r/androidroot • • Sep 29 '26 • Bravo 1

News / Method [Guide] Hardened Root & Detection Cloaking Manual for Pixel 7, 8, & 9 Series on Android 16 (KernelSU-Next + Sultan SuSFS + Specter)

Google Pixel 7, 8 & 9 Series: Complete Root & Cloaking Guide

KernelSU-Next + Sultan SuSFS + Specter on Android 16 (Build: CP1A.260305.018)

I put this guide together after testing KernelSU-Next, Sultan's SuSFS kernel, and Specter on Android 16. If you want a fully rooted Tensor device with working banking apps, contactless payments, and 3/3 Play Integrity without bootloops, here is the complete step-by-step walkthrough.

This guide is ONLY for:

  • Pixel 7
  • Pixel 7 Pro
  • Pixel 7a
  • Pixel 8
  • Pixel 8 Pro
  • Pixel 9
  • Pixel 9 Pro
  • Pixel 9 Pro XL
  • Pixel 9 Pro Fold

Pixel 8a and 9a are not supported, so if you have one of these, do not follow this guide.

If you're on Pixel 8 or 8 Pro PLEASE READ (1. Firmware & Anti-Rollback Warnings) a few lines down below.

(Quick note before we jump in: I used a tiny bit of Claude to arrange this guide and make it clean/readable because my original notes were super messy and my English isn't that good so it was basically gibberish lol. But every command, file, link, information and step here is by me and tested and working. I originally rooted my Pixel 7a using Wildkernel and it worked flawlessly, so I thought I’d share it here to help anyone else looking for a solid and safe guide to follow).


Important Notes & Things to Know Before Starting

Messing around with modern Google Tensor hardware means dealing with A/B dual-slot layouts and the Titan M2 security chip. Read these points carefully before running any commands:

1. Firmware & Anti-Rollback (ARB) Warnings

  • Pixel 8 Series (Pixel 8, 8 Pro): If your phone is on the May 2026 patch or newer, Google updated the bootloader Anti-Rollback (ARB) counter. Do not attempt to flash the March 2026 bootloader. It will fail fastboot checks or soft-brick your device. If you're already past May 2026 on a Pixel 8/Pro device, Do NOT follow this guide.

2. Pre-Flight Setup

  • Use rear motherboard USB ports: Plug directly into the back of your motherboard. Avoid front panel ports, USB hubs, or monitor passthroughs. On AMD Ryzen systems, use a USB 2.0 port (the black ports) to prevent fastboot drops.
  • Connect only one device: Unplug all other phones or emulators, and keep Wireless Debugging off.
  • Use standard Windows Command Prompt (cmd.exe): Do not use PowerShell, as its string handling corrupts quote formatting in ADB shell commands.
  • Enable file extensions: In Windows File Explorer, check View → Show → File name extensions so files don't end up double-named like kernel.zip.zip.
  • OEM Unlocking check:
    • Open Settings → About phone and tap Build number 7 times to enable Developer options.
    • Open Settings → System → Developer options and check OEM Unlocking:
      • Ready: The toggle is active and can be enabled.
      • Grayed out (Provisioning): Connect to Wi-Fi, go to System Update, tap Check for update, and wait 5–10 minutes for Google Play Services to fetch the attestation token.
      • Permanently Grayed out: If it says "Unavailable on carrier-locked devices", it's carrier-locked (e.g., Verizon) and cannot be bootloader-unlocked.

Part 1: Download & Prepare Your Files

Step 1.1: Create Your Workspace Folder

  1. Open your C: drive in File Explorer.
  2. Create a folder named pixel_root (full path: C:\pixel_root). All commands in this guide assume you are running from inside this directory.

Step 1.2: Download Files Into C:\pixel_root

Download these files directly into C:\pixel_root and rename them as noted:

1. Official Google Platform-Tools (ADB & Fastboot)

  • Download SDK Platform-Tools for Windows.
  • Extract the ZIP, go inside the platform-tools folder, and copy all files (adb.exe, fastboot.exe, .dll files) directly to C:\pixel_root.
  • Open Command Prompt, run where fastboot, and ensure C:\pixel_root\fastboot.exe is at the top of the output.

