeat all the steps in Phase 1 and Phase 3 as necessary.
   • If you have done this 10+ times without success, perform fastboot flashing unlock, then after it reboots type adb reboot recovery and go to Format Data. It should reset the phone to factory defaults but should let you enter a pin/password and OEM unlocking should be enabled, although your OS may not know that it is. 😊 Try proceeding anyway - this is what I had to do.
10. Once you have successfully set up a pin or password, you can proceed with the rest of the phone setup or continue to Phase 4.

Phase 4: Gaining temporary root access and installing Magisk

1. Download and install the KernelSU app; look under each Assets section until you find the latest APK file and install that.
2. Open the KernelSU app on your phone to find the Kernel version you need to download. It should be formatted similar to 5.15.41-android.... Note that this number is subject to change with each update and is different depending on your model, so always use the number displayed on your phone.
3. Based on the Kernel version, download the corresponding boot.img.gz file from the KernelSU releases page. For example, if your Kernel version is 5.15.41-android13, you would download a file named like android13-5.15.41_2022-05-boot.img.gz. This file will change with each app update, so always use the latest available file that matches your phone's Kernel version. Save the file in a convenient location.
4. Extract the .img file from the downloaded .gz file. You can use WinRAR or 7-Zip to do this.
5. Reboot your phone to the bootloader using the following command:

   adb reboot bootloader
   

6. BOOT the downloaded kernel. IMPORTANT: DO NOT FLASH THIS TO THE PHONE! Use the following command to boot the kernel:

   fastboot boot {downloaded_img_file_name}.img
   

   For example:

   fastboot boot android13-5.15.41_2022-05-boot.img
   

   At this point, you essentially have temporary root access. RECOMMENDED: This is the best time to make a backup of your clean boot files (see Backing Up Images section). That way if something goes wrong you can at least boot to the original image (which can be hard to find with OP11 as the stock image is not publicly available at this time). After you type su you may need to allow superuser access with KernelSU temporarily.
7. Download and install Magisk Canary or Magisk Debug. The Stable version does not work (links also found on the main page of the Magisk repo.
8. Open the KernelSU app on your phone and select the middle Superuser tab.
9. Scroll down in the Superuser tab and toggle on Magisk.
10. Open the Magisk app and perform a direct install.
11. If you see any warnings or errors related to boot or init_boot or vbmeta (or any variant) then tap Reboot but when your phone reboots, open Magisk and repeat step 10 until you don't see any warnings or errors (usually just once more).
12. Set up DenyList (hide root from certain apps):
    • Open Magisk and tap the settings gear at the top right.
    • Go down to Zygisk and toggle on.
    • Go to Enforce DenyList and toggle on.
    • To hide root from apps, tap Configure DenyList and toggle on for the apps you want to hide root from.
13. If any Google apps such as the Play Store are experiencing issues, go to your phone settings, find these apps, and clear their data.

Phase 5: Installing Needed Modules

Although the phone is technically rooted at this point, you may notice that some apps (like banking/crypto/Netflix) won't let you open them, because they may still detect that your phone is rooted. See disclaimer for more details.

Note: I asked the Magisk team about this but they simply closed the Issue without comment. So I'm not sure what the official response is. If using a Magisk stable version, you may be able to install these modules from the Modules listing, but the listing doesn't appear in the debug version.

Here's the workaround:

1. Download safetynet-fix-v2.4.0-MOD_1.2. This is a Magisk module that will work around Google's SafetyNet attestation.
   • Go to Magisk > Modules > Install from Storage > find the file in Downloads and let it install. Reboot.
2. Download Magic mount extend and liboemcrypto disabler odm. These are Magisk modules that will work around Google's Play Integrity attestation.
   • Go to Magisk > Modules > Install from Storage > find magisk_mount_extend.zip in Downloads and let it install. Reboot.
   • Go to Magisk > Modules > Install from Storage > find liboemcryptodisablerodm_26_magicmount.zip file in Downloads and let it install. Reboot.
3. If any Google apps such as the Play Store are experiencing issues, go to your phone settings, find these apps, and clear their data.

