tbolt root
Last Updated: June 5th, 2012

HTC tried to stop us. They made signed images, a signed kernel, and a signed recovery. They locked the memory. In short, the ThunderBolt is their most locked-down phone to date.

We fixed it for you. Unlike the root method we described yesterday, following the instructions below will provide S-OFF, remove signature checks, and unlock eMMC. Enjoy!

Rooting The ThunderBolt - Version 2.5

Update: This guide was updated to include some steps into the upgrade RUU, making it faster and safer


  • Root with read/write access to /system
  • Ability to downgrade and flash any RUU (i.e. signed firmware)
  • S-OFF
  • Fully unlocked bootloader
  • All ThunderBolts survived testing


  • Voids warranty
  • Could brick your phone if you aren't careful

The method of rooting your Android device as described in the article herein is solely for enthusiasts and not for the faint of heart.


Android Police and Team AndIRC disclaim all liability for any harm that may befall your device, including, but not limited to: bricked phones, voided manufacturer warranties, exploding batteries, etc.

The instructions below assume you already have a strong familiarity with adb command lines - this is not for beginners.

If you’re unfamiliar with some of the terms, hit up our primers here:


  • Scotty2, jamezelle, jcase, and all of Team AndIRC
  • Testers, especially ProTekk and Trident
  • Thanks to scotty2 for WPThis
  • Busybox was pulled from a CyanogenMod ROM, source should be available here
  • psneuter was pulled from somewhere, credit to scotty2, source here
  • All firmware credit goes to 911sniper
  • nat3mil for the video guide
  • Jaroslav from Android Police for editorial help

If I missed anyone in the credits, it was unintentional and I will fix it soon. Lots of people had their hands in on this project.

*** Please read the instructions in full before you attempt the process or head to IRC to ask questions. Also, make sure your battery is fully charged before taking the plunge. ***

Step 1

First, download these files:

  • Downgrade RUU PG05IMG_downgrade.zip (md5sum : aae974054fc3aed275ba3596480ccd5b):


After downloading these files, please check the md5sums!

For instructions on how to do so, see:

Windows: http://helpdeskgeek.com/how-to/check-md5sum-in-windows-7/
Linux: https://help.ubuntu.com/community/HowToMD5SUM
Mac OSX: http://ubuntuforums.org/showthread.php?t=373879 

If the md5sums do not match, please stop and re-download that file.

Step 2

Note that adb is required.

Push misc.img, busybox, and psnueter using the following commands:

adb push psneuter /data/local/

adb push busybox /data/local/

adb push misc.img /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

Step 3

This step will gain temp root and flash the custom misc.img. Run:

adb shell

Now the shell should display "$".



You will now be kicked out of adb, and adb will restart as root. Let's confirm the md5 of misc.img:

adb shell

At this point, the shell should display "#".


/data/local/busybox md5sum /data/local/misc.img

Output should be "c88dd947eb3b36eec90503a3525ae0de." If it's anything else, re-download the file and try again.

Now let's write misc.img:

dd if=/data/local/misc.img of=/dev/block/mmcblk0p17


Step 4

Here you will rename PG05IMG_downgrade.zip as PG05IMG.zip and place it on your SD card. Then, run the following command:

adb reboot bootloader

Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don't freak, it's a long reboot.

Once done, reboot and delete PG05IMG.zip from your SD card.

Set up the two part exploit, to gain root and unlock MMC.

Push wpthis, busybox, and psnueter.

adb push psneuter /data/local/

adb push busybox /data/local/

adb push wpthis /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

adb shell chmod 777 /data/local/wpthis

Step 5

Next, enter the following commands:

adb shell


To unlock eMMC:

adb shell



Step 6

Please pay attention - this is very important. This step involves a small chance of bricking if you mess up.

To push the eng bootloader:

adb push hbooteng.nb0 /data/local/

adb shell

/data/local/busybox md5sum /data/local/hbooteng.nb0

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb" exactly, stop, delete it, and re-download it. Otherwise, continue.

Now we will write the new bootloader.

dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

Confirm proper write:

/data/local/busybox md5sum /dev/block/mmcblk0p18

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn't work, seek help from chat.andirc.net in channel #thunderbolt. DO NOT REBOOT.

Now, reboot your phone, rename PG05IMG_stock.zip as PG05IMG.zip and put on your SD card. Then flash it. This will upgrade you to release firmware with an S-OFF bootloader.

