Rooting

Caution

These instructions were written for and have only been tested on phoenix devices (PICO 4, PICO 4 Pro and PICO 4 Enterprise). They likely will not work on sparrow devices (PICO 4 Ultra or Ultra Enterprise). If you try anyway, here be dragons!

Danger

Rooting your headset and unlocking the bootloader requires your headset to be factory reset! You will lose anything you do not back up!

Unlocking the bootloader

Using picounlock

picounlock is an all-in-one tool for unlocking your PICO 4’s bootloader.

1. Connect your headset to your computer via a reliable USB-C cable.
2. Download and run picounlock for your operating system.
3. Follow the steps in the GUI. If all goes well, your headset’s bootloader will be unlocked!
4. Take note of the unlock key, displayed in the UI and printed in the log file. It looks like picoXXXXXXXX.

Manually

Caution

These steps need work, and I’m not qualified enough to do so. You probably should just use picounlock for now, but if you really are feeling brave, have a look at more-picohaxx.

1. Flash the PICO 3 ABL to your headset using EDL mode and the leaked PICO engineering firehose.
2. Calculate your headset’s unlock key for use in the PICO 3 ABL using the below Python script:

def generate_unlock(serial: int):
key = "0XD9J6FB3ATQIHNM46XYZZZOPQRSTUVWXYZ"

val = serial & 0xF7F3F37F

if val == 0:
  encoded_serial = key[0]
else:
  encoded_chars = []
  while val > 0:
    encoded_chars.append(key[val & 0xF])
    val >>= 4
  encoded_serial = "".join(reversed(encoded_chars))

return f"fastboot oem pico{encoded_serial} unlock"

3. fastboot oem picoXXXXXXXX unlock, replacing XXXXXXXX with your unlock key.
4. fastboot flashing unlock_critical
5. fastboot flashing unlock
6. fastboot oem setenforce 0
7. fastboot reboot-bootloader - you should now see Device state: unlocked in the headset.
8. Boot the headset with fastboot reboot. After a short wait, Android Recovery should ask you to factory reset - do so!

Installing Magisk

1. You will need a copy of adb. If it is not installed on your computer, it is included with picounlock.
2. Download a stock OTA image for your firmware version, and extract the boot.img to your computer.
3. Download Magisk4Pico.apk (stock Magisk will NOT work!).
4. adb push boot.img /sdcard/Download
5. adb install Magisk4Pico.apk
6. Open the Magisk4Pico app on your headset, and choose Install > Select and Patch a File, and choose boot.img.
7. In the output log, you will see the path to the freshly-patched boot image.
8. adb pull <path_to_patched_boot_image_on_device>
9. adb reboot bootloader
10. fastboot oem picoXXXXXXXX unlock, replacing XXXXXXXX with your unlock key.
11. fastboot flash boot <path_to_patched_boot_image_on_computer>
12. Boot the headset with fastboot reboot. The Magisk4Pico app should now show that Magisk is installed.

Your headset should now be rooted, and you are free to install Magisk modules. It is recommended that you go through Magisk’s settings and enable Zygisk.