Mastering KernelSU Removal: A Comprehensive Guide for Your Mi 10T Pro (Apollo) and HyperOS

Navigating the complex landscape of custom ROMs and system modifications can sometimes lead to unexpected challenges. When you’re seeking to remove KernelSU, especially after installing a ported HyperOS ROM on your Mi 10T Pro (codenamed Apollo), it’s crucial to approach the process with a clear understanding and the right tools. This guide is meticulously crafted to provide you with the most detailed and effective methods to achieve your goal, ensuring a smooth transition and a stable device experience. We understand that you’ve encountered issues like device misidentification (Redmi K30 Ultra instead of Mi 10T Pro) and, more critically, bootloops caused by incompatible KernelSU modules or attempts to flash alternative kernels. Our aim is to empower you with the knowledge to uninstall KernelSU from boot.img without relying on stock firmware or another compatible ROM, directly addressing the core of your inquiry.

Understanding the KernelSU Ecosystem and Your Specific Situation

Before we delve into the practical steps of KernelSU removal, it’s vital to grasp why such a situation arises. KernelSU is a powerful tool that grants root access at the kernel level, offering granular control over your Android device. However, its compatibility is deeply intertwined with the specific kernel version and configuration of your ROM.

Your experience with a ported HyperOS ROM on the Mi 10T Pro presents a unique set of circumstances. Ported ROMs, by their nature, are adapted from one device to another, and sometimes this adaptation isn’t perfect. This can lead to:

• Device Identification Discrepancies: As you noted, your device being identified as a Redmi K30 Ultra is a common occurrence with ported ROMs. While often cosmetic, it can sometimes indicate underlying hardware or software mismatches that might affect compatibility with certain modifications.
• KernelSU Module Incompatibility: KernelSU modules are designed to work with specific kernel versions. A ported ROM might not carry over the exact kernel signatures or configurations that your previously installed KernelSU modules were built for. This mismatch is a primary culprit behind non-functional modules and subsequent bootloops.
• Bootloop Issues: When a kernel modification or a root-accessing module causes a critical error during the boot process, the device enters a bootloop, repeatedly restarting without fully loading the operating system. This is precisely what you’re experiencing when attempting to install new kernels with an incompatible KernelSU setup.

The desire to remove KernelSU from boot.img without flashing stock or another ROM stems from a need for a direct, in-place solution. This approach bypasses the potentially time-consuming and data-loss-prone process of reverting to stock firmware or finding a stable, alternative ROM.

Prerequisites for a Successful KernelSU Removal

To effectively remove KernelSU from your Mi 10T Pro’s boot.img, you’ll need to prepare your device and your computer. Ensuring you have the following in place will greatly increase your chances of success:

• A Computer: A Windows, macOS, or Linux computer will be necessary for executing commands and manipulating files.
• USB Debugging Enabled: On your Mi 10T Pro, navigate to Settings > About phone and tap on the Build number seven times to enable Developer options. Then, go to Settings > System > Developer options and enable USB debugging.
• ADB and Fastboot Installed: These are essential command-line tools for interacting with your Android device. You can download the Android SDK Platform-Tools from the official Android developer website. Ensure that the adb and fastboot executables are accessible from your command prompt or terminal.
• A Custom Recovery (Optional but Recommended): While this guide focuses on modifying the boot.img directly, having a custom recovery like TWRP (Team Win Recovery Project) can be invaluable for backing up your current system and restoring it if anything goes wrong. If your current ROM doesn’t have one, you might need to flash one via fastboot first. However, if you’re in a bootloop, this might not be an immediate option.
• Your Current boot.img: This is the most critical component. You need to extract the boot.img file from your currently installed HyperOS ROM. If you don’t have it readily available, you might need to find a flashable zip or extract it from the ROM’s firmware package.
• A Clean boot.img (or a KernelSU-Free boot.img): This is what you will ultimately flash to replace your current boot.img. It will either be a stock boot.img from your device’s original firmware (which is what you’re trying to avoid directly flashing) or a specially prepared boot.img that has had KernelSU and its associated components removed.

Method 1: Extracting and Modifying Your Existing boot.img

This is the most direct approach to remove KernelSU from boot.img without using stock. It involves using specialized tools to unpack your current boot.img, remove the KernelSU components, and then repack it before flashing.

Step 1: Extracting the boot.img from Your ROM

If you have the HyperOS ROM in a flashable zip format, you can often find the boot.img file directly within the archive. If not, you might need to extract it using tools like 7-Zip or WinRAR. In some cases, the boot.img might be part of a larger firmware image that requires specialized unpacking tools for your specific Xiaomi device.

