How to get root rights to Xiaomi Redmi Note 9 without unlocking the bootloader: the complete guide

Getting root rights to Xiaomi Redmi Note 9 (codename merlin) traditionally requires unlocking the bootloader through the official Mi Unlock Tool. However, this process involves waiting 7-15 days, binding to a Mi Account and the risk of losing warranty. Are there workarounds?

Yes, but with reservations. In this article, we'll look at alternative methods for getting root without unlocking the bootloader, their limitations and potential risks. It's important to understand that none of these methods will provide full root with modification of the system partition, we are talking about temporary or partial access. However, for most tasks (deleting the bloat, backup of applications, changing the DNS), this is enough.

Before you go ahead, check your device’s firmware version. The methods only work on MIUI 12–14 (Android 10–12) and require a rollback to the old firmware if you have a global version newer than V12.5.3.0.RJOMIXM installed. Use Settings → About Phone → MIUI version for clarification.

Why Official bootloader Unlocking Is Not Always Suitable

The process of unlocking the bootloader through the Mi Unlock Tool seems simple: link the device to your Mi Account, wait 168 hours (7 days) and unlock.

• 🔄 Resetting the waiting timer when you accidentally leave the account or change SIM-map.
• 🚫 Block unlocking on devices purchased in some regions (e.g. India or China).
• 📱 Loss of warranty – even if unlocking is successful, Xiaomi service centers refuse repairs.
• 🔧 Difficulties with custom firmware - after unlocking not all custom ROM Works correctly with Redmi Note 9 due to problems with camera or module drivers NFC.

Alternative methods without unlocking the bootloader do not have these disadvantages, but have their limitations: for example, temporary root (through exploits) requires re-acquiring rights after each reboot, and Magisk in “systemless” mode does not allow you to modify system files directly.

⚠️ Note: The methods described below may result in soft-brick (the device is switched on but not loaded beyond the logo). MI). Recovery is only possible through Fastboot with complete flashing and data loss!

Method 1: Temporary root through the DirtyCOW exploit (Android 10–11)

DirtyCOW (CVE-2016-5195) allows you to get temporary root rights without unlocking the bootloader. It runs on the Redmi Note 9 with firmware based on Android 10 and Android 11 (MIUI 12), but is not compatible with new versions of the kernel.

Implementation will require:

• 📱 Smartphone Redmi Note 9 with enabled debugging USB (Settings → The phone. → Version. MIUI → 7 times press to activate the developer mode, then Settings → Additionally. → For developers → Debugging by USB).
• 💻 Computer with Windows/Linux and installed drivers ADB/Fastboot.
• 📁 Archive with utilities: DirtyCOW for Merlin (check the relevance of the link to the XDA Developers).

Step-by-step:

1. Connect the phone to the PC and confirm the debugging permission.
2. Open the command prompt (cmd) and check the connection: adb devices must display the serial number of the device.
3. Download and unpack the archive with the exploit. Run the script: adb push dirtycow /data/local/tmp/ adb shell chmod 777 /data/local/tmp/dirtycow adb shell /data/local/tmp/dirtycow
4. If the exploit worked, you’ll see a message called Root success!. Now you can use an adb shell with superuser rights.

Limitations of the method:

• ⏳ Rights are valid until the first reboot.
• 🚫 It is not possible to modify system files (/system).
• 🔄 Requires the exploit to be re-run after each phone shutdown.

💡

Use the adb shell su -c command "pm uninstall -k --user 0 com.miui.analytics" to remove Xiaomi analytics without unlocking the bootloader. Replace com.miui.analytics with another system application package if you want to uninstall another browser.

Method 2: Install Magisk via boot.img patch (without unlocking)

This is a way for users who need to root permanently, but without unlocking the boot.img, and the method is to extract the boot.img file from the firmware, modify it through Magisk, and download the patched image through Fastboot. Importantly, the bootloader remains locked, so the patched boot.img will have to be manually downloaded each time it is turned on.