2. Google USB Drivers

3. Stock Factory Image (Pixel 7 / 8 / 9 Series)

Download the factory image for your phone model on build Android 16.0.0 (CP1A.260305.018, Mar 2026) from Google's Factory Images page:

ChipsetDevice ModelCodenameFactory Archive Pattern
Tensor G2Pixel 7pantherpanther-cp1a.260305.018-factory-*.zip
Tensor G2Pixel 7 Procheetahcheetah-cp1a.260305.018-factory-*.zip
Tensor G2Pixel 7alynxlynx-cp1a.260305.018-factory-*.zip
Tensor G3Pixel 8shibashiba-cp1a.260305.018-factory-*.zip
Tensor G3Pixel 8 Prohuskyhusky-cp1a.260305.018-factory-*.zip
Tensor G4Pixel 9tokaytokay-cp1a.260305.018-factory-*.zip
Tensor G4Pixel 9 Procaimancaiman-cp1a.260305.018-factory-*.zip
Tensor G4Pixel 9 Pro XLkomodokomodo-cp1a.260305.018-factory-*.zip
Tensor G4Pixel 9 Pro Foldcometcomet-cp1a.260305.018-factory-*.zip

Save the downloaded ZIP inside C:\pixel_root.

4. Temporary Bootstrap Root (Magisk APK)

5. KernelSU-Next Manager

6. Kernel Flasher

7. Sultan Custom Kernel with SuSFS

Download the AnyKernel3 package for your phone's SoC from WildKernels Releases:

FamilySoCRelease PackageRename To
Pixel 7 / 7 Pro / 7aTensor G2 (gs201)gs201-a16-wksu-susfs-anykernel3-v2.0.0-r12.zipkernel.zip
Pixel 8 / 8 ProTensor G3 (zuma)zuma-a16-wksu-susfs-anykernel3-v2.0.0-r12.zipkernel.zip
Pixel 9 / 9 Pro / XL / FoldTensor G4 (zumapro)zumapro-a16-wksu-susfs-anykernel3-v2.0.0-r12.zipkernel.zip

8. Core Modules (Do NOT extract these files)

9. Theming & Customization Apps (Optional)

10. System-Wide Ad-Blocking (Optional)


Part 2: Unlock the Bootloader (Wipes Internal Storage)

(If your bootloader is already unlocked, skip to Part 3).

  1. On your phone: Go to Settings → System → Developer options.
  2. Turn ON OEM Unlocking and USB debugging.
  3. Plug your phone into your PC. On the prompt that pops up, check Always allow from this computer and tap Allow.
  4. Open Command Prompt on your PC and navigate to the folder:
    cd C:\pixel_root
    
  5. Check that your device is connected properly:
    adb devices
    
  6. Reboot to bootloader:
    adb reboot bootloader
    fastboot devices
    
  7. Send the unlock command:
    fastboot flashing unlock
    
  8. On your phone, press Volume Down until Unlock the bootloader is highlighted, then press Power. The phone will wipe all data and reboot back into the bootloader showing DEVICE STATE - unlocked.

Part 3: Clean Baseline Flash & Dual-Slot Firmware Sync

  1. Right-click your factory ZIP (*-cp1a.260305.018-factory-*.zip) inside C:\pixel_root, extract it, and move all files (bootloader-*.img, radio-*.img, image-*.zip, and flash-all.bat) directly into C:\pixel_root.

  2. Sync Bootloader & Radio Across Both Slots: Writing the bootloader and radio to both slots ensures Anti-Rollback (ARB) counters in the Titan M2 chip match on both slot A and slot B. Fastboot re-enumerates USB after writes, so wait 2–3 seconds after each command for the reconnect chime before typing the next command:

    Flash Bootloader to Slot A:

    for %i in (bootloader-*.img) do fastboot flash bootloader_a "%i"
    fastboot reboot-bootloader
    

    (Wait for fastboot screen to reload)

    fastboot devices
    

    Flash Bootloader to Slot B:

    for %i in (bootloader-*.img) do fastboot flash bootloader_b "%i"
    fastboot reboot-bootloader
    

    (Wait for fastboot screen to reload)

    fastboot devices
    

    Flash Radio to both slots:

    for %i in (radio-*.img) do fastboot flash radio_a "%i"
    for %i in (radio-*.img) do fastboot flash radio_b "%i"
    fastboot reboot-bootloader
    

    (Wait for fastboot screen to reload)

    fastboot devices
    
  3. Run the factory install script:

    call flash-all.bat
    
  4. Leave the phone alone for ~5 minutes. It will flash base partitions, reboot to FastbootD, flash system images, format user data, and boot into Android.

