Links referenced for video

• https://flash.android.com - Android Flash Tool
• https://grapheneos.org/install/web - GrapheneOS Web Install (Used to remove non-stock key)
• https://intheshellpodcast.com - In the Shell Podcast
• https://yellowball.fm - 🟡 Yellowball, don’t just host your podcast, own it

Links referenced for video

• https://grapheneos.org/install/web - GrapheneOS Web installer
• https://grapheneos.org/donate - GrapheneOS donation page
• https://grapheneos.org/features#sandboxed-google-play - Sandboxed Google Play details
• https://sideofburritos.com/docs/setup-guides/mobile-privacy/ - Mobile Privacy & Security Guide
• https://youtu.be/SZ0PKtiXTSs - How to install Sandboxed Google Play in a separate User Profile

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.

In today’s video, I’m going to cover step by step how to install Graphene OS on the newly released Google Pixel tablet. I’m going to be using the web installer, which makes it nearly impossible to break your device. There are some hiccups you might run into during the installation, and I’ll cover those at the relevant points in the video.

So, to begin the installation, we’re going to head on over to grapheneos.org. Once you get there, select “Install Graphene OS.” Like I said, I’ll be using the web installer, so go ahead and click the “Web USB-based installer.”

Once we get here, go ahead and read through the prerequisites. You must be using a supported OS, which they do list here. I’ll be using macOS for the installation today. It’s also worth noting that if you have an existing Graphene OS device, you can use that for the installation, along with another Android device running stock Pixel OS or another certified Android variant. Make sure your operating system is up to date before proceeding, and then lastly, you must make sure you’re using a supported browser. In this video, I’ll be using Brave, but make sure that you are using one of the browsers listed above.

There are a couple of other notes below that I want to mention. If you are using Linux, avoid flat pack and snap versions of the browser as they’re known to cause issues during the installation process. Do not use incognito mode or other private browsing modes. The reasons why are listed here. There’s also an important note here; I don’t really think this applies to the tablet, but to make sure that the device can be unlocked to install Graphene OS, avoid carrier variants of the devices. So with the phones, they’ll have a Sprint or Verizon version, and those will usually have issues and you can’t unlock them. So if you do buy a device, make sure it’s OEM unlockable. I also suggest reading the rest of the information here, but I’m not going to read that to you.

The first step in the process is to enable OEM unlocking. One thing I want to mention is always go to the source for documentation and guides. Be hesitant to follow some random YouTuber or blog post that claims they have their own method or knows the process better. That’s why I’m following the official guide in this video. You’ll always get the most up-to-date instructions and information.

So, I just took this tablet out of the box and turned it on, which means we’re going to have to walk through the initial setup before we can actually enable OEM unlocking. If you’ve already gone through the setup on your device, feel free to skip this part in the video.

So, I’m going to select “Get started.” I’m going to set up offline, continue. I’m going to leave that set to the default. I’m going to uncheck these options, accept the limited warranty. Next, you should always set a secure PIN on your device, but since I’m going to be erasing the OS in five minutes, I’m just going to set “12345” for mine. I’m going to skip fingerprint unlock because we’re erasing the OS, so select “No thanks.” Swipe navigation, skip. That’s just a guide on how to use it, so if you need to follow that, otherwise skip it. We’ll swipe up to go home.

So, we are now at the home screen. Let’s go back to the instructions. Enable the developer options menu by going to Settings > About phone and pressing the “Build number” menu entry until developer mode is enabled. So, to do that, we’re going to swipe up, we’re going to scroll down and go to Settings, scroll down again, go to About tablet. Scroll down to the bottom, and you’ll see this labeled “Build number.” That’s what you want to tap until you see “Developer options” show up. You’re going to have to enter your PIN code to enable this. And then you’ll see the pop-up that says, “You are now a developer” on the bottom.

So, the next step is to go to Settings > System > Developer options and toggle the OEM unlock settings. So, we’ll go to System, we can see Developer options, select that, scroll down to OEM unlocking, which we can see is grayed out here. So, I did purchase this device brand new from Google, and it is unlocked. But, in order to enable OEM unlocking, you need to connect the device to the internet for the first time. If you bought your device used and someone has previously enabled OEM unlocking, you don’t need to worry about this step. But if you did buy this brand new, like me, you’re going to have to connect to the internet for this to be available. So, go ahead and connect to Wi-Fi. So, you can scroll up, tap “Network and internet,” select “Internet,” to your Wi-Fi network.

So, once your device is successfully connected to the internet, let’s go back to the Developer options, System > Developer options, and we can now see OEM unlocking is no longer grayed out, and we can now enable it. So, we’ll go ahead and tap the toggle. You’ll have to enter your PIN code again. You’ll see a pop-up for “Allow OEM unlocking,” select “Enable,” and OEM unlocking is now enabled.

So now, back to the instructions. The next step is flashing is non-root (this is for Linux, so if you’re on Linux, follow these instructions; if you’re not, skip ahead). The next step is booting into the bootloader interface. You need to boot your phone into the bootloader interface. To do this, you need to hold the volume down button while the phone boots (or, in this case, a tablet). It’s also worth mentioning that I’m making this video about 12 hours after the initial release of Graphene OS for the Pixel tablet, so some things on some wording may change in the future, but the overall general process will be the same.

