diff --git a/scripts/flash_script.sh b/scripts/flash_script.sh
index 8938c468a..282190b45 100644
--- a/scripts/flash_script.sh
+++ b/scripts/flash_script.sh
@@ -339,6 +339,7 @@ unpack_boot $ORIGBOOT
 SUPERSU=false
 if (! $NORESTORE); then
   if [ -d ".backup" ]; then
+    # This implies Magisk is already installed, but no SuperSU
     ui_print "- Restoring ramdisk with ramdisk backup"
     cp -af .backup/. .
     rm -rf magisk init.magisk.rc sbin/magic_mask.sh 2>/dev/null
@@ -350,8 +351,8 @@ if (! $NORESTORE); then
       cp -af $INSTALLER/common/custom_ramdisk_patch.sh /data/custom_ramdisk_patch.sh
     fi
     if [ -d "magisk" ]; then
-      # If Magisk is installed and not SuperSU and no ramdisk backups
-      # Restore previous stock boot image
+      # If Magisk is installed and not SuperSU and no ramdisk backups,
+      # we restore previous stock boot image backups
       if (! $SUPERSU); then
         cp -af /data/stock_boot_*.gz /data/stock_boot.img.gz 2>/dev/null
         gzip -d /data/stock_boot.img.gz 2>/dev/null
@@ -368,8 +369,8 @@ if (! $NORESTORE); then
   fi
 fi
 
-# SuperSU already backup stock boot, no need to do again
 if (! $SUPERSU); then
+  # SuperSU already backup stock boot, no need to do again
   ui_print "- Creating backups"
   mkdir .backup 2>/dev/null
   cp -af *fstab* verity_key sepolicy .backup 2>/dev/null
@@ -378,6 +379,16 @@ if (! $SUPERSU); then
   else
     dd if=$ORIGBOOT of=/cache/stock_boot.img
   fi
+
+  # SuperSU already have root, no need to install root
+  if [ ! -d /magisk/phh ]; then
+    ui_print "- Installing phh's SuperUser"
+    mkdir -p /magisk/phh/bin
+    mkdir -p /magisk/phh/su.d
+    cp -af $INSTALLER/common/phh/. /magisk/phh
+    cp -af $BINDIR/su $BINDIR/sepolicy-inject /magisk/phh/bin
+    chmod -R 755 /magisk/phh
+  fi
 fi
 
 # Patch ramdisk
diff --git a/zip_static/common/phh/module.prop b/zip_static/common/phh/module.prop
new file mode 100644
index 000000000..81134d64a
--- /dev/null
+++ b/zip_static/common/phh/module.prop
@@ -0,0 +1,8 @@
+id=phh
+name=phh's SuperUser
+version=r266-2
+versionCode=4
+author=phhusson & topjohnwu
+description=OpenSource SELinux-capable SuperUser
+support=http://forum.xda-developers.com/showthread.php?t=3216394
+donate=http://forum.xda-developers.com/donatetome.php?u=1915408
diff --git a/zip_static/common/phh/service.sh b/zip_static/common/phh/service.sh
new file mode 100644
index 000000000..3c1ece822
--- /dev/null
+++ b/zip_static/common/phh/service.sh
@@ -0,0 +1,50 @@
+#!/system/bin/sh
+
+LOGFILE=/cache/magisk.log
+MODDIR=${0%/*}
+
+log_print() {
+  echo $1
+  echo "phh: $1" >> $LOGFILE
+  log -p i -t phh "$1"
+}
+
+launch_daemonsu() {
+  # Revert to original path, legacy issue
+  case $PATH in
+    *busybox* )
+      export PATH=$OLDPATH
+      ;;
+  esac
+  # Switch contexts
+  echo "u:r:su_daemon:s0" > /proc/self/attr/current
+  # Start daemon
+  exec /sbin/su --daemon
+}
+
+# Disable the other root
+[ -d "/magisk/zzsupersu" ] && touch /magisk/zzsupersu/disable
+
+log_print "Live patching sepolicy"
+$MODDIR/bin/sepolicy-inject --live
+
+# Expose the root path
+log_print "Mounting supath"
+rm -rf /magisk/.core/bin $MODDIR/sbin_bind
+mkdir -p $MODDIR/sbin_bind 
+/data/busybox/cp -afc /sbin/. $MODDIR/sbin_bind
+chmod 755 $MODDIR/sbin_bind
+ln -s $MODDIR/bin/* $MODDIR/sbin_bind
+mount -o bind $MODDIR/sbin_bind /sbin
+
+# Run su.d
+for script in $MODDIR/su.d/* ; do
+  if [ -f "$script" ]; then
+    chmod 755 $script
+    log_print "su.d: $script"
+    sh $script
+  fi
+done
+
+log_print "Starting su daemon"
+(launch_daemonsu &)