Rooting Methods / The Full Menu
magisk [classic] · kernelsu [stealth] · apatch [advanced]
temp-root [locked-only] · unlock-routes [the gate]
$ _
Every route to root, honestly scored — the ups, the downs, and which phones each one is for.
Systemless root via a patched boot image — modules load without touching /system.
- biggest module ecosystem (Zygisk, Play Integrity workarounds)
- simplest flow in rooting: patch → flash → done
- massive community + docs, works on nearly every unlockable device
- needs an unlocked bootloader first
- detection cat-and-mouse with banking apps, forever
- on Samsung, Knox trips the moment anything custom boots
for almost every unlockable phone — the default choice.
Root that lives inside the kernel (GKI) — apps never see a patched ramdisk.
- much harder to detect than userspace root
- per-app root grants out of the box
- clean module system (same format as Magisk)
- needs kernel support: stock GKI, a patched kernel, or an LKM
- smaller ecosystem than Magisk
for GKI devices, and anyone who wants root that stays quiet.
Patches the kernel and Android; KernelPatch modules (KPM) can hook deep.
- works on non-GKI kernels where KernelSU won’t
- very flexible — kernel-level hooks for hiding and beyond
- more technical than the others
- smaller community, fewer ready-made modules
for non-GKI kernels and power users.
A kernel exploit grants uid 0 for the current boot session. The bootloader stays locked.
- the ONLY route on devices with no unlock at all
- nothing permanent — reboot and the phone is stock again
- lost on every reboot; re-run per boot
- one-shot reliability: races, timing, device noise all matter
- not for daily-driver root — it’s a bridge, not a home
for locked One UI 8 Samsungs and any device with no unlock path.
Every unlock flow — the door you need open before most of the above.
- OEM unlock toggle — Samsung international and others
- Mi Unlock — Xiaomi / Redmi / POCO (account + waiting period)
- fastboot flashing unlock — Pixel, Nothing (community)
- official codes — Sony, Motorola, HTC (emailed per IMEI)
- Deep Testing apps — Oppo / Realme
- EDL / Sahara — Qualcomm emergency download (mostly closed)
- research chains — GBL/EFI staging bugs, community, evolving fast
- every route has trade-offs: wipes, warranties, DRM keys, waiting periods
for see the matrix below for which brand uses which route.
// which method for which phone
| brand | most used route | notes |
|---|---|---|
| samsung | OEM unlock → Magisk / KSU | One UI 8 removed the toggle — locked models: temp root only |
| xiaomi / redmi / poco | Mi Unlock → Magisk / KSU | older HyperOS had a public GBL chain (patched) |
| google pixel | fastboot flashing unlock → Magisk | easiest unlock in Android |
| oneplus | fastboot → Magisk / KSU | unlock wipes data |
| oppo / realme | Deep Testing → Magisk | model dependent |
| motorola / sony | official codes → Magisk | warranty / DRM trade-offs |
| huawei / honor | closed | no official route since 2018 |
| vivo / tecno | closed | no official route |
// the honest ranking
best daily driver = magisk / kernelsu on an unlockable phone
best stealth = kernelsu / apatch
only option locked = temp root
rule of thumb = one wrong file can brick — check the device page for your exact model before flashing anything
$ _