How To Guide Root achieved! Here's how to root the Red Magic 6 and Red Magic 6 Pro

[chocolote4444]

I've been up 24 hours dealing with bootloops. I finally found a way to root the phone and have it boot up!

Join our Discord Channel

Join the Red Magic 6 & 6 Pro [XDA Developers Forums] Discord Server!

Check out the Red Magic 6 & 6 Pro [XDA Developers Forums] community on Discord - hang out with 1 other members and enjoy free voice and text chat.

discord.gg

Youtube Video Tutorial:




UPDATED VIDEO:

For all those websites that claim the RM6 can be rooted with Kingroot, Kingoroot, iRoot, SuperSU... They are MISLEADING you into downloading their software. In other words, they are full of BS and you should INGORE them at all costs as Magisk is the ONLY proper way to root the RM6.



DO NOT USE KINGROOT, iROOT, KingoROOT, or ANY OTHER THIRD-PARTY ROOTING TOOLS PLEASE!! They steal your DATA and sell it. Magisk does not steal anything.​

This procedure will require a wipe of your data.. TWICE! I'll explain why.

When you unlock the bootloader, it wipes your data. Normally you only have to wipe it once, flash the patched boot.img file with magisk, and be done.

However, it seems that users will need to perform another factory reset after flashing the patched boot image. I have no idea why but it works. Please make a note of this as it will be required or you will be stuck in a bootloop.

Requirments


1. Global ROM file
2. A payload dumper
3. Magisk APK to patch the boot img
4. A computer!






Here are the steps!


​

1. Unlock your bootloader. Make sure you enable OEM unlock in developer options. This WILL WIPE YOUR DEVICE! The command to unlock your bootloader is "fastboot flashing unlock"

2. Download the global rom from here: https://rom.download.nubia.com/Europe/NX669J/V312/NX669J-update.zip

3. You will need to download a payload dumper tool. This is due to the firmware being in a .bin file (payload.bin). Follow the link below on how to extract the global firmware:

Extract Android OTA Payload.bin File using Payload Dumper Tool

Learn how to dump and extract Android OTA Payload.bin file to get the boot.img (for rooting with Magisk), vendor.img, and other other important partition images.

www.thecustomdroid.com

I ended up Downloading Termux from the playstore and extracting it with python on my phone.

When you get it extracted, just move the boot.img and vbmeta.img files to your Desktop and on your phone Place it somewhere on your internal storage where you will remember!

4. Download Magisk Manager onto your phone and install it. Select install "patch a file" option and select the boot.img you put on your phone.

Let magisk patch it. It will end outputting a file like "Magisk_Patchedxxx.img" Go ahead and copy that file to your Desktop.

5. Go onto your computer and open up command prompt. Change your directory to the Desktop ex. cd c:/Users/Your Name/Desktop

6. Type fastboot flash boot magisk_patched.img

7. Now make sure you have vbmeta.img on your desktop as well. We need to disable verity on the device. Type fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

8. From the bootloader, reboot into your recovery and perform another factory reset!

9. Reboot the phone and voila! You now have root access!



Another thing to mention is that SafteyNet does NOT pass even with MagiskHide enabled. Please keep that in mind!

So far I've installed the Xposed Framework and some Magisk modules. All seems to work really well.

Happy Modding!

​

 

[Moha1155]

Do u have rom V3:10

 

[Masacr3]

I've been up 24 hours dealing with bootloops. I finally found a way to root the phone and have it boot up!

This procedure will require a wipe of your data.. TWICE! I'll explain why.

When you unlock the bootloader, it wipes your data. Normally you only have to wipe it once, flash the patched boot.img file with magisk, and be done.

However, it seems that users will need to perform another factory reset after flashing the patched boot image. I have no idea why but it works. Please make a note of this as it will be required or you will be stuck in a bootloop.

Requirments


1. Global ROM file
2. A payload dumper
3. Magisk APK to patch the boot img
4. A computer!






Here are the steps!


​

1. Unlock your bootloader. Make sure you enable OEM unlock in developer options. This WILL WIPE YOUR DEVICE! The command to unlock your bootloader is "fastboot flashing unlock"

2. Download the global rom from here: https://rom.download.nubia.com/Europe/NX669J/V312/NX669J-update.zip

3. You will need to download a payload dumper tool. This is due to the firmware being in a .bin file (payload.bin). Follow the link below on how to extract the global firmware:

Extract Android OTA Payload.bin File using Payload Dumper Tool

Learn how to dump and extract Android OTA Payload.bin file to get the boot.img (for rooting with Magisk), vendor.img, and other other important partition images.

www.thecustomdroid.com

I ended up Downloading Termux from the playstore and extracting it with python on my phone.

When you get it extracted, just move the boot.img and vbmeta.img files to your Desktop and on your phone Place it somewhere on your internal storage where you will remember!

4. Download Magisk Manager onto your phone and install it. Select install "patch a file" option and select the boot.img you put on your phone.

Let magisk patch it. It will end outputting a file like "Magisk_Patchedxxx.img" Go ahead and copy that file to your Desktop.

5. Go onto your computer and open up command prompt. Change your directory to the Desktop ex. cd c:/Users/Your Name/Desktop

6. Type fastboot flash boot magisk_patched.img

7. Now make sure you have vbmeta.img on your desktop as well. We need to disable verity on the device. Type fastboot --disable-verity --disable-verification vbmeta vbmeta.img

8. From the bootloader, reboot into your recovery and perform another factory reset!

9. Reboot the phone and voila! You now have root access!



Another thing to mention is that SafteyNet does NOT pass even with MagiskHide enabled. Please keep that in mind!

