The era of simple “one-click” rooters that worked without unnecessary movements is gradually becoming a thing of the past. In 2018, smartphone manufacturers, such as Samsung, Google, OnePlus and Xiaomi, significantly strengthened the protection of bootloaders and system partitions. Now the process of obtaining superuser rights requires not just launching the application, but a deep understanding of the architecture Android and consistent implementation of technical manipulations.
Nevertheless, the need for full access to the system has not gone away. Users still want to remove the preinstalled bloatware, install custom kernels to increase autonomy, or use specialized software for tweaking the interface. If you have in your hands a device released in 2017–2018, the chances of a successful modification are still very high, but the approach should be as careful and informed as possible.
In this material we will analyze modern methods that are relevant for most models of that period. We will not consider outdated kernel exploits that have already been covered by security patches, but will focus on the method of unlocking the bootloader and using the tool Magiskthat has become the de facto industry standard.
Device preparation and data backup
Before starting any manipulations with system partitions, it is critical to save all important information. The bootloader unlocking procedure, which is a mandatory step for most modern phones, results in a complete factory reset. You will lose contacts, photos, messages and application settings if you do not make a backup in advance.
Use the built-in synchronization tools with the cloud Google Drive or create a full local copy on your computer via ADB backup. It is also worth checking the functionality of the memory card, since some methods require saving files on external media. Make sure that the battery charge is at least 60% so that the device does not turn off at the most critical moment of flashing the recovery firmware.
⚠️ Attention: Unlocking the bootloader will automatically void the device warranty in most service centers. In addition, this procedure irreversibly erases all user data from the internal storage.
After saving the data, you must enable developer mode. To do this, go to Settings → About phone and quickly click on the item Build numberseven times. After the message “You have become a developer” appears, go to the new menu For developers and activate items Factory unlocking (or OEM Unlocking) and USB debugging. Without completing this step, further actions are impossible.
☑️ Ready for rooting
Bootloader Unlock
The bootloader is a app that runs before the operating system starts and verifies the digital signatures of loaded components. In 2018, most vendors blocked the ability to install unsigned images, which made it impossible to install custom recovery without first unlocking it. The process differs depending on the brand.
For devices with pure Android or close to it (for example, Nexus, Pixel, some models Motorola and OnePlus) the procedure is performed through Fastboot. Connect the phone to the computer, put it into bootloader mode (usually by holding the volume down and power buttons) and run the command in the terminal:
fastboot oem unlockA warning will appear on the smartphone screen about data loss and the need to confirm with the volume buttons. Once confirmed, the device will reboot and perform a reset. For phones Sony, HTC and Huawei (models before the ban) often required obtaining a unique unlock code on the manufacturer's official website, which added an additional step to the procedure.
The situation with Samsung has its own characteristics. Instead of command oem unlock in mode Download Mode (holding volume down, up and connecting the cable), you need to hold the volume up button to confirm unlocking. This action also triggers the counter, which permanently disables some protected features such as Samsung Pay and Secure Folder, even if you return the stock in the future. Knox, which permanently disables some secure features like Samsung Pay and Secure Folder, even if you return the stock in the future.
What is OEM Unlock in the settings?
OEM Unlocking item in the menu developer is a software switch that allows the bootloader to accept unlock commands from outside. If this item is missing or inactive, the manufacturer may have blocked this feature at the firmware level or the device may be locked to a carrier. In this case, obtaining root access using standard methods is impossible.
Installing custom TWRP recovery
The standard recovery menu (Stock Recovery) has extremely limited functionality and does not allow installing third-party ZIP archives or making full system backups. To obtain root access, we will need to replace it with TWRP (Team Win Recovery Project). This modified recovery has touch controls and supports installing patches.
First you need to find an image twrp.imgthat is compatible specifically with your device model. Using a version for another smartphone may lead to the device becoming bricked. Place the downloaded file in the tools folder ADB on your computer. Switch your smartphone to Fastboot mode and enter the command to flash the image:
fastboot flash recovery twrp.imgAn important nuance for 2018 devices: immediately after flashing the firmware you cannot boot into a regular system, otherwise the stock recovery will overwrite TWRP. You must immediately hold down the combination of buttons (usually Volume Up + Power) to enter the installed recovery. If you accidentally booted the system, you will have to repeat the TWRP firmware procedure.
| Manufacturer | Login mode (Bootloader) | Unlock command | Features |
|---|---|---|---|
| Google Pixel / Nexus | Volume - + Power | fastboot flashing unlock |
Full data reset |
| OnePlus | Volume + Power | fastboot oem unlock |
On-screen confirmation required |
| Samsung | Volume - + Bixby + Power | Download Mode menu | Knox triggered, loss of warranty |
| Xiaomi | Volume - + Power | Via Mi Unlock Tool | Requires waiting 72-168 hours |
If after installing TWRP the menu is not displayed correctly or the sensor is not works, try to find the “Test Build” or “Beta” version for your model on the official XDA Developers forum.
