Getting root access on Android opens access to hidden functions of the operating room systems, allowing you to remove system applications, optimize performance and install modified firmware. However, this process is fraught with risks - from loss of warranty to complete failure of the device. In 2026, rooting methods have evolved: manufacturers have tightened protection, but enthusiasts have found workarounds even for new chipsets. helps you choose a tool for a specific model (from Qualcomm Snapdragon 8 Gen 3 And Mediatek Dimensity 9300.

This article doesn't just list the steps - it explains working principles each stage, helps to choose a tool for a specific model (from Samsung Galaxy S24 to Xiaomi Redmi Note 13) and warns about common errors. We'll figure out why it may not work on some devices, how to bypass it on new firmware, and what to do if it stops working after rooting. Spoiler: there is a solution, but it requires additional manipulations with fastboot oem unlock may not work on some devices, how to get around it VaultKeeper on new firmware One UI 6.1, and what to do if it stops working after rooting Google Pay. Spoiler: there is a solution, but it requires additional manipulations with Magisk.

It is important to understand that the rooting process is individual. What works on Pixel 8 Pro with pure Android is not suitable for Realme GT 6 with shell Realme UI 5.0. Therefore, we have structured the material so that you can adapt the instructions to your device, taking into account the firmware version and the type of bootloader (AB or A/B).

What are root access and why you need them?

root access (from English root — “root”) are granted to the user superuser privileges in the system Android, similar to the administrator in Windows. With their help you can:

  • 🔧 Delete built-in applications (bloatware) uninstall using standard means (for example, Facebook or Samsung Knox on devices Galaxy).
  • ⚡ Optimize performance through the system kernel: overclock the processor, change the task scheduler or disable unnecessary background processes.
  • 📱 Install custom firmware (LineageOS, Pixel Experience) or modified kernels (FrancoKernel).
  • 🔒 Bypass manufacturer restrictions, for example, unlock hidden camera functions (as in GCam for Xiaomi).
  • 📡 Modify network settings: force enable VoLTE or 5G on uncertified devices.

However, along with opportunities come risks:

  • ⚠️ Loss of warranty: most manufacturers (including Samsung, Xiaomi and Google) will void the warranty if root access is detected. Some service centers may restore the warranty after rolling back the changes, but this is not guaranteed.
  • 🛡️ Security vulnerabilities: applications with root access can gain control of system files, which increases the risk of malware infection. For example, a Trojan exploits root access. for hidden installation of advertising modules. Triada exploits root access to covertly install advertising modules.
  • 🔄 Unstable operation: incorrect changes in system files can lead to bootloop (loop loading) or failure of individual functions (for example, Widevine L1 to view Netflix in HD).
⚠️ Attention: On devices with hardware protection. encrypted folders even after deleting root. Titan M2 (For example, Pixel 8) or Knox 3.8 (Samsung Galaxy S23 and newer) rooting can lead to irreversible triggering of the flag RPMBwhich blocks use Samsung Pay and encrypted folders even after root removal.

Preparing the device: unlocking the bootloader

The first and most critical step is unlocking the bootloader (bootloader). Without this, it is impossible to install a custom recovery (TWRP) or modified boot.img. The process differs depending on the manufacturer:

Manufacturer Unlocking method Features
Google Pixel fastboot flashing unlock Requires enabled OEM Unlock in developer settings. On new models (Pixel 8), you may need to link your account Google.
Xiaomi/Redmi/Poco Via Mi Unlock Tool You need to link your account Mi to the device and wait 7-14 days (on new firmware HyperOS the period may increase).
Samsung fastboot oem unlock + Odine On devices with Exynos a patched BL (bootloader) is required. For Snapdragonmodels (for example, Galaxy S24+) you need Combination Firmware.
OnePlus/Oppo/Realme fastboot flashing unlock_critical On new devices (for example, OnePlus 12) you need MSM Tool for full unlocking.

General unlocking algorithm:

  1. Activate Developer mode: go to Settings → About phone → Build number and tap on it 7 times.
  2. Enable OEM Unlock in the menu Settings → System → For developers.
  3. Connect the device to the PC, open cmd (or Terminal on Mac/Linux) and run:
adb reboot bootloader

fastboot flashing unlock

On some devices (for example Huawei or Honor) unlocking the bootloader is officially prohibited. In this case, unofficial methods will be required, such as exploits for Kirinprocessors or the use of DC-Unlocker (paid).

📊 What brand of smartphone do you plan to root?
Samsung
Xiaomi/Redmi/Poco
Google Pixel
OnePlus/Oppo/Realme
Other
⚠️ Attention: On devices with Dynamic Partition (all Android 10+), unlocking the bootloader resets the device to factory settings. Make a backup copy of your data via Titanium Backup or Swift Backup (root access is required, so you will have to make a copy after rooting on another device).

