Marshmallow Root for Nexus 5, 6, 7, 9 and Player by Chainfire

Chainfire just came out of his sabbatical and he so came with a bang! The developer of SuperSU has released modified boot images for Nexus 5, 6, 7, 9 and Player running Marshmallow update, so that you can obtain root on Android 6.0 access easily.

What is involved is flashing of modified boot images first, followed by a TWRP flash of new SuperSU 2.50.

So, it’s first flashing the boot images using fastboot mode, follow by TWRP flash in the very next command in fastboot.

Next, you gotta run the TWRP and flash the SuperSU 2.50 on your device to obtain root.

That’s it.

Btw, there is also another way to root Marshmallow Update, given here.


  • Download modified boot image files:
    • Nexus Player — Link | File: (5.97 MB)
    • Nexus 5 — Link | File: (7.82 MB)
    • Nexus 7 WiFi — Link | File: (7.24 MB)
    • Nexus 7 LTE — Link | File: (7.24 MB)
    • Nexus 6 — Link | File: (7.78 MB)
    • Nexus 9 WiFi — Link | File: (7.70 MB)
    • Nexus 9 LTE — Link | File: (7.70 MB)
  • Download TWRP recovery:
    • Nexus Player — Link
    • Nexus 5 — Link
    • Nexus 7 WiFi — Link
    • Nexus 7 LTE — Link
    • Nexus 6 — Link
    • Nexus 9 WiFi — Link
    • Nexus 9 LTE — Link
  • Download SuperSU root packageLink | File: (3.8 MB)

Here is what we’re gonna do with the above.

We are going to install the modified boot image first, then TWRP recovery, and will then use the TWRP to flash all new SuperSU 2.50 package to acquire root access.


Warranty may be void of your device if you follow the procedures given on this page. You only are responsible for your device. We won’t be liable if any damage occurs to your device and/or its components.


Backup important files stored on your device before proceeding with the steps below, so that in case something goes wrong you’ll have backup of all your important files.

Marshmallow Root Video Tutorial

Here is a video tutorial right below that shows how you can root your nexus device using Chainfire’s root method, and it uses the guide below exactly.

It’s good if you watch the video and proceed with the guide. Especially if you are new to rooting and flashing stuff using fastboot commands and TWRP.

How to Root Marshmallow Update on Nexus devices

Step 1. Download the three files required for Marshmallow root using this method. So, download the modified boot file (in .zip format), then TWRP file, and then the SuperSU 2.50 file. Keep them in a new folder called root6

Step 2. In root6 folder, extract the zip file to get boot.img file from it. Rename the TWRP recovery file to twrp.img — this makes it easy to enter commands when installing the boot and TWRP recovery below in this guide.

So, you now have boot.img and twrp.img in the folder called root6, right?

Step 3. Install ADB and Fastboot drivers on your Windows PC.

Step 4. Connect the device to PC, and transfer the SuperSU file to your Nexus device. Remember the location of the file. Then disconnect the device from PC.

Step 5. Boot your device into bootloader mode. For this,

  1. Power off the device. Then wait for 4-5 seconds after screen goes off.
  2. Press and hold Volume down + Power button together to enter bootloader mode. You will see FASTBOOT written at top.

Step 6. Now, open command window in the root6 folder, in which you have the modified boot and TWRP files. For this:

  1. Open that root6 folder and then left click on empty white space in the folder.
  2. Now, while holding shift key, right click on empty white space to get a pop-up as shown below.
  3. Now choose Open command window here option from that.

You will see a command window open up, with location directed to root6 folder.

Step 7. Test whether fastboot is working alright. In the command window by running the following command.

fastboot devices

→ Upon this, you should get a serial no. with fastboot written after it. If you don’t get fastboot written on cmd window, then it means you need to reinstall adb and fastboot drivers, or change restart PC, or use original USB cable.

Step 8. Make sure your Nexus device is bootloader unlocked. Skip this step if your device is already unlocked (check the Lock status at bottom of the screen in bootloader mode).

If your device is not bootloader locked, then do this to unlock bootloader of it. This WILL DELETE everything on the device. Device will restart after this,

  1. Run the following command first.
    fastboot oem unlock
  2. Now, look at device’s screen, and press Volume up button to choose Yes. (Upon doing this, your device’s all apps and data will be deleted.)

→ Because unlocking the bootloader will delete everything on device, you will need to transfer the SuperSU file again (step 4).

Step 9. Flash modified boot image now. Use the following command for that.

fastboot flash boot boot.img

(You have to use the boot image’s filename in the above command, which in our case is boot.img, from step 2.)

