Obtaining superuser rights on modern devices with an operating system Android 12 has turned from a simple routine into a complex engineering process. Unlike older versions of "one-click" applications, modern security mechanisms require a deep understanding of the system architecture. You have to not only run the app, but also interfere with the boot process of the device, which inevitably entails the risk of loss of warranty and data.
The main difficulty lies in the mechanism Verified Boot (verified boot), which does not allow the system to start with modified system partitions. To bypass this protection, you need to unlock the bootloader and then implement a special binary patch into the boot image. This requires a computer, an original cable and, critically, an exact copy of the firmware specifically for your smartphone model.
This instruction describes a universal method using a tool Magisk, which is currently the industry standard for managing root access. We will analyze each stage: from preparing drivers to the final verification of rights. Be extremely careful, as an error at the firmware stage can turn your device into a “brick.”
Preparing the device and backing up data
Before you start modifying the system, you need to realize that unlocking the bootloader completely erases all data from the internal memory of the device. This is a security measure implemented by Google to protect users from data theft when their phone is stolen. Therefore, the first and most important step is to create a complete backup of all important files, photos and contacts.
It is recommended to use not only cloud services, but also local copying to a computer or external drive. Pay special attention to two-factor authentication: after resetting the settings, some banking applications and instant messengers may require repeated verification, access to which may be lost.
⚠️ Attention: The procedure for unlocking the bootloader is irreversible in terms of data. Even if you change your mind and decide to lock the bootloader back, the data will not be restored automatically.
You also need to activate developer mode. To do this, go to Settings → About phone and click 7 times on the item Build number. After the message “You have become a developer” appears, go to the menu that appears For developers. Here you need to enable two critical parameters: USB debugging i Factory unlocking (OEM Unlocking).
☑️ Preparing for rooting
Bootloader Unlock
Unlocking the bootloader is a fundamental step, without which installing a modified boot image is impossible. Manufacturers implement this process differently: some, like Xiaomi or OnePlus, require waiting from 7 to 15 days and obtaining a special code through the official website. Others, for example Google Pixel or Moto, allow you to do this instantly through Fastboot commands.
First, put your smartphone in Fastboot mode. This is usually done by command adb reboot bootloader when the device is connected to the PC, or by a combination of physical buttons (most often volume down + power) when the phone is turned off. Make sure that drivers ADB and Fastbootare installed on your computer, otherwise the terminal will not see the device.
After entering bootloader mode, enter the command to check the status:
fastboot getvar unlockedIf you receive a response (no), then the bootloader is locked. To unlock, enter the command fastboot flashing unlock (for new devices) or fastboot oem unlock (for old ones). A warning about data loss will appear on the smartphone screen. Confirm the action with the volume buttons.
The process will take a few minutes, after which the device will reboot into a clean system. Now the bootloader status will change to Unlocked, which will allow us to write custom images to the boot section.
What to do if the OEM Unlocking item is gray or inactive?
If the switch is inactive, connect the device to Wi-Fi and wait from 1 to 7 days. Also check to see if your model is a US market device (Verizon or AT&T version), as they often have a hardware bootloader lock that cannot be removed through software.
Extracting and modifying the boot.img image
The central element of the rooting procedure on Android 12 is the file boot.img. This is the system kernel that boots first. Our task is to take the original file from the factory firmware and insert code into it to obtain superuser rights, without changing the system itself.
You need to download the full stock firmware (Factory Image or OTA Zip) specifically for your current build version. The version must match byte by byte: if you have an assembly SQ3A.220705.003.A1, then you need to search for the firmware with the same index. Using an incompatible image will lead to an endless reboot (bootloop).
| Firmware file type | User actions | Difficulty of extraction |
|---|---|---|
| Factory Image (.tgz / .zip) | Unpack the archive, find the image-*.zip file, search inside it boot.img | Low |
| OTA Update (.zip) | Unpack, find payload.bin, use the payload_dumper utility to extract | High |
| Scatter Firmware (MediaTek) | Use SP Flash Tool to read the image or look for a ready-made boot.img | Average |
After you have obtained a clean one boot.img, copy it to the internal memory of your smartphone. Next, install the application Magisk (apk file is downloaded from the official GitHub repository of the developer topjohnwu). Launch the application, click the "Install" button next to Magisk and select the "Select and patch file" option.