Choosing a rooting method: Magisk vs SuperSU

In 2026 Magisk remains the most popular tool for obtaining root access thanks to its support systemless root (does not affect the system partition, which allows you to pass SafetyNet). The alternative - SuperSU - is outdated and does not support new versions Android 14/15. However, even Magisk has limitations:

  • 🔹 Does not work on devices with AVB 2.0+ (for example, Pixel 7/8) without additional patches for vbmeta.
  • 🔹 On some firmware (ColorOS 14, MIUI 15) needs to be disabled dm-verity and forceencrypt manually.
  • 🔹 Samsung with One UI 6.1 needs a modified Magisk (for example, Magisk Delta) due to changes in init.rc.

For installation Magisk you will need:

  1. Download the latest version Magisk APK from the official GitHub (at the time of writing - v26.4).
  2. Patch boot.img via Magisk (instructions below).
  3. Flash the patched boot via fastboot or TWRP.

Alternative methods:

  • 📦 Custom recovery (TWRP): allows you to flash ZIP archives with Magisk or SuperSU. However, on new devices (Snapdragon 8 Gen 2/3) TWRP is often not supported due to changes in partition layout.
  • 🔧 Exploits: for example, DirtyPipe or CVE-2023-2136 for Android 13. Work without unlocking the bootloader, but require technical skills and may not support new kernels.

Download Magisk APK (v26.4+)

Extract boot.img from the firmware (via PayLoad Dumper or Firmware Extractor)

Patch boot.img in Magisk

Copy patched boot.img to PC

Make sure that ADB/Fastboot drivers are installed-->

Step-by-step guide: patch boot.img and install Magisk

This method is universal for most devices on Android 10–15You will need:

  • 🖥️ PC with Windows 10/11, MacOS or Linux;
  • 📱 Unlocked bootloader;
  • 🔌 Cable USB Type-C (preferably original);
  • 📂 Firmware for your model (download from SamMobile, Xiaomi Firmware Updater or Google Factory Images).

Step 1. Extracting boot.img

If you have official firmware in the format .zip (for example, for Pixel), extract boot.img from the archive. For devices Samsung (format .tar.md5) use 7-Zip or PayLoad Dumper:

python payload_dumper.py --output boot.img firmware.zip

Step 2. Patching boot.img in Magisk

  1. Install Magisk APK to the phone.
  2. Copy boot.img to the device memory.
  3. Open Magisk, press Install → Select and patch the file and specify boot.img.
  4. After patching the file magisk_patched.img will appear in the folder Download.

Step 3. Firmware patched boot.img

Connect the phone to the PC in mode fastboot and do:

fastboot flash boot magisk_patched.img

fastboot reboot

For devices with a partition boot_a/boot_b (for example, OnePlus 11) use:

fastboot flash boot_a magisk_patched.img

fastboot flash boot_b magisk_patched.img

What to do if fastboot does not see the device?

Make sure that USB debugging mode is enabled (Settings → For developers → USB debugging).

Install drivers Google USB Driver or Samsung USB Driver (for devices Samsung).

Try another cable or USB port (preferably USB 2.0).

On Windows disable driver signature: bcdedit /set nointegritychecks on (requires reboot).

⚠️ Attention: On devices with Dynamic Partition (for example, Xiaomi 13 Ultra) firmware only boot.img may not give root access. In this case, you will need to patch init_boot.img (for Android 12+) or flash Magisk via TWRP.

Checking root access and bypassing SafetyNet

After the reboot, check for root access using the application Root Checker or the command in Terminal:

su

If the command returns # instead of $ —root access is active. However, many applications (for example Google Pay, Pokémon GO or banking clients) block work on rooted devices due to SafetyNet. To bypass the check:

  1. Install the module MagiskHide Props Config via Magisk.
  2. In Magisk enable MagiskHide (renamed in Zygisk new versions).
  3. Add problematic applications to the hide list (Configure DenyList).
  4. For SafetyNet install the module Universal SafetyNet Fix.

Check the status SafetyNet in the application YASNAC or command:

su -c "snet check"

If ctsProfile returns false, try:

  • 🔹 Change the device fingerprint (fingerprint) to a certified one (for example, Pixel 6) via MagiskHide Props Config.
  • 🔹 Disable all modules Magisk and reboot.
  • 🔹 Use Magisk Delta with a patch for HardwareBacked Keystore (relevant for Android 13+).
💡

If contactless payments stop working after rooting, install a module Magisk called Ruru_Server_Magisk - it emulates a non-rooted environment for Google Pay and Samsung Pay.

