Nothing Phone (3), Phone (2a) Plus & CMF Phone 1/2 Root Guide
Fastboot rooting walkthrough for Nothing Phone (3), Phone (2a) Plus, and CMF Phone 1/2 on Nothing OS 3.0. Covers clean near-AOSP fastboot commands, payload.bin dumping, Glyph Interface compatibility, and Play Integrity Fix configuration.
Hardware & Partition Specifications
Before flashing, confirm your device matches these exact kernel and partition specifications:
| Hardware Parameter | Target Specification | Engineering Details |
|---|---|---|
| SoC / Chipset | Snapdragon 8s Gen 3 (Phone 3) / Dimensity 7350 Pro (Phone 2a Plus) / Dimensity 7300 (CMF Phone 1) | Nothing OS 2.6 / 3.0 |
Hardware processing platform and architecture |
| Target Partition | init_boot.img (Near-AOSP Architecture - Extracted from official Nothing Archive payload.bin) | The exact partition image that must be patched in Magisk |
| OS Compatibility Layer | Android 16 (Baklava / QPR2) Layer → | Kernel specifications, SEPolicy patching & 16KB memory page rules |
| RAM Page Alignment | 4KB Standard (Android 14/15 Nothing OS) |
Virtual memory kernel standard (Android 15/16 compatibility) |
| Firmware Package | Official Nothing OS Full OTA Package (obtain from spike0en Nothing Archive / Nothing Developer Portal) |
Official OEM stock ROM packaging format |
| Unlocking Method | Settings > Developer Options > OEM Unlocking + Fastboot (`fastboot flashing unlock`). Standard AOSP bootloader unlock behavior with zero hardware fuse penalties. |
Bootloader unlocking requirement and tool |
| AVB / dm-verity | Standard AVB 2.0 (No vbmeta patch needed) | Android Verified Boot verification enforcement |
Step-by-Step Rooting Procedure
Unlock the Nothing Phone (3), Phone (2a) Plus & CMF Phone 1/2 Bootloader
Enable Developer Options by tapping Build Number 7 times in Settings → About Phone. Navigate to Settings → System → Developer Options and toggle on OEM Unlocking and USB Debugging.
Settings > Developer Options > OEM Unlocking + Fastboot (`fastboot flashing unlock`). Standard AOSP bootloader unlock behavior with zero hardware fuse penalties.
Extract the Stock Partition Image
Obtain the official stock firmware archive matching your exact software build number. Extract the required partition image:
Patch Partition in the Magisk App
1. Download and install the latest official Magisk v30.7 APK onto your Nothing Phone (3), Phone (2a) Plus & CMF Phone 1/2.
2. Transfer the extracted stock init_boot.img (Near-AOSP Architecture - Extracted from official Nothing Archive payload.bin) to your device's Download folder.
3. Open Magisk, tap Install on the top card, and choose Select and Patch a File.
4. Select your file. Magisk will patch the ramdisk and output magisk_patched_[random].img to your Download directory.
5. Transfer the patched image back to your PC via USB.
Flash Patched Image
Connect your device to your computer in bootloader/download mode and execute the verified flashing command:
Emergency Recovery & Bootloop Prevention
If your device fails to boot after installing an incompatible module, use this model-specific hardware recovery procedure:
Recovery Action: Fastboot Mode -> `fastboot flash init_boot stock_init_boot.img` (from Nothing Archive).
OTA Maintenance: Nothing OS System Update -> Magisk Inactive Slot installation -> Reboot.
Related Guides & Next Steps
Continue setting up your rooted Nothing Phone (3), Phone (2a) Plus & CMF Phone 1/2 with essential modules and protection:
Android 16 (Baklava / QPR2) Layer
OS LayerDeep dive into 16KB kernels, init_boot partitioning, and Play Integrity bypass rules.
Nothing Rooting Hub
OEM HubBrowse all supported Nothing smartphones, firmware guides, and OEM tools.
Play Integrity Fix (PIF)
ModulePass MEETS_DEVICE_INTEGRITY attestation and unblock Google Wallet on Nothing Phone (3), Phone (2a) Plus & CMF Phone 1/2.
Fix Magisk Bootloops
RecoveryEmergency safe mode and ADB module wipe tutorial without data loss.