Jekyll 2026-01-22T06:29:28+00:00 https://berkgoksel.com// Software Security Engineer Berk Cem Göksel 2026-01-22T00:00:00+00:00 2026-01-22T00:00:00+00:00 https://berkgoksel.com/pixel-security-setup <p>This post aims to serve as a guide on how to set a Pixel device up for Android security testing. I’ve tested this on both the Pixel 8 and the Pixel 9. The steps are identical for both.</p> <p>This covers flashing stock Pixel OS, rooting with Magisk, and getting Burp Suite working for traffic interception.</p> <!-- more --> <h2>Prerequisites</h2> <ul> <li>Pixel 8 (codename: shiba) or Pixel 9 (codename: tokay)</li> <li>Ubuntu 22.04 (or similar Linux distro)</li> <li>USB cable</li> <li>adb and fastboot installed: <code class="language-plaintext highlighter-rouge">sudo apt install android-tools-adb android-tools-fastboot</code></li> </ul> <h2>Step 1: Download Factory Image</h2> <p>Get the latest factory image from https://developers.google.com/android/images</p> <ul> <li>Pixel 8: look for <strong>shiba</strong></li> <li>Pixel 9: look for <strong>tokay</strong></li> </ul> <p>Google factory images are named like <code class="language-plaintext highlighter-rouge">shiba-bp4a.251205.006-factory-*.zip</code>. Don’t confuse with GrapheneOS images which use format <code class="language-plaintext highlighter-rouge">shiba-install-*.zip</code>.</p> <h2>Step 2: Enable Developer Options and OEM Unlocking</h2> <p>On the phone:</p> <ol> <li><strong>Settings → About phone → tap “Build number” 7 times</strong> to enable Developer Options</li> <li><strong>Settings → System → Developer options → USB debugging → ON</strong></li> <li><strong>Settings → System → Developer options → OEM unlocking → ON</strong></li> </ol> <p>Note: If OEM unlocking is greyed out, connect to WiFi/mobile data and wait ~24 hours (Google’s anti-theft measure).</p> <h2>Step 3: Extract Factory Image</h2> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">cd</span> ~/Downloads unzip shiba-<span class="k">*</span>.zip <span class="c"># or tokay-*.zip for Pixel 9</span> <span class="nb">cd </span>shiba-<span class="k">*</span> <span class="c"># or tokay-* for Pixel 9</span> </code></pre></div></div> <p>For Pixel 8, extract the inner image zip:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>unzip image-shiba-<span class="k">*</span>.zip </code></pre></div></div> <p>For Pixel 9, the images come extracted already.</p> <p>Make the flash script executable:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">chmod</span> +x flash-all.sh </code></pre></div></div> <h2>Step 4: Unlock Bootloader and Flash</h2> <p>Reboot into fastboot mode using the hardware buttons (Power + Volume Down), then:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>fastboot flashing unlock </code></pre></div></div> <p>Confirm on device with volume keys + power. This wipes everything.</p> <p>Once back at fastboot:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>fastboot devices ./flash-all.sh </code></pre></div></div> <p><strong>Do not re-lock the bootloader</strong> since we need it unlocked for Magisk.</p> <h2>Step 5: Post-Flash Setup</h2> <p>After the phone boots:</p> <ol> <li>Skip through initial setup</li> <li>Re-enable Developer Options (tap Build number 7 times)</li> <li>Re-enable USB Debugging</li> </ol> <h2>Step 6: Install Magisk</h2> <p>Magisk is a systemless root solution that modifies the boot image to provide root access while passing SafetyNet checks. It allows installing modules that modify the system without actually touching the system partition.</p> <p>Download the latest Magisk APK from https://github.com/topjohnwu/Magisk/releases</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb <span class="nb">install </span>Magisk-<span class="k">*</span>.apk </code></pre></div></div> <p>Allow notifications when prompted. Useful for superuser prompts.</p> <h2>Step 7: Patch init_boot Image</h2> <p><strong>Important:</strong> Pixel 8 on Android 13+ uses <code class="language-plaintext highlighter-rouge">init_boot.img</code> for the ramdisk, not <code class="language-plaintext highlighter-rouge">boot.img</code>.</p> <p>Push the init_boot image to the phone:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb push init_boot.img /sdcard/Download/ </code></pre></div></div> <p>On the phone:</p> <ol> <li>Open Magisk app</li> <li>Tap <strong>Install</strong></li> <li>Select <strong>Select and Patch a File</strong></li> <li>Navigate to Downloads and select <code class="language-plaintext highlighter-rouge">init_boot.img</code></li> </ol> <p>Note: You can also extract boot.img from a rooted device using dd, but for fresh installs use the init_boot.img from the factory zip. Just make sure it matches your flashed version.</p> <h2>Step 8: Flash Patched Image</h2> <p>List the patched file:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">ls</span> /sdcard/Download/ </code></pre></div></div> <p>Pull it:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb pull /sdcard/Download/magisk_patched-<span class="k">*</span>.img <span class="nb">.