Obtaining superuser rights, or so-called root accessopens up unlimited possibilities for the smartphone owner that were initially blocked by the manufacturer. This allows you to remove system applications, install specific software for deep system customization, overclock the processor, and even change the device firmware to a completely custom one. However, this process is not trivial and requires the user to have a certain technical literacy, as well as a willingness to accept the risks of loss of warranty and data.
In the modern world Android system protection has increased significantly, and simple “one-button” methods of gaining access, popular in the era of Android 4.0–6.0, have practically disappeared. Now the procedure for obtaining privileges superuser is inextricably linked with unlocking the bootloader and using specialized tools like Magisk. You will have to deal with the command line, drivers and complex manipulations with the device's memory sections, which makes the process a critical step.
On the other hand, why do you need to interfere with the operation of the operating system if it functions stably out of the box? The answer lies in the desire for complete control over your device. Blocking ads at the system level, creating complete backups of applications with their data, using powerful firewalls and interface tweaks - all this becomes available only after performing specific actions to modify the system.
Preparation of the device and risk assessment
Before embarking on any manipulations, you must clearly understand the consequences. obtaining root access root automatically voids the device warranty in most service centers, as the integrity of the software is compromised. In addition, incorrect actions can turn your smartphone into a “brick” - a device that shows no signs of life and requires complex repairs through the programmer.
Particular attention should be paid to data security. The process of unlocking the bootloader, which is a mandatory step, often initiates a full factory reset of the device. This means that all your photos, contacts and messages will be permanently deleted unless you make a backup in advance. Google deliberately implemented this security mechanism to make it more difficult to steal data from a locked phone.
⚠️ Attention: Some banking applications and contactless payment services (for example, Google Pay or Mir Pay) may stop working on a rooted device due to SafetyNet or Play Integrity API security mechanisms. Although there are methods to bypass this blocking, they require constant updating and do not guarantee 100% success.
You will also need a computer with an operating system Windows, macOS or Linux, a working USB cable (preferably original) and a fully charged smartphone battery (at least 60-70%). An unstable connection or a sudden power outage at a critical moment of the firmware can lead to damage to the boot partition boot.img.
Unlocking the bootloader
The first and most important step is to unlock the bootloader. A bootloader is a small app that runs before the operating system and verifies the digital signature of the software being loaded. By default, it is blocked by the manufacturer to prevent the installation of unsigned system images. Without unlocking it, setting rights superuser is impossible.
The unlocking procedure is unique for each manufacturer. Devices from Xiaomi require a special utility Mi Unlock Tool and linking the account to the device for a period of 7 to 168 hours. Smartphones Pixel i OnePlus allow you to do this through the command fastboot flashing unlock in bootloader mode. At the same time, devices from Samsung require switching a special flag in the developer settings and confirming the action by pressing a key combination, which also erases all data.
What is OEM unlocking?
This is an option in the "For Developers" menu that allows the execution of bootloader unlocking commands via Fastboot. If this item is missing or inactive, unlocking on this device is impossible without using paid software bypass methods, which are often unreliable.
After enabling the option OEM unlocking in the menu Settings → For developers, you need to switch the phone to mode Fastboot (usually by pressing the volume down button and the power supply when the device is turned off). Having connected the smartphone to the PC, you enter the command in the terminal:
fastboot oem unlockor a more modern variation:
fastboot flashing unlockA data loss warning will appear on the device screen, which must be confirmed with the volume buttons. Once confirmed, the device will reboot and perform a reset. Now the bootloader is unlocked, and you can write modified images to the download section.
⚠️ Attention: On devices of some telecom operators (carrier versions), unlocking the bootloader may be completely blocked at the hardware level. Before purchasing a smartphone for modifications, be sure to check the model for such restrictions.
Installing custom recovery and patching the image
The modern standard for obtaining root access is the use of a tool Magiskdeveloped by Topjohn (John Wu). Unlike older methods that modified the system partition directly (systemless root), Magisk patches the boot image, leaving the system partition untouched. This increases the chances of successfully passing security checks.
First, you need to download the official application Magisk in APK format and rename the file extension to .zip (or simply extract the contents). Then you need to find an exact copy of the stock boot image boot.img for your specific firmware version. It can be extracted from the full firmware (ROM) downloaded from the manufacturer's official website, or extracted from an already installed update through an application for creating backups.
☑️ Preparing an image for the patch
The algorithm of actions inside the application is as follows:
- 📱 Launch the application Magisk on your smartphone.
- 🔧 Click the "Install" button in the Magisk block.
- 📂 Select the "Select and patch" method file" and specify the path to
boot.img. - ⏳ Wait for the process to complete, after which the file will appear in the downloads folder
magisk_patched_[random].img.
