[Xiaomi 11 Lite 5G NE] zgfg:
Upon waiting the standard 168 hours, I successfully unlocked my new Lisa (Xiaomi 11 Lite 5g NE)

---

Since I had MIUI EEA 12.5.8 (A11), I downloaded the miui_LISAEEAGlobal_V12.5.8.0.RKOEUXM_700eb7116a_11.0.zip (use MIUI Downloader app from Playstore to make it easy).

Unzipped and found payload.bin inside - used Payload_Dumper (search on XDA) to extract boot.img

I installed Magisk Alpha 24001 app (the same will work for Magisk Stable or Magic Beta 2400x) and patched the boot.img.

I first tested does it boot correctly:

fastboot boot patched_boot.img

and then permanently flashed the Magisk:

fastboot flash boot patched_boot.img

New Magisk does no more support MagiskHide - use Zygisk+DenyList+Shamiko instead:

In Magisk app, enable Zygisk and reboot.

Then enable Enforce DenyList, open Configure DenyList, enable filter to show System and OS apps, find Google Play Services (GMS) and checkmark:

com.google.android.gms

com.google.android.gms.unstable

Additionally checkmark the other (like banking) apps you used to checkmark for MagiskHide in the old Magisk v23

E.g., I always checkmark Xiaomi stock Security (com.miui.securitycenter) and Safety Net checkers like YASNAC (download from Playstore - Magisk does no more include SafetyNet checker coming with the app).

Reboot again.

Since it is also good idea to hide this new Zygisk, I installed Shamiko (Magisk module) and disabled Enforce DenyList (Shamiko will read and take over from DenyList).

Reboot

Additionally, to hide init.rc, I installed InitRcHider module.

Finally to pass the SafetyNet (CTS, unlocked Bootloader), I installed USNF 2.2.1 (latest at the moment, like all the other modules I mention here).

Note: InitRcHider and Shamiko are not required for SN, but without Zygisk+DenyList+USNF you will not pass

Google Play was showing that Device is not certified - I deleted Cache and Data for Google Play Store app, rebooted and after some time Device was certified

Since Magisk does no more connect to the Modules Repo, use Fox Magisk Module Manager

---

Further, I installed AdAway hosts/root mode (don't forget to enable Systemless Hosts in Magisk, and reboot), Vanced YouTube root

By using SystemlessDebloater (find in Fox Mmm), I have debloated 40-something preinstalled system apps - attached is the config list for Debloater, if you want to keep certain apps (Facebook or so, remove those names from the list)

E.g., for Vanced YT, I first uninstalled all updates to YT and then used SystemlessDebloater to debloat the built in the system YT v17, then successfully installed Vanced YT root that requires YT v16.29.39

---

Since Riru is incompatible with Zygisk, use LSposed-Zygisk version. As LSPosed modules, I use GravityBox_R, CustoMIUIzer and HideMyApplist (HMA)

E.g. with HMA I detach (hide) YouTube and AndroidAuto (I still need to configure apps and hacks for AA - work in progress) - YT Vanced root and similarly the hacks for AA require particular old versions of YT or AA.

By detaching those apps from Playstore, I make sure that Playstore does not bother, and does not update by mistake (even mine) YT and AA

Also, banking and similar apps usually look for Magisk app, LSPosed, and LSPosed modules - if they find, they detect 'root'

You can use e.g. Oprek Detector (fromg Google Play):

- checkmark in DenyList

- use HMA to hide Magisk app, LSPosed and Lsposed modules (apps) from Oprek Detector.

As a result, Oprek Detector will no more find root

Use that as a proof of concept for hiding the root from banking apps (altough, some of them may require additional steps)