Next, run this command:

adb reboot bootloader

Choose the bootloader option, and press power; let the ROM flash. When asked to upgrade, choose yes. Don't freak, it's a long reboot.

Once done, reboot and delete PB05IM.zip off of your SDCard. You are now fully rooted.

If you prefer videos, you might be interested in the following, however it uses an older method and will be slightly different:


If you still have problems, come to the chat: irc.andirc.net #thunderbolt or use http://chat.andirc.net:9090/?channels=#thunderbolt.

Justin Case
Justin Case is a 30yr old father of four. He has an ever changing array of Android devices, and an eye for mobile security.
  • JustReboot

    wow - that's a lot of steps / kinda reminds me of the og droid... i might try this tonight if i'm brave or monday, if i'm patient :)

  • http://www.AndroidPolice.com Artem Russakovskii

    Flawless victory.

  • jbn

    did it work for you artem?

  • eYe

    Doesn't seen too complicated. A lot of steps for sure but everything seems logical. Good thing that recovery is already available too. I am not planning on getting Thunderbolt but its nice to know that newer HTC phones are rootable.
    Hopefully HTC Pyramid will be as easy to root as this phone. Once again, thanks to all of the devs involved.

    • Justin Case

      This phone was not easy to root, don't be fooled by how quick it came.

      • abraham

        Hello I got stuck on step 4. Was i supposed to download all 8 files you hav up there. Or only the first 3?

        • dave inkeles

          Download 3. Only open the exploit and keep the other 2 files in their zipped state. (1 is 399mb and the other is 459mb )
          You will install the 459mb first and you will name it PG05IMG. Drag it to your sd card and DON'T OPEN IT. The phone will open it automatically. This will be step 4. You will remove PG05IMG from your sd card when you are done. You will name the other file PG05IMG also when you get to step 6-7 and do the same thing.

  • Mitchell
    • Woodzy

      Link works really fast -
      was corrupted first time - downloading again...
      What will this file do for me?

      • wheelieInCali

        I'm pretty sure that's an older version of Verizon's firmware that is rootable. ie. this new and improved Thunderbolt ROM was too locked down to root so these guys flashed an older ROM that they knew they could root.

        There are probably people still working on the original firmware that ships with the Thunderbolt and eventually a root process will exist where you only need to download one file named "PG05IMG" onto the phones SD card ... I wonder what PG05 stands for

  • Nathan

    You guys rock...just did this and everything works. Thank you so much for all your efforts on this!


  • Xecsc

    Worked Perfect !!

    Thanks to all !!

  • ts

    Can someone make a video on this. It would be greatly apreciated.

  • xashaffer

    Will there be an easy root method coming for noobs such as myself? I have never rooted before and I have absolutely no idea what I am doing even with these instructions and I don't really want to brick my phone

    • Mapex

      Yes, wait until next week. Watch @TeamAndIRC on Twitter for updates about the easy root method. Don't risk messing up your device until then. It's not worth it.

  • Bryan

    shit ive rooted my droid x the hard way and im confused by all this, let alone a noob...video would be extremely helpful!

  • Wanker

    When is 1 click root coming out for this thing?

    • Jack

      I don't know about 1-click, but they say an easier method is about 1-2 weeks out.

      • EB

        Has an easier process come about for a non-techie to root his Thunderbolt?

  • lortay78

    I know I am too noob to try this, but where do I put the files to run the commands in adb like this? Can I just enter them like this, or is the directory they are located in left out of the adb commands?

    • DistortedLoop

      You'll need the path on your local drive UNLESS you just put all the files in the same directory that you're in while running adb (which is the easiest thing to do since you can then just copy/paste the commands from the instructions - but check you copied correctly (ie., nothing missing on the end)).

  • Mapex

    Worked for me, even took a picture of the Clockwork Recovery screen on my Xoom :D

    Only question: coming from a Droid I could select recovery options with my camera button, which does not exist on the T-Bolt. How do we select options here if the Power/Home/Menu buttons hide the recovery menu?

  • m00nshake

    Awesome work and super fast to boot... I was worried that like the Inspire, S-off for the Thunderbolt would require a gold card method, which seemed fairly complicated, but this procedure is straight forward to anyone who has basic knowledge of adb. Thanks so much for making this happen... Donation coming your way on pay day...

  • Timothy

    on step 7, I am getting confused/stuck...

    on the steps to remount /system and push su, is that whole chunk of 4 lines ran in one line or... I just want to know when enter is pressed in those 4 lines. Thanks

    • DistortedLoop

      Run each line individually...

