How to Root Samsung Galaxy S9 and Galaxy S9 Plus (Exynos)

Comments 58 Comments

1. Hey! I just wanted to thank you for this guide! It worked like a charm and is super well written 🙂

   I bricked my phone after playing around with root, but then I just looked in the comments of this guide, flashed a stock ROM and repeated.

   I wish you the best – and thanks again!!

   Reply

2. it doesn’t work to install twrp and I activate the oem unlocking bro

   Reply

   1. Andrew, where exactly did you get stuck? Also, which version of the TWRP recovery did you download and use?

   2. Anyone knows Odin just stops responding after I added twrp to the AP folder, is there a specific version that I’m missing? Please help.

   3. Hi, that’s a know quirk with Odin. The program takes a bit of time to read and input the AP firmware slot. Just give it a minute and you should see the file loaded into Odin.

3. Hello really good tutorial, but I rooted my Android 10 and now I’m stuck in a bootloop, so I tried different versions of Maagisk but always in a bootloop. Could someone help me?

   Reply

   1. Moris, I will need a bit more information from your end:

      • Which version of TWRP did you exactly flash to your Galaxy S9? Also, please mention the Magisk version used as well.
      • Did you flash the RMM-Bypass ZIP file through TWRP?

   2. Thank you very much for the quick reply!
      I tried it with very different versions of TWRP and Magisk, since I have a S9 Plus Exynos I have not flashed the RMM bypass ZIP.

      I have seen in the log of TWRP in a few other tutorials a few “Mounting /apex/com.android.example”, “Mounting /vendor” and “Device is system-as-root” but in my log with all the latest versions this is nowhere to be seen even with older versions.

   3. At what point exactly does your phone enters a bootloop? After finishing the whole process?

      Here’s what I want you to do from here:
      1) Reflash stock firmware on your S9 Plus using Odin. You can use Samsung Firmware Downloader for downloading the latest Android 10 firmware for your model number and region.
      2) Boot into Download Mode and check if the RMM/KG state is “Prenormal” or “Checking”?

      Let me know what it says so that I can guide you further.

      As for the TWRP logs you saw in other tutorials, I would suggest you to ignore most of them since they are not actually from the TWRP on the S9 series.

4. I have finished all the steps given above and system has rebooted but I am unable to find the Magisk Manager in the apps

   Reply

   1. Nikhil, if your Galaxy S9/S9+ booted into the system after performing all the steps, then just download the latest Magisk APK file from GitHub and install it on your device.

      After the installation, go to the app drawer and launch the app. If everything went alright, then you should see the installed version of Magisk within the app.

   2. This tutorial worked like a charm. I had no problems whatsoever.
      The phone stayed on the kernel logo for about 10 minutes while it was rebooting. It might have actually been a shorter length of time but it’s always an unnerving experience so it probably just felt longer!

      Thank you for this – it was incredibly useful.

      Right..now to start doing some serious modding!

5. Hi Dhananjay. Thanks for the very detailed and clear article. I’ve followed your instructions very carefully to install TWRP. It’s not working for me, however.

   My phone is an S9+, Android 10, G965F, star2lte, bought in Indonesia. OEM Unlocking is visible and ON.

   After turning off the phone and rebooting using V-down+Bixby+Power, and after pressing V-up, it goes into Download mode just fine. However, RMM is displayed as in Prenormal. I waited 168h (actually 172h) to make sure that wasn’t the issue. I actually have done this more than once, after trying all types of install methods. Every time I wait 168h+, but it does not change the outcome, i.e., RMM is always in Prenormal.

   Odin (v3.14) shows “Added!”, “Auto Reboot” is disabled, the TWRP tar file is loaded into AP. When I press Start, the progress bar above ID:COM goes green until it hits the end and abruptly turns red while flashing FAILED. Then, a red line across the phone screen reads, “Only official released binaries are allowed to be flashed(RECOVERY)”.