Step 10. Flash TWRP recovery image now. Use the following command for that.

fastboot flash recovery twrp.img

(You have to use the recovery image’s filename in the above command, which in our case is twrp.img, from step 2.)

Step 11. When done, simply reboot to Recovery mode now.

For this, disconnect the device. Now, use Volume up/down button to bring up RECOVERY menu, and then use Power button to select it.

You will boot into recovery mode now, and will see TWRP recovery.

Step 12. Now’s the time to root Marshmallow update on your Nexus device. Install SuperSU now.

In TWRP, tap on Install, and then select the SuperSU 2.50 file. Next, do the swipe action at bottom of the screen to flash the SuperSU file.

Step 13. When done, tap on Reboot System button to restart the device.

That’s it. Your Nexus device on Marshmallow update is now rooted with Chainfire’s root trick.

Need help? Let us know via comment section below.

Via Chainfire

  • 2568 Posts
Kapil still loves his Galaxy S2 i9100! No, really. And Galaxy Nexus! Need we say more what kind of guy he is? And he's also a die-hard Liverpool FC fan. Email:
  • Works fine until i start twrp – input password for encrytion, and i don’t know the password 🙁

    • Same here. Can get around it?

      • Krishna

        That’s because your have enabled encryption on your device, and TWRP isn’t overriding it.
        Reboot your device, and disable the encryption. And then try this, it should work when encryption is totally off.

        On Nexus 6 and Nexus 9, encryption is applied by default, and hence you may need a kernel that doesn’t force encrypt. We have exactly that above actually, the force-encryption feature disabled, but if the device is already encrypted, then that needs to be gone first.

        Try and let me know then.

  • …is it correct that the link of the mod-bootloader from n9-lte goes to the fugu-bootloader?

  • Manolo

    After flashing the boot.img on my Nex5 it stucks showing the google logo… the link points to the volantis boot.img not the hammerhead.

    search for “hammerhead-mra58k-boot chainfire” on xda forum to find the right one.

    Works like a charm…

    Thanks a lot

    • Krishna

      Okay, links have been fixed. Thanks for notifying us. Hope you didn’t have much trouble. And, any feedback for the guide?

      • Born Blah

        Beautiful hiss. These give me hope for the future of the moding world, on Android. Your format is the most reassuring and accessible to the most people. It’s complete without being too detailed.

  • Password issues in twrp. Only had this problem since marshmallow update and I’ve no security on the device?

  • RaF

    Здравствуйте у меня nexus 5. всё чотко как у вас но в FastBoot в низу lock state locked как изменить?

  • RaF

    Hello me what to do I have done 10 in a step video, and made recovery mode phone periodically reloaded . help me please.

    • RaF

      Hello all I have got to bring to mind , but when I walked into TWRP fundamentally found SuperSU

  • jojo

    I fucked up bigtime i get – Unable to mount Data

  • Worked fine here. One thing to note if your phone updated OTA to MRA58N you may want to download the latest boot.img from xda. It’s in the SuperSU beta thread.

  • Anthony

    I got to step 11, then now my phone keeps going from google logo to the blue/black screen with the text boxes and then it restarts back to google logo then the blue/black screen. help please

  • Krishna

    Make sure you have the right boot.img in your folder. And then issue that command again with device in fastboot mode. It should work flawlessly. Make sure you are not using recovery image for that command, as it requires boot image only. Re-do it. It would work.

  • Nick

    Does the modified boot image change the kernel of the devices (In my case Nexus 7 2013 Razor)

  • Justin

    followed the steps, but after flashing SuperSu (tried with v2.48 and most recent v 2.52 beta) after rebooting it keeps playing the booting animation of android, without going further. I have a Nexus 7 2013 With Wi-fi, so as a base I started with the factory image for Android 6.0.0.

    It seems that whatever I do, after flahing SuperSu it keeps getting in a loop (displaying the Android animation).Anyone else encountered this or know the solution to this problem? What am I doing wrong here?

  • Born Blah

    Thank you for this well written guide. It’s explained with such care for accessibility & detail.

  • Born Blah

    For the first time, EVER, I deliberately clicked several ads in appreciation for the couple guides I’ve just read on this site. Exemplary work.

    • Krishna

      haha.. thanks! Ad companies are clever enough to detect appreciation-clicks and genuine clicks.. but thanks anyway!! 😀

  • bandit1200n

    Will this work for Marshmallow 6.0.1 on Nexus 7 (2013)?

    • Krishna

      no probably. Download the latest version of kernel perhaps, that might work. BTW, if you have TWRP installed, simply flashing the SuperSU 2.65 and above will do. You don’t need custom kernel or anything else with supersu 2.65 and above.