Root a OnePlus 7T

Disclaimer

This document DOES NOT promote or encourage any illegal activities!

By attempting any of these processes listed in this document you accept full responsibility
for actions. You are fully responsible if your brick your device. I and my team are not
responsible! This guide does not try to be an exhaustive guide to root every Android
phone!
Requirements

1. A Physical Android Phone. This guide will show how to root a OnePlus 7T in preparation
for installing Kali Nethunter.
Requirements

2. A Windows 10/11 PC.

Optional: If you want to install Kali Nethunter you’ll also need a VM running Kali Linux
(You’ll need the Kali VM to compile the Kali Nethunter Kernel. Without the Kali
Nethunter Kernel you’re missing out most of the functionality.)
3. USB-C data cable.
Part 1 - Update Phone

1. Update your phone to Android 11 (Don’t update to Android 12):

Part 2 - Download Platform Tools

1. On a Windows computer, download platform tools. You can do so at the following

website: https://developer.android.com/studio/releases/platform-tools

Download the
tools for your
Scroll Down
platform.
Part 2 - Download Platform Tools

• Accept License Agreement.

Part 2 - Download Platform Tools

2. Extract the zip file on your Desktop or any other easily accessible location.
Part 3 - Unlock Bootloader

1. Enable Developer Mode. Go to Settings. Tap Build number 7 times.

Scroll Down

Tap 7 times
Part 3 - Unlock Bootloader

2. Press Settings > System > Developer Options. When in Developer Options enable USB
debugging and OEM unlocking.

Scroll Down
Part 3 - Unlock Bootloader

3. Open Platform Tools folder in Powershell (if you encounter issues, run as admin)

Right click and press on Open in Terminal

– make sure you use PowerShell and not
CMD
I opened the directory where I extracted the
platform tools. You can cd into it using
Powershell as well.
Part 3 - Unlock Bootloader - Install Drivers

1. Connect phone to computer with a USB-C data cable.

Install Qualcomm Driver (Needed to unbrick phone)

2. Boot into Fastboot mode. Hold in the Volume Up + Volume Down + Power Button.

Make sure you press

Hold the power
both the volume up
button as well until
and volume down
you see the
buttons.
Fastboot Mode.
Part 3 - Unlock Bootloader - Install Drivers

3. Open System then click on Windows Update. Press Check for updates.

1
Part 3 - Install Drivers
4. Click on “Driver Updates”. Check the “Android Bootloader Interface” and install.

1
2
3
Part 3 - Unlock Bootloader - Install Drivers

5. Restart Windows.
Install Qualcomm Driver (Needed to unbrick phone)

6. Connect phone to computer with a USB-C data cable.

Install Qualcomm Driver (Needed to unbrick phone)

7. Open Windows PowerShell in the platform-tools directory.

Install Qualcomm Driver (Needed to unbrick phone)

8. Enter the command ./adb devices if the device is picked up, then run the
command ./adb reboot edl
Install Qualcomm Driver (Needed to unbrick phone)

9. Click on Windows Update.

Install Qualcomm Driver (Needed to unbrick phone)

10. Click on ”Advanced options” then click on ”Optional updates”

2
Install Qualcomm Driver (Needed to unbrick phone)

11. Click on ”Driver updates” then click on ”Optional updates” and “Download & install”

1
2
3
Install Qualcomm Driver (Needed to unbrick phone)

12. Restart Windows.

Install Qualcomm Driver (Needed to unbrick phone)

13. Boot into Fastboot mode from EDL. Hold in the Volume Up + Volume Down + Power Button.

Make sure you press

Hold the power
both the volume up
button as well until
and volume down
you see the
buttons.
Fastboot Mode.
Install Qualcomm Driver (Needed to unbrick phone)

14. Press the power button in the bootloader menu to start the phone.

Press the power

button when you
are in the
bootloader to
restart your phone.
Part 3b - Unlock Bootloader

1. Connect phone to computer with a USB-C data cable.

Part 3b - Unlock Bootloader

2. Allow USB Debugging when prompted (may be after the next step)
Part 3b - Unlock Bootloader

3. In Powershell, Enter the command ./adb devices , you should see that your
device is picked up.
Part 3b - Unlock Bootloader

4. Enter the command ./adb reboot bootloader

Part 3b - Unlock Bootloader

You should see this on your screen.

Part 3b - Unlock Bootloader

5. Enter the command ./fastboot devices , then./fastboot oem unlock

If the device, doesn’t show when you use the ./fastboot devices command, then go back and try installing the
Motorola drivers as specified earlier in the document.
Part 3b - Unlock Bootloader

6. Use volume down to select “Unlock the Bootloader”. Then press the power button.
Part 3b - Unlock Bootloader

7. This wipes your phone and may take while. Wait until you see the Hello message.
IMPORTANT: Do not setup any face & fingerprint or screen lock once you restart the
phone.
Setup your phone as usual, but with the above caution.
Root your phone using Injected boot image

1. Make a note of the following information on your phone (next slides show the steps)
a) Model number
b) Android version
c) Build number
Root your phone using Injected boot image

Press on Settings
Swipe up Press on About phone
Root your phone using Injected boot image

2. In my case I have a OnePlus 7T T-Mobile (US) and had to find the firmware on XDA-Forums. Go to the
OnePlus link, and your phone’s model and download the firmware.