   Are you able to help me out with this? I would not mind settling a fee for that so long as we can make it work.

   Thanks, Dhananjay, and Happy New Year to you and your family.

   Reply

   1. Hi Peter. First off, you’re welcome.

      This is odd, I guess. RMM/KG State should return back to normal/checking after the said time period. Have you tried reflashing the stock firmware from scratch and then wait for the given time? This is the only trick that comes to my mind given your situation and also because you seem to have tried everything.

      Please try this and let me know.

      And a fee is definitely not required. I do this voluntarily and free of any charges. But if you do want to support, you could whitelist my blog from the ad blocker (if you’re using one). That’s the only way I monetize this website and make a living.

      And, a very happy new year to you and your family, Peter.

6. I saw other user uploaded to YouTube regarding initial installation of TWRP at the beginning “Do not swipe in Unmodified System Partition”. He said you need to tap “keep read only” but your method to swipe.
   Here is the link to YouTube:
   https://youtu.be/-Fx8sD8yqpw?t=433

   On the ‘Unmodified System Partition’ screen, slide the ‘Swipe to Allow Modifications’ button.

   I am bit confuse which method I should follow. I am guessing it depends on OS version 8, 9 or 10.

   Reply

   1. This option basically determines if you want TWRP to be able to mount and flash the /system partition of your phone. If it’s just want to flash systemless packages (like Magisk), then you can select ‘Keep Read Only’. But if you do plan on flashing ROMs, mods, etc, you will need to allow the modifications.

      And no, it doesn’t depend on the Android version. Users were told to select ‘Keep Read Only’ while TWRP was in its initial stages of development.

7. Hi,

   Bymistake i installed RMM & Encryption disabler on android 10, Samsung S9+ , due to which there is imei error can you tell me how to fix it?

   Reply

   1. Ashish, it would be best if you flash the stock firmware and start over again.

8. HELLO SIR,
   after completed your all step by step, then i have issued with rooted phone which is was roted by your method.

   problem in the my phone,,, IMEI Number and Sim Card Network not showing.
   please sir fix it.
   I request to you
   waiting for your reply.

   sajid!

   Reply

   1. Hi Sajid. May I know if you used SuperSU or Magisk for rooting?

   2. i just trying to install MAGISK root

   3. finally my phone is rooted..

      Process of my rooted phone :

      1. 7 days before my phone stuck on samsung logo after do everything..
      2. then i was flash my phone with 4.7GB file firmware then it will be ok after flash
      3. 7 days after i am again try to root… and its time
      4. flash zip RAM Bypass file not flash in the twrp
      5. Flash file just DM/Verify….!
      6. after that magis.. install
      7. reboot my phone its successfully done.

      Anybody Have Problem reply here i will fix 😉

      And Thanks for Dhananjay Your Article Helpful!

   4. Hi Sajid, it’s good to know that it worked. However, please avoid flashing the RMM/KG bypass ZIP on Android 10. It’s only meant for Android Pie and Oreo.

   5. thanks for your reply,,!

      And if I will try to RMM/KG bypass Zip flash on android 10 , then what will be happned?

   6. It’s will probably lead to a bootloop. The RMM ZIP only supports Android Pie and Oreo.

9. Hello Master!

   with my little IT knowledge I got lost after reading the first few paragraphs but continued to scan through some of the replies there.

   All I wanted to do was to recover some 3000 pics that my other half accidentally lost during a simple transfer from Phone to PC. (Samsung Galaxy S9) She used Cut and Paste instead of Copy and Paste! half way through and she lost some 3000 pics.

   I used Kingo Root to no avail, it just keeps failing even after 100%.

   What can be done? any hope?

   Kind regards

   Alex

   Reply

   1. Hi Alex. I wouldn’t suggest using Kingo Root or any other one-click root toolkits for rooting your S9 or any other modern Android phone/tablet.

      These tools basically used exploits found in early Android versions to gain root permissions. However, thanks to Android’s new security measures in place, they will not work anymore.