So, to boot into the bootloader interface, if you’ve never done this before, it can take you a few tries. But what you need to do is swipe down, swipe down again, tap the power icon in the bottom right-hand corner, and then select “Restart.” And now, immediately hold the volume down, which is on the left side of the device on the bottom, then keep holding that. And if you are successful in booting into the bootloader interface, you’ll reach a screen that looks like this. This is going to be a little bit difficult for the camera since this is so tiny (that’s what she said). So here, you’ll see this output, it’ll have some information about your device, and also say “Device state is locked,” we’ll be changing that shortly. And for now, I’m going to set this down, and we’ll proceed onto the next step.

So, the next step is connecting the phone, or in this case, our tablet. Again, the Pixel tablet was just released, so they haven’t updated the wording yet, but this is referring to your tablet. So in the note here, if you are on Windows, you need to install a driver for Fastboot if you don’t already have it. No driver is needed on other operating systems. There’s a couple of ways you can install the Fastboot driver on Windows. The first and easiest way, you can obtain the driver from Windows update, which will detect it as an optional update when the device is booted into the bootloader interface, which is what we see on the screen now and connected to the computer. So that’s the easiest way. So if you are on Windows, just follow the instructions here. The second way is you can manually install it with Device Manager. So if you feel up to that, you can also go ahead and do that, but I would recommend the first method as that’s easier and more straightforward.

At this point, we can now connect our tablet to our computer. The typical recommendation is to use the USB cable that came with the device. The tablet does not come with one, so you’re going to need to use one that you have lying around or purchase one. Your best option will be to use the stock cable that came with a Pixel phone if you purchased one in the past, or you can just use whatever cable you have lying around that you know is in good working condition. That’s what I’m using. I just have a third-party cable here. As I mentioned in the beginning, there are a few things that could go wrong with the installation, and the USB cable is a big one that a lot of people have issues with. If you have any strange behavior during the installation, it’s likely due to a faulty USB cable. It might work for powering a device, but data and power use different pins on a USB cable, so it’s possible that the data pins are damaged, and it’s not working so good. First troubleshooting step is to try a different cable, purchase a new one, and again, use that if you have any strange issues during the installation process.

So I’m going to go ahead and connect this to my tablet on the bottom. There’s a USB-C port, plug in the cable there. So once you plug it in, we’re going to move on to the next step, which is “Unlock Bootloader.” So, one warning before unlocking the bootloader. This step will completely erase the device, so if you have any photos you took or maybe you have some contacts you saved, make sure you save those somewhere else first before moving on to this step. Again, this will completely erase the device and anything on there. So, we’re going to select “Unlock Bootloader.” We can see up here, “Pixel tablet” shows up on the screen, select that, press “Connect.” We’re going to see our screen change. We have a warning here, “If you unlock the bootloader, you will be able to install custom operating system software on this phone.” That’s why we’re here. So in order to do this, we can see up at the top right, it says the current option is “Do not unlock the bootloader.” We’re going to press either volume up or down to change the selection. So when I press that, it now says “Unlock the bootloader,” and then to select that, we need to press the power button. So I’m going to press the power button. Now that it says “Unlock the bootloader,” the screen goes blank for a minute, and as I mentioned earlier, down here, we had “Device state,” and it was green, and it said “Locked.” At this point, since we unlocked the bootloader, our device is now unlocked, and it’s red. You will also see the output on the screen that says “Bootloader unlocked.”

So the next step is obtaining factory images. In order to do that, press “Download release.” So depending on your internet speed, this can take a few minutes, but at this point, it’s just downloading the factory image. It’s not actually flashing it to our device yet. And while that’s downloading, I want to mention that if you get any value from Graphene OS or after you install it, you really like it and use it on a regular basis, consider donating to the project. And like I said earlier, they had this tablet release initial release out within 12 hours of me actually receiving the device in the mail, so they do incredible work. They’re a great resource for the privacy and security community. So any monetary contribution you can offer, I’m sure the project would appreciate.

So once the download has finished, you’ll see this has changed to “Downloaded,” doesn’t say “Download” anymore. So the next step is flashing factory images. The initial install will be performed by flashing the factory images. This will replace the existing OS installation and wipe all the existing data. I do suggest you give this paragraph a read before clicking the button above. The most important part down here is avoid interacting with the device until the flashing script is finished and the device is back at the bootloader interface. So once you’re ready, select “Flash release.” You’re going to see your screen flash and change. So just give it a few minutes for this process to complete.

So once the flashing has completed, the text on the screen will change to “Flashed,” and we can now proceed onto the next step, which is “Locking the bootloader.” Locking the bootloader is important as it enables full verified boot. It also prevents using fastboot to flash, format, or erase partitions. There’s also some other interesting information here, so I suggest you give that a read, but similar to how we unlocked the bootloader, in order to lock it, we’re going to select “Lock bootloader” in the corner. We now see “Do not unlock the bootloader.” We’re going to press the volume rocker either up or down, and it now has changed to “Lock the bootloader,” and then to select that option, we’re going to press the power button.

So I’m going to press the power button. Give it a second. And we can confirm the bootloader is locked as “Device state” is now green and “Locked.” So at this point, we are ready to boot up the OS. There’s a couple more steps we need to complete underneath the “Post-installation.” You’ve now successfully installed Graphene OS and can boot it. Nice job! Pressing the power button with the default start option selected in the bootloader interface will boot the OS. We can see the default option right now is “Start,” so select the power button, and our device will now start up.

