The Rabbit R1 is too cute to be e-waste, so I put LineageOS on it

Back in 2024, Rabbit Inc. sold the R1 as an AI companion: a charming little orange square, designed with Teenage Engineering, that was meant to replace your phone apps with a big red button and a cloud service. Underneath the marketing, it was always a locked-down Android device running a Flutter app. This thing has GPS and even a SIM card slot!

Mine now runs LineageOS 21, better known as Android 14, thanks to pointing an LLM at it:

Click here or on the image above for the video

What you're looking at

My R1 is running 21-20250621-UNOFFICIAL-arm64_bgN, one of Andy Yan's unofficial LineageOS GSI builds, running on the R1's MediaTek Helio P35 with 4GB of RAM and 128GB of storage. Because the R1 is Project Treble compatible, a Generic System Image boots without anyone having to build a device-specific ROM. Google services work, the Play Store works, and the whole thing feels far more useful than RabbitOS ever did.

The R1 has no hardware button combination for fastboot and Rabbit never intended the bootloader to be opened. The community worked around that, so now Rabbit allow you to do this officially via Rabbithole.

1. Unlocking the bootloader. The OEM-unlock flag turns out to be the last byte of the frp partition. Using mtkclient, you read that partition, flip the byte from 00 to 01, write it back, and fastboot flashing unlock then works. This is the method from the excellent r1_escape project. (Rabbit's own Rabbithole dashboard has an unlock toggle, but in my case it never actually synced to the device.)
2. Disabling verified boot. Patch the flags in vbmeta to 0x3 so the device will boot unsigned images.
3. Flashing the GSI. The R1 uses A/B slots with dynamic partitions, so system can only be written from fastbootd (fastboot reboot-fastboot), not the bootloader's fastboot. The image is about 3GB and the R1's fastboot only accepts 128MB chunks, so it goes across in pieces: fastboot -S 100M flash system lineage.img.
4. Wiping. fastboot -w from the bootloader's fastboot. This step is not optional: my first attempt at booting Android 14 over Android 13's userdata hung forever because stale Google services data kept crashing the boot process.
5. Certifying Google services. Fresh GSIs report as "not certified". Grab the GSF ID and register it at google.com/android/uncertified.

Things that almost caught out the LLM

• Chrome holds the R1 hostage. Any tab using WebUSB (the Rabbithole dashboard, the community web flasher) takes exclusive control of the USB device. Until you close the tab, fastboot simply won't see the R1.
• Two fastboots, different jobs. Logical partitions like system only exist in fastbootd. Wiping userdata only works in the bootloader's fastboot. You will bounce between them.
• On macOS, use mainline mtkclient. The fork bundled with r1_escape fails the preloader handshake on Apple Silicon. Mainline just works.
• Back up frp and vbmeta before you start, and put the backups somewhere permanent. I kept mine in a temp directory, macOS cleaned it, and they are gone forever. Learn from my carelessness.

Resources

• r1_escape: the unlock toolkit and stock-restore instructions
• mtkclient: low-level MediaTek access
• Andy Yan's GSI builds: the lineage-21-td folder is what you want (arm64_bgN for the R1)
• rabbit-hmi-oss firmware archive and web-based stock flasher: the way back to RabbitOS

Why bother

Because it's just better. The R1 is a perfectly serviceable Android device in one of the most likeable bits of hardware design in years, and it can perform a different job to your smartphone. Thanks to the R1 community, and to Andy Yan and the Treble crowd, it doesn't have to be just a curiosity.

Standard warning: this wipes your device, could brick it, and voids whatever remains of your warranty. Read the r1_escape docs properly before plugging anything in.