  • Eric

    Awesome work..

    If someone could answer a couple noob questions I would appreciate it.

    1.) I am having a hard time pushing files, I keep getting "insufficient permissions for device". I tried from recovery, same thing. I am sure there is an easy answer to this.

    2.) Which of the packages need to be unzipped?


  • Timothy

    nvm guys I found the answer to my own question. At the end of every line, press enter. This method works like a charm!

  • Timothy

    To Eric: Only the exploits.zip needs to be extracted. It should be extracted to your tools folder in the androidsdk

  • JustReboot

    hmm looks like some rights issues,,,

    BootSector:tbolt JustReboot$ ./adb shell
    # mount -o remount,rw -t ext3 /dev/block/mmcblk0p25 /system
    # /data/local/busybox cp /data/local/su /system/xbin/su
    /data/local/busybox: permission denied

    • androiddamnit

      I get the following error:

      C:\Program Files\Android\android-sdk\tools>adb shell
      $ adb push psneuter /data/local/
      adb push psneuter /data/local/
      adb: permission denied

      What am I doing that renders me retarded?

  • Joe Bailey

    I'm on step 4, ran the bootloader, let the rom flash, rebooted and removed the file. Now when I try to run the cmd I get the following message.

    C:\sdk\tools>adb push psneuter /data/local/
    error: device offline

    Any idea's?

  • Timothy

    to Joe:

    I experienced this issue many times while running this method, but it is easily fixed by disconnecting the phone from the computer and reconnecting it.

    I'd also like to report an issue... root explorer is not allowing my to mount the /system/app/ folder as rw so I can delete system apps. Anyone else experiencing this problem?

    • DistortedLoop

      Busybox issue, perhaps? Maybe if you have Titanium installed, go to its "Got Problems" button and let it install Busybox. You can use Titanium Pro to delete the system apps as well, but I saw someone on xda say Titanium was having trouble getting root.

    • DistortedLoop

      Actually, I ran into the same issue after completing the steps. I had to reboot the phone after installing SuperUser from the Market a second time to get it to allow apps (Titanium and Root Explorer both working now).

    • Andrew

      I had the same issue. I had to reenable USB debugging on the phone. Go to Settings > Applications > Development and turn it back on. Reboot the phone, and you should be good.

  • Woodzy

    Root Noob here - :)
    Can someone define the acronyms here please?
    RUU? Root uninstall utility?
    adb? android ? ?

  • Matt

    RUU- Rom Update Utility

    ADB- Android Debug Bridge

  • Ny

    the md5sum on the exploits doesn't match on any of the mirrors. Is that okay?

  • Woodzy

    thanks for the MRU
    (message request update) - lol
    { Just saying thanks was too short }

  • Lee

    Can this be done on terminal emulator?

  • Ny

    what I meant is that i downloaded the exploits from all of the mirrors and none of them match the posted md5sum. is that okay? is the file still usable? the md5sum I get is 3b359efd76aac456ba7fb0d6972de3af.

  • DistortedLoop

    Excellent! Thank you for the root. Just an FYI...the MD5 sum for the exploits.zip file listed above is actually the sum for the RUU_ file. (They're identical in the post.)

    Shouldn't be an issue, since corruption in the zip file should be caught by the unzip program, but it might confuse some.

    • http://www.AndroidPolice.com Artem Russakovskii

      Thanks for spotting this, guys. We fixed it yesterday.

  • Ny

    Thanks for pointing that out DistortedLoop. I appreciate it. I may give this a try in the morning.

    • DistortedLoop

      I'm doing it myself right now...didn't even notice your question in the comments because I was busy typing my message after checking my MD5s on my downloads. Hopefully the guys will fix the post instructions soon to avoid confusing others.

      If it helps at all, the MD5 on my exploits.zip I downloaded is:


  • Ny


    that's exactly what my md5sum for the exploits is. Good luck rooting your TBolt

  • can’t wait to root

    Can we use the following image? It seems newer:


    Or will it remove root?

    • Justin Case

      Follow my tutorial to a T if you want support. It is well thought out and you will end up with current firmware in the ends via the custom ruu.

      • can’t wait to root -> rooted

        Your instructions were PERFECT. You rock. THANK YOU :-)

      • Bryan

        im going to guess your method is windows only and Mac's are SOL...for now?