So, this is the first screen you’re going to see. I’m going to press the power button quick to pause the display or to pause the boot process. So, this is normal to see if you have a different operating system other than stock Android OS installed on your device. We can see here, “Your device is loading a different operating system.” And on these post-installation instructions, there’s one step you can do here, which is “Verified Boot Key Hash.” So, we pause the screen by pressing the power button, and we can now see the hash listed out down there below. And what you want to do is look at that hash that’s listed next to “ID” and make sure that matches the, in this case, Pixel tablet. I’m going to read that quick, and it does match. So it’s just one other way to verify the integrity of the installation we just performed. If that matches, we can proceed. You don’t need to do this every time; this is just after the initial installation. I think it’s good practice. So once you’ve verified that, we can now press the power button to resume. So I’m going to select that. The next screen you’re going to see is the Google splash screen. That’s normal. Don’t be worried. And then we will see the Graphene OS screen. I’m going to let this complete the first boot, but we are now successfully booting Graphene OS. Once that finishes, we’re going to walk through the initial setup. I’m going to press “Start” next.

Change to your time zone.

Enable Wi-Fi if you want. I’m going to skip that for now.

I’m going to uncheck location services.

I’m going to skip the fingerprint setup.

I’m going to set up a PIN code, though. Don’t make your PIN code “12345.” I’m going to be wiping this device shortly.

Once you confirm that, I’m going to skip restore apps and data, and then we can press “Start.”

So I’m pretty excited. This is the first time I’ve ever booted Graphene OS on a tablet. I’ve been waiting for the larger display for a long time, so this is pretty awesome.

So if we go back to the post-installation instructions, we can see “Disabling OEM unlocking.” So we want to complete that step, so we’re going to go into Settings, scroll down to “About phone,” we’re going to tap “Build number.” Once we see this screen, enter your PIN code.

We are now developers. We can see on the bottom. Go to System, and then back to Developer options, and then disable OEM unlocking. Please restart the device to enable the device protection feature. So I’m going to hold down the power button and then select “Restart.”

So my camera is saying it’s going to overheat. Let’s hope it doesn’t overheat.

There’s more information under “Verifying installation” and some other details down below regarding hardware-based attestation. I would suggest you give that a read-through. I’m not going to cover that in this tutorial.

And so once your device boots up, we can swipe up, enter our PIN code.

And you are now ready to start using Graphene OS on your Pixel tablet. So if you’re looking for an easy way to get started and to start downloading apps, Graphene OS offers sandbox Google Play services. They are very easy to install. I’m going to run through that quick. First step is we need to connect to Wi-Fi, so I’m going to go into Settings > Network and internet, select my Wi-Fi network.

So once you’re connected to Wi-Fi, we can swipe up again, go back into the app drawer. We’re going to go into the Apps app. You can then go to Google Play services, tap “Install.” This will take a few minutes depending on your internet connection. You’ll see a few pop-ups. Tap “Install.”

So once that finishes, you can swipe up to go to your home screen. Going to swipe up again, we can now see Play Store is installed. If you’ve ever used Android OS before, this is going to be very similar to the Google Play Store. There’s a lot more information on the sandboxed Google Play services on grapheneos.org, which I’ll link down below. But I’m not going to cover that in this video.

So again, this is just a basic setup if you’re just getting started, want to experiment, and mess around. You can make a fake Google account and sign in with that just on your tablet to use. And if you don’t like having Google Play services on your device, you can always erase your device and set it up however you prefer.

So, if you made it this far and are not tired of hearing me talk yet, I do have a monthly newsletter that I send out. You can sign up for that at sideofburritos.com. I send out random text stuff and non-text stuff. You might like it or you might not, but you can always unsubscribe.

So, my camera just shut off that was recording the tablet, but we’ve reached the end of the installation process. If you’re looking for a good resource on Graphene OS-related information, check out the forum that they host. You can go to that at discuss.grapheneos.org. And if you enjoyed this video, I think you might like the top one listed here, and the YouTube algorithm thinks you might like the bottom one.

Links referenced for video

• https://grapheneos.org/install/web - GrapheneOS Web installer
• https://grapheneos.org/donate - GrapheneOS donation page
• https://grapheneos.org/features#sandboxed-google-play - Sandboxed Google Play details
• https://sideofburritos.com/docs/setup-guides/mobile-privacy/ - Mobile Privacy & Security Guide
• https://youtu.be/SZ0PKtiXTSs - How to install Sandboxed Google Play in a separate User Profile
• https://nitter.net/DanielMicay/status/1552966692749414402#m - Twitter thread explaining OEM unlocking

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.

So in today’s video, I’ll be demonstrating how to install graphene iOS on the Google Pixel seven specifically, but if you have a different Google Pixel, this process will be relatively similar, I’m going to be using the web installer. And if you use that, it’s nearly impossible to mess up your phone. So don’t be afraid to attempt this. Now with that being said, there are a few hiccups you may run into during the install process. And I’ll cover those at the relevant points in the video. The computer I’m demonstrating this from is running Mac OS, and I’m using the brave browser. So to get started, we’re going to head on over to Griffin os.org. All websites that I mentioned in the video will be linked down below in the description box. So once you get here, click on Install Griffin OS. As I mentioned, we’re going to be using the web based installer. So once you get to this page, we’re going to scroll down to the prerequisites, give this a read through make sure that you have all of these requirements met. Make sure you’re using one of the supported OSS, like I said, I’ll be installing from macOS. So besides a supported operating system, make sure you are using a supported browser. There is an important note here, if you are using chromium on Ubuntu, it’s broken and will not work. So use a different browser, such as Google Chrome. Another important note here do not use incognito or private browsing mode. And so once you give that a read through, I’m not going to waste your time by reading it to you, and you make sure that all the prerequisites are met, we can then proceed on to the first step, which is enabling OEM unlocking in the screen we’re currently on is the screen that you’ll see if you just bought it brand new and just took it out of the box. So first, I’m going to walk through the initial setup. If you’re already past this part, you can skip it, I’ll leave the timestamps down below in the play bar. So we’re going to go ahead and select to get started. I’m not going to connect to a mobile network, I don’t have a SIM card in my phone. Skip. I’m going to skip connecting to Wi Fi select Setup offline, continue. Date and time, you can leave that set to default. You don’t need to uncheck these but I like to anyways click Accept limited warranty. Next additional legal terms except we are going to be erasing the phone so you don’t really need to set a pin but I think it’s good practice anyways