Step 2: Unpacking the boot.img

Once you have your boot.img file, you’ll need a tool to unpack it. The most common and effective tool for this is Magisk itself. Although you are trying to remove KernelSU, Magisk’s underlying unpacking and repacking capabilities are universally useful for boot image manipulation.

1. Download the Latest Magisk Zip: Go to the official Magisk GitHub repository and download the latest Magisk release zip file.

2. Install Magisk Manager: If you can boot into your OS, install the Magisk Manager APK. If not, you’ll be working solely from your computer.

3. Use Magisk to Patch boot.img (and then extract): This might seem counter-intuitive, but Magisk is excellent at deconstructing and reconstructing boot images.

   • Place your boot.img file in a convenient folder on your computer.
   • Transfer the boot.img to your phone’s internal storage (or anywhere accessible via ADB).
   • Open the Magisk app on your phone.
   • Tap the Install button.
   • Choose Select and Patch a File.
   • Navigate to and select your boot.img file.
   • Magisk will then patch this boot.img and save it in your Downloads folder (usually named magisk_patched-....img).
   • Crucially, do NOT flash this patched image yet. Instead, transfer this newly patched image back to your computer.
   • Now, using your computer, you can use the Magisk uninstaller zip or specific Magisk utilities that allow for unpacking. A more direct way is to use AIK-Linux (Android Image Kitchen) or similar tools that can unpack boot.img.

   Alternatively, and more directly for removal:

   • You can use tools like extract-ik or Magisk’s internal unpacking capabilities if you can run Python scripts. For many users, the simplest approach is to use the Magisk app as described above to get a “base” for manipulation.
   • Using AIK-Linux: Download AIK-Linux. Place your original boot.img in the in folder of AIK-Linux. Run the repack-linux.sh (Linux/macOS) or repack_linux.bat (Windows) script. This will extract the contents of your boot.img into the out folder.

Step 3: Identifying and Removing KernelSU Components

This is the most technically involved step. KernelSU inserts its own modules and modifies the kernel’s command line or init process.

• Examine the Extracted Files: After unpacking your boot.img using a tool like AIK-Linux, you will find several files and directories in the out folder. The most important ones are:
  • kernel: The Linux kernel image itself.
  • dtb or dtbo: Device Tree Blob or Overlay.
  • ramdisk.cpio.gz: This is the initial RAM disk, which contains the scripts and binaries that run when the device starts up before the main Android system loads. This is where KernelSU often integrates itself.
• Focus on the Ramdisk: KernelSU typically modifies the init binary or scripts within the ramdisk to load its modules and manage root permissions.
  • Unpacking the Ramdisk: The ramdisk.cpio.gz file needs to be further unpacked. You can use gzip -d ramdisk.cpio.gz followed by cpio -idmv < ramdisk.cpio.
  • Scanning for KernelSU Signatures: Look for files and directories that are characteristic of KernelSU. This might include:
    • Files named kernelsu, ksud (KernelSU Daemon), or similar.
    • Entries in init.rc (or related *.rc files) that explicitly load KernelSU services or modules.
    • Modified init binary, which is complex to analyze without reverse engineering tools.
    • Specific KernelSU-related libraries or binaries.
  • Removing the identified components: Carefully delete or rename the files and directories you identify as belonging to KernelSU. Extreme caution is advised here. Removing the wrong file can corrupt your boot image and prevent your device from booting. If you’re unsure, err on the side of caution.
  • Re-packing the Ramdisk: After cleaning the ramdisk contents, you need to re-pack them into a cpio archive and then compress it back into ramdisk.cpio.gz.
    • find . | cpio -o --format=newc > ../ramdisk.cpio (run this command from within the unpacked ramdisk directory)
    • gzip ../ramdisk.cpio
  • Replace the original ramdisk.cpio.gz in the AIK-Linux out folder with your newly created one.

Step 4: Repacking the Modified boot.img

Once you have cleaned the ramdisk (and potentially other components if you identified KernelSU modifications elsewhere), you can repack the boot.img.

• Using AIK-Linux: Place your modified ramdisk.cpio.gz (and any other modified files) back into the respective folders within the AIK-Linux out directory. Then, run the repack-linux.sh or repack_linux.bat script again. This will create a new boot.img in the Images folder within AIK-Linux. This new boot.img is your KernelSU-free boot image.