        • DistortedLoop

          No...this works on Mac. I did it myself on one last night.

          Mac actually has an advantage over Windows because we don't need to worry about installing drivers to get the phone to talk to the Mac over adb.

  • http://shortfuse.org ShortFuse

    This could be dangerous if somebody put a wrong command.

    It look pretty straightforward.

    I'm going to try to implement this into SuperOneClick v2.0

    • Justin Case

      I am going to respectfully have to ask you not to, without personally contacting me first. Special considerations must be taken.

      • http://shortfuse.org ShortFuse

        Yeah, I just saw you post this same reply on somebody's thread in XDA.

        I have been planning on making something alternative for NAND locked devices (simliar to what unrevoked does).

        An md5 assert is probably the right way to go. Looking at these instructions, step 3 and 6 would be the "scary" part.

        The rest is nothing new to what I've been doing in SuperOneClick (shell root and su install with Scott's psneuter)

        I really can't see this being done in a GUI without actual pictures of what to press. Well designed images with big arrows on what buttons to press.

        I'm planning on a massive rewrite of the software to support these changes. I'll shoot you a message on XDA when I have something more concrete (don't worry, won't go public without your approval)

        • Justin Case

          Well if you shoot me a msg before you start, maybe it could be made easier for you.

      • one click root

        Not really anything you caan do to stop them

  • Kevin24lg

    Thank you so much. The instructions were pretty scary and it took me a while to get everything set up properly before I was able to execute the commands, but everything went perfectly. Doing a nand backup as we speak. Thank you again!!! Now all I need is some delicious CM7.

  • DistortedLoop

    Wasn't difficult at all, but I'm very familiar with adb and no issues getting my Mac to recognize the phone.

    For adb noobs, the instructions don't remind you to go to Settings, Applications and re-enable USB Debugging after the flashing, so if you're having trouble with adb, don't forget to that on your own.

    Also, it took me two reboots to get su working, so those with root issues after finishing all the steps, don't forget to try that as well.

  • Bryan

    I'm Stuck @ Step 6:
    Confirm proper write:
    /data/local/busybox md5sum /dev/block/mmcblk0p18
    If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn’t work, seek help from chat.andirc.net in channel #thunderbolt. DO NOT REBOOT.

    the irc server isn't responding and I'm getting a different output, even though my data/local/busybox md5sum /data/local/hbooteng.hp0 output was the same.

    • http://shortfuse.org ShortFuse


      dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

      again, then do the md5sum command to check if it copied properly

  • Chris

    Is there any way for the big V to know / charge for tethering once you are rooted?

    Also, when skype mobile with video is released, will we just be able to download it through the market or will a custom rom have to be downloaded.

    One more thing, will that May 15 date when the big V "pushes an update" out to the Thunderbolts affect a rooted Thunderbolt?


    • RW525

      Three good questions... I'm also hoping someone can answer these.

  • http://blumpk.in/ Dranyam

    I'd just really like to thank you guys for all of your hard work. Worked like charm.. Thanks for the tutorial as well, donation coming your way as soon as payday gets here.

  • PerCompLLC

    Flawless victory!! #WINNING

  • CoZ

    I'd like to thank you guys as well. Great work.
    No way I'm going to try this until some sort of "easier" method materializes. I'm too chicken $h!t at the moment.
    My Nexus was much easier and even that scared me initially. :)

    • Justin Case

      Come to chat and we can help you. It really isn't that hard.

  • Eric

    Thanks for the hard work guys, enjoying my rooted Thunderbolt this rainy morning.

    Quick question that may benefit those many among us who are coming from the Droid 1. Now that we are rooted, what role does the bootloader play? or is it superseded by CW Recovery? Droid not not have an option to boot into a bootloader.

  • Chris

    How can you save a snapshot of the original ROM before you root it so you can revert back?

    • Bob

      Anyone knows the answer?

  • Oliver

    What are the differences between both ROM versions? I remember reading about issues with battery life and would hate to tun into these issues. Any idea when the stock ROM will be rooted?

  • http://www.imgerman.com German American

    How do you get to the IRC chat?

    Stupid question but I'm on step #1 (push PSNeuter) and I get an error that says "no such file or directory".

    I'm assuming I download psneuter from the link and put it... where? In the ADB folder?

    • Eric

      You need to be typing the code from the directory the files are stored in. Unzip exploits to a folder you create on your C:\ drive. Cd\ to that folder name in terminal and then starting copying and pasting the commands.

  • http://www.imgerman.com German American

    Is the IRC down?

  • UBRocked

    @ Joe Bailey - I don't know if you already found an answer to your question but for me, I had the "device offline" error in step 4 as well. Go into settings > applications > development > make sure usb debugging and mock locations are both checked.

  • blusgtone

    I noticed after the first flash the screen said s-on, is that right?

    • Eric

      Yes, that is correct

  • lortay78

    Just want to confirm this method worked flawlessly. I look forward to lot's of fun with this phone now. This was my first time using adb. I just unzipped the exploits into the sdk platform tools file, and followed all the instructions exactly as written. Awesome. Thank you so much.

  • rick

    could someone elaborate on how to use adb and what the heck does push mean?

    • lortay78

      You will have to do your own googling on this. It is a bridge that allows you to manipulate the phone with a command prompt. Pushing is putting things into the phone from the computer.

  • Ny

    This worked for me perfectly. Thanks to all the developers out there that put their time and effort into this method.

  • KD

    I'm waiting on a new sim card from VZW in order to activate my phone. I went through steps 1-7 and got held up at 8. Since I can't connect via 3G without the new simcard, I tried connecting via wifi but I kept getting a "Unable to connect to the network" message when inputting the wifi settings on the TB. Is this related to rooting the phone and if so, is there a solution?

  • aLb3Rt

    OKay so I've been stuck at Step 7. I got 1-6 fine, phone is S-OFF and all but whenever I do shell and psneuter on step 7, I get an "MMAP error, not permitted" am I missing something?! I can't get no answer at the chatroom so I'm hoping someone here can. Thank's in advance!

    • drew

      Im stuck here as well, not sure where to go

  • Antonio

    in step 6 it says If the output does not match “6991368ee2deaf182048a3ed9d3c0fcb,” try again; if it still doesn’t work, seek help from chat.andirc.net in channel #thunderbolt.
    my output is reading "bfa2f3ac5eb3bcf67af23509b4081999" can someone please help. I'm scared to turn off my phone.

    • Justin Case

      You are ok, reboot and start from step you. You failed to downgrade properly.

      • Antonio

        So everything works fine till I get to step four. I cannot flash this downgraded Rom. I go into bootloader and it just will not flash it. Should I redownload the Rom. It flashes and says image could not be found with more messages but it goes so fast I can't takeout the rest and goes back to the bootloader option screen. Any ideas?

        • Bryson

          I made the same mistake. 15 minutes later I realized in renaming the file PG05IMG.zip I was actually renaming it to PG05IMG.zip.zip. Check that it should work.

  • one click root

    Turning this into a one click root as we speak.

    • http://www.romanstwelve.net JeremyReger

      With Justin Case's blessing? I will donate :)

    • Justin Case

      Please contact me before you do it, I can make your life 100x easier.

      • joe280zx

        how do you put ruu onto sd card?
        which PG05IMG.zip do I put?
        stuck in middle

      • Dave Inkeles

        Justin, I need your help PLEASE!! I'm attempting to root my t-bolt and I'm at step 7 on my T-bolt and I'm stuck. I downloaded the RUU (399MB) and did not open it. I sent it straight to my SD card as I did with the 459MB from step 4 (which worked perfectly). It sits as PG05IMG at the bottom of my card as a zip file (unopened).
        When I hit the adb reboot bootloader the update starts and the blue line goes up and starts loading, then the brown line goes up...BAM..that when it takes me back to the bootloader and does not ask me to update, just reboot,recover, etc...
        I'm lost. What could I be doing wrong.
        I've received a lot of help but maybe I'm dense.
        Any help would be wonderful

        • jcase

          You left me no contact info....

    • rick

      thank gooooodddd!!!!

    • Antonio

      I'm all ears on the one click root method. Will donate right now just tell me where lol...

  • http://www.themobizone.com/ MePascal

    My first question ....of many I'm sure ... my first action (after downloading the required files) was to unzip the exploit.zip to my SDK platform-tools folder. After I completed the unzip I noticed the misc file is zipped as well. Do I leave it zipped insided the platform-tools folder?

    • selina

      First off, I am a noob to rooting, but have been enjoying android since 1.6 ony old cliq. I now have a beautifully rooted Thunderbolt. ( THANKS TO YOU HARDWORKING GENIUSES) Rooted last nite, followed the instructions above to the T. Havent installed a custom ROM, but plan to. Root confirmed by TB and SU. One prob. No camera. What do I do next. Please help me.

