Disclaimer: for advanced power user only. If you don't understand what your are doing, then don't do it.
- Phone unlocked (OEM unlock / Mi unlock)
- USB debug enabled
Rooting with Magisk#
Plug your phone to your PC with an USB cable.
adb devices to pair your PC with your phone (accept the popup on the phone).
Extract the ROM to a folder (eg.
7z x miui_ALIOTHEEAGlobal_V18.104.22.168.SKHEUXM_17e135935d_12.0.zip -omiui.
As we can see on Magisk app, the POCO F3 has a ramdisk, so as
explained in Magisk documentation we need to fetch a copy of
boot.img. But as we can see the ROM image contains only a big
$ 7z l miui_ALIOTHEEAGlobal_V22.214.171.124.SKHEUXM_17e135935d_12.0.zip
We'll have to extract
payload.bin. For this we'll use
payload dumper (see Android OTA payload dumping / extraction: 4 tools review to see how to do it with
ssut/payload-dumper-go which is much faster).
$ git clone https://github.com/vm03/payload_dumper
Install the dependencies, for me on ArchLinux:
pacman -S python-protobuf python-six --needed --asdeps && pikaur -S python-bsdiff4,
else you can still create a virtual environment and pip install
requirements.txt or use the docker image.
Then launch the extraction:
$ python payload_dumper.py ../miui/payload.bin
The extracted boot image is stored in
We have a separate vbmeta partition because
vbmeta.img is extracted from the firmware
package and we can also confirm by running
adb shell ls -l /dev/block/by-name
We can copy the boot image we extracted to the phone with the following command:
$ adb push output/boot.img storage/self/primary/Download/
Now we can click
Install on the Magisk app. You will have to select
from the download folder to select the image to patch.
Then we'll download the patched image to our PC (the path is written in Magisk logs).
$ adb pull /storage/emulated/0/Download/magisk_patched-[ramdom].img
Treble Check app show we have a A/B partition system, so this will change the flash method.
Reboot the phone in bootloader/fastboot mode:
$ adb reboot bootloader
In fastboot mode flash the boot image:
$ fastboot flash boot_ab magisk_patched-[ramdom].img
Now reboot the phone.
We can launch the Magisk app to check the root was successful.