Typical errors and their solutions

Even if you follow the instructions, problems may arise. Let's consider the most common ones:

Error Cause Solution
fastboot: error: cannot load 'magisk_patched.img' The file is damaged or in the wrong place format Repatch boot.img to Magisk or download the original firmware again
The device is loaded into bootloop Wrongly patched boot.img or module conflict Flash the original boot.img via fastboot flash boot boot_original.img
Magisk is not installed on Samsung Protection is active Knox or RMM State Use Magisk Delta + patch for lpm (or flash Combination Firmware)
adb: device unauthorized Access to USB debugging is not confirmed Confirm the request on the device screen or reinstall the drivers
Netflix does not work in HD Reset Widevine L1 to L3 Flash the original vendor or use the module Widevine L1 Certifier

For devices Mediatek (for example, Realme GT Neo 6) a typical error is BROM ERROR: SLA AUTH when attempt to unlock. Solution:

  1. Use MTK Bypass Tool to bypass Secure Boot.
  2. Flash preloader with signature verification disabled (risky!).
  3. For new chips (Dimensity 9000+) may be required Firehose Programmer.
⚠️ Attention: On devices with AVB 3.0 (for example, Pixel 8 Pro) the modified firmware boot.img without a patch vbmeta will lead to bootloop. Use the command:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

How to remove root access and return the warranty

If you need to return the device to a service center or sell it, you need completely remove traces of rooting. data-i="323">not enough - you need to: Magisk not enough - required:

  1. Flash the original boot.img (or init_boot.img for Android 12+).
  2. Restore vbmeta (if it was patched).
  3. For Samsung: reset the flag Knox via Combination Firmware + EFT Dongle (paid, ~$20).
  4. For Pixel: execute fastboot flashing lock (will block the bootloader).

Check the device status:

  • 🔹 On Samsung: in download mode (Download Mode), the flag RMM STATE: Prenormal should be absent.
  • 🔹 On Pixel: in fastboot check getvar all — line unlocked: yes should change to no.
  • 🔹 For Xiaomi: in Mi Unlock Tool the status should be Locked.

If the warranty is still not restored (for example, on Samsung with triggered Knox, you can try:

  • 🔹 Flash stock firmware via Odine (for Samsung) or Flash Tool (for Mediatek).
  • 🔹 Use Reset Knox Counter (does not work on all models).
  • 🔹 Contact an unofficial service for flashing EFS (risky!).
💡

Even after removing root, some functions (for example Samsung Pay or Secure Folder) may remain blocked due to hardware flags. Before rooting, make sure you are ready for this.

FAQ: answers to frequently asked questions

Is it possible? get root on Android 15?

Yes, but the process is more complicated due to the tightening SELinux i AVB 3.0. For Android 15 you will need:

  • 🔹 Patched Magisk (for example, Magisk Delta or KernelSU).
  • 🔹 Disabling dm-verity i forceencrypt in fstab.
  • 🔹 To Pixel 9 may need an exploit to bypass Titan M2.

On some devices (for example, Samsung Galaxy S25) rooting is only possible through init_boot, since boot.img is now signed with a hardware key.

Will Google Pay work after rooting?

Yes, but with with reservations:

  • 🔹 On Android 10–12 enough to enable MagiskHide and add Google Pay to DenyList.
  • 🔹 On Android 13+ required module Universal SafetyNet Fix + changing the device fingerprint to a certified one (for example, Pixel 6).
  • 🔹 On Samsung s One UI 5.0+ you need to additionally patch Samsung Attestation Key.

If Google Pay still doesn’t work, try:

  1. Delete all modules Magisk.
  2. Clear data Google Play Services.
  3. Use an alternative - Revolt or Curve.
How to root Samsung without a trigger Knox?

At the moment (2026), it is impossible to completely bypass the Knox trigger on new Samsung devices (Exynos 2400/Snapdragon 8 Gen 3 chips). However, there are ways to minimize the consequences:

  • 🔹 Use Magisk Delta with a patch for lpm —this will hide the root from some applications.
  • 🔹 Flash Combination Firmware before rooting - this reduces the risk of it triggering Knox on 0x0.
  • 🔹 For older models (Galaxy S20 and earlier) you can use KnoxGuard to reset the flag.

Important: even if Knox is not triggered, some functions (for example, Samsung Health or Secure Folder) may stop working.

What to do if the mobile network does not work after rooting?

This problem most often occurs on devices with Mediatek or Qualcomm due to damage modemst1/modemst2. Solutions:

  • 🔹 Flash the original modem and vendor partitions via SP Flash Tool (for Mediatek) or QFil (for Qualcomm).
  • 🔹 Check IMEI with command *#06#. If it is reset, restore it via Maui META (for Mediatek) or QCN (for Qualcomm).
  • 🔹 Install the module IMS Fix for Magisk (relevant for VoLTE/VoWiFi).

If the problem persists, try flashing the full stock firmware marked FRP Lock.

Is it possible to root the device without unlocking the bootloader?

Technically yes, but only on older devices (before Android 8) or through exploits Current methods in 2026:

  • 🔹 Kernel exploits: for example, DirtyPipe (CVE-2022-0847) or CVE-2023-2136 for Android 13. They work without unlocking, but require manual patching and may not support new kernels.
  • 🔹 KernelSU: alternative Magisk, which is built into kernel. Supports some devices without an unlocked bootloader (for example, Nothing Phone 2).
  • 🔹 ADB root: on some firmware (for example, Pixel c Android 14), you can temporarily get root via adb root + adb shell, but the rights will disappear after a reboot.

Limitations:

  • ❌ It is not possible to flash custom firmware.
  • ❌ Many modules Magisk will not work.
  • ❌ High risk soft-brick in case of an error.