Documentation overview

Rooting, safely and clearly

This guide explains the basics of Android rooting, the risks involved, and the most common ways to unlock a bootloader, flash a root solution, and hide root from sensitive apps.

NOTE : This Guide is NOT Affiliated with any of the developers of the tools mentioned. It is a community-written guide to help users understand the rooting process and its implications.

1. Rooting: An Introduction

Please be careful what apps you give root permissions to. Root access can expose your device to data theft, financial loss, and unexpected instability.

What is Rooting?

Rooting an Android device means gaining full administrative control over the system, similar to an administrator account on a computer.

Pros of Rooting

Cons of Rooting

What is a Bootloader?

The bootloader is the first software that starts the device and decides which operating system image to load. It is usually locked to protect the phone from unauthorized changes.

What is Bricking?

Bricking means a device becomes non-functional due to failed software tampering or a broken firmware flash.

2. Unlocking the Bootloader

This process usually wipes user data. Back up important files before continuing.

Fastboot Method

Step 1 : Reboot the phone into bootloader mode.

adb reboot bootloader

Step 2 : Unlock the bootloader.

fastboot flashing unlock

Step 2.1 : If your device uses an older command set, try the fallback method.

fastboot oem unlock

MTKClient for MTK Devices

Use this only if your device is compatible and you understand the risks. It can bypass some locked MediaTek protections but may also trigger dm-verity corruption.

Step 1 : Dump vbmeta

python mtk.py r vbmeta_a,vbmeta_b vbmeta_a.img,vbmeta_b.img

python mtk.py r vbmeta vbmeta.img

Step 2 : Unlock the bootloader

python mtk.py da seccfg unlock

Step 3 : Disable dm-verity

python mtk.py da vbmeta 3

Step 4 : Erase userdata

python mtk.py e metadata,userdata

Step 5 : Reboot device

python mtk.py reset

3. Rooting Methods

Magisk

Patch the stock boot.img or init_boot.img with Magisk and flash it. This remains the most widely supported option for many devices.

Flash to Active Slot:

fastboot flash boot_a patched.img

fastboot flash init_boot_a patched.img

Flash to Inactive Slot (If Needed):

fastboot flash boot_b patched.img

fastboot flash init_boot_b patched.img

For Older Devices:

fastboot flash boot patched.img

KernelSU

KernelSU works well on supported devices with a compatible kernel. It is often preferred when strong stealth and systemless operation are needed.

Flash to Active Slot:

fastboot flash boot_a patched.img

fastboot flash init_boot_a patched.img

Flash to Inactive Slot (If Needed):

fastboot flash boot_b patched.img

fastboot flash init_boot_b patched.img

For Older Devices:

fastboot flash boot patched.img

APatch

APatch is another kernel-based option. Check compatibility carefully because not every device is supported.

Flash to Active Slot:

fastboot flash boot_a patched.img

Flash to Inactive Slot (If Needed):

fastboot flash boot_b patched.img

For Older Devices:

fastboot flash boot patched.img

4. Root Hiding Modules

Root hiding tools can help reduce detection by banking apps and some games, but they should be used carefully and only after the device is already rooted.

1. Tricky Store (Closed Source, recommended)

This module spoofs hardware-backed attestation by injecting a valid KeyBox.xml. When combined with the Tricky Addon and its WebUI, the process is easier.

Step 1 : Obtain the module zip files for Tricky Store and Tricky Addon and flash them via your recovery.

Step 2 : Reboot and open the Tricky Store app. Tap the Action button to launch the WebUI.

Step 3 : In the WebUI, select the target apps and tap Set Valid Keybox.

Links:

2. Shamiko (Closed Source)

Shamiko hides root traces and can help fake a locked bootloader status for apps that check for root or Zygisk. Use only trusted builds.

Step : Install the Shamiko module via your Magisk or module manager and configure it per the module's README.

Link: Shamiko (releases)

3. Play Integrity Fix (for custom ROM users)

These modules assign a valid fingerprint or otherwise patch integrity checks systemlessly. Flash one compatible module and use its action UI to apply fixes.

Step : Flash a Play Integrity module and follow its instructions in the module UI.

Links:

Open-source alternatives

If you prefer fully open-source solutions, consider these community projects — they may require additional setup and are not always feature-parity with closed-source variants.

Credits :