How To Guide Root achieved! Here's how to root the Red Magic 6 and Red Magic 6 Pro

Search This thread
I've been up 24 hours dealing with bootloops. I finally found a way to root the phone and have it boot up! :ROFLMAO:







Join our Discord Channel







Youtube Video Tutorial:




UPDATED VIDEO:




For all those websites that claim the RM6 can be rooted with Kingroot, Kingoroot, iRoot, SuperSU... They are MISLEADING you into downloading their software. In other words, they are full of BS and you should INGORE them at all costs as Magisk is the ONLY proper way to root the RM6.



DO NOT USE KINGROOT, iROOT, KingoROOT, or ANY OTHER THIRD-PARTY ROOTING TOOLS PLEASE!! They steal your DATA and sell it. Magisk does not steal anything.






This procedure will require a wipe of your data.. TWICE! I'll explain why.

When you unlock the bootloader, it wipes your data. Normally you only have to wipe it once, flash the patched boot.img file with magisk, and be done.

However, it seems that users will need to perform another factory reset after flashing the patched boot image. I have no idea why but it works. Please make a note of this as it will be required or you will be stuck in a bootloop.




Requirments


1. Global ROM file
2. A payload dumper
3. Magisk APK to patch the boot img
4. A computer!







Here are the steps!


1. Unlock your bootloader. Make sure you enable OEM unlock in developer options. This WILL WIPE YOUR DEVICE! The command to unlock your bootloader is "fastboot flashing unlock"

2. Download the global rom from here: https://rom.download.nubia.com/Europe/NX669J/V312/NX669J-update.zip

3. You will need to download a payload dumper tool. This is due to the firmware being in a .bin file (payload.bin). Follow the link below on how to extract the global firmware:


I ended up Downloading Termux from the playstore and extracting it with python on my phone.

When you get it extracted, just move the boot.img and vbmeta.img files to your Desktop and on your phone :) Place it somewhere on your internal storage where you will remember!

4. Download
Magisk Manager onto your phone and install it. Select install "patch a file" option and select the boot.img you put on your phone.

Let magisk patch it. It will end outputting a file like "Magisk_Patchedxxx.img" Go ahead and copy that file to your Desktop.

5. Go onto your computer and open up command prompt. Change your directory to the Desktop ex. cd c:/Users/Your Name/Desktop

6. Type fastboot flash boot magisk_patched.img

7. Now make sure you have vbmeta.img on your desktop as well. We need to disable verity on the device. Type fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

8. From the bootloader, reboot into your recovery and perform another factory reset!

9. Reboot the phone and voila! You now have root access!




Another thing to mention is that SafteyNet does NOT pass even with MagiskHide enabled. Please keep that in mind!


So far I've installed the Xposed Framework and some Magisk modules. All seems to work really well.

Happy Modding!


 
Last edited:

Masacr3

Member
Apr 22, 2021
10
0
I've been up 24 hours dealing with bootloops. I finally found a way to root the phone and have it boot up! :ROFLMAO:

This procedure will require a wipe of your data.. TWICE! I'll explain why.

When you unlock the bootloader, it wipes your data. Normally you only have to wipe it once, flash the patched boot.img file with magisk, and be done.

However, it seems that users will need to perform another factory reset after flashing the patched boot image. I have no idea why but it works. Please make a note of this as it will be required or you will be stuck in a bootloop.




Requirments


1. Global ROM file
2. A payload dumper
3. Magisk APK to patch the boot img
4. A computer!







Here are the steps!


1. Unlock your bootloader. Make sure you enable OEM unlock in developer options. This WILL WIPE YOUR DEVICE! The command to unlock your bootloader is "fastboot flashing unlock"

2. Download the global rom from here: https://rom.download.nubia.com/Europe/NX669J/V312/NX669J-update.zip

3. You will need to download a payload dumper tool. This is due to the firmware being in a .bin file (payload.bin). Follow the link below on how to extract the global firmware:


I ended up Downloading Termux from the playstore and extracting it with python on my phone.

When you get it extracted, just move the boot.img and vbmeta.img files to your Desktop and on your phone :) Place it somewhere on your internal storage where you will remember!

4. Download
Magisk Manager onto your phone and install it. Select install "patch a file" option and select the boot.img you put on your phone.

Let magisk patch it. It will end outputting a file like "Magisk_Patchedxxx.img" Go ahead and copy that file to your Desktop.

5. Go onto your computer and open up command prompt. Change your directory to the Desktop ex. cd c:/Users/Your Name/Desktop

6. Type fastboot flash boot magisk_patched.img

7. Now make sure you have vbmeta.img on your desktop as well. We need to disable verity on the device. Type fastboot --disable-verity --disable-verification vbmeta vbmeta.img

8. From the bootloader, reboot into your recovery and perform another factory reset!

9. Reboot the phone and voila! You now have root access!




Another thing to mention is that SafteyNet does NOT pass even with MagiskHide enabled. Please keep that in mind!


