Root on Xiaomi: from unlocking the bootloader to installing Magisk

Getting root rights on Xiaomi smartphones opens up access to hidden Android features, but it requires caution: wrong actions can turn a device into a brick. In 2026, the process was complicated by the tightening of the security policy of MIUI and the new HyperOS, but remains feasible. This article will detail all the steps from unlocking the bootloader to installing Magisk and TWRP, taking into account the features of the latest firmware.

It’s important to understand that on devices with MediaTek processors (such as the Redmi Note 12 or POCO M6 Pro), the unlocking algorithm is different from the Snapdragon, and for some models, it requires waiting 168 hours after an account is tied. We’ll look at both scenarios, as well as alternative methods for devices where official unlocking is not available.

Preparation of the device: what to do before unlocking

Before you start unlocking the bootloader, follow the mandatory steps:

• 🔋 Battery charge of at least 60% – the process can take up to 2 hours.
• 📱 Create a backup of data through Settings → The phone. → Backup or Mi Cloud. Once unlocked, all data will be erased.
• 🔑 Link your Mi Account to your device (in Settings) → Accounts. Unblocking is impossible without this.
• 🖥️ Install the Mi Unlock Tool (no lower version) 5.5.224.30) Windows-based 10/11.

Pay special attention to drivers: if the Mi Unlock Tool does not see the device in Fastboot mode, install ADB and Fastboot drivers from Google or use Xiaomi Driver Installer.

fastboot devices

If you see the serial number of the device, the drivers are installed correctly. On models with HyperOS (for example, Xiaomi 14 or Redmi). K70) Additional confirmation of unlocking may be required through SMS-code.

Unlock the bootloader: the official method through Mi Unlock

The official unlock method works for most devices, but has limitations:

Step-by-step:

1. Activate Developer Mode: Go to Settings → About Phone and click on MIUI Version 7 times.
2. Enable OEM unlocking and USB debugging in Settings → Additional → For developers.
3. Turn off the phone and press Volume Down + Power to log into the Fastboot.
4. Connect the device to your PC and launch the Mi Unlock Tool. Sign in with the same account you have on your phone.
5. Press Unlock and wait until the process is completed (usually 10-30 seconds).

⚠️ Note: On devices with HyperOS after pressing Unlock may appear a request for input SMS-The code sent to the number associated with the Mi Account is valid for 5 minutes.

The device rebooted automatically|Fastboot has a sign on it. UNLOCKED|When turned on, a warning appeared about the unlocked loader|B Settings → The phone. → Device status bootloader: Unlocked-->

Installation of custom recovery (TWRP)

Once the bootloader is unlocked, you need to install TWRP, an alternative recovery that allows you to flash modified images. Official TWRP builds are available on twrp.me, but new models (such as the Xiaomi 13T or Redmi Note 12 Turbo) may require unofficial versions from developer Telegram channels.

Download the correct version of TWRP for your model (note the encoding, for example, vili for Xiaomi 12 or rubens for Redmi Note 12 Pro+).

fastboot flash recovery twrp-3.7.0_12-0-vili.img


fastboot boot twrp-3.7.0_12-0-vili.img

If, after rebooting, the TWRP system offers to enter a password (due to data encryption), format the Data partition in the Wipe menu → Format Data (all data will be deleted!).

Getting root rights through Magisk

Magisk is a universal root-rights tool that is systemless root, with Magisk 26.4 being the most recent stable version as of 2026, but HyperOS may require a beta version (27.0+).

Installation instructions:

1. Download Magisk APK and install it on your phone (you can use it directly from TWRP).
2. Download the same file Magisk-v26.4.apk, but rename it to Magisk-v26.4.zip (this is the flashable image).
3. In TWRP, select Install → Select Magisk-v26.4.zip → Swipe to Confirm Flash.
4. After the firmware is restarted, Magisk will offer additional settings when you first start up.

To check access rights, install the Root Checker app from Google Play. If Root Access: Available status is successful, it was successful.

⚠️ Note: Mi Pay and some banking applications may stop working on HyperOS devices after Magisk is installed.

💡

If after firmware Magisk phone fixated on the logo, try flashing Disable_Dm-Verity_ForceEncrypt.zip (available XDA). This patch disables system integrity checks, which can block booting.

Problem Solving: Frequent Errors and Corrections

Even if you follow the instructions accurately, you can get errors.

• 🔄 Fastboot: FAILED (remote: 'Flashing is not allowed in Lock State' - bootloader not unlocked. Repeat process in Mi Unlock Tool.
• 📱 The device does not turn on after firmware TWRP — It's probably the wrong version of recovery. boot.img Fastboot: Fastboot Flash boot boot.img
• 🔒 Apps don’t see root – activate MagiskHide in Magisk settings and add apps to the exclusion list.
• 🔋 Fast battery drain after root - disable Magisk modules associated with the change CPU/GPU (KernelSU or Performance Mode).

For devices on MediaTek (e.g. Redmi 10C or POCO M5), an additional step may be required – disabling SLA (Secure Boot) via the command:

fastboot oem disable-sla

Without this, TWRP will not be able to access the partitions.

💡

If the phone doesn’t turn on after all the manipulations, try flashing the full stock ROM through the Mi Flash Tool in Clean All mode. This will return the device to factory state, but delete all data.

Alternative methods of obtaining root without unlocking the bootloader

For some models (such as the Xiaomi 11T Pro or Redmi K50 Gaming), there are exploits that allow you to get a temporary root without unlocking the bootloader. The most famous is DirtyPipe (CVE-2022-0847), but it only works on Android 12 and below.

A more reliable way is to use ADB backup to extract boot.img, modify it through Magisk, and reverse firmware.

1. USB debugging enabled.
2. Installed Android SDK Platform Tools.
3. Knowledge of the command line for working with adb and fastboot.

Detailed instructions:

adb backup -f boot.ab -apk -obb -shared -all -system

Remove boot.img from boot.ab archive (use 7-Zip)


Open boot.img in Magisk and get patched_boot.img


Squeeze the modified boot:



fastboot flash boot patched_boot.img

This method does not require unlocking the bootloader, but has limitations: root will be lost after the system update, and some features (such as changing system files) will remain unavailable.

Security after root: how not to lose your warranty and data

Getting root rights voids Xiaomi's warranty, but it can be returned by restoring stock firmware to minimize the risks:

• 🔒 Regularly create backups through TWRP (Backup section. Save copies on PC.
• 🛡️ Do not uninstall system applications without checking (e.g. MiuiDaemon is responsible for updates).
• 📱 For banking applications, use the MagiskHide Props Config module and set up root hiding.
• 🔄 Before the update MIUI/HyperOS Temporarily remove Magisk (uninstall option) → Complete Uninstall in the appendix).

If you need a service center, return the device to stock state:

1. Sweep the original boot.img through Fastboot.
2. Install stock recovery: fastboot flash recovery recovery.img
3. Log in to Fastboot and execute: fastboot oem lock (⚠️ This will block the bootloader and delete all data!)

After that, the service center will not be able to determine that the device has been unlocked.

FAQ: Answers to Frequent Questions