As soon as Google kickstarted the beta initiative of Android 13's second Quarterly Platform Release (commonly referred to as QPR2), many enthusiasts expected that achieving root on these builds would be just as easy as rooting the stable channel firmware, but that didn't turn out to be the case. To be precise, the generic root guide that involves patching the boot image using Magisk stopped working for the Google Pixel 6 series. If you have a Pixel 6, 6 Pro, or Pixel 6a, neither the stable nor the Canary build of Magisk can generate a working patched boot image for superuser access on the QPR2 beta builds. But solving the riddle seemed to be a matter of when, not if, and the Android modding scene had already figured out a clever way to root the Pixel 6 lineup running Android 13 QPR2 beta by borrowing some bits from the Pixel 7.

For people who’re reading this article, chances are that you probably have a favorable opinion of rooting. After all, thanks to root privilege, you're able to block ads system-wide, tweak kernel parameters, or forego the need for a custom ROM altogether, thanks to the myriad of customizations available through Magisk modules and the Xposed Framework. With that said, root access is absolutely meaningless to the average user, considering the maturity of Android as well as the OEM skins. For carriers and device makers, root access is actually a headache that prevents these companies from locking down your phone within their ecosystem of apps and services. But at the end of the day, this is XDA, which means although attaining root access has been a losing battle for consumers, the modding community will not stop.

Needless to say, aftermarket development seems to be moving along just fine. In fact, several users have confirmed the existence of an intriguing frankenbuild method of rooting these phones on Android 13's latest beta iteration. The Pixel family's gradual move towards Generic Kernel Image played a key role in the discovery, while the similarities between the two generations of the Tensor chipsets made it possible to accomplish the fate. In a nutshell, it's still possible to root the Google Pixel 6 lineup running Android 13 QPR2 beta, but the process requires some additional steps.

The rise of init_boot

In order for root access to work on Android devices, the superuser executables and su daemon need to be started at boot. Before Marshmallow, this was achieved by modifying the /system partition to include the scripts in init needed to achieve root access at boot. Thanks to the introduction of device-mapper-verity (dm-verity), Google essentially nullified the possibility to modify /system, which led us to "systemless" root methods. Magisk, the most popular superuser privilege provider, patches the stock boot image of the target device. You can then flash the patched boot image to gain root access, provided the bootloader of the device is unlocked to allow modified binaries.

For devices launching with Android 13, the generic ramdisk is removed from the boot image and placed in a separate init_boot partition. On the Google Pixel 7 series, for example, you have to patch the stock init_boot image with Magisk for root access. However, the Pixel 6 lineup doesn't have the init_boot partition, as they were launched with Android 12.

Exploiting GKI for rooting

Keep in mind that devices launching with kernel version 5.10 or higher must ship with the GKI kernel to comply with the GKI 2.0 specification. As such, the boot images of the Pixel 6, 6 Pro, and 6a contain the generic ramdisk and the GKI kernel.

While we don't know the exact reason behind the incompatibility between Magisk and the QPR2 beta boot images for the Google Pixel 6 family yet, it seems that you can use the patched boot image from the Pixel 7 series to root them. This strange phenomenon is actually possible because:

  1. The kernel sources corresponding to the first-generation Tensor powering the Pixel 6 and the Pixel 7's Tensor G2 share quite a few common bits due to internal similarities.
  2. In case there's no OEM-supplied generic ramdisk in boot on a legacy SAR A-only device with a compatible bootloader, Magisk adds a basic generic ramdisk while patching the boot image so that the Magisk interface is accessible in boot mode. This fix is also applicable to some Android 13 GKIs like the Pixel 6 series that require an additional ramdisk compression format fix. It would appear that a compatible boot image without a ramdisk (like the one from the Pixel 7 series) can eventually be converted for use on the Pixel 6 series with a working generic ramdisk manually added by Magisk.

How to root the Google Pixel 6 series running Android 13 QPR2 beta with Magisk

Make sure that your Pixel 6/6 Pro/6a has an unlocked bootloader, so that you can boot modified boot images. To reiterate, you'll need to patch the Pixel 7's boot image for Magisk to work. The easiest way to do this is to extract the stock boot image of the Google Pixel 7 from the factory image beforehand and patch it using the Magisk app.

  1. On your PC/Mac, download the factory image of the Pixel 7 or Pixel 7 Pro corresponding to the QPR2 beta version that's installed on your Pixel 6/6 Pro/6a. In our testing, we're running the QPR2 Beta 2 (T2B2.221216.006) build on the Pixel 6a, so the same beta for the Pixel 7 should be enough.
  2. Unpack the factory image using your favorite archive manager, locate the image-<device codename>-<build number>.zip file, and extract the boot.img file from it.
  3. Patch that boot image using Magisk, but don't flash it yet.
    • While using the latest stable version of Magisk (which is v25.2 at the time of writing this article) is recommended, you can also opt for the bleeding edge Canary build.
    • The boot image can be patched on any Android device - you don't necessarily need to perform the task on a Pixel 6 or Pixel 7.

  4. Copy the Magisk-patched boot image from your phone to your PC/Mac and rename it to magisk_patched_boot.img.
  5. Provided USB debugging is on, reboot the Pixel 6 (/6 Pro/6a) into the bootloader mode: 
            adb reboot bootloader
  6. Flash the patched boot image and reboot the phone. 
            fastboot flash boot /path/to/magisk_patched_boot.img
    fastboot reboot
    • Before flashing it permanently, you can also temporarily boot the image for testing: 
              fastboot boot /path/to/magisk_patched_boot.img
    • In a temp-booted environment, Magisk allows you to patch the existing boot image of your phone. However, doing so under this scenario won't be useful and you might end up with a non-rooted boot image after rebooting, so we don't recommend it.

  7. Open the Magisk app and your Pixel 6/6 Pro/6a should show as rooted.

We can confirm that both the Pixel 7 and Pixel 7 Pro's patched boot images can be used interchangeably on the vanilla Pixel 6, as well as on the 6 Pro and 6a.

XDA Forums: Google Pixel 6 || Pixel 6 Pro || Pixel 6a || Pixel 7 || Pixel 7 Pro

So far, multiple users on our forums have reported that they have successfully rooted the Pixel 6, 6 Pro, and 6a running Android 13 QPR2 beta using this method. The nature of the rooting process is itself a bit finicky, though, plus you can no longer install newer beta builds via OTA. Be that as it may, if you own a Pixel 6 series device and want root access on the beta channel, this seems to be the only way to achieve it.

Do give it a shot and let us know if it worked for you!