Region Variant Download

China / Hong Kong HD1900 https://www.oneplus.com/hk/support
/softwareupgrade
India HD1901 https://www.oneplus.in/support/softw
areupgrade
Europe HD1903 https://www.oneplus.com/uk/support
/softwareupgrade
US / Global HD1905 https://www.oneplus.com/global/supp
ort/softwareupgrade
T-mobile (US) HD1907 XDA Forums Link T-Mobile firmware
Root your phone using Injected boot image

3. When downloading, go to the correct website for your model and unzip the downloaded file

Scroll Down
Root your phone using Injected boot image

Make sure that your firmware on your phone is the same version as the version on the
website.

Click here to download.

Compare and download if the
firmware version is the same.
Root your phone using Injected boot image

I can root the phone if I

can get the firmware
online which is the same
as I am running on my
phone.
Root your phone using Injected boot image

4. Go to GitHub and download the payload-dumper-go tool for your Operating System:
https://github.com/ssut/payload-dumper-go

Scroll Down
When you see the link to prebuilt binaries click on the
link.
Root your phone using Injected boot image

Click to download the appropriate version for your Operating System

Root your phone using Injected boot image

5. Unzip, and untar the file using 7Zip or alternative application.

Root your phone using Injected boot image
Root your phone using Injected boot image

6. Unzip the Firmware you downloaded.

Root your phone using Injected boot image

7. Open Powershell in the directory where the payload-dumper-go.exe file is.

Root your phone using Injected boot image

8. Open a Powershell terminal in Go Payload Dumper folder and run the command.

.\payload-dumper-go.exe <PATH TO FIRMWARE payload.bin FILE>

Root your phone using Injected boot image

9. Wait for the payload dumper to extract all the different image files.
Root your phone using Injected boot image

10. See the folder starting with extracted, in that folder you have boot.img. Remember the path to this file.
Root your phone using Injected boot image

10. You now have to unlock Developer Options on your phone again and enable USB
Debugging.

Press on Software
version (or Build
Number) 7 times.

Press on About phone

Press on Settings
Swipe up
Root your phone using Injected boot image

Scroll Down
Root your phone using Injected boot image

11. Connect your phone to the computer. Press Allow to Allow USB Debugging.
Root your phone using Injected boot image

9. We will now use the Android Platform Tools to move the boot image to the Download
folder on your OnePlus 7T device. Open the platform-tools folder again in Powershell.
Use command .\adb push <Path to boot.img file> /sdcard/Download
 Root your phone using Injected boot image

11. Download and install Magisk from GitHub.

Search for “Magisk GitHub”

Download Magisk-v25.2 apk

Press OK
Press Open

Press on Releases
Root your phone using Injected boot image

Toggle Allow from this

source

Press INSTALL Press OPEN

Root your phone using Injected boot image

11. Create patched boot image with Magisk.

Press “Select and

Press “Install” Press “File Manager” Go to Download and
Patch a File” Press “Let’s Go”
Press “boot.img”
Root your phone using Injected boot image

12. Once the patched img was created, go to File Manager and look for the file name.

Remember the
filename. We will
Check under now pull it from
Downloads the storage.
Root your phone using Injected boot image

13. Use the Android Platform Tools to pull the pacthed boot image.

.\adb pull /sdcard/Download/<PATCHED BOOT IMAGE FILE>

Root your phone using Injected boot image

14. Restart in bootloader mode .\adb reboot bootloader then flash the boot
image with the patched Magisk image with the following command:

.\fastboot flash boot <PATH TO PATCHED IMAGE ON HARD DISK>

Root your phone using Injected boot image

15. Restart your phone by pressing button power button.

After flash is complete, make sure you’re on

START and press power button. Phone will
now restart.
Root your phone using Injected boot image

16. Your phone is now rooted. But you need to do a few more steps before installing
Nethunter.

Magisk now displays Installed

Root your phone using Injected boot image

17. To confirm that your phone is rooted. Install and run the Root checker app.

Search for
Root Checker Press Install

Press Play Store

Root your phone using Injected boot image

Confirmation
Press “VERIFY ROOT”

Open root checker

app. AGREE to
Disclaimer.
Press “GET STARTED”
Appendix - adb and fastboot commands

To list all connected devices. You will need to have USB debugging turned on.
You also need to allow for USB debugging on your phone.
./adb devices

To restart your device

./adb reboot

To restart your device in the bootloader mode

./adb reboot bootloader
Appendix - adb and fastboot commands

To restart your device in the download mode.

./adb reboot download

Using adb command to transfer a file to your phone

./adb push <filename> <optional location on device>

Using adb command to get a file from a phone

./adb pull <filename>
Appendix - adb and fastboot commands

Using adb to install an apk

./adb install <filename>

Using adb to open a shell

./adb shell

fastboot (use when device is in bootloader)

Get device details in the bootloader
./fastboot getvar all
Appendix - adb and fastboot commands

boot from an img file

./fastboot boot <filename>
./fastboot flash recovery recovery.img
Appendix – Modes on a OnePlus phone

• Normal mode and Safe Mode (OS)

• Recovery (For factory reset)
• Fastboot / Bootloader (For Flashing partitions)
Get more information

1. Website: https://www.youtube.com/davidbombal
2. Website: https://www.kali.org/docs/nethunter/