Rooting Android 6.0: Step-by-Step Guide

Users of devices based on the operating system Android Marshmallow often face limitations that do not allow them to unlock the full potential of their gadgets. The desire to remove software pre-installed by the manufacturer, fine-tune energy saving, or use specialized utilities for deep memory cleaning pushes many to obtain superuser rights. This process requires care, but the result often exceeds expectations, turning an ordinary smartphone into a powerful tool under the full control of the owner.

It is important to understand that rooting Android 6.0 differs from procedures on more recent versions of the system in the presence of specific vulnerabilities and methods of bypassing protection SELinux. While modern methods rely on patching the boot image via Magisk, for the sixth version both classic exploits and modified_recovery_images are relevant. Before starting any manipulations, you need to understand the risks: loss of warranty and possible software failure are real threats if done incorrectly.

This article is a set of proven techniques relevant to the processor architecture of that time, including Snapdragon, MediaTek and Exynos. We will consider not only the technical steps, but also the preparation of the device, which is often ignored by beginners, leading to unpleasant consequences. Are you ready to take responsibility for your device?

⚠️ Attention: You perform all the actions described below at your own peril and risk. The author of the article is not responsible for turning your device into a “brick” or loss of personal data.

Device preparation and backup

Before tampering with system partitions, it is critical to create a complete backup of all significant data. obtaining root access Root to Android 6.0 in most cases means resetting the settings to factory settings (Wipe Data), which will permanently delete contacts, messages and installed applications. Use Google cloud services or specialized software on your PC to save information.

The next mandatory step is to activate developer mode. To do this, go to the menu Settings → About phone and click seven times in a row on the item Build number. After a notification appears that you have become a developer, go to the new section For developers and activate the item USB debugging. Without this step, the computer will not be able to send the necessary commands to the smartphone through the interface ADB.

Also make sure that the battery level is at least 60-70%. The process of flashing or installing a custom recovery consumes a significant amount of energy, and suddenly turning off the device at a critical moment can disrupt the file system structure. Connect your phone to a reliable power source or keep it on charge during the preparatory stages.

Unlocking the bootloader

The bootloader (Bootloader) is a app that runs before the operating system and checks software signature integrity. On most devices, it is blocked by the manufacturer, which prevents the installation of modified recovery images required to gain root access. The unlocking procedure varies depending on the brand of your smartphone.

For processor-based devices MediaTek utilities like SP Flash Tool or special scripts that exploit communication protocol vulnerabilities are often used. Devices Samsung require switching to mode Download Mode and using the utility Odin to flash unlocked recovery. Owners Xiaomi and Huawei are forced to go through official procedures for obtaining an unlock code through the manufacturer's servers, which can take from several days to a week.

The command for unlocking via Fastboot is as follows, but it only works if the manufacturer provides this option:

fastboot oem unlock

Or a newer version of the command for some devices:

fastboot flashing unlock

After entering the command, a warning about loss of warranty and data deletion will appear on the smartphone screen. Confirm the action with the volume buttons. The device will reboot and all user data will be erased. This is a necessary security measure on Android's part.

What to do if the Fastboot command does not work?

If the console displays the error "command not allowed" or similar, then the manufacturer has completely closed the possibility of software unlocking. In this case, all that remains is hardware methods (Test Point) or searching for specific exploits for a specific model, which is much more difficult and risky.

Installing custom Recovery (TWRP)

The standard recovery menu (Stock Recovery) has extremely limited functionality and does not allow installing unsigned zip archives required for rooting. Therefore, it needs to be replaced with a custom solution, the most popular of which is TWRP (Team Win Recovery Project). This tool provides a convenient touch interface and access to all memory sections.

To install, you will need to find an image .img, designed specifically for your smartphone model and version of Android 6.0. Using an image from a different model or a different firmware version is guaranteed to cause the device to malfunction. Place the downloaded file in the tools folder ADB on your computer for convenience.

Switch your smartphone into mode Fastboot (usually by holding the volume down button and the power button) and connect it to the PC. Enter the following instructions on the command line to temporarily download the recovery without permanently flashing it:

fastboot boot twrp-3.x.x-x-model.img

If the download was successful, you will see the TWRP touch menu. From here you can make a full backup of the current system (Nandroid Backup), which is the best insurance. For permanent installation, use the command fastboot flash recovery twrp-3.x.x-x-model.img, but be careful: on some devices, the stock recovery may be automatically restored the first time you boot into the system.

⚠️ Attention: On devices with data encryption (Encryption), TWRP may not see the internal memory. In this case, you need to format the data (Format Data) inside the recovery menu by entering the word “yes”. This will delete all files forever!

Methods for obtaining root access on Android 6.0

There are two main approaches to obtaining superuser privileges on this version of the system: using kernel vulnerabilities (exploits) and installing a patched boot image via Magisk. The first method is simpler to implement, but less stable, the second is more modern and reliable, but requires an unlocked bootloader.

For the method with exploits, applications like KingRoot or iRootwere often used. They install as regular APK files and try to exploit a known set of vulnerabilities to inject a binary file su into the system partition. The effectiveness of this method on Android 6.0 is still high, however such applications often contain advertising modules and can transmit telemetry.

