So you’ve gotten yourself a shiny new Thunderbolt, huh? You’ve heard of this magic “rooting” shenanigans, and the stuff you see over at xda. There are hundreds of guides for Windows but none for Mac. What to do? After rooting a friend’s Thunderbolt I decided it would be beneficial to help all the other Mac-Thunderbolt users out there. This guide is for absolute novices. If you follow this guide your Thunderbolt will be rooted even if you have no idea why or what you did.
Some opening credits:
This guide still works with all Thunderbolts as of Wed, July 20th, 2011.
I did not in anyway find out how to root this monstrously secured phone. The people who did it are way smarter than I am, and the thread over at xda with all of the proper credits and the original root method can be found here. Unfortunately I used this Windows rooting method almost the entire time before discovering the one below. Regardless, TeamIRC is composed of amazing people and they deserve your thanks if nothing else.
Secondly, I used IISiDeK1CKII‘s guide (located here) for some guidance when it was needed, and if you want to use his guide I can also attest that it will work. This guide will NOT cover setting up adb, however his does. If you don’t even know what adb is I would suggest taking 10 minutes to learn before rooting your phone (especially since you will be using it). I will also be using his mirrors as I know that they work. This guide is only possible because of his, as I would have gotten stuck several times without it.
So let’s get started then! For convenience make sure you have USB debugging turned on and your phone mounted as a disk drive (connected to the computer).
Things you need to know before doing this:
This guide has worked for several test subjects, myself, and the method of it has worked for countless others. That being said: Rooting your phone voids your warranty. TalkAndroid and myself are not responsible for anything that happens to your phone while following this guide or utilizing the opportunities that a rooted phone offers. You take full responsibility if this causes your phone to brick, act strangely, or slap your kitten while you sleep.
Go to chat.andirc.net in channel #thunderbolt (http://chat.andirc.net:9090/?channels=#thunderbolt) and ask for assistance if at any time you feel like you did something wrong (difficult to do since this guide is step by step). They are the most knowledgeable/helpful people about this phone that you’ll ever meet. In fact, HTC would be better off firing their Thunderbolt Team and hiring these guys. They’re that good.
If you are OCD and still worried about your phone bricking despite step-by-step instructions and the Thunderbolt gods on your side (website shown in previous paragraph) get the extended warranty on your phone. If something happens to your phone and they can’t help you (which in itself is impressive) you have two options as there are two types of “bricks”:
1) If it is completely dead and is not able to be turned on/make contact with any other electrical device take it in to Verizon and say your phone is defective. They’ll give you a new one. *Lose* or wipe your SD card so no traces of rooting are present.
2) If your phone is bootlooping and it is evident that you rooted it. Drop that sucker in a sink full of water. In fact, do that several times until the phone is so water damaged that it resembles option 1. Go to Verizon and claim that you have friends and that they pushed you in a pool with your phone in your pocket. You’ll get another one for pretty cheap if you have the extended warranty. If you don’t, hope that your Verizon Salesperson is very nice.
Step 1: Get your files ready
You will need three files for this to happen.
1)
RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_
165253 (md5sum : aae974054fc3aed275ba3596480ccd5b)
2)
Mirrors for the package (md5sum : 3b359efd76aac456ba7fb0d6972de3af)
Multiupload mirror
GalaxySense mirror
DroidSite mirror
3)
Custom RUU mirrors (md5sum : aff07b8256628a175c40938d408fa16f):
Multiupload mirror
GalaxySense mirror
Place the exploit.zip and the first file (ruu_mecha_reallylongtitle) in your platform-tools folder. This way you can just push it to your phone without having to change your directory. Once they are both in there, extract the exploit.zip. Put the third file (PG05IMG.zip) somewhere you’ll easily find it and you won’t get it confused with the other files (because you’ll be renaming the first file that later). Your desktop might be that such place.
Step 2: Push some files!
Make sure your phone is connected
(from now on, anything in italics should be copied LETTER FOR LETTER) to your terminal.
Also for those of you that have created a path text file for adb, you will not need the ./ in front of every adb command. If you followed the instructions in the xda thread you will need ./ . If you would like to just be able to type adb (recommended) check out a guide here.
./adb devices
If your devices is not shown (or says offline) you will not be able to proceed. More than likely you just haven’t turned USB debugging on. Go into your settings, application settings, development, and make sure it is enabled.
Push misc.img, busybox, and psnueter to your phone
./adb push psneuter /data/local/ ./adb push busybox /data/local/ ./adb push misc.img /data/local/ ./adb shell chmod 777 /data/local/psneuter ./adb shell chmod 777 /data/local/busybox
Step 3: Gain Temporary Root
Get some shell lovin’
./adb shell
At this point in time the shell should display a $ after your name.
Do a Barrel Roll
/data/local/psneuter
Reboot it in root
./adb shell
You should now see a # instead of a $
Check the md5 sum
/data/local/busybox md5sum /data/local/misc.img
Make sure it is exactly the same as the md5 sum shown earlier (c88dd947eb3b36eec90503a3525ae0de). If it is not the exact same download the file again and check it until it is.
Write misc.img and exit the shell
dd if=/data/local/misc.img of=/dev/block/mmcblk0p17 exit
Doing good so far? Hopefully. That stuff was easy.
Step 4: Downgrade
Yes, you want to downgrade. Seems odd that you have to do that to upgrade doesn’t it?
Rename the first file (ruu_mecha) to PG05IMG.zip exactly. Do not get it confused with the PG05IMG file you downloaded in step one. Place the file on the root of your SD card. If you aren’t sure what that means it means that it can’t be in any folders. If you’re looking at your finder window, simply drag it onto the drive that is your device.