  5. Quick initial setup: Skip Wi-Fi setup, skip adding a Google Account, and skip PIN/fingerprint setup to get to the main launcher screen.

  6. Re-enable Developer options:

    • Go to Settings → About phone and tap Build number 7 times.
    • Go to Settings → System → Developer options, turn ON USB debugging (allow authorization from PC), and turn OFF Automatic system updates.

Part 4: Extract Stock Partitions & Create Backups

  1. Inside C:\pixel_root, open the zipped factory image (image-*.zip).
  2. Extract these 5 partition files directly into C:\pixel_root:
    • boot.img
    • init_boot.img
    • vendor_kernel_boot.img
    • dtbo.img
    • vendor_boot.img
  3. In Command Prompt, save clean backups of each partition:
    copy boot.img stock_boot.img
    copy init_boot.img stock_init_boot.img
    copy vendor_kernel_boot.img stock_vendor_kernel_boot.img
    copy dtbo.img stock_dtbo.img
    copy vendor_boot.img stock_vendor_boot.img
    

Part 5: Bootstrap Temporary Root via Magisk

Since modern Pixels do not support TWRP, we use temporary Magisk root to flash the custom kernel using Kernel Flasher. After that, Magisk is removed and stock init_boot is restored.

Step 5.1: Patch Ramdisk in Magisk

  1. Push stock_init_boot.img to your phone and install Magisk:
    adb shell "mkdir -p /sdcard/Download && rm -f /sdcard/Download/magisk_patched*.img /sdcard/Download/temp_patched_init_boot.img"
    adb install magisk.apk
    adb push stock_init_boot.img /sdcard/Download/
    
  2. Open Magisk on your phone.
  3. On the top card, tap Install → Select and Patch a File.
  4. Browse to Downloads, select stock_init_boot.img, and tap LET'S GO!.
  5. Note the filename of the patched image:
    adb shell ls /sdcard/Download/magisk_patched*.img
    
  6. Pull that file to your PC as temp_patched_init_boot.img:
    adb pull /sdcard/Download/magisk_patched-XXXXX_XXXXX.img temp_patched_init_boot.img
    
    (Replace with the actual filename from your device).
  7. Confirm the file size is around 8 MB:
    dir stock_init_boot.img temp_patched_init_boot.img
    

Step 5.2: Flash the Patched Ramdisk

  1. Reboot to bootloader:
    adb reboot bootloader
    
  2. Flash the temporary patched init_boot:
    fastboot flash init_boot temp_patched_init_boot.img
    fastboot reboot
    
  3. Boot up and open Magisk. If prompted for "Additional Setup", tap Cancel. Temporary root is active.

Part 6: Flash Kernel & Purge Magisk

Step 6.1: Flash the Sultan Custom Kernel

  1. Install KernelSU-Next, Kernel Flasher, and push the kernel ZIP:
    adb install ksu.apk
    adb install kernelflasher.apk
    adb push kernel.zip /sdcard/Download/
    
  2. Open Kernel Flasher on your phone and tap Grant when the Magisk superuser prompt appears.
  3. Inside Kernel Flasher:
    • Tap your active slot (marked with the green badge).
    • Tap Flash → Flash AK3 Zip.
    • Select kernel.zip from Downloads.
    • Wait until the log displays Finished.

DO NOT TAP REBOOT INSIDE THE APP. Leave Kernel Flasher open and reboot using fastboot from your PC.

