root access on Android: how to unlock the superuser without the risk of bricking your phone

Receiving root-rights on Android opens access to hidden functions of the system, but turns the smartphone into a “wild territory”, where each step can either improve performance or permanently disable the device. This instruction will not only tell how to get root, but also explain why 80% of users abandon the idea after the first bad experience - and how you can avoid this.

In 2026, the process became more complicated: manufacturers tightened protection, and old methods like KingRoot or Framaroot stopped working on new firmware. We will analyze current methods for Samsung Knox, Xiaomi HyperOS, Google Pixel and other popular brands, and also show you how to check the compatibility of your device before begin manipulation. Without “magic buttons” - only technical details and warnings about pitfalls.

What are root access and why you need them in 2026

root access (or rights superuser) are an analogue of administrator access in Windows, but for Android. They allow:

• 🔧 Remove built-in applications (bloatware) that cannot be uninstalled using standard methods (for example, com.sec.android.app.launcher on Samsung).
• ⚡ Overclock the processor/GPU or, on the contrary, lower frequencies to save battery (through kernels like FrancoKernel).
• 📱 Install custom firmware (LineageOS, Pixel Experience) with current versions Android on old devices.
• 🔒 Block advertising at the system level via AdAway or Blokada.
• 🔄 Make a full backup of the system (including application data) using TWRP or OrangeFox.

However 9 out of 10 users lose the warranty after receiving root access, and 30% of devices with an unlocked bootloader become vulnerable to attacks through exploits like DirtyCow or StagefrightManufacturers seem to be Samsung or OnePlus actively fighting root: on new models (for example, Galaxy S24 Ultra or OnePlus 12) a hardware lock is triggered RMM State, which can return the device to a “bricked” state after a reboot.

⚠️ Attention: On devices with Android 14+ chips Snapdragon 8 Gen 3/Exynos 2400 some root methods (for example, via Magisk) require disabling AVB 2.0 in the bootloader. Without this, the system will boot into fastboot with an error dm-verity verification failed.

Preparing the device: 5 mandatory steps before rooting

Before getting root, you need to prepare the phone - otherwise the risk of turning it into a “brick” increases 3 times. Follow this checklist:

Unlock OEM Unlock in the developer settings

Make a full backup of data on a PC or cloud

Check the processor model (Snapdragon/Exynos/Mediatek)

Download the correct version of Magisk (for Android 13/14 - 26.4+)

Install ADB/Fastboot drivers on your computer-->

Activate first developer mode: go to Settings → About phone → Build number and tap on it 7 times. Then in the menu that appears For developers turn on:

• 🔓 OEM Unlock (unlocking the bootloader).
• 🖥️ USB debugging.
• 🔄 Network unlocking (if available).

For devices Samsung you will additionally need to disable Auto Reboot in Download Mode (hold Vol Up + Vol Down when connecting to a PC). (policy Xiaomi need to link account Mi to the device and wait 7 days (policy Xiaomi Anti-Rollback).

⚠️ Attention: On some models Realme and Oppo (for example, Realme GT 6 or Oppo Find X7) unlocking the bootloader erases IMEI. You can restore it only through a service center - keep this in mind!

Ways to obtain root access in 2026: what works and what does not

Methods for obtaining root are divided into 3 categories: through custom recovery (TWRP), direct firmware (Magisk), and exploits (for older devices). Let's consider each taking into account current limitations.

Method	Suitable devices	Complexity	Risks
Magisk (patched boot.img)	Google Pixel, OnePlus, Xiaomi (without Anti-Rollback)	Average	Loss of OTA updates, triggered SafetyNet
TWRP + Magisk	Samsung (up to Galaxy S22), Sony Xperia, Moto G	High	Risk of brick with incorrect firmware recovery
Exploits (DirtyPipe, CVE-2023-21036)	Devices on Android 10-12 with unupdated kernel	Low	Temporary root, requires restart after reboot
KingRoot/iRoot	Device up to Android 8 (for example, Samsung Galaxy J5 2017)	Low	Installing backdoors, blocking with banking applications

The most reliable way today is firmware Magisk via a modified boot.img. To do this:

1. Download the stock firmware for your model from the website. manufacturer (for example, SamFW for Samsung).
2. Extract boot.img from the archive (use 7-Zip or Payload Dumper for .ozip/.payload.bin).
3. Open Magisk App, select Install → Select and Patch a File and specify boot.img.
4. Flash the received magisk_patched.img via fastboot:

   fastboot flash boot magisk_patched.img
   fastboot reboot

Never tried|KingRoot/iRoot|Magisk|TWRP+SuperSU|Other-->

Root on Samsung: bypassing Knox and RMM State

Devices Samsung are the most difficult to root because of the system Knox and protection RMM StateEven after successful rooting, some functions (for example, Samsung Pay or Secure Folder) will stop working, and the counter Knox will work on 0x1, which will void your warranty.

For models Galaxy S23/S24 and newer you will need:

1. Unlock the bootloader via Odin (file BL from the stock firmware).
2. Flash TWRP for your model (for example, twrp-3.7.0_9-0-d2xq.tar for Galaxy S23+).
3. Install Magisk to section recovery (not boot!) to bypass AVB 2.0.
4. Disable dm-verity via module Magisk Universal SafetyNet Fix.

On Samsung s Exynos (for example, Galaxy S22 Ultra Exynos) you can use an alternative method via Shizuku + ADB, but it only gives a temporary root until a reboot.

What will happen if you do not disable RMM State?