Backing Up Images

The boot files will either be the boot_a.img or boot_b.img files, depending on which slot the system is currently in. There is only one persist.img file, and it changes with each update, so make sure you save it.

It is highly recommended that you back up your images before and after patching. The OnePlus 11 stock images are not officially available, so that way if something goes wrong you can at least boot back into the stock image.

Steps to perform the backup:

1. Type these commands in terminal:

   adb shell
   su
   dd if=/dev/block/by-name/boot_a of=/sdcard/boot_a.img
   dd if=/dev/block/by-name/boot_b of=/sdcard/boot_b.img
   dd if=/dev/block/by-name/init_boot_a of=/sdcard/init_boot_a.img
   dd if=/dev/block/by-name/init_boot_b of=/sdcard/init_boot_b.img
   dd if=/dev/block/bootdevice/by-name/persist of=/sdcard/persist.img
   

   These commands will create a copy of your system's boot and persist images and save them to your phone's SD card.
2. Once these files are saved, you can then move them from your phone to your computer for safekeeping. To do this, you can use the file transfer feature of your phone when it is connected to the PC via USB.

By completing this phase, you have successfully backed up your system files. Keep them safe as they could be instrumental in recovering your phone in case of a malfunction or mishap.

How to Handle Over-The-Air (OTA) Updates

Warning: You must unroot your device first before proceeding with the OTA update. Failure to do so may result in system instability or a bricked device.

Backup Recommended: If you wish to backup the new stock boot_a.img, boot_b.img, init_boot.img, and persist.img files before rooting the update, check the previous step.

Traditional Steps:

1. Open the Magisk app on your phone. Tap on Uninstall Magisk and then select Restore Images. DO NOT REBOOT after this step.
2. Install the OTA update using Settings > About > OxyenOS/Update. Again, DO NOT REBOOT after this step.
3. Open Magisk again and select Install to inactive slot. After this, you can now reboot your device.

If it's working now, skip the rest of this section.

Alternate steps (OPLocalUpdate):

If the traditional update method above doesn't work, you can use the OPLocalUpdate method:

1. Download and install Oxygen Updater. Grab the latest incremental version listed there (confirm it's the right version). It will download the incremental ROM by default unless you've toggled advanced mode.
2. Download and install OPLocalUpdate 13 from OnePlus.
3. Open the Magisk app on your phone. Tap on Uninstall Magisk and then select Restore Images. DO NOT REBOOT after this step.
4. Install the OTA update using the System Update (OPLocalUpdate) app.
5. Open Magisk again and select Install to inactive slot. After this, you can now reboot your device.

For those who previously flashed the patched init_boot following other instructions, you should reflash the stock init_boot using the same method you used to flash the patched file. This ensures that your device is in a clean state before applying the OTA update.

Unbrick your OnePlus 11

If you bricked your phone and it won't boot, DO NOT change the active slot. For whatever reason, OnePlus 11 doesn't ship with a working secondary slot. I thought this was just my problem, but had another user reach out to me with the same exact issue.