Reboot your phone into bootloader
./adb reboot bootloader
Your phone will reboot here, don’t be scared. Hopefully you read this before you freaked out that it turned off and now you’re at a screen with Androids skateboarding.
Once you are there select bootloader (you scroll with the volume buttons and select with the power button). Allow your phone to do the upgrade and tell it to reboot when it is finished. It may ask you to upgrade multiple times. I don’t know why it does, but if it does don’t be alarmed. It asked me to upgrade 3 times before giving me the option to reboot. Just keep updating until you’re given that option.
Step 5: Setting up the exploit
Once your phone is booted and you’re past the htc setup shenanigans, re-enable usb debugging.
Make sure your phone is connected
./adb devices
If your devices is not shown, you know the drill.
Push the important files to your phone
./adb push psneuter /data/local/ ./adb push busybox /data/local/ ./adb push wpthis /data/local/ ./adb shell chmod 777 /data/local/psneuter ./adb shell chmod 777 /data/local/busybox ./adb shell chmod 777 /data/local/wpthis
Unlock MMC
./adb shell /data/local/psneuter ./adb shell /data/local/wpthis exit
Step 6: eng bootloader
This is the important step. This is what will root your phone. If you do not follow instructions EXACTLY and check the md5 sum SEVERAL TIMES JUST TO MAKE SURE you can brick your phone. This step is the most dangerous because if you don’t follow instructions well you have a moderate chance that you will have a $200 paper weight.
Check the md5 sum of the eng bootloader
I miss my eng bootloader on my Evo…
./adb push hbooteng.nb0 /data/local/ ./adb shell /data/local/busybox md5sum /data/local/hbooteng.nb0
If the md5 sum does not match 6991368ee2deaf182048a3ed9d3c0fcb exactly (EVERY LETTER), stop what you’re doing. Delete the file, download it again, and start here again. I can’t begin to tell you how important it is that you check this at least twice to make sure.
Write the bootloader
dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18
Check the mdf sum again to make sure it wrote properly
/data/local/busybox md5sum /dev/block/mmcblk0p18
If the md5 sum does not match 6991368ee2deaf182048a3ed9d3c0fcb exactly (EVERY LETTER), stop what you’re doing. VERY IMPORTANT: If the md5 sum does not match EXACTLY, try the last two commands again. If it still does not match DO NOT REBOOT YOUR PHONE UNDER ANY CIRCUMSTANCE. Doing so will cause you to brick your device. Go to chat.andirc.net in channel #thunderbolt and ask for assistance. They will help you out and save you from tears. You’ll be fine, it just takes a level of understanding that I don’t have nearly enough understanding to teach (remember when I said those guys were pros? I meant it). http://chat.andirc.net:9090/?channels=#thunderbolt.
Step 7: S-off
Reboot your phone and put that custom RUU (the one that you had to rename PG05IMG.zip) on the root of your SD card (rename the other one PG05IMG(1).zip so you can have them both on there just in case). Make sure usb debugging is enabled.
Reboot into bootloader again
./adb reboot bootloader
Let the phone update using the same process as in step 4. Reboot when you’re done.
Congratulations, your firmware is now S-off (be excited, that’s a good thing)!
Enable usb debugging again.
Step 8: The last bit of code!
Push those files AGAIN (ugh, redundant, I know)
./adb push psneuter /data/local/ ./adb push busybox /data/local/ ./adb push su /data/local/ ./adb shell chmod 777 /data/local/psneuter ./adb shell chmod 777 /data/local/busybox
Shell Root
./adb shell /data/local/psneuter
Set up Superuser
./adb shell mount -o remount,rw -t ext3 /dev/block/mmcblk0p25 /system /data/local/busybox cp /data/local/su /system/xbin/su chown 0:0 /system/xbin/su chmod 6755 /system/xbin/su
Congratulations! All the hard stuff is done and your phone is rooted!
Step 9: The easy stuff
Welcome to the stuff that even your mom could do! If you’ve made it this far your phone is rooted and all you need are superuser permissions and a recovery (both of which are available in the Market*!).
*Some people (including myself) have problems on this (ironically). If your Market doesn’t work or your SU permissions don’t work after you reboot your phone. A couple of reboots should fix those problems. If it doesn’t, just start from Step 7 and try again. I had to do this twice after the first attempt to be able to open my Market. Don’t know why.
Install the app called “Superuser” (by ChainsDD) from the Market. This will give your phone full root permissions! Yes, this is important.
Next, install the app called ROM Manager and use it to install Clockwork Recovery
Image taken from IISiDeK1CKII‘s guide
If you’re having any problems with this step (and believe me, a lot of people do despite it being the easy one) go to the irc chat and ask. (http://chat.andirc.net:9090/?channels=#thunderbolt)
And there you go! Your Thunderbolt is now rooted! Realize that you will probably need to upgrade your radios to you flash different ROMs (again, hit up xda‘s Thunderbolt section). This has the MR0 radio. Most ROMs have MR1, MR2, and MR2.5 variations.
I again would like to thank all the people that made this whole process possible. That includes that found the root process, the guides that made it easier to understand, and Google for not banning my computer for how much I spammed their search engine while doing this process. Without all of you this guide wouldn’t have been possible. I’m doing this to help get the word out to Thunderbolt users and I in no way take any credit for the contents of this guide. I did not discover any of it, rather just passed on the information to you readers. Thanks so much for your time!