ogmini - Exploration of DFIR
Having fun while learning about and pivoting into the world of DFIR.
About Blog Posts by Tags Research CTF/Challenge GitHub RSS
10 September 2025
Pixel 7 - Patching init_boot
by ogmini
Previously, we unlocked the bootloader on the Pixel 7 - https://ogmini.github.io/2025/09/09/Pixel-7-Unlocking-Bootloader.html. What follows are some of my notes on the process to patch init_boot using PixelFlasher/Magisk. This will give us root on the phone and allow us to take full backups for forensic analysis.
- Download the Factory Image from Google for the specific pixel device. You should be downloading zip file that matches the current Build Number on the device.
- Download and run PixelFlasher
- Point PixelFlash to your installation of Android Platform Tools. Browse to the location of the Android Platform Tools.
- Connect phone to the computer and click “Scan”. Make sure it finds your device.
- Browse to the location of the downloaded Factory Image zip for the Device Image.
- Click on “Rooting App” and “Download” the rooting app of your choice. In my case, I went with Magisk Stable.
- Click “Process” for the Device Image.
- Check the “Show All boot/init_boot” checkbox.
- Select the relevant package and click “Patch”. This will extract the init_boot and patch it in preparation of putting it back on the phone.
- Select the new patched entry.
- Choose “Dry Run” and click “Flash Boot”. This will just do a dry run test and the phone will reboot.
- Choose “Keep Data” and click ‘Flash Boot”. Again, the phone will reboot.
- On the phone, go to the applications and you should see Magisk installed. Open Magisk to finish the installation by following the prompts. The phone will reboot again.
- Root can be verified a few different ways. I found the easiest was to reconnect the phone to PixelFlash, click “ADB Shell”, and type in
sufollowed bywhoami. It should state root.
Notes
- Pixel 7 / Android 16 / Build BP3A.250905.014
- Android Platform Tools 36.0.0
- PixelFlasher v8.5.1.0
- Magisk 29.0