      The proper way to rooting is to use a custom recovery (like TWRP) and then flash the superuser flashable ZIP (Magisk) via it, as shown in the instructions.

      Anyhow, on to the real problem now. I am not absolutely sure whether you’ll be able to actually recover the photos. But if those photos are important, I think it’s worth a try.

      First thing that you should understand is that installing custom binaries (TWRP, Magisk, etc) will trip the KNOX counter of your phone. This is irreversible. With tripped KNOX, you will no more be able to use apps like Secure Folder, Samsung Pass, Samsung Pay, etc. That’s because these apps rely on KNOX’s integrity.

      If you’re okay with that, you could surely try rooting via this method. But before that, I would also suggest you to explore other options (if any). Like taking a look at Samsung Cloud/Google Photos (if you had that installed) to check if the photos were automatically backed up there.

      Please let me know if you have any further questions. I would be very happy to provide any help that I can.

10. Please let me know i am using android 9 on my galaxy s9 plus with magisk installed and rooted.

    I am not able to login my samsung account and not able to use fingerprint and biometric login via samsung pass app. Plz guide me if i can use these thing on my rooted s9 or not. Your reply will be highly appreciated. And plz let me know if i want to update my rooted s9plus to android 10 what r the possible ways.

    Reply

    1. Hi Ismail. As far as things like Samsung Pass, Health, Secure Folder are concerned, they will not work once KNOX is tripped.

       Now Samsung account is a different matter. Did you have your Samsung account logged in before you began the rooting process?

       I tried searching on this and found a plausible solution. According to an XDA user:
       To get rid of Samsung account request when the device is rooted, you need to freeze the system app "Samsung Experience Service". Useful to set lock screen bypassing samsung login. When finished, unfreeze it to avoid the bootloop at next reboot.

       This will allow you to setup biometrics by bypassing the Samsung account request. However, I believe you also want to log into your Samsung account for using Galaxy Store or other things, right?

11. Hello again, Dhananjay!

    After successfully rooting my Galaxy Tab S4, I decided to update my Galaxy S9+ from Oreo to Pie, and following your clear, easy-to-follow instructions here, I was able to root firmware version G965FXXU7CSK1 with no difficulty.

    Thank you once again for providing this valuable resource: your instructions are far simpler and clearer than anything else I have found, and if I decide to update further from Pie to Q at a later stage, I will let you know how I get on!

    Reply

    1. Hi Arthur. I am really happy that my tutorials have proved useful to you. Your kind words mean a lot to me, so thanks to you! I will surely give my best to help you should you need it.

12. Hi, I appreciate your time to help.
    Can you please send me a link or description to restore the stock firmware and undo twrp etc.
    I’m aware I need to replace twrp and not delete it.
    But is it necessary to replace twrp to run stock firmware?
    Also I can’t seem to download the latest firmware without paying for an account at sammobile. Can you verify that? Is the software open source?

    I’ve followed your steps exactly and it all works but I wan’t to give my s9 with build qp1a 190711 020 n960f xxs5 dtb6 and android 10.

    Reply

    1. Hi Skive. Okay, so the steps you need to follow could be found in this guide. It’s quite easy IMO.

       As for downloading the latest firmware, use the Frija Tool. It downloads the stock firmware file directly from Samsung’s firmware database.

       Online databases like SamMobile are legit as well. However since they require a lot of server space to host the firmware for a long list of Galaxy devices, they make it up by limiting the free downloads with speed caps and charging for full speed downloads. Justified on their end.

       I personally always use the Frija or SamFirm tool. You’ll get the fastest download speed possible.

13. Hi
    My S9 has a build of
    PPR1.180610.011.G960FXXU7CSJ1

    Can you let me know which version of ElementalX i should be using?

    Thanks very much!

