How to install GrapheneOS on Google Pixel Tablet GPT + Setup for new users

published 2023-07-24 · updated 2023-07-24 #how_to #android #grapheneos #install #tablet
The Google Pixel Tablet is finally here! Unfortunately, the stock Android OS is lacking when it comes to privacy. GrapehenOS is a private and secure mobile operating system with Android app compatibility.

Transcript

Please excuse any grammatical errors. I used a tool to generate the transcript and haven't had a chance to read through it yet.

In today's video, I'm going to cover step by step how to install Graphene OS on the newly released Google Pixel tablet. I'm going to be using the web installer, which makes it nearly impossible to break your device. There are some hiccups you might run into during the installation, and I'll cover those at the relevant points in the video.

So, to begin the installation, we're going to head on over to grapheneos.org. Once you get there, select "Install Graphene OS." Like I said, I'll be using the web installer, so go ahead and click the "Web USB-based installer."

Once we get here, go ahead and read through the prerequisites. You must be using a supported OS, which they do list here. I'll be using macOS for the installation today. It's also worth noting that if you have an existing Graphene OS device, you can use that for the installation, along with another Android device running stock Pixel OS or another certified Android variant. Make sure your operating system is up to date before proceeding, and then lastly, you must make sure you're using a supported browser. In this video, I'll be using Brave, but make sure that you are using one of the browsers listed above.

There are a couple of other notes below that I want to mention. If you are using Linux, avoid flat pack and snap versions of the browser as they're known to cause issues during the installation process. Do not use incognito mode or other private browsing modes. The reasons why are listed here. There's also an important note here; I don't really think this applies to the tablet, but to make sure that the device can be unlocked to install Graphene OS, avoid carrier variants of the devices. So with the phones, they'll have a Sprint or Verizon version, and those will usually have issues and you can't unlock them. So if you do buy a device, make sure it's OEM unlockable. I also suggest reading the rest of the information here, but I'm not going to read that to you.

The first step in the process is to enable OEM unlocking. One thing I want to mention is always go to the source for documentation and guides. Be hesitant to follow some random YouTuber or blog post that claims they have their own method or knows the process better. That's why I'm following the official guide in this video. You'll always get the most up-to-date instructions and information.

So, I just took this tablet out of the box and turned it on, which means we're going to have to walk through the initial setup before we can actually enable OEM unlocking. If you've already gone through the setup on your device, feel free to skip this part in the video.

So, I'm going to select "Get started." I'm going to set up offline, continue. I'm going to leave that set to the default. I'm going to uncheck these options, accept the limited warranty. Next, you should always set a secure PIN on your device, but since I'm going to be erasing the OS in five minutes, I'm just going to set "12345" for mine. I'm going to skip fingerprint unlock because we're erasing the OS, so select "No thanks." Swipe navigation, skip. That's just a guide on how to use it, so if you need to follow that, otherwise skip it. We'll swipe up to go home.

So, we are now at the home screen. Let's go back to the instructions. Enable the developer options menu by going to Settings > About phone and pressing the "Build number" menu entry until developer mode is enabled. So, to do that, we're going to swipe up, we're going to scroll down and go to Settings, scroll down again, go to About tablet. Scroll down to the bottom, and you'll see this labeled "Build number." That's what you want to tap until you see "Developer options" show up. You're going to have to enter your PIN code to enable this. And then you'll see the pop-up that says, "You are now a developer" on the bottom.

So, the next step is to go to Settings > System > Developer options and toggle the OEM unlock settings. So, we'll go to System, we can see Developer options, select that, scroll down to OEM unlocking, which we can see is grayed out here. So, I did purchase this device brand new from Google, and it is unlocked. But, in order to enable OEM unlocking, you need to connect the device to the internet for the first time. If you bought your device used and someone has previously enabled OEM unlocking, you don't need to worry about this step. But if you did buy this brand new, like me, you're going to have to connect to the internet for this to be available. So, go ahead and connect to Wi-Fi. So, you can scroll up, tap "Network and internet," select "Internet," to your Wi-Fi network.

So, once your device is successfully connected to the internet, let's go back to the Developer options, System > Developer options, and we can now see OEM unlocking is no longer grayed out, and we can now enable it. So, we'll go ahead and tap the toggle. You'll have to enter your PIN code again. You'll see a pop-up for "Allow OEM unlocking," select "Enable," and OEM unlocking is now enabled.

So now, back to the instructions. The next step is flashing is non-root (this is for Linux, so if you're on Linux, follow these instructions; if you're not, skip ahead). The next step is booting into the bootloader interface. You need to boot your phone into the bootloader interface. To do this, you need to hold the volume down button while the phone boots (or, in this case, a tablet). It's also worth mentioning that I'm making this video about 12 hours after the initial release of Graphene OS for the Pixel tablet, so some things on some wording may change in the future, but the overall general process will be the same.

