https://github.com/realdtn2/xiaomi-unlocking-rooting-guide
Guide on Bootloader Unlock / Root / Hide Root/ Play Integrity/ Spoof Bootloader Status as Locked (Key Attestation) for Xiaomi devices (HyperOS/HyperOS 2.0/HyperOS 3.0) (Global) [2026]
https://github.com/realdtn2/xiaomi-unlocking-rooting-guide
2026 android bootloader bootloader-unlock guide hyperos hyperos-2 hyperos-3 kernelsu key-attestation magisk magisk-alpha play-integrity play-integrity-fix play-integrity-fix-guide root xiaomi xiaomi-bootloader-unlock
Last synced: about 20 hours ago
JSON representation
Guide on Bootloader Unlock / Root / Hide Root/ Play Integrity/ Spoof Bootloader Status as Locked (Key Attestation) for Xiaomi devices (HyperOS/HyperOS 2.0/HyperOS 3.0) (Global) [2026]
- Host: GitHub
- URL: https://github.com/realdtn2/xiaomi-unlocking-rooting-guide
- Owner: realdtn2
- Created: 2024-11-23T05:48:16.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2026-06-05T17:28:45.000Z (about 1 month ago)
- Last Synced: 2026-06-05T18:40:18.125Z (about 1 month ago)
- Topics: 2026, android, bootloader, bootloader-unlock, guide, hyperos, hyperos-2, hyperos-3, kernelsu, key-attestation, magisk, magisk-alpha, play-integrity, play-integrity-fix, play-integrity-fix-guide, root, xiaomi, xiaomi-bootloader-unlock
- Homepage:
- Size: 9.82 MB
- Stars: 101
- Watchers: 4
- Forks: 13
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
Bootloader Unlock and Root for Xiaomi devices (HyperOS / HyperOS 2.0 / HyperOS 3.0) (Non-Mainland China Devices)
&
Hide Root / Play Integrity / Spoof Bootloader Status as Locked (Key Attestation) for most Android devices
# Bootloader Unlock
## Warning
- **BACK UP ANY DATA YOU MAY HAVE ON YOUR PHONE**
- **ALL OF YOUR DATA WILL BE WIPED**
## Requirements
- Your **Xiaomi account** must be over **30 days old**
- Enable **Find device** in **Xiaomi Cloud** in **Settings** (might not be necessary, but enable for certainty)
### Step 1: Enable OEM Unlocking
- In **Settings**, press **About phone** and tap **OS version** 5 times to unlock **Developer Options**
- In **Developer Options**, enable **OEM Unlocking**
### Step 2: Reinstall Xiaomi Community
- Uninstall **Xiaomi Community** and reboot
- Install the **latest version** of **Xiaomi Community** on the **Play Store**
### Step 3: Account Region
- Sign in with your **Xiaomi account** in **Xiaomi Community**
- In the **Me** tab, find **Set up** and press it
- Press **Change region** and choose **Global**
### Step 4: Apply for unlocking
- Press "Apply for unlocking" at exactly **12:00 AM GMT+8** (pressing it too late will cause the **"application quota limit reached"** error. Use this [website](https://time.is/GMT+8) to check the time)
- **"Account Error"** might show up. If that happens, retry after 10 days
- **Tip:** If it keeps failing, try another method using this [Python automation script](https://xdaforums.com/t/how-to-unlock-bootloader-on-xiaomi-hyperos-all-devices-except-cn.4654009/#post-89311595)
### Step 5: Bootloader Unlock Preparation
- Logout of your **Xiaomi account** in **Settings**
- Reboot
- Login again with your **Xiaomi account** in **Settings**
### Step 6: Add account to Mi Unlock
- Turn off **Wi-Fi** and make sure a **working mobile data connection** is available
- In **Developer Options**, find **Mi Unlock status** and press it
- Press **Add account and device**
### Step 7: Mi Unlock tool
- Download the **latest version** of it from [here](https://miuirom.org/updates/mi-flash-unlock)
### Step 8: Sign in to your Xiaomi account
- After download, extract and navigate to its folder
- Open **miflash_unlock.exe**, you will be prompted to sign in
- After signing in, **agree to the disclaimer**
### Step 9: ADB and Fastboot
- Enter this [site](https://developer.android.com/tools/releases/platform-tools?hl=en) and select the one for **Windows**
- After download, extract and navigate to its folder
- Click on the **address bar** of the folder and replace everything with **cmd**