    Reply

    1. Hi Gareth. CSJ1 is the October update. The EX kernel for the same is out, but only available via the EX Kernel Manager app for now. I suggest you wait a bit until the newer version of the kernel is uploaded here. Once it is, I will be updating this guide with links as well.

    2. Hey mate running S9+ international exynos build number –

       PPR1.180610.011.G965FXXS7CSJ3

       I have the November security patch but was wondering if i was to purchase the EX kernel manager could i bypass waiting for it to be uploaded to that website?

    3. Hi Chris. EX kernel for CSJ1 is already available through the EX Kernel Manager app. On the other hand, for CSJ3 (the one that you have installed) the kernel is not released yet, because Samsung is yet to push the kernel source code. The developer will post the CSJ3 build as soon as the source code is available.

       And yes, if you purchase the app, you wouldn’t have to wait for the build to be uploaded on the website. Users with the app will straightforward get the latest build of the kernel when available.

14. wow was thinking of rooting my s9plus after reading every thing here not sure I would get all the steps right and all the button press in the right order?
    may be I should not do it?
    If I mess it up how hard is it to working again or back to stock

    Reply

    1. Hi. Although the process is quite easy, I can understand how hard it could be to perform if you’re new. This specific guide would look more complex/lengthy when compared to several others out there when you compare. However, there’s a reason for that. I took my time to write it all up in detail, split up the procedure into different sub headings so that it would be easier for users who are new to the scene.

       “not sure I would get all the steps right and all the button press in the right order? may be I should not do it?” – You wouldn’t know until you try.

       Here’s what I recommend:
       1) Take a backup (Apps, messages, contacts, call logs, emails, and the complete internal storage)
       2) Go through the instructions twice before performing them. Ensure that you understand exactly what exactly is going to happen.
       3) Also, don’t forget to acknowledge that services like Samsung Pay, etc will not work after rooting. So, will Secure Folder, or any other Samsung service/app that relies on KNOX.
       4) Finally start performing it.

       In any case if you mess up, it’s quite easy to restore back to the stock firmware. But I am sure you’ll get through it easily.

15. Hi,

    Great Post. I just rooted my S9 on Android 9 pie. After the reboot I am unable to use intelligent scan and any locking mechanism. As they all get stuck when setting them up. Any idea how to fix this? I followed the guide down to the T.
    Also can you tell me how to fully remove root and put everything back to stock

    Reply

    1. Hi Jay! Thanks for the appreciation.

       Below, I am quoting an explaination put up by the official maintainer of TWRP for the S9/S9+:

       Samsung implemented security measures such as "Real-time Kernel Protection (RKP)" and "RKP Control Flow Protection".
Those security measures are intended to block control flows such as privilege escalation, memory kernel code modification, etc which are not authorized by Samsung.
If those are not disabled, processes (such as daemon of root solutions) that violated those security rules will fall into deadlock.
Deadlocked processes will then consume large amount of resources (leads to performance issues, battery drains) and eventually crash the system.
Technically it is possible to disable those security measures by hex editing stock kernel but just simply flash a custom kernel is better in my opinion.
TL;DR: Flash custom kernel before root or be screw

       A simple way to fix this issue is:
       1) Download latest ElementalX kernel and Magisk 18.1 zip files
       2) Reboot your S9/S9+ into TWRP
       3) Flash EX kernel zip and then Magisk zip (In that order)

       Finally, reboot your phone and it should start working again.

16. When I root and get back onto my phone and try to create a password or sign into my Samsung account it does not let me. Then when I reboot my phone it sends me into an infinite boot loop. How do I fix this? My model number is SM-G960F.

    Reply

    1. Hi Lewis. Have you flashed ElementalX kernel and then Magisk?

    2. Yes I have, ive tried this multiple times and keep getting the same error.

    3. Also when i try and download rmm state bypass v2 it redirects me back to the same page with no download

    4. Hi Lewis. Instead of directly clicking on the link, try right-click and select ‘Save link as’ option. After selecting, you might have to wait up to 15 seconds for the file to start downloading. I have experienced the same and this seems to work for me.

