[Guide] Root for Redmi Note 9 - Mediatek (Helio G85)

[N3OMOD]

Preamble:

After a bit of research, I've found a simple way to - at least - obtain root privileges on the basic version of Redmi Note 9 (Mediatek - Helio G85).

The procedure has been tested on a Redmi Note 9 Global NFC 4/128 (Model: M2003J15SG) with MIUI Global 11.0.5.

The attached files comprise:

• Original Boot Image from MIUI Global 11.0.5 (provided as a courtesy, download your own copy from MIUI Website if you wish)
• Patched Boot Image from Magisk on MIUI Global 11.0.5 (again, the file provided as a courtesy; you can generate your own file, on your device.)
• VBMETA Patched Image: essential to the process, this file has not been created by me. Courtesy of user Neko-kun from MI.cn Forum. I can only confirm that the file works as expected; please, if you have the required expertise, inspect the file and report your findings.

Warning:

This procedure depends on having previously unlocked the bootloader. Doing so you have read, understood and accepted all the information regarding security and potential stability issues given by XIAOMI before completing the procedure.
Also, this means you have understood and accepted potential warranty issues arising from such procedure, and you understand the risks associated with a rooted device.
I'm not responsible for any damage, loss of personal data, brick or loss of usability arising from following this procedure and/or from any user error committed by doing so.
As a result, your warranty may be void, according to laws in effect in your state.

This procedure is only valid for Redmi Note 9 (not the Pro version, not the 9S version) with MEDIATEK chipset


Note:
Always make a back-up of your data! This procedure will re-initialize the device.


Requirements:

• A valid MI Account, associated with the phone, used to certification in the bootloader unlocking procedure. (via official MI UNLOCK)
• Unlocked Bootloader (new devices usually have a 7-day waiting period)
• A personal computer with FASTBOOT installed, basic knowledge of FASTBOOT commands, drivers correctly installed on your system of choice. (for windows users, a valid solution is "Minimal ABD and Fastboot".)

Resources:

1. Magisk Manager
2. Boot Image / Magisk Patched Boot Image / VBMeta Image - link or see attached files

Procedure:

1. Download the attached files (or generate the first two on your own device, using Magisk Manager).
2. Copy the prepared files inside the fastboot directory (so you don't have to worry about file path in the following steps)
3. Reboot the phone into Fastboot Mode (hold Power+Volume Down until fastboot screen)
4. Connect the phone to the computer, open fastboot terminal and issue the following commands. BE PATIENT AND DOUBLE CHECK EVERYTHING BEFORE CONFIRMING! Text between round brackets are comments, it must not be copied.
   

   fastboot devices (check your phone is the only device shown)
   fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img (this disables system changes)
   fastboot erase userdata (this will clear user data!)
   fastboot erase cache
   fastboot flash boot magisk_patched.img
   fastboot reboot

5. The following first reboot will take a while. After completing the initial configuration, install the latest Magisk Manager (at the time of writing, v. 7.5.1) and continue with the configuration following the in-app prompt.
6. Phone will reboot at the end of the procedure. Launch once again Magisk Manager, select the "Beta Channel" for updates and enable Magisk Hide.
7. Reload Magisk Manager, check for Safety Net: you should have the green light.

Enjoy your root privileges. (aka, get rid of the bloatware )


Known BUGs / LIMITATIONS:

• Can't modify /system partition
• Need to temporary set SELinux to permissive in order to remove system apps. Please refer to this post.

 

[N3OMOD]

Removing "Bloatware"

Probably one the main reasons for obtaining root privileges is to get rid of some default apps which come bundled with the official MIUI.

Given the current situation for this device, using classic methods (such as Titanium Backup / System App Remover / etc.) is not possible and - most probably - attempting in doing so will result in a soft-brick.

Instead, there is a particularly useful Magisk Module that can be used for this scope: Debloater.

You can read more about it here on XDA; the installation procedure will vary just a bit since there is currently no TWRP support for the Helio G85 Redmi Note 9.

Installing Debloater

1. Launch Magisk Manager and select "Download" from the menu
2. Use the search function to locate the package "Busybox for Android NDK"
3. Install the package, and chose to skip the reboot at the end of the procedure.
4. Use the search function to locate the package "Debloater Terminal Emulator"
5. Install the package and this time proceed with the reboot
6. When the reboot is complete, install any terminal emulator app from PlayStore (like Termux)
7. Open the terminal and issue:

   su

   (confirm the request for superuser access) and then

   debloat

Now you can use Debloat to remove all the unwanted applications that come bundled with the ROM.

Please refer to the video included in the post mentioned above to learn more about Debloat and how to use it.

 

[[email protected]]

One Question

Can i know this work for Redmi Note 9 global non NFC?