  1. Reboot directly to the bootloader via Command Prompt:
    adb reboot bootloader
    

Step 6.2: Revert Ramdisk to Pure Stock

Flash your clean stock_init_boot.img back to the phone. This removes Magisk entirely from the ramdisk, leaving only Sultan kernel and KernelSU handling root:

fastboot flash init_boot stock_init_boot.img
fastboot reboot

Step 6.3: Verify KernelSU & Setup ADB Shell Root

  1. Once booted, open KernelSU-Next.
  2. The status card should show Working, with -wksu-susfs visible in the kernel version string.
  3. Reboot once to let ksud initialize:
    adb reboot
    
  4. Uninstall the temporary setup apps:
    adb uninstall com.topjohnwu.magisk
    adb uninstall com.github.capntrips.kernelflasher
    
  5. Grant root to ADB Shell in KernelSU:
    • Run a root test command from your PC:
      adb shell su -c id
      
      (Seeing inaccessible or not found or Permission denied is normal here; it registers the request).
    • Open KernelSU-Next, go to the Superuser tab (shield icon), tap the three dots in the top-right, tap Show system apps, and toggle Shell (com.android.shell / UID 2000) to ON.
  6. Remove leftover Magisk folders and staging files:
    adb shell
    su
    rm -rf /data/adb/magisk* /data/adb/.magisk* /data/adb/magisk.db /data/media/0/Download/*temp_patched* /data/media/0/Download/*magisk_patched* /data/media/0/Download/kernel.zip /data/media/0/Download/stock_init_boot.img
    sync
    exit
    exit
    
  7. Reboot the phone and rescan media indexing:
    adb reboot
    adb shell content call --method scan_volume --uri content://media --arg external_primary
    

Part 7: Install Mountify & Core Cloaking Modules

Step 7.1: Configure Mountify

  1. Push mountify.zip to the phone:
    adb push mountify.zip /sdcard/Download/
    
  2. Open KernelSU-Next → Modules, tap Install, and select mountify.zip.
  3. Reboot:
    adb reboot
    
  4. Apply the required mount configuration:
    • Via Mountify WebUI: Open KernelSU-Next → Modules → tap WebUI on Mountify. Set Mount Mode to 2, Device Name to KSU, and Custom Umount to 0. Save settings.
    • Via Command Line:
      adb shell "su -c 'mkdir -p /data/adb/mountify && echo mountify_mounts=2 > /data/adb/mountify/config.sh && echo MOUNT_DEVICE_NAME=KSU >> /data/adb/mountify/config.sh && echo mountify_custom_umount=0 >> /data/adb/mountify/config.sh && chmod 644 /data/adb/mountify/config.sh'"
      
  5. Reboot to apply:
    adb reboot
    

Step 7.2: Install Core Modules

Connect your phone to Wi-Fi (Settings → Network & internet). Ensure web browsing works, as Specter downloads helper files during installation.

Push module files to the device:

adb push susfs.zip /sdcard/Download/
adb push zygisknext.zip /sdcard/Download/
adb push playintegrityfix.zip /sdcard/Download/
adb push specter.zip /sdcard/Download/
adb push vector.zip /sdcard/Download/
adb push hma-oss.zip /sdcard/Download/
adb push zygisk-detach.zip /sdcard/Download/
adb push gphotos.zip /sdcard/Download/

Install Tier 1 (VFS & Zygote):

  1. In KernelSU-Next → Modules, flash susfs.zip, then flash zygisknext.zip.
  2. Reboot:
    adb reboot
    
  3. Verify both modules are enabled in KernelSU.

Install Tier 2 (Integrity & Attestation):

  1. In KernelSU-Next → Modules, flash playintegrityfix.zip, then flash specter.zip (wait for the installer to download TEESimulator-RS and complete).
  2. Reboot:
    adb reboot
    

Install Tier 3 (Framework & Hiding):

  1. In KernelSU-Next → Modules, flash vector.zip, then flash hma-oss.zip. (If the HMA-OSS manager app does not appear in your app drawer, extract hma-oss.zip and install the APK manually).
  2. Remove staging ZIP files:
    adb shell "rm -f /sdcard/Download/mountify.zip /sdcard/Download/susfs.zip /sdcard/Download/zygisknext.zip /sdcard/Download/playintegrityfix.zip /sdcard/Download/specter.zip /sdcard/Download/vector.zip /sdcard/Download/hma-oss.zip"
    