17. does this root remove secured folder and samsung pay or do i still have all regular funtionality?

    Reply

    1. Hi Brent. It will prevent you from using features like that. But that’s where the beauty of Magisk lies. You can use Magisk Hide after rooting to hide root from such apps and they should work again without problems.

18. I followed the guide and everything went well; unfortunately, however, I went into the app Magisk and I updated (as he asked me), at which point the phone is no longer turned on (trying to restart but could not). At that point I entered the Twrp with the combination of keys, I made a format, at which point the phone turned on but Magisk was gone and I have problems with the Samsung account (I enter the password and nothing happens) . How can I solve the two problems? Thank you

    Reply

    1. Hi Sabrina. The best and most clear solution to this is to first flash the Samsung stock firmware using Odin. You can grab the latest firmware from websites like sammobile[dot]com. Once you have flashed that, you can start over with the rooting procedure.

19. Why if it boots into OS after twrp I cant flash? how do I know the Prenormal RMM State has been set???

    Reply

    1. Hi. You can boot into Download Mode, and you should see “RMM State: Prenormal” there. Another way to find this out is, you will not see the “OEM Unlock” toggle in Developer options.

       In this case, you will have to keep your phone connected to the network and running for straight 7 days without a reboot to get the “Normal” RMM State back. Once it is back, you can continue flashing. Just ensure that you flash the RMM State bypass zip every time you flash custom stuff. It will prevent RMM State from appearing again.

20. Thanks for this great article!

    I was looking for a rooting solution that would give me access to the system partition where I could install an anti-theft .apk. I have followed your instructions and I have used Magisk, but after reading some forums I am led to believe that the app won’t survive a factory reset in the system partition (Which was the whole point of me rooting my phone), but it would under SuperSU.

    Is it a simple procedure to switch from Magisk to SuperSU or do I have to somehow undo everything first? I am not a developer just a regular guy that can follow instructions. Thank you for your time if you can help.

    Reply

    1. Hi Darren. Thanks for appreciating.

       If an app is installed to the system partition, then it shouldn’t be removed upon a factory reset. Only if you specifically erase and reflash the system partition. A normal factory reset via the phone’s settings or stock recovery, or even a custom recovery won’t remove the app.

       I am not even sure if SuperSU would be able to help you root the latest Samsung firmware. On the other hand, Magisk integrates all the specific patches for some Samsung-specific security features.

       I hope this helps. If you have any more questions, please feel free to drop a comment.

    2. Thanks Dhananjay for your time and help I really appreciate it. I am trying to protect my daughters new phone with an anti-thief app (Cerberus). I am using a ‘Terminal App Systemizer’ module in Magdisk to convert the app into a system app so that it won’t get wiped on a factory reset. When prompted I transfer it to ’../system/priv-ap’. Everything on the face of it appears to work ok and the Systemizer module recognises that it is transferred. My problem is it still disappears when I do a factory reset. Is there something I am missing?

       PS. Following a Factory reset Magisk Manager is still there but when I open it, it prompts for confirmation to install. Is that normal?

    3. Hi Darren. Instead of that, why don’t you just add a Google account (That will enable FRP on the phone). So even if someone resets it after stealing, he would not be able to log into the phone without the ID and password. A phone with FRP lock is useless and no one can open it.

       Next, make sure “Enable OEM Unlock” is DISABLED inside developer options. This will prevent any outside flashing of firmware or other flashable images, to overwrite the firmware.

       Third, use Android Device Manager (Now, “Find My Device”). This way, you will be able to locate your phone using your PC. Just make sure that mobile data is set to ON at all times for this to work.

    4. Hey …how about rooting the snapdragon variant…???

    5. Hi. It depends on what model you are using. The U variants are not unlockable, so cannot be rooted. However, you can install TWRP and root Galaxy S9 (SM-G9600) and Galaxy S9+ (SM-G9650) just fine.