Edit:

Xposed Framework DOES work!


would be the same process for version V4.12? 🤔
 

adwinp

Senior Member
Jun 22, 2008
2,033
323
urandom
7. Now make sure you have vbmeta.img on your desktop as well. We need to disable verity on the device. Type fastboot --disable-verity --disable-verification vbmeta vbmeta.img
You're missing the "flash" command inside, as such:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

A couple of questions:
1: does the phone retain full functionality? radio (BT/A2DP/different wifi bands/fingerprint scanner/camera)?
2: have you tried using an empty vbmeta?
 
  • Like
Reactions: chocolote4444
You're missing the "flash" command inside, as such:
Code:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

A couple of questions:
1: does the phone retain full functionality? radio (BT/A2DP/different wifi bands/fingerprint scanner/camera)?
2: have you tried using an empty vbmeta?
Everything still works except the fingerprint. When the bootloader is unlocked, the fingerprint stops working.

As for flashing empty vbmeta images, I have not tried it. I know some devices you may have to flash an empty vbmeta img at last resort but I was able to boot it up using the stock vbmeta.
 
  • Like
Reactions: adwinp

adwinp

Senior Member
Jun 22, 2008
2,033
323
urandom
Everything still works except the fingerprint. When the bootloader is unlocked, the fingerprint stops working.

As for flashing empty vbmeta images, I have not tried it. I know some devices you may have to flash an empty vbmeta img at last resort but I was able to boot it up using the stock vbmeta.
Thx for responding.
1: Would you be able to test/comfirm if the fingerprint scanner is restored when relocking the bootloader using either the rooted boot.img or the stock one?
2: The same issue with fp calibration is faced by RM 5S/G users; can you check if the calibration fix in these forums works also for the RM6?
3: Lastly, have you tried flashing the latest phh GSI to see if it's working?
 
Last edited:
Thx for responding.
1: Would you be able to test/comfirm if the fingerprint scanner is restored when relocking the bootloader using either the rooted boot.img or the stock one?
2: The same issue with fp calibration is faced by RM 5S/G users; can you check if the calibration fix in these forums works also for the RM6?
3: Lastly, have you tried flashing the latest phh GSI to see if it's working?
Fingerprint scanner should work after relocking the bootloader. As for flashing a GSI, there's no custom recovery for this device yet so I can't test any GSI roms yet.
 

adwinp

Senior Member
Jun 22, 2008
2,033
323
urandom
Fingerprint scanner should work after relocking the bootloader. As for flashing a GSI, there's no custom recovery for this device yet so I can't test any GSI roms yet.
In this case, would you be able to run the following tests & share findings?
1: reflash stock boot, relock BL - check if fingerprint scanner is fixed
2: flash rooted boot.img (disable vbmeta), relock BL - check if fingerprint is fixed
If that would be the case, we could copy the calibration data from such a device; the data would be in /mnt/vendor/persist/goodix - I checked the stock ROM & it's not in there meaning it probably gets copied over during boot or mount-binded.

The last theory I want to check is the link between BL lock status & the fingerprint scanner - if some people have reported success with fixing the scanner with the builtin tool, there's a chance that the system framework or some other app is checking for the bootloader lock status & disabling the fingerprint if the former is unlocked. I've dumped the stock firmware but couldn't find a goodix dedicated apk, hence my hunch that it's a framework overlay. We would need to identify where the code is stored, decompile, find the security checking routine, disable, recompile & check agian - assuming it's not in any of the native libraries or the binary.
Assuming the access to the fingerprint scanner is indeed baked into the framework, using an AOSP GSIs would mean that the system would get unrestricted access to the fingerprint scanner, thus no blocking issue.

Thus (& addressing the 2nd part of your previous response), I'd suggest a 3rd test:
3: flash phh GSI or LOS GSI. The reason for the latter is because LOS usually has a wider range of hardware supported via hardware overlays.
You don't need a custom recovery to flash GSIs as these are fastboot images, so the following should suffice:
Code:
fastboot flash system gsi.img
fastboot -w
 
Last edited:
  • Like
Reactions: bs3pro

whincloud01

New member
Apr 26, 2021
3
0
Umm Sir, got some problem with the global rom i patched it from your link. i cannot save any photos even screenshot. its nothing on my gallery. it seems it is not saving any photo. i hope you can teach me to solve it. thanks in advance
 

adwinp

Senior Member
Jun 22, 2008
2,033
323
urandom
Umm Sir, got some problem with the global rom i patched it from your link. i cannot save any photos even screenshot. its nothing on my gallery. it seems it is not saving any photo. i hope you can teach me to solve it. thanks in advance
Do a factory reset as you need to properly reinitialize package IDs, SELinux contexts & permissions.
 