Edit:

Xposed Framework DOES work!

​

would be the same process for version V4.12?

 

[chocolote4444]

would be the same process for version V4.12?

Yes. Mine is showing up as still 4.12

 

[mslezak]

Are you SURE it doesn't pass SafetyNet? The Magisk check is broken download SafetyNet Checker from the app store and see what it says...

 

[chocolote4444]

Are you SURE it doesn't pass SafetyNet? The Magisk check is broken download SafetyNet Checker from the app store and see what it says...

I does not pass safety net. I've tested every testing app on the Play Store. I'll keep looking for a solution though.

 

[adwinp]

7. Now make sure you have vbmeta.img on your desktop as well. We need to disable verity on the device. Type fastboot --disable-verity --disable-verification vbmeta vbmeta.img

You're missing the "flash" command inside, as such:

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

A couple of questions:
1: does the phone retain full functionality? radio (BT/A2DP/different wifi bands/fingerprint scanner/camera)?
2: have you tried using an empty vbmeta?

 

[chocolote4444]

You're missing the "flash" command inside, as such:

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

A couple of questions:
1: does the phone retain full functionality? radio (BT/A2DP/different wifi bands/fingerprint scanner/camera)?
2: have you tried using an empty vbmeta?

Everything still works except the fingerprint. When the bootloader is unlocked, the fingerprint stops working.

As for flashing empty vbmeta images, I have not tried it. I know some devices you may have to flash an empty vbmeta img at last resort but I was able to boot it up using the stock vbmeta.

 

[adwinp]

Everything still works except the fingerprint. When the bootloader is unlocked, the fingerprint stops working.

As for flashing empty vbmeta images, I have not tried it. I know some devices you may have to flash an empty vbmeta img at last resort but I was able to boot it up using the stock vbmeta.

Thx for responding.
1: Would you be able to test/comfirm if the fingerprint scanner is restored when relocking the bootloader using either the rooted boot.img or the stock one?
2: The same issue with fp calibration is faced by RM 5S/G users; can you check if the calibration fix in these forums works also for the RM6?
3: Lastly, have you tried flashing the latest phh GSI to see if it's working?

 

[mslezak]

Yes usually you just flash stock vbmeta.img via fastboot: fastboot flash vbmeta vbmeta.img --disable-verity --disable-verification should try it out...

 

[chocolote4444]

Thx for responding.
1: Would you be able to test/comfirm if the fingerprint scanner is restored when relocking the bootloader using either the rooted boot.img or the stock one?
2: The same issue with fp calibration is faced by RM 5S/G users; can you check if the calibration fix in these forums works also for the RM6?
3: Lastly, have you tried flashing the latest phh GSI to see if it's working?

Fingerprint scanner should work after relocking the bootloader. As for flashing a GSI, there's no custom recovery for this device yet so I can't test any GSI roms yet.

 

[adwinp]

Fingerprint scanner should work after relocking the bootloader. As for flashing a GSI, there's no custom recovery for this device yet so I can't test any GSI roms yet.

In this case, would you be able to run the following tests & share findings?
1: reflash stock boot, relock BL - check if fingerprint scanner is fixed
2: flash rooted boot.img (disable vbmeta), relock BL - check if fingerprint is fixed
If that would be the case, we could copy the calibration data from such a device; the data would be in /mnt/vendor/persist/goodix - I checked the stock ROM & it's not in there meaning it probably gets copied over during boot or mount-binded.

The last theory I want to check is the link between BL lock status & the fingerprint scanner - if some people have reported success with fixing the scanner with the builtin tool, there's a chance that the system framework or some other app is checking for the bootloader lock status & disabling the fingerprint if the former is unlocked. I've dumped the stock firmware but couldn't find a goodix dedicated apk, hence my hunch that it's a framework overlay. We would need to identify where the code is stored, decompile, find the security checking routine, disable, recompile & check agian - assuming it's not in any of the native libraries or the binary.
Assuming the access to the fingerprint scanner is indeed baked into the framework, using an AOSP GSIs would mean that the system would get unrestricted access to the fingerprint scanner, thus no blocking issue.

Thus (& addressing the 2nd part of your previous response), I'd suggest a 3rd test:
3: flash phh GSI or LOS GSI. The reason for the latter is because LOS usually has a wider range of hardware supported via hardware overlays.
You don't need a custom recovery to flash GSIs as these are fastboot images, so the following should suffice:

fastboot flash system gsi.img
fastboot -w

 

[whincloud01]

Umm Sir, got some problem with the global rom i patched it from your link. i cannot save any photos even screenshot. its nothing on my gallery. it seems it is not saving any photo. i hope you can teach me to solve it. thanks in advance

 

[adwinp]

Umm Sir, got some problem with the global rom i patched it from your link. i cannot save any photos even screenshot. its nothing on my gallery. it seems it is not saving any photo. i hope you can teach me to solve it. thanks in advance

Do a factory reset as you need to properly reinitialize package IDs, SELinux contexts & permissions.

 

[whincloud01]

Do a factory reset as you need to properly reinitialize package IDs, SELinux contexts & permissions.

thank you. it is working well now.

 

[Masacr3]

I did the root process, but the phone stayed in the redmagic logo and it does not start me, what is the next process? flash the stock boot.img and it won't start

 

[FFX2]

@chocolote4444 please share the solution when it gets stuck on the logo

 

[chocolote4444]

@chocolote4444 please share the solution when it gets stuck on the logo

I am currently looking into it

 

[sitlay]

Thanks for the guide

 

[letzdoit]

Hi. Will this also work for Android 11 on RM 5s?