Magisk installation method to get Root
The outdated one has been replaced by SuperSU came Magisk. Its main advantage is the “less modification” system. Magisk does not modify the system partition directly, but loads its modules when the system boots. This allows you to pass a security check Google SafetyNet, which is critical for the operation of banking applications and games with protection from cheats.
The installation process is as follows: download the latest version Magisk.apk (or rename .zip to .apk to install as an application) and copy the file to your phone. Boot into TWRP, press the Installbutton, select the Magisk file and swipe to confirm the firmware. After rebooting, the Magisk Manager application will appear on the system.
In some cases, especially on devices with data encryption, installation via ZIP may not work. Then the image patching method is used boot.img. You need to extract the boot partition image from the stock firmware, open it through the Magisk application on your phone (button Install → Patch Boot Image), and then flash the resulting file patched_boot.img through the computer with the command:
fastboot flash boot patched_boot.imgThis method is more complex, but it guarantees compatibility even on devices with strict integrity checks. After successful installation in the Magisk application, the version will be displayed in the "Magisk" line, and the "SafetyNet" status should turn green, which confirms the presence of superuser rights and hiding modifications.
Alternative methods and one-click utilities
Despite the dominance of the bootloader unlocking method, for some 2018 devices there are still exploits that allow you to gain rights without erasing data. Utilities like KingRoot, iRoot or Towelroot try to exploit vulnerabilities in the system kernel. However, their effectiveness in 2018 was already very low due to security updates for Android 7 and 8.
The use of such apps carries additional risks. Since many of them are closed source, you have no way of knowing what exactly is going on with your data in the background. Often such applications install their own services, which are difficult to remove even after receiving rights. In addition, antivirus apps almost always detect them as potentially unwanted software.
If your device runs on a processor MediaTek, sometimes you can use the utility SP Flash Tool to flash a modified recovery or boot image without unlocking the bootloader in the classical sense. This method requires precise selection of the scatter file and is extremely dangerous: an error in memory addresses can turn the phone into a “brick”, which can only be restored by the programmer.
⚠️ Attention: One-click apps often require an Internet connection and sending data to a remote server to select an exploit. Use them only on a device where there is no important confidential information.
Possible problems and ways to solve them
The rooting process rarely goes perfectly smoothly the first time. One of the common problems is “bootlap” (cyclic reboot). This can happen if the Magisk version is not compatible with the Android version or kernel. In this case, you need to go into TWRP and delete the installed Magisk ZIP file or restore the backup bootmade before the firmware.
Another common situation is Wi-Fi or Bluetooth not working after obtaining root access. This is a consequence of damage to partitions persist or modem due to incorrect actions. Recovery requires flashing the modem's stock image via Fastboot. Users may also experience that banking applications stop launching.
To solve the problem with banks in the Magisk application, you need to enable the function Magisk Hide (in new versions it is called Zygisk and requires setting up an exception list). Add banking application packages to the hidden list, clear the data of these applications, and reboot your device. Sometimes you need to rename the Magisk manager package to hide its presence from detectors.
The most common reason for failure is a mismatch between the TWRP or Magisk version of a specific firmware build. Always check compatibility on the developer forum before starting work.
FAQ: 2018 Root FAQ
Does the warranty become void after you obtain root access?
Yes, in most cases, unlocking the bootloader, which is required to obtain rights, will officially void the warranty manufacturer. Some brands, for example OnePlus or Xiaomiare more loyal to this, but Samsung and Huawei may refuse free repair if traces of interference in the software are detected.
Is it possible to completely remove Root and return it? phone to its original state?
Yes, this is possible. The Magisk app has a "Full uninstall" button that removes permissions. However, if you have unlocked the bootloader, the Knox counter (on Samsung) has already been triggered and cannot be reset. To completely return to stock, you will need to flash the official firmware and re-lock the bootloader with the command fastboot oem lock.
Is it safe to use banking applications with root access?
The modern Magisk method allows you to hide the presence of rights from most applications. If configured correctly Magisk Hide or Zygisk, banking applications will work correctly and consider the system clean. However, the risk of theoretical data interception in the presence of vulnerabilities in the system remains higher than on a stock device.
What to do if the phone does not turn on after flashing TWRP?
Try to enter Download mode (for Samsung) or Fastboot (for others) and flash the stock image boot.img or recovery.img from the official firmware. If the device does not respond to buttons, a service center may need to intervene to reprogram the memory.
Will the phone slow down getting root access?
The mere presence of superuser rights does not slow down the system. On the contrary, the ability to remove system junk and install optimizing kernels often improves performance. Slowdown is possible only if low-quality modules are installed or software conflicts.