The resulting patched file must be copied back to the computer in the folder with tools ADB i Fastboot. Next, the phone is switched back to Fastbootmode. The command for writing a modified image looks like this:
fastboot flash boot magisk_patched.imgIt is important to note that on devices with the architecture A/B (seamless updates), which are typical for many modern models Pixel, Xiaomi i OnePlus, the command may differ or require specifying a slot. In some cases, it is necessary to flash the image into both slots: fastboot flash boot_a and fastboot flash boot_b.
If after flashing the phone the phone goes into an endless reboot (bootloop), try going into Recovery mode and doing wipe cache/dalvik. If this does not help, you will have to return the stock boot.img via Fastboot.
Alternative methods and old utilities
Although the c Magisk method is the gold standard, there are other methods that may be relevant for specific devices or older versions. Android. Utilities like KingRoot, KingoRoot or OneClickRoot try to use vulnerabilities in the system kernel to gain privileges without unlocking the bootloader.
These methods work on the principle of an exploit: they find a “hole” in the security of the OS and inject a binary file there su. However, on modern versions Android (starting from 9.0 and higher), such vulnerabilities are quickly closed by security patches, making these apps useless. Moreover, using unverified software from unknown Chinese developers carries a high risk of introducing malicious code or spyware into your system.
For processor-based devices MediaTek there is a tool MTKClient, which allows you to gain access rights and unlock the bootloader even without OEM unlocking enabled, using vulnerabilities in the preloader protocol. This is a powerful tool, but it requires caution as improper use can change the device identifier (IMEI), which is illegal in many countries.
The table below shows a comparison of the main methods for obtaining root access:
| Method | BL unlock required | Security data | Relevance |
|---|---|---|---|
| Magisk (Patch Boot) | Yes | Reset data when unlocked | High (Android 14+) |
| KingRoot / OneClick | No | Data are saved | Low (up to Android 8) |
| MTKClient (Brom Mode) | No (bypass) | Data is saved | Medium (MediaTek only) |
| Custom Recovery (TWRP) | Yes | Reset data when unlocked | High |
Privilege check and basic configuration
After successfully rebooting the device with the patched image, you should see the application icon Magisk in the menu. If it is not there, install the APK file manually. When you first launch the application, you may request additional configuration or a reboot. The presence of an icon does not guarantee full functionality, so verification is required.
Download the application Google Play application Root Checkerfrom the store. Launch it and click the “Check permissions” button. If you see a green screen with a congratulations message, then the binary file su has been correctly integrated into the system and applications can request elevated privileges. In the manager itself Magisk you can configure the list of applications that are allowed to use root access, which is an important security element.
Zygisk and reboot the device. This will allow you to load modules that are embedded in the process Zygote —the ancestor of all processes in Android.
Possible problems and solutions
One of the most common problems is a cyclic reboot (bootloop). It occurs if the patched image boot.img is incompatible with the kernel version or was damaged during writing. In this case, you need to enter the mode again Fastboot and flash the original, stock bootloader image that you saved at the very beginning. This will return the phone to its original state, but without root access.
Another common problem is the lack of Internet or communication modules working after receiving rights. This may be due to a change in kernel parameters or a driver conflict. In such cases, resetting the network settings or reflashing the modem (if it is placed in a separate image) helps. It is also worth checking whether the firewall is blocking system processes, which sometimes happens when installing network tweaks.
⚠️ Attention: Menu interfaces and item names may differ depending on the version of Android and the manufacturer’s shell (MIUI, OneUI, ColorOS). Always check the official documentation for your specific device before entering commands.
If you accidentally deleted a critical system application through a file manager with root access, you can restore the system only through a full reset (Wipe Data) in Recovery mode or flashing the device through official utilities (for example, Odin for Samsung or SP Flash Tool for MediaTek).
The key to success is an exact match between the firmware versions and the boot image. Using boot.img from another version of Android is guaranteed to result in a boot error.
Frequently asked questions (FAQ)
Is it possible to get root access without unlocking the bootloader?
On modern devices with Android 9 and higher, this is almost impossible, except for rare vulnerabilities (as is the case with MediaTek processors and BROM mode). Standard methods require mandatory unlocking of the bootloader, which entails resetting the data.
Will root hide from banking applications?
Yes, using the Zygisk function and the Hide My Applist module in Magisk, you can hide the fact that you have superuser rights from most applications. However, this is a constant battle between “shield and sword”, and after banking software updates, the settings may get lost.
Will Warranty Bit be deleted on Samsung after getting root?
Yes, the Knox counter (0x1) is triggered irreversibly the first time you try to modify the system partition or bootloader. This permanently disables the ability to use Samsung Pay, Secure Folder and some protected folders, even if you return the stock firmware.
Is it safe to delete system applications with root access?
Only if you know exactly the purpose of the package being deleted. Removing critical system components (for example SystemUI, Phone, Settings) will result in the device not working and the need for a complete flashing.
Is it possible to update Android over the air (OTA) with root access?
Usually no. The presence of a modified boot partition blocks the installation of OTA updates. To update, you need to temporarily return the stock image, install the update, and then patch the new boot.img again via Magisk.