I had rooted this device when I bought it and it was on Android 9 (See Here)

Now I upgraded the device to Android 10 with Lenovo Smart and Rescue Assistant. When I try to root it the same way I get a bootloop.

This is what I have tried.

  1. I tried using the Magisk Manager for Canary as per this info. This didn't help.
  2. I tried to flash the vbmeta.img with the option --disable-verification as per this post on xda. This did get me out of the bootloop but after it booted I didn't have root.

Any suggestions on what else I may try?

Thank You,

  • did you flash 'empty' vbmeta or just the stock one? do you have TWRP? android.stackexchange.com/q/219968
    – alecxs
    Nov 19, 2020 at 10:38
  • you can dump stock recovery with mtk-su and port TWRP from Xiaomi Redmi 6
    – alecxs
    Nov 19, 2020 at 16:48
  • @alecxs I didn't flash an empty vbmeta I flashed the original one from the firmware. I have the original boot.img file. How do I go about porting the TWRP?
    – Sruly
    Nov 19, 2020 at 21:32
  • @alecxs Is there any tutorial you can point me to? About rooting please see my answer.
    – Sruly
    Nov 20, 2020 at 15:07
  • just unpack recovery.img with osm0sis' AIK you will see two folders ramdisk + kernel. switch kernel and repack. twrp.fstab is in etc. don't know of any special but there are tutorials
    – alecxs
    Nov 20, 2020 at 16:06

1 Answer 1


I finally figured this out and got root. You need to flash the patched boot image file after you flash the vbmeta.img with --disable-verification.

Here are the steps I did to get root.

  1. Copied boot.img from the firmware to my device.
  2. Downloaded Magisk Manager. (The regular version, no need for the canary version).
  3. Patched the boot.img with magisk manager.
    1. Clicked on Install on the righthand top in magisk manager.
    2. Clicked on Next Righthand top.
    3. Selected Select and Patch a File.
    4. picked the boot.img file I had copied in step 1. Magisk manager patched the file.
  4. Copied the patched file pack to my PC.
  5. Booted into Fastboot.
  6. (Flashed the patched boot image to my device fastboot flash boot path-to-patched-boot-image) I don't think this is needed here but it is what I had done.
  7. Flashed the vbmeta.img from the firmware with the option --disable-verification. fastboot --disable-verification flash vbmeta path-to-vbmeta-imageIt does not need to be an empty vbmeta image.
  8. Flashed the patched boot image to my device fastboot flash boot path-to-patched-boot-image. (A second time, but as mention before I don't think the first time is necessary).
  9. fastboot reboot.

...And now I have root.

Disclaimer use this info at your own risk. I take no responsibility for it.

  • OK. I was only saying that for root it isn't needed the empty vbmeta Where\how can I get an empty vbmeta?
    – Sruly
    Nov 20, 2020 at 16:14
  • I just tried the line: fastboot --disable-verification flash vbmeta path-to-vbmeta-image but I get in return: fastboot: unknown option --disable-verification And then it stays in a loop when I try to power it on. Any ideas?
    – Mihai
    Dec 21, 2020 at 5:09
  • @Mihai Did you replace "path-to-vbmeta" with the actual path to your vbmeta image? If this still doesn't work you can try with the same command but flash an empty vbmeta image.
    – Sruly
    Dec 21, 2020 at 17:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .