In this article, I will share the steps I took to unlock and root my Nexus 6p which I bought on eBay for around £50. The purpose of unlocking/rooting the phone is so that I can install Kali NetHunter on it to use in penetration testing.

This guide assumes you have already made a full backup of your phone and anything you want to keep has been stored elsewhere like Google drive.

Before we get started, there are a few files we need to get hold of.

  • Download the following files:
    • Android USB drivers (if using Windows OS) – Link
    • Android File transfer (if using MacOS) – Link
    • Androids Platform Tools – Link
    • TWRP – Link
    • Magisk – Link
  • Make a folder called Android and copy the files into it.
  • Unzip the USB drivers and Platform Tools.

Pre-requirements

On the phone, complete the following steps.

  • Enable Developer settings.
    • Apps -> Settings -> System -> About phone -> Tap Build number seven times.
  • Go back to System then Developer options.
    • Enable OEM unlocking.
    • Disable Automatic system updates.

Enable file transfer between the phone and computer


Windows OS

figure 1
  • Connect the phone to the computer using the USB cable.
  • Open device manager. Windows button, type device manager into the search box.
  • In the list of resources under your computer, the phone should show up as an Android Device (figure 1)
  • Double-click the Android Bootloader Interface and the select the Drivers tab. Then select Update Driver. Browse to the folder where the extracted Android USB drivers (previously downloaded) are e.g. <location of Android folder>\usb_driver_r13-windows\ then select the usb_driver folder.
  • The phone’s internal memory should now be browsable in file explorer.

MacOS

  • Install the Android File Transfer app.
  • Connect the phone to the Mac using the USB cable.
  • On the phone, drag down the system panel and tap the USB charging this device mode. From the menu, select Transfer files.
  • Open Finder and run Android File Transfer. The internal storage for the phone will be shown in the app.

The computer is now ready for transferring files as required further in this guide.

Unlock the phone

  • Power off the phone.
  • Disconnect the USB cable, if connected.
  • Power on into bootloader. Press and hold both the power button and the volume down button. This might take ten seconds or more, just keep the buttons held down.
  • Connect the USB cable between the phone and computer.
  • Check the phone can be detected…

Windows

  • cd <location of Android folder>\platform-tools_r31.0.3-windows\platform-tools
  • fastboot devices

MacOS

  • cd <location of Android folder>/platform-tools_r31.0.3-windows/platform-tools
  • ./fastboot devices

This should return the serial number of the phone plus “fastboot”.

  • Unlock the phone

Windows

  • fastboot flashing unlock

MacOS

./fastboot flashing unlock


  • On the phone, the Unlock bootloader screen will be displayed. With Yes highlighted, press the power button to select the option and continue.
  • On the computer, the following message will be displayed:
Figure 2
  • On the phone, when the boot loader screen appears, press the power button to select Start.
  • The phone will now restart and will load with an unlocked boot loader. This is indicated by the unlocked padlock on the Google screen during loading. You can now go ahead and set up your phone.

Root the phone

This is the process of copying across Magisk.

  • With the phone and computer connected via the USB cable. On the phone, drag down the system panel and tap the USB charging this device mode. From the menu, select Transfer files.
  • Copy across the Magisk apk file

Windows

  • Open file explorer/Windows explorer and double click the Nexus 6P device to open the internal storage. Open the Internal Storage folder so that you are at the root of storage.
  • Drag across the Magisk-v23.0.apk file to the root of the internal storage.

MacOS

  • Open Finder and run Android File Transfer. The internal storage for the phone will be shown in the app.
  • Drag across the Magisk-v23.0.apk file to the root of the internal storage.

  • Power off the phone, disconnect the USB cable (to prevent starting up in charge) and start it up into the boot loader using the power and volume down buttons.
  • Plug in the USB cable.
  • Check that the phone is detected:

Windows

fastboot devices

MacOS

./fastboot devices


This should return the serial number of the phone plus “fastboot”.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.