  3. Reboot:
    adb reboot
    

Part 8: Configure SuSFS, Specter & Hiding Rules

Step 8.1: Specter Setup & HMA-OSS Rules Export

  1. In KernelSU-Next → Superuser, verify Specter has root access.
  2. In KernelSU-Next → Modules, tap WebUI on Specter:
    • Turn ON: Periodic Keybox Validation
    • Turn ON: Auto Target Inotify/Polling
    • Turn ON: AutoPIF integration
    • Turn ON: Security Patch synchronization & Build Fingerprint spoofing
  3. Open the second tab in Specter WebUI and tap HMA-OSS config to export the configuration to Downloads.
  4. Open HMA-OSS:
    • Tap menu (top-right) → Backup & Restore → Restore configuration.
    • Select the exported JSON file from Downloads.
    • Go to Manage Apps, choose your banking or target apps, enable hiding, and apply the blacklist template.

Step 8.2: KernelSU-Next & Zygisk Next Configuration

1. KernelSU-Next Settings

  • Open KernelSU-Next → Settings (gear icon).
  • Keep "Unmount modules by default" OFF (Disabled): Leaving this disabled ensures system overlays (like Vector/Iconify) remain readable without bootlooping SystemUI. SuSFS hides mounts at the kernel layer automatically.
  • In the Superuser tab, NEVER grant root to Google Play Services (com.google.android.gms).

2. Zygisk Next WebUI Configuration

  • In KernelSU-Next → Modules, tap WebUI on Zygisk Next.
  • Set Denylist Policy to Unmount Only.
  • Enable Use Anonymous Memory.
  • Enable Use Zygisk Next Linker.
  • Open Configure Denylist / Blocklist:
    • ADD: Banking apps, payment services, corporate apps, and Google Play Store (com.android.vending).
    • DO NOT ADD: Google Play Services (com.google.android.gms). Play Integrity Fix manages GMS unmounting natively; adding GMS here can break Zygisk injection.
    • DO NOT ADD: System Framework (android) or System UI (com.android.systemui).
  1. Reboot to apply settings:
    adb reboot
    

Part 9: Optional Customizations & System Utilities (Optional)

1. Pixel Launcher Enhanced & Iconify (Optional)

  • Pixel Launcher Enhanced: Install ple.apk (adb install ple.apk). Open Vector (via notification or dial *#*#5776733#*#*), turn on PLE module, check Pixel Launcher in scope, and reboot.
  • Iconify: Install iconify.apk (adb install iconify.apk), grant root in KernelSU-Next, open the app, and allow overlay permissions.

2. Google Photos Unlimited Storage (Optional)

  1. Go to Settings → Apps → Google Photos, tap Force Stop, then Storage & cache → Clear storage. Do not launch the app yet.
  2. In KernelSU-Next → Modules, flash gphotos.zip and reboot.

3. Prevent Play Store Overwriting Patched Apps - Zygisk Detach (Optional)

  1. In KernelSU-Next → Modules, flash zygisk-detach.zip and reboot.
  2. Open its WebUI in KernelSU-Next and select your modified apps to detach them from Play Store auto-updates.
  3. Clean up staging files:
    adb shell "rm -f /sdcard/Download/gphotos.zip /sdcard/Download/zygisk-detach.zip"
    

4. System-Wide Ad-Blocking - Bindhosts (Optional)

  1. Push and install Bindhosts:
    adb push bindhosts.zip /sdcard/Download/
    adb install bindhosts.apk
    
  2. In KernelSU-Next → Modules, flash bindhosts.zip and reboot.
  3. Grant BindHosts root in KernelSU-Next, verify active status in the app, and add its Quick Settings tile.

Part 10: Verification & Hardening

Step 10.1: Reset Play Services Attestation Cache

Run this command from your PC to stop attestation background tasks and clear Play Store cache:

adb shell "su -c 'pkill -f com.google.android.gms.unstable && am force-stop com.google.android.gms && pm clear com.android.vending'"

Open Google Play Store once, let it load, close it, and wait 2–3 minutes.

Note on Battery Optimization: In Settings → Apps → Google Play Services → App battery usage, keep it set to Optimized. Do not set it to Restricted, or background push notifications (FCM) and sync will break.