confirm the pin fingerprint unlock I’m going to skip this because like I said, we’re just gonna be erasing the phone momentarily. No banks face on luck, no thanks. This is just a quick tutorial on swipe navigation. If you want, you can go through it. Otherwise skip. So we have finished the initial setup offline and go ahead and swipe up. And we’re now at the home screen. So I’m recording this part while editing the video because I forgot to mention it initially, this step is not required. But it is suggested that you update your device before installing graphene allow us to check for updates, first connect to Wi Fi, then swipe up, go into settings, scroll down, tap on system. And then tap system update. If you see your system is up to date, then you’re good to go. Otherwise, install any pending updates and then continue with the video. So to enable OEM unlocking we first need to enable developer options, which you can do by going to settings about and repeatedly pressing the build number menu entry. And just one note before we actually start following the instructions, make sure you always go to the source when you’re looking for information. Don’t just follow some random YouTuber or some blog post, always go to the official documentation in this case graphene os.org get your information from the source first and then go from there. Select the instruction said we’re going to swipe up, go into settings, scroll down to the bottom, we’re going to tap about phone, scroll to the bottom. And down here we have build number. Go ahead and tap that until you are prompted for your PIN. If you set one, enter your PIN. And we can now see you are now a developer. So another developer options are enabled. Next go into Settings System developer options and toggle the OEM unlocking setting. So we’re going to go back, scroll down, go to system. At the bottom, we have developer options, tap that. If we scroll down, we can see here OEM unlocking so there is one caveat about OEM unlocking that I want to mention. So if you purchased your phone brand new from Google or from a store, you will need to connect to the internet first so that your phone can check if the serial number was sold carrier locked or if you’re able to enable OEM unlocking devices that are typically locked by the carrier or Verizon based devices, those ones even if you connect to the internet, you won’t be able to unlock. Your only option at that point is to either return the device or sell it and buy a factory unlocked device. For me personally, I usually buy my devices directly from Google, I select the unlocked version option. And every time I’ve had no issues, so if you’re watching this video and haven’t purchased a device yet, and you’re looking to buy a used mobile phone, I suggest asking the seller to send you a screenshot or a photo showing that OEM unlocking is available. That’s the only way to truly guarantee it. I’ve purchased a device used in the past, and it was carrier unlocked, which means I could connect to different carriers, but it didn’t actually support OEM unlocking so reach out to the seller to confirm that if they’re not willing to send you a photo showing that I would suggest not buying that device. So again, if you bought a new phone, you connected the internet OEM unlocking should be available at that point. And once it is, go ahead and enable OEM unlocking, you’ll be prompted for your pin again. Allow OEM unlocking, enable, and we can now see OEM unlocking is enabled. So on to the next step flashing as non root. This is for anyone who’s on Linux, I’m not on Linux. So I’m not going to cover this. But if you are give this a read over following that is booting into the bootloader interface, you need to boot your phone into the bootloader interface. To do this, you need to hold the Volume Down button while the phone boots, the easiest way is to reboot your phone and begin holding the Volume Down button until it boots up into the bootloader interface. So this part can be a little bit tricky for some people. So we’re going to swipe down, swipe down again, you’ll see down here the power button, select that, and then select Restart. Once restarting disappears from the screen, hold the Volume Down button.

This will take a minute. And if you were successful on booting into the bootloader interface, you will see this screen. If you were not successful, your phone will just boot up as normal. At that point restarted again, hold the Volume Down button until you get into this interface. So the next step is connecting the phone. If you’re on Linux, here’s a note about that. If you’re on Windows, you need to install the driver for fast boot if you don’t already have it, there’s a couple options for actually obtaining the drivers. So pause the video and Give this a read over if you’re on Windows. And for everyone else, we can just go ahead and connect our USB cable to our device. So this is where a lot of people run into an issue. They plug their phone into the computer with a USB cable, and their computer doesn’t actually see the phone and they don’t understand what’s going on. Typically that’s due to a faulty USB cable. The best option in this scenario is to use the stock cable that came with your device. If you don’t have that use a third party cable. But if you plug in your phone to the computer with a USB cable, and it doesn’t see it, try a different cable. Typically it’s a faulty cable causing you issues. One other thing to mention, make sure you’re plugging your USB cable directly into your computer, don’t plug it into a dongle first. That can also be the cause of issues. So again, use the cable that came with your device, plug it directly into your computer, and you should have the best chance of not having an issue. So plugging the cable to your device. So before we unlock the bootloader it’s important to note that once you do, all data on your device will be wiped. So if you were using your phone and you took some photos, or maybe this was your primary device and now you want to test out graphene iOS, make sure you make a backup of everything on there, your contacts, calendar events, text messages, everything will be erased and there’s no way to recover it. So once you confirm you have everything’s backed up or saved that you want, you can then proceed to unlock the bootloader select unlock bootloader and if your cables not faulty and your computer sees your device, you will see a prompt like this graphene os.org wants to connect, you should see your device listed here. Select Connect, we can see the screen changed, we have a quick disclaimer down here about unlocking the bootloader. And up here we can see it do not unlock the bootloader we want to unlock the bootloader. So to change the selection, we’re going to press the volume down or up. You’ll now see it says unlock the bootloader once you see that to select that option, press the Power button. And if you were successful at unlocking the bootloader you’ll see device state has now changed to red unlocked. So now that the bootloader is unlocked, we can proceed on to the next step which is obtaining factory images. We’re going to select Download release. And the actual amount of time this takes to download will vary depending on your internet speed. It’s gonna take a minute, two minutes or an hour. And so while that’s downloading, I just want to mention to consider donating to the project if you’re getting any sort of value from it, the developers putting in a lot of work to updates and Supporting new phones as they come out. My favorite way to contribute is using GitHub sponsors, it lets me schedule a monthly recurring donation to them. So again, consider donating to the project donations are used for paying developers purchasing hardware paying for infrastructure. So once the download has finished, it’ll say downloaded and the progress bar will be full. So now that the download has completed, we can proceed on with flashing our device, the initial install will be performed by flashing the factory images. This will replace the existing OS installation and wipe all the existing data, give this paragraph or read over. But the most important part is avoid interacting with the device until the flashing script is finished. So once we click flash release, just leave your device alone, don’t touch it, wait for it to complete. Once you’re ready, select flash release, you’ll see the screen changes. And again, just let the device do its thing. Don’t interact with it at all.