  • http://www.FlatRateComputerGuy.com houndazs

    Flawless tut thank a million guys!!!

    One question, I have root with now problems, but the "fix permissions" from ROM Manager says "an error occurred while attempting to run privileged commands!" should i just run chmod 777 as SU in terminal emulator from the phone, or not worry about it....?

  • http://www.FlatRateComputerGuy.com houndazs


    Flawless tut thanks a million guys!!!

    One question, I have root now with no problems, but the "fix permissions" from ROM Manager says "an error occurred while attempting to run privileged commands!" should i just run chmod 777 as SU in terminal emulator from the phone, or not worry about it....?

  • http://www.themobizone.com/ MePascal

    I think I figured out the answer to my own question....the misc.zip is in fact the misc.img that will get pushed....at least that's what I think anyways

    • http://www.FlatRateComputerGuy.com houndazs

      Yes keep both files zipped except the exploit.zip folder

      • http://www.themobizone.com/ MePascal

        Thanks...1st timer...but I feel confident going into this that I will get it right.

  • http://www.FlatRateComputerGuy.com houndazs

    As long as you READ the whole tut BEFORE start and follow EVERY step EXACTLY as written....you will get it right with no problems.

  • African Bob

    Is step 4 asking to rename file RUU_Mecha...(the first download link)

  • http://www.FlatRateComputerGuy.com houndazs

    yes that is correct

  • http://www.themobizone.com MePascal

    I'm at step seven and just before I start there I pasted the Custom RUU to my SD but bootloader will not flash it...keeps taking me back to fastboot....Any thoughts

  • http://www.FlatRateComputerGuy.com houndazs

    sweet just changed boot screen on thunderbolt weeeeeeeeeeeeeeeee

  • http://www.FlatRateComputerGuy.com houndazs

    step 4 you rename RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.0103_2r_NV_8k_1.37_9k_1.52_release_
    165253 to PG05IMG.zip

    Step 7 you use PG05IMG.zip.

    I hope this makes sense.

    • http://www.themobizone.com MePascal

      yeah ... made sense ....was already there with the renaming ... it was the PG05IMG.zip (Custom RUU) ... when flashing it from my sd the bootloader didn't like it. So I deleted it from the SD and my PC, re-downloaded it, pasted it to the SD and then I was off to the races....

      Thanks again for the help!

  • http://www.FlatRateComputerGuy.com houndazs

    as soon as i find a pic i like im changing the HTC logos

  • leo

    Nice! I've rooted several phone, but think i'll just wait for one click.

    • http://www.FlatRateComputerGuy.com houndazs

      its no so bad took me about 30min tops

  • African Bob

    Finally enjoying rooted thunderbolt goodness!

    Thanks for great instructions guys!

  • Teknurd

    Awesome, thanks for all the hard work! I hate the bloatware and needed this badly. Your instructions got me rooted!

  • http://www.FlatRateComputerGuy.com houndazs

    Just an FYI if you are planning on using the Wifi Tether app on the market after the free mobile hot spot is gone.....it does not give you 4g speeds. i just tested it and i only get 3g speed. I hope you guys are planning on coming out with a Verizon Wifi Hotspot hack...!!!!!

    • Chris

      Will verizon know how much data has been used for tethering? or is that only possible before the rooting?

      • http://www.FlatRateComputerGuy.com houndazs

        I have been rooted since Aug. 2009 with my Moto Droid 1, and have never been "caught" by Verizon. Rumor has it that they are developing a way to "Catch" people that are tethering, but if this is so give it a week or so and someone will crack that too lol. Remember, there is always someone out there smarter than the people at Verizon, Sprint, AT&T, T-Mobile, Microsoft.....and so on and so on.....

  • Antonio

    So everything works fine till I get to step four. I cannot flash this downgraded Rom. I go into bootloader and it just will not flash it. Should I redownload the Rom. It flashes and says image could not be found with more messages but it goes so fast I can’t read the rest and goes back to the bootloader option screen. Any ideas?

  • rick

    hey j what about a video tutorial??? pleeeaaassseeee

    • Antonio

      I agree a vidoe would be so much better. I've been workin on this for four day and I cant get the bootloader to load the downgraded rom.