Advantages:

• 🔧 Full Magisk with module support (e.g, ViPER4Android App Systemizer).
• 🔄 Ability to update firmware without losing root (subject to repeated patching) boot.img).
• 🛡️ Data encryption is maintained (/data).

Instructions:

1. Download the firmware for your model from the Xiaomi Firmware Updater website. Select the Fastboot version (not Recovery!).
2. Remove boot.img from the firmware archive (located in the image folder).
3. Install Magisk Manager on your phone and download it. boot.img So, the result is a file. magisk_patched.img.
4. Reboot your phone to Fastboot (Switch Off → Hold Power + Vol Down)
5. Download the patch image temporarily (without writing to the section): fastboot boot magisk_patched.img

⚠️ Note: If you accidentally run fastboot flash boot instead of fastboot boot, the device will stop booting. Restore is only possible through full flashing in the Mi Flash Tool with loss of data. Always check commands before running!

Method 3: Using Shizuku for the ADB-root-access

If you don’t need a full root, but only need access to the Android API (for example, to backup apps or change settings through ADB), consider Shizuku.It allows you to run applications with adb rights without unlocking the bootloader and without risking damage to the system.

Shizuku works through USB debugging and does not require modification of system files.

• 📱 Data backup (Swift Backup, OAndBackupX).
• 🔧 Changes to system settings through ADB (For example, disabling MiuiOptimization).
• 📊 Monitoring of application activity (AppOps).

How to set up:

1. Install Shizuku from GitHub or F-Droid.
2. Connect your phone to your PC and execute: adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh
3. In the Shizuku app, click Start and confirm access via ADB.
4. You can now use compatible apps (e.g. AppOps or Swift Backup).

Limitations:

• 🔌 Requires a permanent connection to the PC or enabled debugging over Wi-Fi.
• 🚫 No access to modification of system files (/system, /vendor).
• 🔄 Some features (such as Titanium Backup) don’t work.

Risks and how to minimize them

Any method of getting root without unlocking the bootloader comes with risks.

• 💥 Soft-brick – the device only loads to the logo MI. Reason: Incorrect modification boot.img Magisk module conflict.
• 🛡️ Security breach – temporary root through exploits can be used by attackers to install malware.
• 📵 Loss of loss OTA-Updates - after modification boot.img Staff updates will no longer be installed.
• 🔋 Battery issues – some Magisk modules (such as Greenify) may conflict with energy-saving features MIUI.

How to reduce the risks:

1. Data Backup: Use TWRP (if the bootloader is unlocked) or Swift Backup via Shizuku.
2. Firmware check: Make sure that the MIUI version is compatible with the method you have chosen (see table below).
3. Testing: Before using Magisk modules, check them for compatibility with Redmi Note 9 on the XDA or 4PDA forums.
4. Recoil: Save the original boot.img for recovery in case of failure.

💡

On devices with MIUI 13+ and Android 12, temporary exploits (DirtyCOW) do not work. The only safe option is Shizuku or a pullback on MIUI 12.5.3.

What to do if something goes wrong

If after manipulations the phone stopped booting or there were errors, act on the algorithm:

1. Soft-brick (hang on the logo) MI): 🔄 Try to download to Fastboot (Power) + Vol Down) and temporarily download the original boot.img: fastboot boot original_boot.img 📥 If it doesn’t work, run the full firmware through the Mi Flash Tool (select the clean all option).
2. Bootloop (Cyclical Reboot): 🔧 Remove conflicting Magisk modules through ADB: adb shell magisk --remove-modules 🔄 Reboot to Fastboot and download the patched boot.img moduleless.
3. Loss of network or camera: 📡 The problem is typical of unofficial firmware. MIUI via Mi Flash Tool. 📷 If the camera doesn’t work, check whether the ANXCamera or GCam module is compatible with your version. MIUI.

⚠️ Note: If after firmware through the Mi Flash Tool device requires authorization in Mi Account, but you do not remember the password, you can restore access only through the official Xiaomi service with confirmation of purchase.

FAQ: Frequent questions about root on Redmi Note 9