Contents (expandable)
This guide will be outdated if not updated constantly.
Last updated on 2026-06-28
Following actions should be done with understanding the risk of losing your data and the possibility of bricking your device. All information provided here is based on publicly available projects.
1 - Rooting Methods (Links)
Personal recommendation for bronco: APatch/FolkPatch, Magisk
1.1 - KernelSU workaround
KernelSU manager patches boot image of the ThinkPhone with a wrong KMI resulting in no root access, the correct KMI version that works with bronco’s kernel is **android12-5.10**.
Use KernelSU CLI (“ksud”) to patch boot image with the correct KMI version.
Another way is to use GKI-images, but I recommend using native kernel.
1.2 - Rooting the device
Requirements: unlocked bootloader and ADB tools on computer.
1.2.1 - KernelSU (not tested)
- Download boot.img (LOS Download) or pull from device.
- Download ksud tool, read usage information, patch boot image with correct kmi:
--kmi android12-5.10
- Reboot phone to fastboot, recheck phone connection with
fastboot devices and run fastboot flash boot patchedimagename.img
- Reboot.
1.2.2 - SukiSU (tested)
- Download boot.img (LOS Download) or pull from device.
- Download and install latest SukiSU manager, patch boot.img, select
android12-5.10 KMI, copy patched image to PC.
- Reboot phone to fastboot, recheck phone connection with
fastboot devices and run fastboot flash boot patchedimagename.img
- Reboot.
1.2.3 - APatch / FolkPatch (tested)
- Download boot.img (LOS Download) or pull from device.
- Download and install latest commit version of APatch manager (from actions)
- Patch boot.img with manager, copy patched image to PC.
- Reboot phone to fastboot, recheck phone connection with
fastboot devices and run fastboot flash boot patchedimagename.img
- Reboot.
1.2.4 - Magisk
https://xdaforums.com/t/how-to-root-the-motorola-thinkphone-xt2309-2-and-xt2309-3.4646332/
2 - Device Specific Patches
- Flickering screen
LineageOS Bug, can be fixed by setting high and low refresh rates to same number and enabling “Disable HW Overlays” parameter in developer options. You can use a module developed by me to persist the setting after reboot.
3 - Root Hiding
General recommendations:
- Install only modules you trust and know their purpose.
- Keep things minimal, this minimizes traces and obsolete files.
- Think about the level of hiding you need.
3.1 - General solutions
- Zygisk: ZygiskNext, ReZygisk
- Keystore spoofer: Tricky Store, TEESimulator, TEESimulator-RS
- Play Integrity: PlayIntegrityFork, others?
- Props: Specter, Treat Wheel
- App hiding: HMA-OSS (Zygisk + LSPosed)
- LSPosed: Vector, Official LSPosed or forks
3.2.1 Specific solutions