And so while that’s flashing I just want to mention that I have a somewhat monthly newsletter that I send out, you can sign up for that at site of burritos.com. If you’re new to privacy and security on your mobile device, I have a page on my website that has an index of all my videos I have. It’s a good starting point if you want to get familiar with what options are out there.

And then while we wait for this to complete, one of my friends came to me the other day upset about something they did, I told them some solid life advice, and that was that they needed to embrace their mistakes. So they gave me a hug

so once the flashing has completed, you’ll see the text on the screen has changed to flashed, and our phone is back at the bootloader interface. The next step and this is extremely important is to actually lock the bootloader give this a read over it explains why it’s so important. But again, to do that, we’re going to select Lock bootloader we see the prompt on our screen again, we see it says do not lock the bootloader same as earlier we’re going to press the volume up or down until it says lock the bootloader at that point, press the Power button

and if that completes successfully, we’ll see device state now says locked and it is green. Congratulations. You’ve now successfully installed graphene OS and can boot it. pressing the power button with the default start option selected in the bootloader interface will boot the OS. So if you have the default option selected, it should say start press the power button

you’re going to see the screen here devices loading a different operating system. Since we have a nonstock operating system installed, the screen is normal so expect to see that it’s also normal to see the Google splash screen. And at this point you’ll now see the graphene OS boot animation we’ll take a minute for the initial boot we can now walk through the initial setup. Select Start, select your language Next, set your timezone. Next I’m going to skip connecting to Wi Fi for now skip I don’t have a SIM card in my device but you can put one in if you want. Next, I’m going to disable location services for now. Next fingerprint you can set this up if you want to.

I do suggest setting a PIN code at the very least then please set something else besides 12345. Once you type that in and again press confirm if you had a backup from an existing graphene OS installation, you can restore it now. Otherwise, if this is a new installation for you, press skip

and then start so back on the webpage disabling OEM unlocking OEM unlocking can be disabled again in the developer settings menu within the operating system after booting it up again. After disabling OEM unlocking we recommend disabling developer options for a device that’s not being used for app or OS development. So we’re going to follow the same steps We did it when we initially enabled OEM unlocking, we’re going to go into settings, scroll to the bottom, select About phone, go to the bottom, tap build number to be prompted for your PIN code. You are now a developer, select back, go into System developer options. We can see here OEM unlocking is enabled, we want to disable that, please restart the device to enable device protection feature. So we’re going to do that in a moment. And then again, we want to disable developer options. So on select that, you need to restart your device to change this setting. Tap Restart. Now on the boot screen, I’m going to press my power button. When that initial warning shows up, tell you why in a second.

So pressing the power button pauses the boot. And the reason for that is down below here, we can verify the boot key hash. And so what you want to do depending on the device you have, if it’s a pixel six or newer, you want to look at this screen. In my case, I’m on the pixel seven. And I want to verify that this string matches what is displayed on my device. So take a minute to do that. Looking at it, I can see it does match. The reason as to why is listed here. So give that a read over. And so once you confirm that, press the Power button again to resume the boot. So at this point, you have successfully installed graphene OS and you can start using it if you like. But if you are new and looking for the simplest way to get started, I want to quickly cover that one feature of graphene OS is they offer sandbox Google Play services on stock Android OS plays services are installed in a way where they bypass the app sandbox and receive a massive amount of highly privileged access. On Griffin OS Play services can be installed as standard apps with no special access or privileges. So if you’re new and looking for the simplest way to get started, this is what I recommend. And that’s what I will be demonstrating. There’s a couple other options if you want a bit more privacy, such as installing them in a separate user profile. And I cover that in a video which I will link down below. But if you’re at all hesitant about this switch, and using graphene OS, then I suggest installing them as I’m about to demonstrate. Once you get more comfortable, you can watch my other videos or check out different blog posts on some ways to enhance your privacy and security. But for now, take the simplest approach get comfortable and go from there. So the first thing we need to do to install sandbox Play services is connected to Wi Fi. So I’m going to swipe down, select Internet, I’m going to select my Wi Fi network. Once you’ve successfully connected to your Wi Fi, we’re going to swipe up, select the Apps app. We’re going to go to Google Play Store, select that, as we can see here, it’s also going to install a Google services framework and Google Play services. Select Install all it’s going to take about five minutes to complete, I will be linking this down below, I do suggest you take the time to read it over, as well as the usage guide that’s linked at the bottom. There’s a lot of great information in here. It explains how it works, the actual configuration, limitations, things like that. So take the time read it over. There’s a lot of good stuff. So once that’s completed, you’ll see down here and now says open instead of installing. I’m just going to swipe up. We’re going to swipe up again, go into our app drawer. And you’ll now see Play Store listed here. So this will function just like Play Store on stock Android OS, you can select that sign in. If you’re looking for a little more privacy, create a separate Google account that you just use on here to download apps and things like that. Go ahead and sign in, download your apps, get yourself started. And then like I said at that point once you’re comfortable, check out some of my other videos or different options that are available. On my last piece of advice, privacy and security. It’s a journey. Don’t try and do everything at once. If you change too much, it’ll be hard to keep the habit so take it step by step. Do what you can and every little bit helps.