 

[dfahren]

The download link in the first post does not work any longer ... Gives a 404. Please re-upload and don't use XDA's upload space. Thanks!

 

[N3OMOD]

The download link in the first post does not work any longer ... Gives a 404. Please re-upload and don't use XDA's upload space. Thanks!

Sorry for the inconvenience, there is still the MEGA link from the first post up and working.
Here it is: https://mega.nz/file/ucFDXIaY#FrUllKuUASoStlSvrcMYABsbYv6ie-WHR4zOqJMdP4E

 

[N3OMOD]

Can i know this work for Redmi Note 9 global non NFC?

It should work, since there is no significant difference between the two models regarding the rooting procedure. But I have no way of testing it because I don't have that phone version on hand.

 

[dfahren]

It should work, since there is no significant difference between the two models regarding the rooting procedure. But I have no way of testing it because I don't have that phone version on hand.

Hi there,
I can confirm the aforementioned procedure to root one's phone does work. I own a Redmi Note 9, Code: merlinnfc, Version: 11.0.5.0 (QJOEUXM). As you can see it's the European variant.
However, I didn't use the Zip archive the OP provided since it is meant for the global variant and (as of now) I don't see any necessity to reflash my phone to the global firmware.

I strongly recommend everybody to have Magisk Manager generate patched boot.img files and NOT use the original author's boot.img file! This holds true especially for those guys like me who own, say, an indian, chinese or european variant or run a different firmware version like, e.g., 11.0.3.0.

What's also important to mention is that there is no special "patched" vbmeta file. That guy "neko-kun" simply used the one contained in the original full firmare downloadable from Xiaomi's servers. Here you also have to make sure you use the one that matches the installed firmware version on your phone. Do not flash any other or you might get a brick!

If anybody of you guys has managed to get AFWall up and running and apply iptable rules without error, please drop me a line.

Thanks and good speed to everybody!

 

[N3OMOD]

Hi there,
I can confirm the aforementioned procedure to root one's phone does work. I own a Redmi Note 9, Code: merlinnfc, Version: 11.0.5.0 (QJOEUXM). As you can see it's the European variant.

Thank you for the feedback! That is the same version (hardware and ROM) I used to test the procedure before writing the article.

However, I didn't use the Zip archive the OP provided since it is meant for the global variant and (as of now) I don't see any necessity to reflash my phone to the global firmware.

I strongly recommend everybody to have Magisk Manager generate patched boot.img files and NOT use the original author's boot.img file! This holds true especially for those guys like me who own, say, an indian, chinese or european variant or run a different firmware version like, e.g., 11.0.3.0.

Indeed, as I mentioned in the first post, those files are provided only as a courtesy for those who may have the same device with the same firmware: I strongly encourage everyone to make their own using Magisk Manager.

What's also important to mention is that there is no special "patched" vbmeta file. That guy "neko-kun" simply used the one contained in the original full firmare downloadable from Xiaomi's servers. Here you also have to make sure you use the one that matches the installed firmware version on your phone. Do not flash any other or you might get a brick!

Thanks for the clarification about the vbmeta file. I will update the post to clarify this aspect.: good:
The original explanation from the user was a bit difficult to understand, hence the warning about the possibility of a "patched" file. (I didn't want to create any trouble for anyone).

Also, a little comforting for anyone who might incur in a (soft)brick: I have seen some people flashing only the "boot.img" and ending up in an infinite bootloop (black screen with "redmi" logo).
Should that happen, you can always enter the fastboot mode (keeping pressed the power+vol down for a bit longer than usual) and re-flash the original "boot.img" extracted from the official ROM image available on MIUI site.

If anybody of you guys has managed to get AFWall up and running and apply iptable rules without error, please drop me a line.

Thanks and good speed to everybody!

Will let you know as soon as I have some time to test it.
(sidenote for those interested: for now I can confirm that AdAway is working fine)

 

[Akitake]

Followed the steps, worked flawlessly on my Redmi Note 9 (Merlin) 3gb ram 64gb storage purchased in Europe, running Global 11.0.5.

Thank you so very much!
I had successfully done this in the past but messed something up with xposed later, I won't xposed it this time and just enjoy my root-ness.

 

[dfahren]

Thanks for the clarification about the vbmeta file. I will update the post to clarify this aspect.: good:
The original explanation from the user was a bit difficult to understand, hence the warning about the possibility of a "patched" file. (I didn't want to create any trouble for anyone).
...
Also, a little comforting for anyone who might incur in a (soft)brick: I have seen some people flashing only the "boot.img" and ending up in an infinite bootloop (black screen with "redmi" logo).
Should that happen, you can always enter the fastboot mode (keeping pressed the power+vol down for a bit longer than usual) and re-flash the original "boot.img" extracted from the official ROM image available on MIUI site.
...
(sidenote for those interested: for now I can confirm that AdAway is working fine)

The original explanation from user "neko-kun" seemed to me an automatic translation hence the rather weird language.
I can testify to the statement that you can reflash the original boot.img file should you enter a bootloop (which I got).
AdAway is also working for me as does AFWall+ (I needed to leave logging of blocked packets as it is -> off)

 

[noodlelicious]

Thank you for the feedback! That is the same version (hardware and ROM) I used to test the procedure before writing the article.