If you do not reset RMM State (via Odin or Combination Firmware), after rebooting the device will freeze on the logo Samsung s error Only official released binaries are allowed to be flashed. This can only be corrected by a complete flashing via Download Mode.

Root on Xiaomi, Redmi and POCO: the fight against Anti-Rollback

Xiaomi uses a system Anti-Rollback (ARB), which blocks the firmware of older versions. data-i="185">or custom recovery. On models MIUI or custom recovery. On models Redmi Note 13 Pro+ or POCO F6 when you try to flash TWRP you will receive an error Anti-rollback check fail.

Workaround:

1. Unlock the bootloader via (requires account linking and waiting 7 days). data-i="196">Install Mi Unlock Tool (requires account linking and waiting 7 days).
2. Sew fastboot-firmware with disabled ARB (look for versions marked ARB Disabled on XDA Developers).
3. Install OrangeFox Recovery (supports HyperOS better than TWRP).
4. Flash Magisk to section init_boot (for Android 13+):

   fastboot flash init_boot magisk_patched.img

For devices on Mediatek (for example, Redmi 12) an additional shutdown may be required SLA (Secure Boot) via SP Flash Tool.

What to do after obtaining root access: setup and security

After successful root you need to:

1. Install Magisk Manager and check the root status in the section Superuser.
2. Disable automatic check for updates (it can overwrite modified files).
3. Configure MagiskHide to bypass SafetyNet (required for Google Pay, Netflix HD).
4. Create a backup EFS (for Samsung) or modemst1/modemst2 (for Mediatek) - this will save IMEI in case of failures.

Useful modules for Magisk:

• 🔒 Universal SafetyNet Fix — undergoing certification SafetyNet.
• 🎮 Game Turbo Mod — overclocking the GPU for games.
• 📵 Disable Flag Secure — allows you to take screenshots in protected applications.
• 🔋 Battery Charge Limit — limits the battery charge (for example, to 80%).

To check the functionality of the root, use the commands:

su
id

If the response shows uid=0(root), then the root is active. To check SafetyNet run:

adb shell su -c "snet check"

Typical errors and how to fix them

Errors when obtaining root are divided. on software (fixable) and hardware (require repair). Let's consider the first ones:

Error	Cause	Solution
fastboot: error: Cannot generate image for userdata	There is not enough space in the partition userdata or damaged fstab	Flash stock firmware via Odin/SP Flash Tool
Magisk: Installation failed: Invalid boot image header	Wrong version Magisk or damaged boot.img	Download Magisk Delta (fork with support for new devices)
Stuck on the logo after flashing TWRP	Incompatible version recovery or enabled dm-verity	Flash disable_dm-verity_forceencrypt.zip via ADB Sideload
Knox 0x1 on Samsung	Protection triggered when unlocking the bootloader	Uncorrectable (only replacing the motherboard)

If the device does not turn on (the so-called soft brick), try:

1. Press Vol Down + Power to enter Download Mode/Fastboot.
2. Flash the stock firmware via Odin (for Samsung) or fastboot (for Pixel/OnePlus).
3. If that doesn’t help, use EDL Mode (an authorized account is required Qualcomm).

⚠️ Attention: On devices with Android 14 and Dynamic Partition (for example, Google Pixel 8) incorrect firmware boot.img can lead to the loss of the partition super. It can only be restored through fastboot enhance with a complete repartition. memory.

FAQ: Answers to frequently asked questions about root access

Is it possible to get root without unlocking the bootloader?

On most devices - no. The exception is older models (up to Android 9), where exploits work. like DirtyCow or TowelRoot. On new smartphones (for example, Samsung Galaxy S24 or Xiaomi 14) without unlocking the bootloader it is impossible to get root due to hardware protection (AVB 2.0, RMM State).

How to hide root from bank accounts applications?

Install Magisk modules:

• MagiskHide Props Config - changes the device fingerprint.
• Universal SafetyNet Fix - passes verification SafetyNet.
• Shamiko - hides the root from applications using rootBeer or RootChecker.

Also enable MagiskHide in the settings and add banking applications to the list of hidden ones. For SberBank Online you may need to additionally change the property ro.build.tags to release-keys.

Is it possible to update Android after receiving root?

Yes, but only manually.. Automatic OTA updates will overwrite the modified files and the device will stop booting. To update:

1. Download the full stock firmware for your model.
2. Extract boot.img and patch it via Magisk.
3. Flash the update via TWRP or fastboot, then flash the patched boot.img.

On Samsung this will require disabling VBMeta via Odin (file vbmeta_disabled.tar).

How to remove root and return the warranty?

For complete removal of root:

1. Remove Magisk via Magisk Manager (option Uninstall → Complete Uninstall).
2. Flash stock boot.img via fastboot:

   fastboot flash boot boot.img
   fastboot reboot

3. On Samsung additionally flash the stock firmware via Odin with the flag Re-Partition.
4. To reset the counter Knox you will need a service center (officially this is impossible).

The guarantee cannot be returned if it has been unlocked bootloader (on Samsung checked by Knox, on Xiaomi by status BL Unlock).

Does root work on Android 14/15?

Yes, but with reservations:

• On Google Pixel 8/Samsung Galaxy S24 required Magisk Delta (fork with support init_boot).
• On Xiaomi HyperOS you need to flash Magisk to the section init_boot, and not boot.
• Some functions (for example, MagiskHide) may not work due to tightening SELinux.

For Android 15 (Developer Preview) root is only possible on Google Pixel via fastboot boot with patch init_boot.