- Press enter and a **CMD window** should pop up
### Step 10: USB Debugging
- In **Developer Options**, enable **USB Debugging**
### Step 11: Bootloader Unlock
- Plug in your phone and press **allow computer** when prompted on the phone
- In the **CMD window** opened in **Step 9**, type `adb.exe reboot fastboot` and press enter
- Your phone should reboot and display **FASTBOOT**
- In the Mi Unlock app, it should display **phone connected**
- Press **unlock** and then press **unlock anyway**
- It might say **couldn't unlock**; wait for the amount of time displayed (during this time, **DO NOT** log out of your **Xiaomi account** on the phone or in **Xiaomi Community**)
- When **enough time** has passed, repeat **this Step** and your phone should be unlocked
---
# Root
## Disclaimer: `init_boot` is for newer devices. Older devices do not have `init_boot`, so only use `boot` on those
## Tip: Disable auto-update in the Settings to prevent losing root
>
> KernelSU (recommended — install to check if your phone is supported) (Android 12+)
>
> ### Step 1: Obtain ROM Files
> 1. Navigate to **About phone** on your device
> 2. Download the firmware **(Fastboot ROM)** from [miuirom.org](https://miuirom.org/) that matches **your device** and **OS version**
>
> ### Step 2: Extract Firmware
> - After download, extract and navigate to its folder
>
> ### Step 3: Locate the `images` Folder
> - Find the `images` folder and enter it
>
> ### Step 4: Backup `init_boot.img`
> 1. In the folder, copy `init_boot.img` to the `platform-tools` folder in **Step 9 of unlocking the bootloader**
> 2. Rename the copied file to `init_boot_stock.img` (DO NOT DELETE IN CASE OF A BRICK)
>
> ### Step 5: Transfer to Phone
> - Transfer the `init_boot_stock.img` file to your phone
>
> ### Step 6: Install KernelSU
> - Download and install the **latest APK** from their **releases**
> https://github.com/tiann/KernelSU/releases
>
> ### Step 7: Check KernelSU compatibility
> 1. Open **KernelSU**
> 2. If the app shows **Not installed**, then your device is **officially supported** by **KernelSU**
> If the app shows **Unsupported**, it means that you should **compile the kernel yourself**, **KernelSU** won't and never provide files for you to flash
>
> ### Step 8: Patch the `init_boot_stock.img`
> 1. Open **KernelSU**
> 2. Click on **Not installed - Tap to install** -> **Select a file**.
> 3. Choose `init_boot_stock.img`
> 4. Click on **Next** and choose the option with **This device KMI**
> 5. Press **Confirm**
> 6. The **patched file** should be something like `kernelsu_patched_20260605_045957.img` in the **Download** folder of your phone
>
> ### Step 9: Transfer Patched File to PC
> - Move the **patched file** (`kernelsu_patched_20260605_045957.img`) to `platform-tools`
>
> ### Step 10: Reboot to Fastboot
> 1. Plug in your phone
> 2. Navigate to `platform-tools`, click on the **address bar** of the folder and replace everything with **cmd**
> 3. Press enter and a **CMD window** should pop up
> 4. Run the following command in CMD:
> ```
> adb.exe reboot fastboot
> ```
>
> ### Step 11: Flash Patched `init_boot`
> 1. In the same CMD window, execute the following commands using it as an example:
> ```
> fastboot.exe flash init_boot_a kernelsu_patched_20260605_045957.img
> fastboot.exe flash init_boot_b kernelsu_patched_20260605_045957.img
> fastboot.exe reboot
> ```
>
> 2. Your device should reboot into the system and be rooted
>
>
>
> Magisk Alpha
>
> ### Step 1: Obtain ROM Files
> 1. Navigate to **About phone** on your device
> 2. Download the firmware **(Fastboot ROM)** from [miuirom.org](https://miuirom.org/) that matches **your device** and **OS version**
>
> ### Step 2: Extract Firmware
> - After download, extract and navigate to its folder
>
> ### Step 3: Locate the `images` Folder
> - Find the `images` folder and enter it
>
> ### Step 4: Backup `init_boot.img`
> 1. In the folder, copy `init_boot.img` to the `platform-tools` folder in **Step 9 of unlocking the bootloader**.