  • Woodzy

    As a fellow droid-noob, I offer this link to using abd (android bridge debugger)

  • rick

    yea but we need a walkthru lol

  • Thomas Check

    Great guide! The only real problem I had was with the old RUU; I think the first download was corrupted so I just had to re-download it and then everything went off without a hitch.

    One question though: For some reason, the Android Market on my phone uses the old interface, whereas before I used the updated android market (the streamlined one where all of an app's information was on one page). I was told this should update automatically, but it's been about 16 hours and still nothing has changed in the Market. Is there a particular reason for this?

  • rootnoob

    just rooted and only have 1x data now tried several reboots any help would be nice

    • btangoo05

      same here!!!!!!!!

      • rootnoob

        Just be patient with it... After a few minutes (and a few reboots) 3G will come back.

  • Antonio

    when I download the files on my computer it doesn't download as a zip folder. It just a file that looks like a tiny white sheet of paper any ideas?

  • http://www.FlatRateComputerGuy.com houndazs

    that is most likely due to a bad download and a corrupted file. download again

  • rick

    what gives? my sowngrade file checksum is correct. i renamed it moved it to sd card and my phone wont flash

  • David

    AMAZING WORK!!! To literally everyone in the credits, GREAT JOB! You guys are perfect at what you do and thank you so much for sharing to the public :) GREATLY APPRECIATE ALL OF YOU!
    To people who are wondering if this is hard... Well I had no idea what ADB was, was always used to one-click roots;)
    This method is simple as long as you go in with open eyes and not hard headed ha, read step by step.
    Only problem I had was when I tried to rename the RUU i was putting '.zip' at the end of it.. when it is already a zip file. Do NOT put .zip if you are having problems with it not flashing it. Should be 'PG05IMG' instead of naming it 'PG05IMG.zip'

    Anways great job guys extremely appreciate the time and effort put into this!!

    • Justin Case

      it is actually PG05IMG.zip, however windows likes to treat users like puppets and hide the extension. Sorry for the confusion.


  • D3SC3NT

    How do I unroot and go back to the stock ROM?

    Do I need to ignore OTA updates when I'm rooted?

    Wanted to give props to everyone who rooted the Thunderbolt. I'm a total noob but figured out "everything" I needed to do to root on this site!


  • Sean

    Any updates on the easier root status? this sounds simple enough but if an easier route its going to be available I will just wait

  • doogie

    where are the usb drivers? d/l sdk but did not see usb driver folder? need drivers for windows 7 32bit

  • D3SC3NT

    Having problems with drivers too. Google drivers do not work?

  • D3SC3NT

    I guess the concensus is to download HTC Sync. Did that. Took a while. Everything else seems good. Will prolly mess around with the stocker for a week then root it. Thanx again for all the info.

  • Mexigun

    Just wanted to say i was a total NOOB about all this 2 days ago, but with research and a lot of reading I was able to root my phone sucessfully! Great guide and the vid was a good help too. The only thing I had to change was to take off the ".zip" on the file when you rename it. Otherwise, the phone wouldn't take it.

  • Daniel

    Thank You.

    I just rooted my Thunderbolt.

  • Chris

    Justin, please help. I rooted and was using the 4g just fine and rebooted multiple times no problem. But now I only get intermittent 1X. Sometimes it won't have any mobile network at all

    • ChadS

      I'm having the same problem as Chris...

      • Chris

        I booted into the recovery and did a factory wipe and then it worked. Some were saying that Verizon was just having LTE problems this morning?

    • Justin Case

      Verizon network wide outage, my unrooted phones are having the same issue.

      • http://www.FlatRateComputerGuy.com houndazs

        good to know thank you Justin.

      • ChadS

        I dialed *#*#4636#*#* to get into network settings and switched my preferred nwetork type to "LTE mode" under "Phone Info". Now I have 4G again, and it's working great.

        • http://www.FlatRateComputerGuy.com houndazs

          mine is working normally now too without doing the above so you can probably switch it back.......if ya want to i think i might keep it on strictly 4g for a while to see the results....

  • http://www.FlatRateComputerGuy.com houndazs

    I am officially having radio problems now too. hrmmmmmmmmmmmmm

  • ChadS

    I am having 4g issues after rooting as well. Prior to rooting I had great 4G service, now I'm switching between 1X and 3G at best. Any thoughts on this?

    • Justin Case

      Verizon network wide outage, my unrooted phones are having the same issue. Please see above.