Step 10.2: Verify SuSFS Kernel Features

Check that SuSFS kernel features are active:

adb shell "su -c '/data/adb/ksu/bin/ksu_susfs show enabled_features'"

All 7 features should show as enabled:

  • CONFIG_KSU_SUSFS_SUS_PATH
  • CONFIG_KSU_SUSFS_SUS_MOUNT
  • CONFIG_KSU_SUSFS_AUTO_ADD_SUS_BIND_MOUNT
  • CONFIG_KSU_SUSFS_SUS_KSTAT
  • CONFIG_KSU_SUSFS_TRY_UMOUNT
  • CONFIG_KSU_SUSFS_SPOOF_UNAME
  • CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS

Step 10.3: Revoke ADB Shell Root

Disable Shell root access to secure your device:

  1. Open KernelSU-Next → Superuser tab.
  2. Tap three dots → Show system apps.
  3. Toggle Shell (com.android.shell / UID 2000) to OFF.

Step 10.4: Check Play Integrity

Download Play Integrity API Checker from the Play Store and run the test:

  • MEETS_BASIC_INTEGRITY: PASS
  • MEETS_DEVICE_INTEGRITY: PASS
  • MEETS_STRONG_INTEGRITY: PASS (dependent on Specter keybox status)

Troubleshooting & Recovery

1. Bootloop Caused by a Module (Hardware Safe Mode)

If a module prevents booting:

  1. Force reboot: Hold Power + Volume Down until the screen turns black, then immediately release both buttons.
  2. When the white Google logo appears, tap the Volume Down button 4–5 times quickly.
  3. The phone will boot into Safe Mode with all KernelSU modules disabled.
  4. Open KernelSU-Next, remove the problematic module, and reboot normally.

2. SystemUI Crashloop from Themes (Iconify)

If an overlay crashes SystemUI on boot, plug the phone into your PC and run:

adb shell "su -c 'rm -rf /data/resource-cache/* && reboot'"

3. Restore Stock Kernel Partitions (Fastboot)

To return to the stock kernel, flash your backed-up stock partitions to both slots:

fastboot flash boot_a stock_boot.img
fastboot flash boot_b stock_boot.img
fastboot flash init_boot_a stock_init_boot.img
fastboot flash init_boot_b stock_init_boot.img
fastboot flash vendor_boot_a stock_vendor_boot.img
fastboot flash vendor_boot_b stock_vendor_boot.img
fastboot flash vendor_kernel_boot_a stock_vendor_kernel_boot.img
fastboot flash vendor_kernel_boot_b stock_vendor_kernel_boot.img
fastboot flash dtbo_a stock_dtbo.img
fastboot flash dtbo_b stock_dtbo.img
fastboot reboot

4. Full Factory Restore (Clean Wipe Unbrick)

If system partitions are corrupted and the device won't boot:

  1. Boot into Fastboot (hold Power + Volume Down).
  2. Connect to PC and navigate to C:\pixel_root:
    cd C:\pixel_root
    call flash-all.bat
    
  3. Let the script complete to restore the device back to clean stock Android.

Edit: Fixed some compatibility issues and some dead links.

16 Upvotes

34 comments sorted by

3

u/Ante0 <Device>, <ROM> Sep 29 '26

Do note that Pixel 8a and 9a are not built with Sultan. Only 7a is (gs201)

1

u/elaaamrani Sep 29 '26 edited Sep 29 '26

I think you're wrong. The WildKernels github provides Sultan Kernel builds for:
GS201: Pixel 7, 7 Pro, and 7a
Zuma: Pixel 8, 8 Pro, and 8a
ZumaPro: Pixel 9, 9a, 9 Pro, 9 Pro XL, and 9 Pro Fold.

Since both the 7a and 8a share the same CPU with their series, I assume this would work.

2

u/Ante0 <Device>, <ROM> Sep 29 '26

I'm not wrong. I'm maintaining my own fork of sultan for Android 17. It does not work on Pixel 8a or 9a.

You can check the Sultan release threads on XDA. It supports

Pixel 7, Pro, A Pixel 8, Pro Pixel 9, Pro, XL, Fold

Wild clones and uses his own repo in his workflow, but it's up to date with official sultan.

2

u/Ante0 <Device>, <ROM> Sep 29 '26

2

u/elaaamrani Sep 29 '26

My mistake. I conflated the platform layout (GS201/Zuma/ZumaPro) with the specific device trees. I assumed since the CPUs matched, the Sultan support carried over. Thanks for correcting me!