> 2. Rename the copied file to `init_boot_stock.img` (DO NOT DELETE IN CASE OF A BRICK)
>
> ### Step 5: Transfer to Phone
> - Transfer the `init_boot_stock.img` file to your phone
>
> ### Step 6: Install Magisk Alpha
> - Download and install the **latest version** of Magisk Alpha from their [Telegram Channel](https://t.me/magiskalpha)
>
> ### Step 7: Patch the `init_boot_stock.img`
> 1. Open **Magisk Alpha**
> 2. Tap **Install** -> **Select and Patch a File**
> 3. Choose `init_boot_stock.img`
> 4. The **patched file** should be something like `magisk_patched-XXXXX_xxxxx.img` in the **Download** folder of your phone
>
> ### Step 8: Transfer Patched File to PC
> - Move the **patched file** (`magisk_patched-XXXXX_xxxxx.img`) to `platform-tools`
>
> ### Step 9: Reboot to Fastboot
> 1. Plug in your phone
> 2. Navigate to `platform-tools`, click on the **address bar** of the folder and replace everything with **cmd**
> 3. Press enter and a **CMD window** should pop up
> 4. Run the following command in CMD
> ```
> adb.exe reboot fastboot
> ```
>
> ### Step 10: Flash Patched `init_boot`
> 1. In the same CMD window, execute the following commands
> ```
> fastboot.exe flash init_boot_a magisk_patched-28001_xxxxx.img (e.g., fastboot.exe flash init_boot_a magisk_patched-28001_p5r8c.img)
> fastboot.exe flash init_boot_b magisk_patched-28001_xxxxx.img (e.g., fastboot.exe flash init_boot_b magisk_patched-28001_p5r8c.img)
> fastboot.exe reboot
> ```
> **Only** for **OLD DEVICES** without `init_boot` ***(DO NOT FOLLOW IF YOUR DEVICE HAVE `init_boot`)***
> ```
> fastboot.exe flash boot_a magisk_patched-28001_xxxxx.img (e.g., fastboot.exe flash boot_a magisk_patched-28001_p5r8c.img)
> fastboot.exe flash boot_b magisk_patched-28001_xxxxx.img (e.g., fastboot.exe flash boot_b magisk_patched-28001_p5r8c.img)
> fastboot.exe reboot
> ```
> **Only** for **OLD DEVICES** without `init_boot`, if there's an **error**, try running this command ***(DO NOT FOLLOW IF YOUR DEVICE HAVE `init_boot`)***
> ```
> fastboot.exe --disable-verity --disable-verification flash vbmeta vbmeta.img (vbmeta.img is from the firmware you downloaded)
> ```
>
> 2. Your device should reboot into the system and be rooted
>
>
---
# Hide Root / Play Integrity Fix / Spoof Bootloader Status as Locked (Key Attestation)
## Requirements
>
> KernelSU
>
> ### Step 1: Install Required Magisk / KernelSU Modules
> Install the **latest release version** of the following modules in this order:
> - Hybrid Mount (reboot your phone)
> https://github.com/Hybrid-Mount/meta-hybrid_mount/releases
> - Zygisk Next (reboot your phone)
> https://github.com/Dr-TSNG/ZygiskNext/releases
> - TEESimulator-RS (Way Better Alternative to Tricky Store)
> https://github.com/Enginex0/TEESimulator-RS/releases
> - Tricky Addon Enhanced (auto-fetch keyboxes)
> https://github.com/Enginex0/tricky-addon-enhanced/releases (press Vol+ when asked)
> - Vector (LSPosed fork)
> https://github.com/JingMatrix/Vector/releases
> - PlayIntegrityFix (inject-s)
> https://github.com/KOWX712/PlayIntegrityFix/releases
>
> ### Step 2: Reboot
>
>
>
> Magisk Alpha
>
> ### Step 1: Install Required Magisk Modules
> Install the **release version** of the following modules in this order:
> - Zygisk Next (reboot your phone)
> https://github.com/Dr-TSNG/ZygiskNext/releases
> - TEESimulator-RS (Way Better Alternative to Tricky Store)
> https://github.com/Enginex0/TEESimulator-RS/releases
> - Tricky Addon Enhanced (auto-fetch keyboxes)
> https://github.com/Enginex0/tricky-addon-enhanced/releases (press Vol+ when asked)
> - Vector (LSPosed fork)
> https://github.com/JingMatrix/Vector/releases
> - PlayIntegrityFix (inject-s)
