How to install root rights on Xiaomi without unlocking the bootloader: all ways and pitfalls

Getting root rights on Xiaomi smartphones has traditionally been associated with unlocking the bootloader, a procedure that requires waiting, approval from the manufacturer and potential risks to warranty. However, there are workarounds to get extended rights without officially unlocking the bootloader. In this article, we will discuss all the current methods, their limitations and consequences for the device.

It's important to understand that none of these methods is 100% guaranteed to succeed. Xiaomi is actively closing vulnerabilities that previously could have been bypassed, so the performance of the methods depends on the device model, the firmware version. MIUI And we've analyzed the forums. 4PDA, XDA Developers and user reviews to gather the most up-to-date information for 2026.

If you're looking for a way to flash custom Recovery or install Magisk without unlocking, this is the guide for you, but first, let's look at why the manufacturer makes it so difficult, and what are the alternatives for those who are not willing to risk the stability of the system.

Why Xiaomi is blocking root without unlocking the bootloader

The manufacturer is imposing strict restrictions for a reason, and here are the key reasons why Xiaomi is making it harder to get root rights:

• 🔒 Data security: Root access opens up opportunities for malware to gain control of system partitions, especially for supported devices MIUI Pay and other financial services.
• 📱 Stability: Incorrect changes to system files often lead to “bricks” (inoperable devices), which increases the burden on service centers.
• 📉 Controlling the ecosystem: Xiaomi is interested in keeping users in its ecosystem (e.g., using Mi Cloud or Mi Video.
• 🛡️ Warranty obligations: Any manipulation of the firmware will automatically void the warranty, even if the failure is not root related.

Since 2020, Xiaomi has tightened its policy to require a device-based Mi Account to be linked to the bootloader and wait up to 720 hours (30 days), making alternative methods even more popular, but most of them are based on exploits, firmware vulnerabilities that are patched over time.

⚠️ Note: The methods described below may result in data loss, device locking, or inability to update. MIUI In the future, on devices with Dynamic. RAM Expansion root may disrupt this function.

Preparing the device: what to do before getting root

Before starting the procedure, follow the mandatory steps:

Pay special attention to the firmware version. For example, on the Xiaomi Redmi Note 10 Pro (sweet), the method using DirtyCow worked only on the device. MIUI 12.5.3. but ceased to function after the update to MIUI 13. Check the relevance of the method for your version:

If your model is not listed in the table, check the thematic branches on the 4PDA or XDA by device code (e.g., alioth for Poco) F3). Note that some methods require a rollback on the old firmware, which can lead to the device locking due to antirollback.

💡

Before starting the procedure, disable all antiviruses on your PC – they can block Magisk files or ADB, seeing them as a threat.

Method 1: Temporary root through DirtyCow vulnerability (for old firmware)

This method is based on exploit CVE-2021-4034 (It was known as DirtyPipe, which allowed temporary root access without unlocking the bootloader. 2022 It is currently supported on a limited number of models with outdated firmware.

Algorithm of action:

1. Download the archive with the DirtyCow Root utility (check compatibility with your model).
2. Connect your smartphone to your PC in Debugging mode USB (included in the settings → The phone. → Version. MIUI (7 times press) → Additionally. → For developers).
3. Run the script. run-as-root.sh through ADB: adb push dirtycow /data/local/tmp/ adb shell chmod 777 /data/local/tmp/dirtycow adb shell /data/local/tmp/dirtycow
4. If the exploit worked, you will get access to su for 1 session. Permanent root requires you to flash Magisk through temporary access.

⚠️ Attention: On devices with MIUI 13+ This method doesn't work because of a vulnerability fix. Attempting to use it can lead to soft-brick).

If the script gives you a Permission Denied error, try:

• 🔄 Reboot the device and repeat the process.
• 📱 Install another version MIUI (For example, roll back 12.5 on the Fastboot).
• 🖥️ Launch. ADB on behalf of the administrator on the PC.

Method 2: Installation of Magisk through patched boot.img (for some)

This method is suitable for devices where you can temporarily unlock the bootloader for one session (for example, through Fastboot with the Mi Account checkout bypass), it does not require constant unlocking, but still carries risks.

Instructions:

1. Download the original boot.img for your firmware (you can extract from the official Fastboot-ROM via the Mi Flash Tool).
2. Install Magisk Manager on your phone and patch it. boot.img via.
3. Reboot the device in Fastboot (Battery) + Volume down) and flash the patch image: fastboot flash boot magisk_patched.img fastboot reboot
4. If after the reboot there is a warning about damage to the bootloader, follow: fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img fastboot reboot

This method works for Poco. X3 NFC (The surya, Redmi Note 8 Pro (begonia) and some other models, however, on new devices (such as Xiaomi 13 or Redmi Note 12), it is not applicable due to the increased protection. AVB 2.0.

💡

If after the patching boot.img The device is not loading, try flashing the original boot.img back through Fastboot. 90% In some cases, it restores the workability.

Method 3: Using the Shamiko module to circumvent restrictions MIUI

Shamiko (formerly known as DenyList) is a module for Magisk that hides root from certain applications, including Xiaomi system services. It does not provide full root, but allows you to bypass some restrictions without unlocking the bootloader.

How to determine:

1. Make sure that the device already has Magisk installed (for example, through temporary root or patched). boot.img).
2. Download the Shamiko module and install it through Magisk Manager.
3. Restart the device and open the module settings in Magisk.
4. Add to the list of exceptions apps that should not see root (e.g. Mi Home, Mi Pay, Google Pay).

This method is suitable for:

• 📲 Bypassing the lockdown of the installation APK source.
• 🔧 Use some root applications (e.g. Titanium Backup or Greenify).
• 🎮 Modifications of game parameters (for example, overclocking) GPU via Game Turbo).

⚠️ Note: Shamiko does not allow access to system partitions /system or /vendor. For full root, you will still need to unlock the bootloader.

Root Alternatives: What You Can Do Without Unlocking the bootloader

If none of the methods worked, consider alternatives that don’t require root:

• 🧹 Removing Bloat Without Root: Use ADB Deactivation of system applications: adb shell pm uninstall -k --user 0 com.miui.analytics (a complete list of removal packages can be found at 4PDA).
• 🔧 Change of change DNS: To block advertising in MIUI set up privately DNS In Settings → Connections → Private DNS (e.g. dns.adguard.com).
• 📱 Shizuku: This tool allows some applications (like App Ops) to gain rights ADB rootless.
• 🔄 Castom launchers: Install Nova Launcher or Hyperion to change the interface without interfering with the system.

For devices on MIUI 14+ The "Developer Mode" function is also available, which allows:

• Disable animations (Settings) → Additionally. → For developers → Scale of animation).
• Turn on the debugging. USB for scrcpy (managing phone with PC).
• Configure the limitations of background processes.

💡

If you need root only to remove ads in the MIUI, Try to disable personalized ads in your Mi Account settings. This reduces the number of banners on your account. 60-70%.

Risks and how to minimize them

Any method of getting root without unlocking the bootloader comes with risks, and here are the most common problems and ways to avoid them:

If the device has stopped loading:

1. Try to boot up in Fastboot (Loudness Down). + Food) and to sew the original boot.img.
2. If it doesn’t work, use the Mi Flash Tool for full flashing (select the Clean All option).
3. On some models, resetting through Recovery (Loudness up) helps. + Nutrition → Wipe Data).

Remember: Xiaomi can remotely block devices with unofficial modifications through the Mi Cloud service. If after receiving root, the phone is no longer identified in Find My Device, this may be the first sign of future lock.

FAQ: Frequent questions about root on Xiaomi without unlocking