Step 5: Flashing the Cleaned boot.img

Now that you have your modified boot.img ready, you can flash it to your device using fastboot.

1. Reboot to Bootloader: Connect your phone to your computer via USB. Open a command prompt or terminal in your AIK-Linux directory (or wherever your new boot.img is located) and run:

   adb reboot bootloader
   

   Your phone should now be in fastboot mode.
2. Verify Fastboot Connection: You can check if your device is recognized by fastboot by running:

   fastboot devices
   

   You should see your device’s serial number listed.
3. Flash the boot.img: Flash your newly created boot.img by running:

   fastboot flash boot your_cleaned_boot.img
   

   Replace your_cleaned_boot.img with the actual name of the boot.img file generated by AIK-Linux.
4. Reboot System: Once the flashing process is complete, reboot your device:

   fastboot reboot
   

Your device should now boot without KernelSU.

Method 2: Using a KernelSU Uninstaller (If Available)

While your prompt specifically asks to avoid stock or other ROMs, it’s worth mentioning that if a specific KernelSU uninstaller script or flashable zip were to become available for your particular ROM version, that would be the most straightforward method. However, these are rare, especially for ported ROMs. If you happen to find one that explicitly targets the KernelSU version you have, flashing it via your custom recovery (if you can boot into one) would be the simplest path. Since this is unlikely to be your immediate solution given the bootloop scenario, we prioritize direct boot.img manipulation.

Troubleshooting Common Issues

Even with meticulous steps, you might encounter problems. Here’s how to address them:

• Device Still Bootlooping:
  • Incorrect boot.img Modification: This is the most probable cause. You might have accidentally removed a critical system file during the ramdisk cleaning process.
  • Kernel Incompatibility: Even after removing KernelSU, the underlying kernel might still have issues with your HyperOS port.
  • Solution: Revert to a known good boot.img. If you created a backup of your original boot.img before modification, you can flash that using fastboot: fastboot flash boot original_boot.img. If you don’t have a backup, you’ll need to find the stock boot.img for your specific HyperOS port or the closest stable firmware for your Mi 10T Pro.
• Fastboot Errors:
  • “Waiting for device”: Ensure USB debugging is enabled, your USB cable is functional, and you have authorized your computer for ADB access on your phone.
  • “Flashing is not allowed” or similar errors: Some devices have a locked bootloader or specific partitions that prevent direct flashing. Ensure your bootloader is unlocked.
• Magisk Manager Not Detecting Root: After successfully booting, if you don’t have root access (which is expected if you removed KernelSU and didn’t install Magisk’s own root solution), this is normal. If you intended to install Magisk for root, you would proceed with flashing the Magisk-patched boot.img after verifying your system boots clean.

Post-Removal Steps and Best Practices

Once you have successfully removed KernelSU from your Mi 10T Pro, here are some recommendations for ensuring a stable and optimized experience:

• Verify System Stability: Spend some time using your device to ensure there are no lingering issues, crashes, or unexpected behavior.
• Consider a Different Root Solution: If you require root access, you might consider installing Magisk instead. Magisk is renowned for its systemless approach and extensive module support, which often boasts better compatibility across different ROMs and kernel versions. You can achieve this by obtaining a clean boot.img (perhaps from a different, compatible HyperOS build or a stable MIUI ROM for your Mi 10T Pro) and patching it with the latest Magisk Manager APK, then flashing the patched boot.img via fastboot.
• Module Management: If you were using KernelSU modules, you will need to find Magisk-compatible alternatives if you decide to root with Magisk. Always ensure modules are compatible with your Android version, device, and kernel.
• Future Updates: When updating your HyperOS ROM, be prepared for the possibility that KernelSU (or any other root solution) might be removed or overwritten. You will likely need to re-apply your preferred root method after each major ROM update.

Conclusion: Regaining Control of Your Mi 10T Pro

The journey to remove KernelSU from your Mi 10T Pro running a ported HyperOS ROM can be challenging, particularly when dealing with bootloops and device misidentification. By meticulously following the steps outlined in this guide, focusing on the direct manipulation of your boot.img using tools like AIK-Linux, you can effectively strip away KernelSU and restore stability to your device. Remember that precision and caution are paramount. Backing up your data before attempting any system-level modifications is always a wise precaution. With a clean boot.img and the right approach, you can overcome these hurdles and enjoy a seamless Android experience tailored to your preferences. We are committed to providing you with the most effective solutions to manage your device’s root access and system modifications, ensuring you have the power and control you desire.