Indeed, as I mentioned in the first post, those files are provided only as a courtesy for those who may have the same device with the same firmware: I strongly encourage everyone to make their own using Magisk Manager.



Thanks for the clarification about the vbmeta file. I will update the post to clarify this aspect.: good:
The original explanation from the user was a bit difficult to understand, hence the warning about the possibility of a "patched" file. (I didn't want to create any trouble for anyone).

Also, a little comforting for anyone who might incur in a (soft)brick: I have seen some people flashing only the "boot.img" and ending up in an infinite bootloop (black screen with "redmi" logo).
Should that happen, you can always enter the fastboot mode (keeping pressed the power+vol down for a bit longer than usual) and re-flash the original "boot.img" extracted from the official ROM image available on MIUI site.



Will let you know as soon as I have some time to test it.
(sidenote for those interested: for now I can confirm that AdAway is working fine)

i'm having an infinite bootloop and keep pressing power + vol down didn't help , what should i do ?

 

[dfahren]

@noodlelicious
That's very unfortunate. I know this situation only too well. First of all what type of Redmi Note 9 do you have. Please post the "Product Model" number you can find on your phone and package. Mine, for example, is M2003J15SG. Which version of MIUI did you run? Is it MIUI 11 or the newer MIUI 12? Do you run some regional flavor of MIUI such as European, Russian, Indonesian, Indian or China?
Second, did you flash the correct vbmeta file? I mean this is an IMG file that must match the flavor? The original poster supplied a vbmeta IMG file for the global variant that might (I'm really not sure) not fit to your specific flavor.

Ok, how do you get rid of the boot loop? I manged to stop the loop by pressing Volume down continuously for about a minute. After that my phone reboots into fastboot mode. Please DO NOT press the power button, this is unnecessary.
When in fastboot mode reflash your original boot.img according to the steps above.

I hope that helps you a bit.

Best wishes,
Didi

 

[noodlelicious]

@noodlelicious
That's very unfortunate. I know this situation only too well. First of all what type of Redmi Note 9 do you have. Please post the "Product Model" number you can find on your phone and package. Mine, for example, is M2003J15SG. Which version of MIUI did you run? Is it MIUI 11 or the newer MIUI 12? Do you run some regional flavor of MIUI such as European, Russian, Indonesian, Indian or China?
Second, did you flash the correct vbmeta file? I mean this is an IMG file that must match the flavor? The original poster supplied a vbmeta IMG file for the global variant that might (I'm really not sure) not fit to your specific flavor.

Ok, how do you get rid of the boot loop? I manged to stop the loop by pressing Volume down continuously for about a minute. After that my phone reboots into fastboot mode. Please DO NOT press the power button, this is unnecessary.
When in fastboot mode reflash your original boot.img according to the steps above.

I hope that helps you a bit.

Best wishes,
Didi

Thank you so much for replying my problems.
First, i'm using M2003J15SS
I'm running on latest miui 11 indonesian.
I'm flashing the vbmeta on first post , i skip all the comment section and straight install all the things there.
I already put a rubber band on my vol down since 7 hours ago and still got no fastboot.
What else can i do ?

 

[ma259]

What about entering recovery?

Thank you so much for replying my problems.
First, i'm using M2003J15SS
I'm running on latest miui 11 indonesian.
I'm flashing the vbmeta on first post , i skip all the comment section and straight install all the things there.
I already put a rubber band on my vol down since 7 hours ago and still got no fastboot.
What else can i do ?

Try to enter stock recovery, if you can, select mi assitant. After that connect trough adb and run "adb reboot bootloader", that should do the trick.
If phone isnt booting none of main enviroments (system, recovery or fastboot/bootloader) battery drainage may restablish normal boot order. Just remember that if in any case it boots to recovery, use adb command to reboot to bootloader.

 

[ma259]

Tested on RN9 Global non-NFC (M2003J15SS) with MIUI 12 Global

Hi, just to inform. The following was tested in Redmi Note 9 Global non-NFC (M2003J15SS) with MIUI 12 Global.

- Patched boot image from MIUI12 Global (Android 10) works fine if dm-verity and forced encryption are disable at the time of making the boot image with magisk.