So, to boot into the bootloader interface, if you've never done this before, it can take you a few tries. But what you need to do is swipe down, swipe down again, tap the power icon in the bottom right-hand corner, and then select "Restart." And now, immediately hold the volume down, which is on the left side of the device on the bottom, then keep holding that. And if you are successful in booting into the bootloader interface, you'll reach a screen that looks like this. This is going to be a little bit difficult for the camera since this is so tiny (that's what she said). So here, you'll see this output, it'll have some information about your device, and also say "Device state is locked," we'll be changing that shortly. And for now, I'm going to set this down, and we'll proceed onto the next step.

So, the next step is connecting the phone, or in this case, our tablet. Again, the Pixel tablet was just released, so they haven't updated the wording yet, but this is referring to your tablet. So in the note here, if you are on Windows, you need to install a driver for Fastboot if you don't already have it. No driver is needed on other operating systems. There's a couple of ways you can install the Fastboot driver on Windows. The first and easiest way, you can obtain the driver from Windows update, which will detect it as an optional update when the device is booted into the bootloader interface, which is what we see on the screen now and connected to the computer. So that's the easiest way. So if you are on Windows, just follow the instructions here. The second way is you can manually install it with Device Manager. So if you feel up to that, you can also go ahead and do that, but I would recommend the first method as that's easier and more straightforward.

At this point, we can now connect our tablet to our computer. The typical recommendation is to use the USB cable that came with the device. The tablet does not come with one, so you're going to need to use one that you have lying around or purchase one. Your best option will be to use the stock cable that came with a Pixel phone if you purchased one in the past, or you can just use whatever cable you have lying around that you know is in good working condition. That's what I'm using. I just have a third-party cable here. As I mentioned in the beginning, there are a few things that could go wrong with the installation, and the USB cable is a big one that a lot of people have issues with. If you have any strange behavior during the installation, it's likely due to a faulty USB cable. It might work for powering a device, but data and power use different pins on a USB cable, so it's possible that the data pins are damaged, and it's not working so good. First troubleshooting step is to try a different cable, purchase a new one, and again, use that if you have any strange issues during the installation process.

So I'm going to go ahead and connect this to my tablet on the bottom. There's a USB-C port, plug in the cable there. So once you plug it in, we're going to move on to the next step, which is "Unlock Bootloader." So, one warning before unlocking the bootloader. This step will completely erase the device, so if you have any photos you took or maybe you have some contacts you saved, make sure you save those somewhere else first before moving on to this step. Again, this will completely erase the device and anything on there. So, we're going to select "Unlock Bootloader." We can see up here, "Pixel tablet" shows up on the screen, select that, press "Connect." We're going to see our screen change. We have a warning here, "If you unlock the bootloader, you will be able to install custom operating system software on this phone." That's why we're here. So in order to do this, we can see up at the top right, it says the current option is "Do not unlock the bootloader." We're going to press either volume up or down to change the selection. So when I press that, it now says "Unlock the bootloader," and then to select that, we need to press the power button. So I'm going to press the power button. Now that it says "Unlock the bootloader," the screen goes blank for a minute, and as I mentioned earlier, down here, we had "Device state," and it was green, and it said "Locked." At this point, since we unlocked the bootloader, our device is now unlocked, and it's red. You will also see the output on the screen that says "Bootloader unlocked."

So the next step is obtaining factory images. In order to do that, press "Download release." So depending on your internet speed, this can take a few minutes, but at this point, it's just downloading the factory image. It's not actually flashing it to our device yet. And while that's downloading, I want to mention that if you get any value from Graphene OS or after you install it, you really like it and use it on a regular basis, consider donating to the project. And like I said earlier, they had this tablet release initial release out within 12 hours of me actually receiving the device in the mail, so they do incredible work. They're a great resource for the privacy and security community. So any monetary contribution you can offer, I'm sure the project would appreciate.

So once the download has finished, you'll see this has changed to "Downloaded," doesn't say "Download" anymore. So the next step is flashing factory images. The initial install will be performed by flashing the factory images. This will replace the existing OS installation and wipe all the existing data. I do suggest you give this paragraph a read before clicking the button above. The most important part down here is avoid interacting with the device until the flashing script is finished and the device is back at the bootloader interface. So once you're ready, select "Flash release." You're going to see your screen flash and change. So just give it a few minutes for this process to complete.