  • Like
Reactions: whincloud01

Masacr3

Member
Apr 22, 2021
10
0
I did the root process, but the phone stayed in the redmagic logo and it does not start me, what is the next process? flash the stock boot.img and it won't start
 

Top Liked Posts

  • There are no posts matching your filters.
  • 6
    I've been up 24 hours dealing with bootloops. I finally found a way to root the phone and have it boot up! :ROFLMAO:







    Join our Discord Channel







    Youtube Video Tutorial:




    UPDATED VIDEO:




    For all those websites that claim the RM6 can be rooted with Kingroot, Kingoroot, iRoot, SuperSU... They are MISLEADING you into downloading their software. In other words, they are full of BS and you should INGORE them at all costs as Magisk is the ONLY proper way to root the RM6.



    DO NOT USE KINGROOT, iROOT, KingoROOT, or ANY OTHER THIRD-PARTY ROOTING TOOLS PLEASE!! They steal your DATA and sell it. Magisk does not steal anything.






    This procedure will require a wipe of your data.. TWICE! I'll explain why.

    When you unlock the bootloader, it wipes your data. Normally you only have to wipe it once, flash the patched boot.img file with magisk, and be done.

    However, it seems that users will need to perform another factory reset after flashing the patched boot image. I have no idea why but it works. Please make a note of this as it will be required or you will be stuck in a bootloop.




    Requirments


    1. Global ROM file
    2. A payload dumper
    3. Magisk APK to patch the boot img
    4. A computer!







    Here are the steps!


    1. Unlock your bootloader. Make sure you enable OEM unlock in developer options. This WILL WIPE YOUR DEVICE! The command to unlock your bootloader is "fastboot flashing unlock"

    2. Download the global rom from here: https://rom.download.nubia.com/Europe/NX669J/V312/NX669J-update.zip

    3. You will need to download a payload dumper tool. This is due to the firmware being in a .bin file (payload.bin). Follow the link below on how to extract the global firmware:


    I ended up Downloading Termux from the playstore and extracting it with python on my phone.

    When you get it extracted, just move the boot.img and vbmeta.img files to your Desktop and on your phone :) Place it somewhere on your internal storage where you will remember!

    4. Download
    Magisk Manager onto your phone and install it. Select install "patch a file" option and select the boot.img you put on your phone.

    Let magisk patch it. It will end outputting a file like "Magisk_Patchedxxx.img" Go ahead and copy that file to your Desktop.

    5. Go onto your computer and open up command prompt. Change your directory to the Desktop ex. cd c:/Users/Your Name/Desktop

    6. Type fastboot flash boot magisk_patched.img

    7. Now make sure you have vbmeta.img on your desktop as well. We need to disable verity on the device. Type fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

    8. From the bootloader, reboot into your recovery and perform another factory reset!

    9. Reboot the phone and voila! You now have root access!




    Another thing to mention is that SafteyNet does NOT pass even with MagiskHide enabled. Please keep that in mind!


    So far I've installed the Xposed Framework and some Magisk modules. All seems to work really well.

    Happy Modding!


    2
    Success. Thank you for your thread. Maybe we can get a Kernal going. Here's the modules needed. Install props last. Go in terminal run props module. Pick me fingerprint. Xoamoi then select number 30. It's the Xoami mi 3. Yes reboot. Then clear date and catch in both play store apps in settings. Turn magisk hide on in magisk app. Select play store and click all the bubbles not just the one pre enabled. Reboot device. Go in playstore turn off play protect. Now you are hidden.
    Screenshot_2021-05-21-17-49-28-983.png
    Screenshot_2021-05-21-17-43-42-279.png
    2
    Can someone with the device, with a (re)locked bootloader, please check & confirm, whether the following process works:
    1: delete all fingerprints & disable unlocking via fingerprint (remove screenlock altogether or via PIN only)
    2: unlock the bootloader via:
    Code:
    fastboot oem nubia_unlock NUBIA_NX669J
    Please pay attention as this is different from the generic fastboot flashing unlock
    3: enable unlock via fingerprint & report if the fingerprint sensor works, else, the issue with calibration persists.
    1
    Are you SURE it doesn't pass SafetyNet? The Magisk check is broken download SafetyNet Checker from the app store and see what it says...
    I does not pass safety net. I've tested every testing app on the Play Store. I'll keep looking for a solution though.
    1
    How to use this function fastboot oem nubia_unlock NUBIA_NX669J
    u need to have oem unlock enable in ur phone setting..... the thing is we cant even get past that screen lol