> https://github.com/KOWX712/PlayIntegrityFix/releases
> - Shamiko
> https://github.com/LSPosed/LSPosed.github.io/releases
>
> ### Step 2: Reboot
>
>
## Hide Root (should be compatible with most Android devices like Xiaomi, Samsung, etc.)
>
> KernelSU
>
> ### Step 1: Install KsuWebUI
> - Download and install the latest version of KsuWebUI from
> https://github.com/5ec1cff/KsuWebUIStandalone/releases
>
> ### Step 2: Set up KernelSU
> 1. Open **KernelSU**
> 2. Go to **Settings** → Turn off **Kernel unmount**
>
> ### Step 3: Configure Zygisk Next
> 1. Open **KsuWebUI**
> 2. Click on the **Zygisk Next** module
> 3. Set **Denylist Policy** to **Unmount Only**
> 4. Turn on **Use anonymous memory**
>
> ### Step 4: Install Hide My Applist
> - Install Open Source HMA-OSS
> https://github.com/frknkrc44/HMA-OSS/releases
> - Enable it in the **LSPosed Manager** notification, select **Recommended**
> - Reboot
>
> ### Step 5: Configure "Manage templates"
> 1. Open **HMA-OSS**
> 2. Go to **Manage templates**
> 3. Create a **blacklist template**
> 4. Name it anything
> 5. Edit list of **0 apps invisible**, add:
> - HMA-OSS
> - KernelSU
> - All LSPosed modules installed
> 6. If new LSPosed modules are installed later, update this template again
>
> ### Step 6: Configure "Manage apps"
> 1. Open **HMA-OSS**
> 2. Go to **Manage apps**
> 3. Select the app(s) detecting root
> 4. Turn on **Enable hide**
> 5. Press **Template config**
> 6. Make sure **Work mode** is **Blacklist**
> 7. Press **Using 0 templates** and select your **blacklist template**
> 8. Confirm
>
>
>
> Magisk Alpha
>
> ### Step 1: Install KsuWebUI
> - Download and install the latest version of KsuWebUI from
> https://github.com/5ec1cff/KsuWebUIStandalone/releases
>
> ### Step 2: Hide Magisk App
> 1. Open **Magisk Alpha**
> 2. Go to **Settings** → **Hide Magisk App** (you can name it anything, e.g., `Settings`)
> 3. Disable **Zygisk**
> 4. Turn **Enforce Denylist** OFF
>
> ### Step 3: Configure DenyList
> 1. Navigate to **Configure DenyList**
> 2. Select the app(s) you want to **hide root** from (tap app first, then checkbox)
>
> ### Step 4: Configure Zygisk Next
> 1. Open **KsuWebUI**
> 2. Click on **Zygisk Next** module
> 3. Set **Denylist Policy** to **Enforced**
> 4. Turn on **Use anonymous memory**
>
> ### Step 5: Install Hide My Applist
> - Install Open Source HMA-OSS
> https://github.com/frknkrc44/HMA-OSS/releases
> - Enable it in the **LSPosed Manager** notification, select **Recommended**
> - Reboot
>
> ### Step 6: Configure "Manage templates"
> 1. Open **HMA-OSS**
> 2. Go to **Manage templates**
> 3. Create a **blacklist template**
> 4. Name it anything
> 5. Edit list of **0 apps invisible**, add:
> - HMA-OSS
> - Settings (hidden Magisk app or renamed one)
> - All LSPosed modules installed
> 6. If new modules are installed later, update this template again
>
> ### Step 7: Configure "Manage apps"
> 1. Open **HMA-OSS**
> 2. Go to **Manage apps**
> 3. Select the app(s) detecting root
> 4. Turn on **Enable hide**
> 5. Press **Template config**
> 6. Make sure **Work mode** is **Blacklist**
> 7. Press **Using 0 templates** and select your **blacklist template**
> 8. Confirm
>
> ### Step 8: Make sure Shamiko is toggled ON
>
>
---
## Play Integrity Fix
### Step 1: Configure PlayIntegrityFix
1. Open the KsuWebUI app.
2. Click on the **Play Integrity Fix [INJECT]** module.
3. Make sure **Spoof Build** and **Spoof Build (Play Store)** is enabled
4. Click on **Fetch** and choose **GitHub** to get the **latest one**
### Step 2: Check the Integrity
- Use this [app](https://play.google.com/store/apps/details?id=gr.nikolasspyr.integritycheck&hl=en) to check it
### Note: If you suddenly fail to pass Play Integrity, do Step 1 again
> Some old custom ROMS spoof old fingerprints (PIF's) by default, you'd need to disable that functionality if your ROM has it built in, I can't help much for this part
---
## Spoof Bootloader Status as Locked (Key Attestation)
### Step 1: Keybox Automation
1. Open **KsuWebUI**
2. Click on the **TEESimulator-RS** module
3. Click on the **3 dots** on the top right corner
4. Press **Keybox Automation**
5. You can set **Fetch Interval** to your liking or just leave it as it is
6. Find **Manual Actions** and click on **Fetch Key**
### Step 2: Select your app(s)
Search for the app(s) you want to **spoof bootloader status as locked**, then click on the checkbox for it
---
## Tested / Working on the following devices (I'd appreciate it if you could report your device back to me in **Issues** if it works)
- Xiaomi 14T (HyperOS)
- Xiaomi Redmi K60 Ultra 5G (HyperOS/HyperOS 2.0)
- Xiaomi Mi 11 Ultra (HyperOS)
- Xiaomi 12 (Lineage OS 22.2)
- Xiaomi 13 Ultra (HyperOS 2.0)
- Xiaomi Redmi Note 15 5G (HyperOS 2.0)
- Poco F8 Pro (HyperOS 3.0)
---
## Images