So once the flashing has completed, the text on the screen will change to "Flashed," and we can now proceed onto the next step, which is "Locking the bootloader." Locking the bootloader is important as it enables full verified boot. It also prevents using fastboot to flash, format, or erase partitions. There's also some other interesting information here, so I suggest you give that a read, but similar to how we unlocked the bootloader, in order to lock it, we're going to select "Lock bootloader" in the corner. We now see "Do not unlock the bootloader." We're going to press the volume rocker either up or down, and it now has changed to "Lock the bootloader," and then to select that option, we're going to press the power button.

So I'm going to press the power button. Give it a second. And we can confirm the bootloader is locked as "Device state" is now green and "Locked." So at this point, we are ready to boot up the OS. There's a couple more steps we need to complete underneath the "Post-installation." You've now successfully installed Graphene OS and can boot it. Nice job! Pressing the power button with the default start option selected in the bootloader interface will boot the OS. We can see the default option right now is "Start," so select the power button, and our device will now start up.

So, this is the first screen you're going to see. I'm going to press the power button quick to pause the display or to pause the boot process. So, this is normal to see if you have a different operating system other than stock Android OS installed on your device. We can see here, "Your device is loading a different operating system." And on these post-installation instructions, there's one step you can do here, which is "Verified Boot Key Hash." So, we pause the screen by pressing the power button, and we can now see the hash listed out down there below. And what you want to do is look at that hash that's listed next to "ID" and make sure that matches the, in this case, Pixel tablet. I'm going to read that quick, and it does match. So it's just one other way to verify the integrity of the installation we just performed. If that matches, we can proceed. You don't need to do this every time; this is just after the initial installation. I think it's good practice. So once you've verified that, we can now press the power button to resume. So I'm going to select that. The next screen you're going to see is the Google splash screen. That's normal. Don't be worried. And then we will see the Graphene OS screen. I'm going to let this complete the first boot, but we are now successfully booting Graphene OS. Once that finishes, we're going to walk through the initial setup. I'm going to press "Start" next.

Change to your time zone.

Enable Wi-Fi if you want. I'm going to skip that for now.

I'm going to uncheck location services.

I'm going to skip the fingerprint setup.

I'm going to set up a PIN code, though. Don't make your PIN code "12345." I'm going to be wiping this device shortly.

Once you confirm that, I'm going to skip restore apps and data, and then we can press "Start."

So I'm pretty excited. This is the first time I've ever booted Graphene OS on a tablet. I've been waiting for the larger display for a long time, so this is pretty awesome.

So if we go back to the post-installation instructions, we can see "Disabling OEM unlocking." So we want to complete that step, so we're going to go into Settings, scroll down to "About phone," we're going to tap "Build number." Once we see this screen, enter your PIN code.

We are now developers. We can see on the bottom. Go to System, and then back to Developer options, and then disable OEM unlocking. Please restart the device to enable the device protection feature. So I'm going to hold down the power button and then select "Restart."

So my camera is saying it's going to overheat. Let's hope it doesn't overheat.

There's more information under "Verifying installation" and some other details down below regarding hardware-based attestation. I would suggest you give that a read-through. I'm not going to cover that in this tutorial.

And so once your device boots up, we can swipe up, enter our PIN code.

And you are now ready to start using Graphene OS on your Pixel tablet. So if you're looking for an easy way to get started and to start downloading apps, Graphene OS offers sandbox Google Play services. They are very easy to install. I'm going to run through that quick. First step is we need to connect to Wi-Fi, so I'm going to go into Settings > Network and internet, select my Wi-Fi network.

So once you're connected to Wi-Fi, we can swipe up again, go back into the app drawer. We're going to go into the Apps app. You can then go to Google Play services, tap "Install." This will take a few minutes depending on your internet connection. You'll see a few pop-ups. Tap "Install."

So once that finishes, you can swipe up to go to your home screen. Going to swipe up again, we can now see Play Store is installed. If you've ever used Android OS before, this is going to be very similar to the Google Play Store. There's a lot more information on the sandboxed Google Play services on grapheneos.org, which I'll link down below. But I'm not going to cover that in this video.

So again, this is just a basic setup if you're just getting started, want to experiment, and mess around. You can make a fake Google account and sign in with that just on your tablet to use. And if you don't like having Google Play services on your device, you can always erase your device and set it up however you prefer.

So, if you made it this far and are not tired of hearing me talk yet, I do have a monthly newsletter that I send out. You can sign up for that at sideofburritos.com. I send out random text stuff and non-text stuff. You might like it or you might not, but you can always unsubscribe.

So, my camera just shut off that was recording the tablet, but we've reached the end of the installation process. If you're looking for a good resource on Graphene OS-related information, check out the forum that they host. You can go to that at discuss.grapheneos.org. And if you enjoyed this video, I think you might like the top one listed here, and the YouTube algorithm thinks you might like the bottom one.