A cleaner and recommended method is to use Magisk. You need to download the Magisk installation zip (Android 6 compatible version, such as 20.x or 21.x) and place it on your memory card or internal storage. In the TWRP menu, select Install, select the archive and swipe to confirm the installation. The script will automatically modify the boot image and install the rights manager.

• 📂 KingRoot: Automatic installation of rights without a PC, but with the risk of having unnecessary software.
• 🛡️ Magisk: Systemless-root, which allows you to hide rights from banking applications and pass SafetyNet.
• ⚙️ SuperSU: A classic solution that still works on Android 6.0 stable, but the project is officially closed.

After installation and reboot, a new application will appear on the system. If it's Magisk, open it and wait for the advanced setup to complete ("Advanced Setup"). The device may reboot again. The presence of a superuser icon in the list of applications confirms the success of the operation.

Checking rights and setting up access

After a successful procedure, it is necessary to verify the presence of superuser rights. Download the utility Root Checkerfrom the application store. Launch it and click the check button. If you see a green icon and a message indicating that access has been granted correctly, then the binary file su is working properly.

It is important to configure rights request management. The first time you launch an application that requires elevated privileges, a pop-up window from the root manager (Magisk or SuperSU) will appear on the screen. Read carefully which application is requesting access. Never grant rights Root to unknown apps or those whose necessity you doubt, as this gives them complete control over the system.

In the root manager settings, you can enable notification mode or automatic refusal for new applications. This adds an extra layer of security. Also available in Magisk is the "Settings" section, where you can activate the "Zygisk" function (on newer versions) or "Magisk Hide" to hide the root from specific applications, although on Android 6.0 the hiding mechanisms work differently than on newer versions.

Possible problems and ways to solve them

The rooting process rarely goes perfectly smoothly on all devices. Users may experience cycling (Bootloop), where the smartphone constantly reboots without booting the system. This is often due to a conflict between the modified kernel and stock firmware or an error when installing a ZIP archive.

If you get into a bootlap, first try booting into Recovery mode and clearing the cache (Wipe Cache Partition). If this does not help, you will have to restore the system from a previously made Nandroid backup or flash the stock image via Fastboot/Odin. Having an unlocked bootloader in this case is a salvation, allowing you to bring the device back to life using software methods.

Another common problem is the disappearance of rights after a reboot. This is typical for methods with exploits that are not written to permanent memory, but exist only in operational memory until the next reboot. There is only one solution - switch to a method with modification of the boot image via TWRP and Magisk, which guarantees the preservation of rights between reboots.

Problem	Probable cause	Solution
Bootloop (cyclic reboot)	Kernel conflict or broken firmware file	Entering Recovery → Wipe Cache / Restore Backup
No root access after reboot	Temporary used exploit	Flashing via TWRP with a permanent patch
The computer does not see the device in Fastboot	Missing drivers or bad cable	Installing universal ADB drivers / Replacing the cable
Banking applications do not work	Root access detected	Using the hide function in Magisk settings

⚠️ Attention: Recovery interfaces and menu item names may vary slightly depending on the version of TWRP and the specific device model. Always check the documentation for your gadget.

Security and further operation

Obtaining superuser rights removes many software restrictions, but at the same time reduces the level of security of the device. Malware that gains access to Root can cause significantly more damage than in a normal environment. Be extremely careful when installing applications from unverified sources and do not grant access rights without a good reason.

Regularly update the root manager (Magisk/SuperSU), as developers close vulnerabilities and improve hiding mechanisms. However, remember that on Android 6.0, support for many modern security features has already been discontinued by the developers of the OS itself, so rooting such a device carries slightly greater risks than rooting a recent model.

If you plan to sell the device or give it to another person, be sure to perform a complete wipe. A simple reset may not be enough if there are traces of modification left in the boot image. The best way is to reflash the device to stock firmware and lock the bootloader back, if possible.

Is it possible to update the system over the air (OTA) after rooting?

As a rule, no. Modifying the system partition or boot image violates the digital signature, and the update server will refuse installation. You will have to update manually by downloading the firmware and installing it via Recovery, after which the rooting procedure will have to be repeated.

Will rooting remove the warranty on my device?

In most cases, yes. The fact of unlocking the bootloader and changing the system software is grounds for denial of warranty service. Some manufacturers allow you to reflash the stock version and lock the bootloader back, which can hide traces of tampering, but physical tags (triggers) inside the case sometimes detect tampering.

Will banking applications work after receiving Root?

By default, many banking applications and services like Google Pay (at the time Android 6 is current) stop working when they detect permissions superuser. However, using Magisk and its hiding function (Magisk Hide) in most cases allows you to bypass this check and use applications in normal mode.

What is a “brick” and can it be restored?

“Brick” is a slang name for a device that does not show signs of life or does not boot. A software “brick” (soft brick), when the phone is stuck on the logo, can almost always be restored through Recovery or Fastboot mode. A hardware “brick” (hard brick), when the device does not respond to buttons and charging, requires repair at a service center.

Do you need a computer to root Android 6.0?

Not always. There are one-click methods by installing APK files directly on your smartphone. However, the most reliable and secure method using custom recovery TWRP and Magisk requires a PC to send commands through the Fastboot and ADB interface.