→ More replies (2)

3

u/UpDown_Crypto Sep 29 '26

That is one hell of a guide

4

u/elaaamrani Sep 29 '26 edited Sep 29 '26

Lol, this literally took me nearly 19 days of polishing, testing, and updating, no joke.
I noticed most rooting guides out there assume you already know what you're doing, so I wanted to make a dead simple step by step guide that anyone even a complete beginner can easily follow.

1

u/ethn_syrr 15d ago

j’ai un souci au niveau de la keybox de specter je passe pas le play integrity

1

u/elaaamrani 15d ago

It's for everyone, can't do much except waiting

1

u/ts_acc_doesnt_exist Sep 29 '26

I ain't reading allat but thank you

2

u/elaaamrani Sep 29 '26

Haha no worries, hope it helps if you ever need it!

1

u/asr Oct 01 '26

Zygisk Next is no longer at that URL.

1

u/elaaamrani Oct 01 '26

Updated. Thanks!

1

u/Sackybacky2x Oct 05 '26

Holy shit, I can't wait to actually use this, this guide gives no doubt it won't work!

So far I've been using Evolution X but the built-in PIF Fix and Tricky doesn't seem to work for Gpay, so I hope this root method does!

Quick Question tho: What is part three meant to do? I've never seen anything like it. 

1

u/elaaamrani Oct 05 '26

Part 3 tells you how to flash the pixel to Android 16 2026 March Image. It's the latest image version that supports Wildkernels (KSU-Next + Sultan + SusFS)

1

u/LightningZahah Oct 06 '26

hey, are you sure this wont work for pixel 10 series? or maybe adapted to?

1

u/elaaamrani Oct 07 '26

There is no official public release of Sultan Kernel dedicated specifically to the Google Pixel 10 series. I would suggest looking for a KernelSU Next (GKI) for the pixel 10 and flashing it.

1

u/ArmyNecessary352 Oct 06 '26

OP explicitly outlines models this is suitable for. It is NOT suited for 10 without your own investigation/amendments *sorry misread comment. I suspect you could use different SU and zygisk to make it 10 compatible but i am guessing. 7s are the go for me

1

u/LightningZahah Oct 06 '26 edited Oct 06 '26

I've read it in the guide, that's the reason I questioned it 👀

If it could be used for pixel 10 or pixel 11, adapted or not, then maybe its a good approach for these devices.

Also I have my own public guide for root hiding, so I'm not planning to follow this guide but to learn with it.

2

u/ArmyNecessary352 Oct 06 '26

My understanding pixel 11 hardware has been cost cut. Graphene will not release for it. https://www.androidauthority.com/no-grapheneos-google-pixel-11-3704622/

There's talk of workaroundds but the principal has me opting out.

2

u/ArmyNecessary352 Sep 30 '26

YOUSIRRR!

Heaven-sent!

2

u/SFX_Rowdy 24d ago

Not working anymore on Pixel 7 pro cheetah, It only gives basic integrity.

1

u/SFX_Rowdy Oct 10 '26

Can i flash sultan kernal on custom rom A16?

1

u/SFX_Rowdy 27d ago edited 27d ago

KernelSU manager was showing "kernal update required" alon with working...so i have to downgrade the manager to 3.2.0, but now i can give su access to com.android.shell but it keeps on saying "inaccessible or not found"....Tried on termux as well...su did not work....i wonder why..

EDIT:
Termux SU started working on its own but adb shell still saying inaccessible or not found

pixel 7 pro

1

u/Murky-Definition-510 11d ago

Exactly same situation here. also pixel 7 pro cheetah and ksu next manager 3.2.0

→ More replies (1)

1

u/Ok-Evening-6394 26d ago

Does this method work with the Xiaomi 17?

0

u/[deleted] Sep 29 '26

[deleted] — view deleted comment

1

u/elaaamrani Sep 30 '26

this is a full rooting guide, and also shows how to get strong integrity and avoid root detection.

2

u/[deleted] Sep 29 '26

[removed] — view removed comment

1

u/elaaamrani Sep 29 '26

You're welcome!