Links referenced for video

• https://grapheneos.org/install/web - GrapheneOS Web installer
• https://nitter.net/DanielMicay/status/1552966692749414402#m - Twitter thread explaining OEM unlocking
• https://grapheneos.org/donate - GrapheneOS donation page
• https://grapheneos.org/features#sandboxed-google-play - Sandboxed Google Play details

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.

So the main purpose of today’s video is to install graphene OS on the Google Pixel six a specifically, the process will be similar regardless of which pixel you have. But the one I’m demonstrating on today is the six A, we’re going to be following the instructions on graphene os.org. I’ll put the link down below in the description as well as on the screen right now. And we will be using the web installer, it’s essentially impossible to break your phone using the web installer. So don’t be scared to try this, I’ve done the process probably about 50 to 100 times at this point, I’ve never had an issue with it. Now that being said, there are some issues that come up for some individuals when they are going through the install process. And I will point those out throughout the video for any tips, you can try to overcome those. But with that out of the way, let’s begin the installation process. So we’re at Griffin os.org, the web installer, we’re going to go down to the prerequisites, give this a read through the supported OS. I’m installing this from Mac OS today using brave browser, make sure you are using a supported browser and a supported OS. Otherwise you will encounter issues. This is a very important note for those on Ubuntu. If you’re using chromium that is broken and will not work. So make sure if you’re on a boon to you are not using chromium. So once you know you’re using a supported browser and OS, we can continue, make sure to give all this a read through I’m not going to waste your time reading it to you. But there’s some other important bits of information in here such as Do not use an incognito browser or private browser. Because again, you will encounter issues. So once you make sure all the prerequisites are met, we are on to enabling OEM unlocking. So just a note about where you get your information from always go to the source directly, in this case, Griffin os.org. That’s why I’m following along in their guide when showing you the developers do a great job documenting the installation process and different features. Always go to the source. First, don’t trust some random YouTuber talking about it, or some random forum posts that you saw, you’ll always get the best information directly from the source. So the first step for this OEM unlocking needs to be enabled from within the operating system, enable the developer options by going into settings about and pressing the build number entry until developer mode is enabled. So I’m going to be demonstrating this, like I just took my pixel out of the box. When you turn it on for the first time, you will see this screen. If you already past the initial setup, and you want to skip ahead, I’ll have that in the play bar below. So you can skip this section. But if you’re here, go ahead and press Get Started. I don’t have a SIM card in the phone yet. So go ahead and click Skip. So you could connect to Wi Fi at this point. But I like to skip this because we don’t need a Wi Fi connection, we can set up the pixel offline first. So we’re gonna go to Setup offline. Just a quick warning about setting up offline continue. Date and time. I uncheck these just for good practice. Except Except it’s always good practice to set a pin. Even if you’re just going to be erasing the OS quick. Sometimes I don’t but you should anyways.

No fingerprint, no thanks. Skip, and then swipe up to go home. So at this point, we’re on the home screen, the first step is to go into settings about so swipe up,

