HTC Thunderbolt Full Root and Bootloader Unlock Instructions

Uh Oh, looks like HTC has failed again. For some odd reason all these manufacturers insist on trying to lock down these devices. I think they should just embrace the custom ROM and hacker community. After all it’s extremely popular and has totally helped Android become what it is today. I’m just waiting for CyanogenMod Phone One to be released so we don’t have to ever worry about rooting ever again. (Happy Face)

UPDATE: EasyRoot 1 Click option now available. Follow here for that story

The Thunderbolt was one of, if not the most locked down device from HTC to date. Apparently they made signed images, a signed kernel, and a signed recovery. They locked the memory too. As always the developer community has done what they do best, and that is completely take care of all the hard work for you. It is now fully rooted, as well as S-OFF. Fully unlocked. Team AndIRC has been working on this for the last 72 hours almost non stop. So feel free to thank them, or buy them a drink. Now we just have to wait a few weeks and you will all be able to run CyanogenMod 7 and overclock your Thunderbolts to 1.5+ Ghz.

Now I’ve talked way to long. I’ll just go ahead and skip to the good stuff. I must mention that this is NOT for the faint at heart. These instructions are new, and just released. I’m sure easier ways will eventually show up, but for now this is it. Most people that will do this I expect to know what they are doing. As always, take extreme caution with anything in adb. Remember it voids your warranty, and enjoy it. Android Police, or AndroidCommunity hold no responsibility for your actions.

Rooting The ThunderBolt – Version 2

Pros

* Root with read/write access to /system
* Ability to downgrade and flash any RUU (i.e. signed firmware)
* S-OFF
* Fully unlocked bootloader
* All ThunderBolts survived testing

Cons

* Voids warranty
* Could brick your phone if you aren’t careful

**** Remember to take your time and fully read all instructions. Make sure you have a full battery before starting.

Step 1

First, download these files:
* RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.0103_2r_NV_8k_1.37_9k_1.52_release_
165253 (md5sum : aae974054fc3aed275ba3596480ccd5b):
o Multiupload mirror

* Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : aae974054fc3aed275ba3596480ccd5b):
o Multiupload mirror

* Custom RUU mirrors (md5sum : aff07b8256628a175c40938d408fa16f):
o Multiupload mirror

Step 2

Note that adb is required.
Push misc.img, busybox, and psnueter using the following commands:
adb push psneuter /data/local/

adb push busybox /data/local/

adb push misc.img /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

Step 3

This step will gain temp root and flash the custom misc.img. Run:

adb shell
Now the shell should display “$”.

Run:
/data/local/psneuter

You will now be kicked out of adb, and adb will restart as root. Let’s confirm the md5 of misc.img:

adb shell
At this point, the shell should display “#”.

Run:
/data/local/busybox md5sum /data/local/misc.img

Output should be “c88dd947eb3b36eec90503a3525ae0de.” If it’s anything else, re-download the file and try again.

Now let’s write misc.img:

dd if=/data/local/misc.img of=/dev/block/mmcblk0p17

exit

Step 4

Here you will rename the downgrade RUU as PG05IMG.zip and place it on your SD card. Then, run the following command:

adb reboot bootloader
Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.
Set up the two part exploit, to gain root and unlock MMC.
Push wpthis, busybox, and psnueter.

adb push psneuter /data/local/

adb push busybox /data/local/

adb push wpthis /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

adb shell chmod 777 /data/local/wpthis

Step 5

Next, enter the following commands:

adb shell
/data/local/psneuter

To unlock eMMC:
adb shell

/data/local/wpthis

exit

Step 6

Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.

To push the eng bootloader:

adb push hbooteng.nb0 /data/local/

adb shell

/data/local/busybox md5sum /data/local/hbooteng.nb0

If the output does not match “6991368ee2deaf182048a3ed9d3c0fcb” exactly, stop, delete it, and re-download it. Otherwise, continue.

Now we will write the new bootloader.

dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

Confirm proper write:

/data/local/busybox md5sum /dev/block/mmcblk0p18

If the output does not match “6991368ee2deaf182048a3ed9d3c0fcb,” try again; if it still doesn’t work, seek help from chat.andirc.net in channel #thunderbolt. DO NOT REBOOT.

Now, reboot your phone and put the custom RUU (PG05IMG.zip) on your SD card. Then flash it. This will upgrade you to release firmware with an S-OFF bootloader.

Next, run this command:

adb reboot bootloader

After it flashes, you will be running release firmware with S-OFF.

Step 7

Push SU, busybox, and psneuter.

adb push psneuter /data/local/

adb push busybox /data/local/

adb push su /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

To gain root:

adb shell

/data/local/psneuter

The following will remount /system and set up SU:

adb shell

mount -o remount,rw -t ext3 /dev/block/mmcblk0p25 /system

/data/local/busybox cp /data/local/su /system/xbin/su

chown 0:0 /system/xbin/su

chmod 6755 /system/xbin/su

Step 8

Install Superuser from the Market.

Reboot your phone. You should now have full root permissions.

Step 9

Finally, install ROM Manager and flash the ThunderBolt recovery.

If you have problems getting SU to work, a couple extra reboots will likely fix it. If you still have problems, come to the chat: irc.andirc.net #thunderbolt or use http://chat.andirc.net:9090/?channels=#thunderbolt.

[via Android Police]