- vbmeta file provided by OP also works (I think any file would work if it's flashed with "--disable-verity --disable-verification" option. This option is essential to avoid bootloop after flashing any non-stock (or patched) image to any partition:

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

The vbmeta file I used was extracted (and possibly) edited from a previous version of MIUI (MIUI11), and applied over MIUI12 ROM, that's why I think any file could be used.

 

[gvalro]

Hi .. Is there a way to write to system / app. I need to be able to pass an application to system. Thank you.

 

[haigu]

Does netflix still work in HD after having the BL unlocked and further rooted?

 

[farvehar09]

How to patch vbmeta



---------- Post added at 05:50 PM ---------- Previous post was at 05:14 PM ----------

Preamble:

After a bit of research, I've found a simple way to - at least - obtain root privileges on the basic version of Redmi Note 9 (Mediatek - Helio G85).

The procedure has been tested on a Redmi Note 9 Global NFC 4/128 (Model: M2003J15SG) with MIUI Global 11.0.5.

The attached files comprise:

• Original Boot Image from MIUI Global 11.0.5 (provided as a courtesy, download your own copy from MIUI Website if you wish)
• Patched Boot Image from Magisk on MIUI Global 11.0.5 (again, the file provided as a courtesy; you can generate your own file, on your device.)
• VBMETA Patched Image: essential to the process, this file has not been created by me. Courtesy of user Neko-kun from MI.cn Forum. I can only confirm that the file works as expected; please, if you have the required expertise, inspect the file and report your findings.

Warning:

This procedure depends on having previously unlocked the bootloader. Doing so you have read, understood and accepted all the information regarding security and potential stability issues given by XIAOMI before completing the procedure.
Also, this means you have understood and accepted potential warranty issues arising from such procedure, and you understand the risks associated with a rooted device.
I'm not responsible for any damage, loss of personal data, brick or loss of usability arising from following this procedure and/or from any user error committed by doing so.
As a result, your warranty may be void, according to laws in effect in your state.

This procedure is only valid for Redmi Note 9 (not the Pro version, not the 9S version) with MEDIATEK chipset


Note:
Always make a back-up of your data! This procedure will re-initialize the device.


Requirements:

• A valid MI Account, associated with the phone, used to certification in the bootloader unlocking procedure. (via official MI UNLOCK)
• Unlocked Bootloader (new devices usually have a 7-day waiting period)
• A personal computer with FASTBOOT installed, basic knowledge of FASTBOOT commands, drivers correctly installed on your system of choice. (for windows users, a valid solution is "Minimal ABD and Fastboot".)

Resources:

1. Magisk Manager
2. Boot Image / Magisk Patched Boot Image / VBMeta Image - link or see attached files

Procedure:

1. Download the attached files (or generate the first two on your own device, using Magisk Manager).
2. Copy the prepared files inside the fastboot directory (so you don't have to worry about file path in the following steps)
3. Reboot the phone into Fastboot Mode (hold Power+Volume Down until fastboot screen)
4. Connect the phone to the computer, open fastboot terminal and issue the following commands. BE PATIENT AND DOUBLE CHECK EVERYTHING BEFORE CONFIRMING! Text between round brackets are comments, it must not be copied.
   

   fastboot devices (check your phone is the only device shown)
   fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img (this disables system changes)
   fastboot erase userdata (this will clear user data!)
   fastboot erase cache
   fastboot flash boot magisk_patched.img
   fastboot reboot

5. The following first reboot will take a while. After completing the initial configuration, install the latest Magisk Manager (at the time of writing, v. 7.5.1) and continue with the configuration following the in-app prompt.
6. Phone will reboot at the end of the procedure. Launch once again Magisk Manager, select the "Beta Channel" for updates and enable Magisk Hide.
7. Reload Magisk Manager, check for Safety Net: you should have the green light.

Enjoy your root privileges. (aka, get rid of the bloatware )


Known BUGs / LIMITATIONS:

• Can't modify /system partition
• Need to temporary set SELinux to permissive in order to remove system apps. Please refer to this post.

can i use original vbmeta in rom files for this command
"fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img (this disables system changes)"
Because my phone is redmi note 9 (m2003j15ss) updated to 12.03.0(QJOMIXM) miui version
If not with the original, how do I patch this file?

 

[skribb]

can this be used to root the EU model: MZB9410EU ?

 

[co2thunderboy]

---------- Post added at 05:50 PM ---------- Previous post was at 05:14 PM ----------

can i use original vbmeta in rom files for this command
"fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img (this disables system changes)"
Because my phone is redmi note 9 (m2003j15ss) updated to 12.03.0(QJOMIXM) miui version
If not with the original, how do I patch this file?

Yes u can, i use the original vbmeta from miui_MERLINIDGlobal_V12.0.1.0.QJOIDXM_709d727d58_10.0.zip (ID variant)