Specify the path to the copied file boot.img. The application will automatically analyze the file, implement the necessary scripts and save the result in a folder Download under the name magisk_patched_[random].img. This new file is the key to obtaining root access.
Do not try to patch the recovery.img file instead of boot.img on devices with A/B separation - this may lead to recovery mode not working. Always work with the boot image.
Flashing the modified image via Fastboot
The final stage is writing the modified image back to the device. Put your smartphone into Fastboot mode again and connect it to your computer. Make sure that the modified file magisk_patched.img is located in the same folder where you run the terminal commands, or specify the full path to it.
The command for flashing depends on the architecture of your processor. For most modern devices with A/B partitions (slotless update system), the command looks like this:
fastboot flash boot magisk_patched.imgHowever, if your device uses older standards or has a specific layout, you may need to specify the slot. In such cases, use the command fastboot flash boot_a and fastboot flash boot_b in turn, or simply fastboot flash bootif the slot is detected automatically.
After successful recording (you will see a message Finished. Total time: X.XXXs), you must reboot the device. It is important to do this correctly so that the system accepts the changes. Enter the command:
fastboot rebootThe first boot may take longer than usual as the system optimizes applications. Do not interrupt this process.
Checking rights and setting up Magisk
After loading the operating system, find the icon on the desktop Magisk. If the application is installed and opens, this is a good sign. Go to the application settings (gear in the corner) and make sure that the option is enabled Zygisk. This technology allows modules to be embedded in system processes, which is necessary for the operation of many modern modules and bypassing root detection.
To check for superuser rights, you can install any terminal (for example, Termux) or a specialized application like Root Checker. In the terminal, enter the command su. If the system requests confirmation of rights grant (Magisk pop-up window), then everything was successful.
In the rights request window, click “Grant”. If the invitation symbol in the terminal changes from $ to #, congratulations - you have gained full access to the file system.
⚠️ Attention: After receiving root access, some applications (banks, games with anti-cheat) will no longer run. For them to work, you will need to configure hiding the root via DenyList in the Magisk settings.
Possible problems and ways to solve them
Rooting process Android 12 does not always go smoothly. The most common problem is Bootloop (cyclic reboot). This happens if the patched image is incompatible with the kernel of your firmware. In this case, you need to enter Fastboot mode again and flash the original, clean boot.imgthat you saved before starting work.
Another common error is the message “Custom binary blocked by FRP lock”. This means that Reset Protection (FRP) is active and is blocking the installation of custom images. Solution: Log in with your Google account, wait 24 hours, then repeat the unlocking procedure.
- 📱 The device is not visible in Fastboot: install generic Google USB Drivers or manufacturer-specific drivers (for example, Xiaomi ADB Fastboot Tools).
- 🔋 Rapid battery drain: often caused by a conflict modules or incorrect operation of Zygisk. Try disabling unnecessary modules.
- 🛡️ SafetyNet/Play Integrity error: even with root you can pass the check if you configure Magisk Hide correctly and use the Universal SafetyNet Fix modules.
Remember that the developer community is constantly updating methods for bypassing protections. What worked a month ago may require new settings today.
Always save the original boot.img before flashing the patched file. This is your only insurance for restoring the phone's functionality in the event of an error.
Will the warranty expire after obtaining root access?
In most cases, yes, formally the warranty is voided if the integrity of the software is violated. However, if you can lock the bootloader back and return the stock firmware, the service center may not notice the intervention during standard diagnostics. Physical traces (oxidation of contacts, chips) will definitely void the warranty; software traces depend on the brand’s policy.
Is it possible to update the system over the air (OTA) with root access?
Direct update "over the air" is usually impossible or will lead to the loss of root access and restoration of the stock bootloader. The correct algorithm: download the OTA package manually, do not install it right away, patch a new boot.img from this package, flash it via fastboot, and only then start installing the update through the phone settings.
Is it safe to use banking applications with root?
root access themselves do not steal money, but they reduce the level of security of the application sandbox. Modern banking applications detect an unlocked bootloader. Using the DenyList function in Magisk and the Zygisk module, you can hide the fact of rooting from specific applications, making their work possible, but the risk always remains higher than on a clean device.
What is Zygisk and why do you need it?
Zygisk (Zygote + Magisk) is a modern implementation of injecting Magisk code into the process Zygote, which is the parent of all applications in Android. It replaced the old MagiskHide. Zygisk is necessary for the operation of modules that change system behavior on the fly, and is a key tool for bypassing security checks in new versions of Android.