1. Don't freak out. It's most likely fixable! There's just a few things you should try first.
2. Determine if your phone can get into fastboot:
   • In PowerShell or CMD, type:
     • adb reboot fastboot
     • If that works, continue to step 4.
   • Immediately after rebooting the phone and before the boot logo, hold the Volume Down key, release it when you see the fastboot screen
   • If it doesn't do anything, hold down the Volume Up + Volume Down + Power keys until it vibrates, then immediately hold down the Volume Down key; release it when you see the fastboot screen
3. If you can get into fastboot, skip this step. If you can't get into fastboot, try getting into recovery:
   • In PowerShell or CMD, type:
     • adb reboot recovery
     • If that works, continue to step 4.
   • Immediately after rebooting the phone and before the boot logo, hold the Volume Up key, release it when you see the fastboot screen
   • If it doesn't do anything, hold down the Volume Up + Volume Down + Power keys until it vibrates, then immediately hold down the Volume Up key; release it when you see the fastboot screen
4. As long as you can perform adb boot boot.img where boot.img is the image you want to boot to, then there's no big issue. Try booting into the original image and the patched images separately. If the patched image doesn't work but the original image does work, search the web for a fix or post in this thread.
5. If you can't boot at all, or you can only get into recovery, just perform a Format Data to reset everything. After you perform this, you may need to go into fastboot and boot to the original image if you already patched the image.
6. If you still can't boot, you'll need to either:
   • Have OnePlus support fix the phone. Not sure if they'll want you to send back the phone or can fix remotely. This is probably what you should try first as it is the official method to fix.
   • I've personally used NCUnlock.com and it was easy; it only costs $15 and takes < 30 minutes. I used this place and chatted with their team without any issue at all! Recommended!
     • YouTube video of the process.
     • If you decide to use them, go to this page and download the appropriate stock firmware and each of the flash files. Install the Qualcomm drivers and extract the data before you chat with NCUnlock.com's support.
     • To purchase their services, go to this page and place the order. Then message them on Telegram (link at bottom of their page). They usually get back quick, I chatted with them around 7 PM CST.
     • Note: I am not affiliated with NCUnlock.com and have only used them once. You purchase remote services from them and they perform the unlock. You don't actually get a login to the app in the video, which I was a little bummed about, but nonetheless they were super helpful.
     • They're using the official Flash Tool that OnePlus support uses, so I'm not sure if OnePlus support would just remote-in to your computer and do the same process for free, or what. They did log in to a seemingly legitimate account and did not use the modded/leaked version.
   • I tried using QLMFlasherPro but they only support OnePlus up to OnePlus 9 Pro. I contacted their support and asked them if it would work with OnePlus 11 and they said "no". They said they could fix it and send me a screenshot of the same fix that NCUnlock.com uses. 😊

App Recommendations

App	URL	Description
Swift Backup	https://play.google.com/store/apps/details?id=org.swiftapps.swiftbackup	Performs a backup of apps and app settings, requires root. Runs on a schedule, even supports cloud backup.
Revanced Manager	https://github.com/revanced/revanced-manager	Revanced manager application for Revanced Patches.
Revanced Patches	https://github.com/revanced/revanced-patches	Patches to hide ads on YouTube, Spotify, Reddit, Facebook, Twitter, and more.
AdAway	https://github.com/AdAway/AdAway	Blocks ads in all apps. Enable Systemless Hosts in Magisk settings first.

---

Links

Title	URL	Description
XDA-Developers OnePlus 11 Forum	https://forum.xda-developers.com/f/oneplus-11.12687/	Your goto resource for anything Android.
PROPER CPH2451 Root and Update instructions	https://forum.xda-developers.com/t/proper-cph2451-root-and-update-instructions.4556839/	Original rooting instructions
Netflix and other DRM apps won't play, what's the official fix?	topjohnwu/Magisk#7077	Official Magisk Response on DRM problem (none provided)
How to Unbrick OnePlus 11 BootLoop - Fastboot Lost	https://www.youtube.com/watch?v=Q08z_t0X8xE	NCUnlock OnePlus 11 Unbrick YouTube Video

Credits

Thanks to g96818 for posting the original rooting instructions. I have tested everything above on a OnePlus 11 except for the OTA updates section, however, I've performed those same steps on other OnePlus phones without issue, and the article states that it should work as well.

Disclaimer

The information provided in this article is for educational purposes only. Rooting a phone can have risks and may void the device's warranty. Users are solely responsible for any consequences that arise from rooting their devices. It is recommended to thoroughly research and understand the process before proceeding. Backup your data and proceed at your own risk. The author and publisher assume no liability for any damages or issues caused by rooting a phone.

The information presented here regarding DRM issues is intended for users seeking to restore the normal functionality of their media apps. It is important to note that these instructions should only be used for typical user operation and not for any other purposes. Modifying operations outside the Terms of Service of any app may not be permitted in your country.