you’ll see settings, go to Settings, scroll down to the bottom, we’re going to go into about phone, scroll down at the bottom here you see build number. Now tap on that you will get this screen if you set a PIN number, type in the pin. And we can now see you are now a developer. So developer options are enabled. And that’s where the setting for OEM unlocking will be located. So next, go into settings, system developer options and toggle OEM unlocking. So we’re gonna go back word in the settings, so go to System developer options. And here’s the option to enable OEM unlocking. So there’s a couple things to note about OEM unlocking. So if you purchase your device brand new OEM unlocking will be grayed out and you won’t be able to enable it. The reason for that is that you need to actually connect to Wi Fi at this point before you can enable OEM unlocking. So we can see here OEM unlocking requires Internet access so that the stock OS can check if the device was sold as locked by a carrier. And so what does that actually mean? So the founder and lead developer of graphene OS has a thread on Twitter describing how OEM unlocking actually works, which again, I’ll link down below if you want to read through it. So essentially, how that works is that Google has a database of the pixels serial numbers and which ones were sold as an unlocked device not locked by the carrier. Your device will check with Google if the device is enabled for OEM unlocking after you connect to the internet. You will then be able to enable OEM unlocking. If your device checks with Google and your serial number is not authorized for unlocking, then that option will remain grayed out because it’s locked by the carrier devices that are commonly locked or Verizon branded pixels. So if you have a Verizon pixel, you will not be able to enable OEM unlocking and you cannot install graphene unless your only option is to return it or sell it and buy a OEM, unlockable pixel. For me personally, I buy my devices directly from Google as unlocked, so I know that it’s unlockable, I don’t need to worry about it being locked. If you decide to buy used online, I would suggest asking the seller to confirm if OEM unlocking is available, had them send you a screenshot so that you know, I’ve made the mistake in the past of buying a locked pixel, I had to return it. So don’t make the same mistake as me. One other note on the site is so for the pixel six A, this phone in particular, if you’re using one, unlocking won’t work with the version of the stock OS from the factory, you need to update it to the June 2022 release or later, via and over the air update. After you’ve updated it, you also need to factory reset the device to fix the OEM unlocking issue. So depending on when you bought your pixel, this may not be an issue for you. This pixel was purchased around a month ago, and it shipped with the newer updates. And I did not have to factory reset or follow this at all to get it to work. But if you purchased a pixel earlier, you may need to do this and follow these steps to actually get OEM unlocking to work. So I’ve unlocked this device in the past, which is why OEM unlocking is available. So again, connect to Wi Fi, if it’s not, if your device is able to be unlocked after a checksum with Google, you will then be able to enable it, enable OEM unlocking if you have a pin set you need to enter it. Allow OEM unlocking enable, and we can now see it’s enabled. So on to the next step flashing as non root. This is for Linux distributions, I’m not going to cover this part. So the next step is booting into the bootloader interface, you need to boot your phone into the bootloader interface. To do this, you need to hold the Volume Down button while the phone boots. The easiest approach is to reboot the phone and begin holding the Volume Down button until it boots up into the bootloader interface. So now what that looks like we have OEM unlocking enabled. Going to swipe down, going to pull down again, in the bottom right hand corner is the power button. And then from here, we’re going to select Restart, hold down the volume down button on the right side of the phone. So as you saw that took about 10 seconds. And once you see this screen, we are in the bootloader interface. If the screen doesn’t come up for you, the phone will just boot up like normal, try restarting and again, hold the Volume Down button until you get to this screen. So the next step is actually connecting the phone to our computer. And so for this step I want to mention, make sure you use the stock cable that actually came with your device. Now that being said, the most common issue that I’ve heard others talk about is that their computer doesn’t see the phone. And that’s because they have a faulty USB cable. So if you plug in your USB cable to your computer with your phone, and it doesn’t see it or you have any other strange issues when downloading the OS later in this guide, go ahead and try a different USB cable, and likely that’ll solve your issue. Also, when connecting the USB cable to your computer connected directly to your computer, don’t connect it through a dongle that’s plugged into another port. While it still might work. This could lead to some other strange issues. Let’s go ahead and connect the USB cable to our device. So just some notes here. If you’re using Windows on Windows, you need to install the driver for fastboot. If you don’t already have it, you can obtain the driver from Windows Update, which will detect it as an optional update when the device is booted into the bootloader interface and connected to the computer. So you should see a little pop up if you’re on Windows. Another method is to go here and just download the driver manually. But the easiest option will likely be through Windows Update. So once you have your device connected to your computer with a USB cable, and you have all the drivers installed, if you’re on Windows, the next step is unlocking the bootloader. It’s important to note that unlocking the bootloader will erase the device and wipe all data. It’s impossible to recover your data if you erase it. So make sure if you had any contacts or calendar events or photos that you need to save that you save those before proceeding because your device will be erased. So if you’re ready to continue, we’re going to press the unlock bootloader button, you’ll see this prompt in your browser. If you have issues or if the drivers didn’t install or you’re using an unsupported browser, you’ve likely will not see your phone here. If that’s the case, the first and easiest step, go through again, if you’re on Windows, make sure you install the drivers. And what I usually suggest to people is if you’re not using Google Chrome, just go ahead and install it even if it’s temporary google chrome Rome is supported and will work. So that’s one easy way to rule out that your browser is the issue. But if you do see it in your browser, and you see you can select your phone, go ahead and select Connect, you’re going to see this warning on the phone, take a second to read that through. Once you do, press the volume down or up button, so that it says unlock the bootloader. And once you see that, press the Power button to select that. And if this was successful, you will now see device state red unlocked, as compared to before where it was green and said locked. So once you see device state unlocked, we’re ready to proceed on to the next step. Next one is obtaining the factory images. So go ahead and press download release. This will download the release in your browser. Depending on your internet connection speed. This could take a minute, a few minutes or an hour. And so while that’s downloading it, just want to mention that once you start using graphene OS consider donating to the project. The developers put in a lot of hard work supporting current devices and new devices very quickly. The donations are used for paying developers and purchasing hardware. Me personally, I like the GitHub sponsors option. So I set that up. So I have a reoccurring monthly donation. And again, I’ll link this down below. So you can check out the page and set up your donation. And so once that finishes, you’ll see the progress bar is full and this will say downloaded and then the name of the release dot zip. And the next step is to actually flash the image to our device. So the initial install be performed by flashing the factory images. This will replace the existing OS installation and wipe all existing data. The main thing to note here is avoid interacting with the device until the flashing script is finished and the device is back at the bootloader interface. So once you’re ready, select flash release, you’ll see your screen change waiting bootloader. And your device will now flash and go through the entire process. And again, this will probably take five to 10 minutes. So while that’s flashing and you and I are both waiting for this to finish, I just want to mention that I have a monthly newsletter that I send out, you can sign up for that at side of burritos.com. So the other day I was talking to my best friend who was a truck driver and he asked me if I knew what frogs did when their car breaks down. I said no, I do not know what frogs do when their car breaks down. And he said they get it towed. So with that great joke out of the way I’m going to fast forward the video and I will see you shortly

