Rooting the HTC Thunderbolt: In-Depth How To!

by: ChintanApril 10, 2011
26 2

Yes, you read that right. We think we can change your HTC Thunderbolt’s experience. Although you will see the steps below look a bit challenging, we can assure you that is well worth the effort.  We are about to tell you how to root your HTC Thunderbolt which will do wonders for your phone.

Rooting your device provides administrative access. It gives you the privilege to work as an administrator with the Linux subsystem on his/her device and play with the system files.

Also, read our  “Rooting Dummies Guide” for detailed knowledge.

For HTC, the Thunderbolt is the most locked phone they have released to date. There is everything they have tried to prevent it – signed images, signed kernel and even a signed recovery. They also locked the memory. But, the developer community has toiled hard to let you overclock your Thunderbolts to lightening speeds of 1.5+ GHz, and even as high as an amazing 2Ghz! It will also let you fully unblock the bootloader and various other privileges as our above post mentioned.

“With every bad there is a good side, but with every good there is a bad side.”

So, as you get S-OFF, remove signature checks and unlock eMMC you will also ‘void the warranty’. We advise the user to enjoy annulling the warranty, since what follows is an amazing experience.

A word of caution: This could brick your mobile, dear user, and especially if you aren’t careful. Please, take due caution with any activity in adb. We expect you to be familiar with adb command lines and linux OS in general. We here at Android Authority do not hold any kind of responsibility for your actions. But, we do recommend it for a better experience when used with care.

**Please, go through the beneath mentioned process when you are stress free and wide-awake. Go through all the instructions undistracted before attempting the process. Also, make sure you have a full battery life before starting.

Step 1

The first thing you need to do is download these three files:

  • RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.0103_2r_NV_8k_1.37_9k_1.52_release_
    165253 (md5sum : aae974054fc3aed275ba3596480ccd5b):GalaxySense mirror
  • Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : 3b359efd76aac456ba7fb0d6972de3af):GalaxySense mirror

You may also use Multiuploadmirror for downloading.

Please, ensure that the MD5 hash of the files matches. In case if the md5sums do not match, please stop and redownload that file.

Step 2

As we indicated earlier adb command lines familiarity is desirable. Here are the commands you need to enforce through adb.

Push the three system files – misc.img, busybox, and psnueter using the following commands:

adb push psneuter /data/local/

adb push busybox /data/local/

adb push misc.img /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

Step 3

This step will gain temp root and flash the custom misc.img.


adb shell

Now the shell should display “$”.



You will now be kicked out of adb, and adb will restart as root. Let’s confirm the md5 of misc.img:

adb shell

At this point, the shell should display “#”.


/data/local/busybox md5sum /data/local/misc.img

Output should be “c88dd947eb3b36eec90503a3525ae0de.” If it’s anything else, please re-download the file and try again.

Now let’s write misc.img:

dd if=/data/local/misc.img of=/dev/block/mmcblk0p17


Step 4

Now, you need to rename the downgrade RUU as and place it on your SD card. This is to be followed by running the following command:

adb reboot bootloader

Choose the bootloader option and press power; let the ROM flash. When prompted with a box to upgrade, choose yes.

This is not meditation. But, take a deep breath. Wait since the reboot is a long one.

Once done, reboot and delete from your SD card.

Set up the two part exploit, to gain root and unlock MMC.

Push wpthis, busybox, and psnueter.

adb push psneuter /data/local/

adb push busybox /data/local/

adb push wpthis /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

adb shell chmod 777 /data/local/wpthis

Step 5

We know it’s extensive adb. But, we already told you. Please, survive through a few more steps and you are through to a speedy fun ride. Ready, then, enter the following commands:

adb shell


To unlock eMMC:

adb shell



**Step 6

Extreme caution in this step please. You may end up bricking your phone here if you are not careful.

To push the eng bootloader:

adb push hbooteng.nb0 /data/local/

adb shell

/data/local/busybox md5sum /data/local/hbooteng.nb0

If the output does not match “6991368ee2deaf182048a3ed9d3c0fcbexactly, stop, delete it, and re-download it. Otherwise, continue.

Now we will write the new bootloader.

dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

Confirm proper write:

/data/local/busybox md5sum /dev/block/mmcblk0p18

If the output does not match “6991368ee2deaf182048a3ed9d3c0fcb,” try again; if it still doesn’t work, we advise you to seek help from in channel #thunderbolt. DO NOT REBOOT.

Now, reboot your phone and put the custom RUU ( on your SD card. Then flash it. This will upgrade you to release firmware with an S-OFF bootloader.

Next, run this command:

adb reboot bootloader

Just wait for the flash. As you witness its flash, you are now running release firmware with S-OFF. Now, you may get a bit excited but don’t loose the focus. It’s the time to set up SU.

Step 7

Push SU, busybox, and psneuter.

adb push psneuter /data/local/

adb push busybox /data/local/

adb push su /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

To gain root:

adb shell


The following will remount /system and set up SU:

adb shell

mount -o remount,rw -t ext3 /dev/block/mmcblk0p25 /system

/data/local/busybox cp /data/local/su /system/xbin/su

chown 0:0 /system/xbin/su

chmod 6755 /system/xbin/su

Step 8

Now, please download the superuser from the android market. Now, reboot your phone.

Close your eyes and open them shouting ‘Eureka, Eureka!’

You now have full root permissions!

Step 9

Now, finally, we are done with the bulky process of gaining access. We will need managing our privileges though. So, install ROM Manager and flash the Thunderbolt recovery.

Enjoy! You have endured through the irksome process. You deserve to relish the remarkable experience that follows!

You may have problems getting SU to work. We recommend a couple of extra reboots to fix it.

But, if you still have problems, we recommend putting it up on the IRC of Andric: #thunderbolt or use

As you put this process to use please do give us feedback on how has your experience changed? Care to tell us how much faster and smoother your phone runs now? Express how much happier you feel. Your joy will multiply and we will rejoice with you.

Via : Android Police