</span> </code></pre></div></div> <p>You can test by booting the image directly without flashing:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb reboot bootloader fastboot boot magisk_patched-<span class="k">*</span>.img </code></pre></div></div> <p>If Magisk shows as installed, flash it permanently:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb reboot bootloader fastboot flash init_boot magisk_patched-<span class="k">*</span>.img fastboot reboot </code></pre></div></div> <h2>Step 9: Verify Root</h2> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb shell su </code></pre></div></div> <p>You should see a superuser prompt on the phone. Grant access and you’ll have a root shell.</p> <h2>Step 10: Configure Magisk</h2> <p>In Magisk app, go to <strong>Settings</strong> and configure:</p> <ol> <li><strong>Zygisk → ON</strong> (enables code injection into apps, needed for DenyList)</li> <li><strong>Enable Zygisk DenyList</strong> (hide root from specific apps)</li> <li><strong>Enable DNS over HTTPS</strong></li> <li><strong>Hide the Magisk app</strong> → enter a custom name → add shortcut icon when prompted</li> </ol> <p>Reboot the phone. After reboot, verify Zygisk shows <strong>Yes</strong> in Magisk home screen.</p> <h2>Step 11: Install Burp CA Certificate</h2> <p>Android 14+ has read-only system partitions protected by dm-verity. We’ll use a Magisk module to install the CA cert as a system certificate.</p> <h3>Export Burp Certificate</h3> <p>In Burp Suite: <strong>Proxy → Proxy settings → Import/Export CA Certificate → Export → Certificate in DER format</strong> → save as <code class="language-plaintext highlighter-rouge">cacert.der</code></p> <h3>Convert and Hash the Certificate</h3> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>openssl x509 <span class="nt">-inform</span> DER <span class="nt">-in</span> cacert.der <span class="nt">-out</span> cacert.pem <span class="nb">hash</span><span class="o">=</span><span class="si">$(</span>openssl x509 <span class="nt">-inform</span> PEM <span class="nt">-subject_hash_old</span> <span class="nt">-in</span> cacert.pem | <span class="nb">head</span> <span class="nt">-1</span><span class="si">)</span> <span class="nb">mv </span>cacert.pem <span class="nv">$hash</span>.0 </code></pre></div></div> <h3>Install MagiskTrustUserCerts Module</h3> <p>Download from https://github.com/NVISOsecurity/MagiskTrustUserCerts/releases</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb push MagiskTrustUserCerts.zip /sdcard/Download/ </code></pre></div></div> <p>In Magisk app: <strong>Modules → Install from storage → select the zip → reboot</strong></p> <h3>Install Certificate as User Cert</h3> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb push <span class="nv">$hash</span>.0 /sdcard/Download/ </code></pre></div></div> <p>On phone: <strong>Settings → Security &amp; Privacy → More security settings → Encryption &amp; credentials → Install a certificate → CA certificate → Install anyway</strong> → select your .0 file from Downloads</p> <p>Reboot the phone. The MagiskTrustUserCerts module will promote the user certificate to system trust.</p> <h2>Step 12: Configure Proxy</h2> <h3>Option A: WiFi Proxy</h3> <p>On phone: <strong>Settings → Network &amp; internet → Internet → tap your WiFi network → Edit → Advanced options → Proxy → Manual</strong></p> <p>Set proxy hostname to your Burp machine’s IP and port 8080.</p> <h3>Option B: ADB Reverse (for VM setups)</h3> <p>If Burp is running in a VM, redirect USB to the VM first:</p> <ul> <li><strong>QEMU/virt-manager:</strong> Virtual Machine → Redirect USB device → select Pixel</li> <li><strong>VirtualBox/VMware:</strong> Configure USB passthrough in VM settings</li> </ul> <p>Stop adb on host first if running:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb kill-server </code></pre></div></div> <p>In the VM:</p> <div class="language-bash highlighter-rouge"><div class="highlight"><pre class="highlight"><code>adb devices adb reverse tcp:8080 tcp:8080 </code></pre></div></div> <p>On phone, set proxy to <code class="language-plaintext highlighter-rouge">127.0.0.1:8080</code>.</p> <p><strong>Important:</strong> Disable any VPN on the phone. VPN overrides proxy settings.</p> <h2>Step 13: Test</h2> <p>Open browser on phone. Traffic should appear in Burp’s HTTP history.</p> <h2>Troubleshooting</h2> <ul> <li><strong>Magisk shows “N/A” after flashing:</strong> Make sure you’re flashing <code class="language-plaintext highlighter-rouge">init_boot</code> not <code class="language-plaintext highlighter-rouge">boot</code> on Pixel 8</li> <li><strong>Can’t remount system:</strong> Android 14+ uses dm-verity, use Magisk modules instead</li> <li><strong>No traffic in Burp:</strong> Check VPN is disabled, proxy settings are correct, and Burp is bound to all interfaces (0.0.0.0)</li> <li><strong>Certificate not trusted:</strong> Ensure MagiskTrustUserCerts module is installed and phone was rebooted</li> </ul> Berk Cem Göksel

This post aims to serve as a guide on how to set a Pixel device up for Android security testing. I’ve tested this on both the Pixel 8 and the Pixel 9. The steps are identical for both. This covers flashing stock Pixel OS, rooting with Magisk, and getting Burp Suite working for traffic interception.