so once that’s completed, for me, it took about five minutes for that to complete. You will see flashed and then again the name dot zip to device. And I want to the next step which is locking the bootloader which is extremely important as it enables full verified boot. And some of the reasons why this is extremely important are in the rest of this paragraph, which I would suggest you read over. So to do that, we’re going to select Lock bootloader again, we can see do not lock the bootloader use the volume up or down to change that. When it says lock the bootloader Press the Power button to select and once that is successful, you will see device state is now green locked. So once that’s completed, we can go on to the next step post installation booting. You’ve now successfully installed graphene OS congratulations and can boot it. pressing the power button with the default start option selected in the bootloader interface will boot the OS. So we can see here it says start press the power button the screen is normal. Do not be afraid if you see that we have a customer lesson installed. Seeing the Google screen is normal and then once you see the graphene OS screen, this is now the boot animation booting into graphene OS so the next step after booting is disable OEM unlocking. So for that we have to go to the initial setup. So start set your language, date and time set that we’re going to skip Wi Fi for now. I don’t have a SIM card if you do, you can put it in now just turn location services off by default. Next, I’m going to skip fingerprint setup but you can set that up if you want. I’m just going to set a PIN code quick just for the demo but again, set a secure PIN code along with fingerprint if you want. I don’t have a backup to restore from Skip and start. So we have now reached the GrapheneOS home screen. And now to disable OEM unlocking we’re gonna go into settings. We’re going to scroll down again to About phone. Go to the bottom tap Build Number or type in the PIN code. We can now see your now developer, go back system developer options.

Disable OEM unlocking, please restart the device to enabled device protection feature. And also, I’m going to disable developer options, you don’t really need those enabled,

we can now see developer options are gone. So as the instruction said, Let’s Reboot the device, since we disabled OEM unlocking, restart so I’m just gonna press the power button quick, so I can pause it on the screen. So the next part, verifying installation, give this a read over some very good information. This verified boot key hash, the reason I paused it by pressing the power button on boot is that we can verify the boot key hash. And here we have the pixel six A in this example, can make sure the number matches there. Which does so we’re good to go. So I’m gonna press the power button to resume. So I’m just gonna log in quick. So the next thing I want to cover quick is what I think is the best setup for anyone that’s new to Griffin OS. If you’ve read around, there’s a lot of videos, including my own channel or blog post that talks about using F Droid or Aurora store or all these different things you can do to increase your privacy and security. And while some of them are valid, it can be a bit overwhelming for anyone that’s new. So what I’m going to do is show you a basic initial setup that I think is best for anyone that’s new here. So for that we need to connect to Wi Fi.

And some other Wi Fi is connected, we can proceed on, we’re going to swipe up, we’re going to go into apps.

And the apps app support allows you to install different apps that are provided by Griffin OS. In this case, we’re going to be installing the sandbox Google Play services. Again, like I said, this is going to be a basic setup for anyone that’s new, I get a lot of messages from people that say they’re new to privacy or the security community. And it’s overwhelming at first they get a VPN, they get a new phone, they get this, they get that they want to use F droid. And I can understand how that’s overwhelming. And that’s why don’t suggest trying to do everything at first, privacy and security as a journey. You can’t do it all at once. Because if something’s too difficult, you’re not going to stick with it, you’re gonna give up easily. And that’s why I think it’s easier to go ahead and install the sandbox Play services use Google Play, like we’re about to do and start there. Once you get comfortable with the OS, you can make changes one by one, you can check out some other videos I have, you can see different suggestions that users might have online. But the first step is getting a solid base that you’re comfortable with using Griffin OS. And I think sandbox Google Play services are a great place to start. So to do that, we’re going to go down to the bottom, and we want to install Google Play Store. We can see here it’s going to install these other two dependencies, services framework and Play services. So select Install. All right. So that took about three minutes, we can now see that it’s finished. Because we see the Open option. You can either select open, or you can go swipe up. And you’ll now see Play stores installed. This is the same Play Store you’d get on Android OS except on graphene OS it’s sandboxed and installed as a normal app instead of an app with system level access. So select the Play store. You can select Sign In. And then at this point, you can either sign in with your personal Gmail account. Or another option if you want a little bit of increased privacy, create a separate gmail account that you can use specifically for this. That’s not tied to anything else you have. If you have paid for apps, you can sign in with that account. You can installed paid apps like anything else. And since we now have all the Google services installed in our device, notifications, and everything else will work as expected. And if you’ve used Android in the past, this is going to feel like the standard Android experience.

Links referenced for video

• https://flash.android.com - Android Flash Tool
• https://grapheneos.org/install/web - GrapheneOS Web Install (Used to remove non-stock key)

Commands referenced in video

If you’re on Arch Linux or Debian/Ubuntu, use the following commands to install as non-root:

sudo pacman -S android-udev

Arch Linux

sudo apt install android-sdk-platform-tools-common

Debian/Ubuntu

Links referenced for video

• https://grapheneos.org - GrapheneOS Homepage
• https://grapheneos.org/install/web - GrapheneOS Web Install
• https://www.chromium.org/getting-involved/download-chromium/ - Download Chromium
• https://developer.android.com/studio/run/win-usb - Windows Users - Google USB Driver - Fastboot
• https://developer.android.com/studio/run/oem-usb#InstallingDriver - How to install Windows Drivers with Device Manager