  • asd

    Is there going to be a method coming out that doesn't involve wiping data? I don't mind if it's not 1 click i just don't want to lose my data.

  • Hellboy2232

    Is the file in step one supposed to say invalid when u double click on it? I have downloaded from all 3 mirrors and they all say that

  • Dotson

    I did the same thing, says invalid but its not, if you use winrar it will open it and show you

  • Hellboy2232

    Awesome it worked . Had a random reboot after flashing the downgrade RUU, But I rebooted phone and adb and it worked!!!!! Thank you all for your hard work. I now know how to use adb!!! Well a little lol.

  • Dxun

    Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.

    Ok I'm stuck here. Never had the option to upgrade. Did a quick process then came back to bootloader screen.


    Any ideas what i should do?

  • AllyWonders

    Ok.... I installed superuser and Rom manager everything works flawless but I cant go to clockwork recovery it goes directly to boot loader and it still says S-ON some how... Is there something I missed ?

  • Payab

    I have rooted the TB, and everything was working. Then market place keep shutting down. SO i try to install CM 7 using
    http://www.addictivetips.com/mobile/install-cyanogenmod-7-custom-rom-on-verizon-htc-thunderbolt/ Instruction.

    Now my phone come on and when i push the power button, it restart all the time and i cant get to use it.

    I can get into Clockwork Mod Recovery by taking battery out and restart. it would go into the Clockwork Mod menu. I tried to reinstall by install zip from sdcard with stock firmware rename PG05IMG. "Cant open /sdcar/PG05IMG.zip(bad)"

    How can i get my TB back ?

  • Mark

    I just rooted my TB & immediately began the process on my wife's TB, however I'm having problems during step 4 after the flash & reboot. When I typed the 4th command my DOS window closed unexpectedly. I reopened the window and retyped all the commands in Step 4, but now in Step 5 /data/local/psneuter gives me a reply of failed - Operation not permitted. Please help!

  • Joey v

    Couple of questions 1.This step will gain temp root and flash the custom misc.img. Run:
    adb shell
    Now the shell should display "$".
    You will now be kicked out of adb, and adb will restart as root. Let’s confirm the md5 of misc.img:
    adb shell
    At this point, the shell should display "#".
    Mine displays the #right away. 2. How do you "flash" the files, and 3.is the RUU suppose to not be able to show on the PC? Sorry for the noob questiond

  • TonyStarkV5

    Is the person in the video tutorial doing it that fast to be a dick? Yeah, nice way to show n00bs and advanced users...in light speed. Congrats.

    • Woodzy

      download the video to your pc and watch it - it should run at normal speed.

  • mike

    Couple of questions 1.This step will gain temp root and flash the custom misc.img. Run:
    adb shell
    Now the shell should display “$”.
    You will now be kicked out of adb, and adb will restart as root. Let’s confirm the md5 of misc.img:
    adb shell
    At this point, the shell should display “#”.
    Mine displays the #right away. 2. How do you “flash” the files, and 3.is the RUU suppose to not be able to show on the PC? Sorry for the noob questiond

    Same questions here!!, also how do you put things on your sd card?

  • joe280zx

    Really new
    in step 4 where do you rename downgrade file and How do you del pg50 img from sd card

    • Krebster

      The first file (RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.0103_2r_NV_8k_1.37_9k_1.52_release_
      165253) is the one you rename. Make sure the USB connection type is set to Disk drive so that you can access the SD card in the phone through windows explorer. Then just place the renamed zip file on the root of the SD card. Then go ahead and flash.
      After rebooting check that the USB connection type is set to Disk drive, and then access the SD card through windows explorer to delete it.

      • dave inkeles

        I downloaded 3 files and used the 459mb to my sd card and I was able to get through Step #4 perfectly. I went through to #7. This is where I just lost it. I did the same download and (399mb) and put it as an zip file (unopened) at the bottom of my sd card (not in a file). I went through the same procedure as I did in step 4 but this time I did not get all the way through.
        I'm so bummed right now as I have been at this all day. I guess I don't understand the jargon. the file is named PG05IMG just as it was named in step 4 (although a different file. I'm lost

  • dave inkeles

    Justin is the greatest. Patient and helpful.
    Thanks so much!!

  • Christoph

    Someone else asked above but it wasn't answered... would it be possible to do this using Terminal Emulator instead of adb?

  • ryan

    When I tried to root my phone, the root worked but the phone does not seem to detect anything other than 2G networks. Anyone else seen this?

  • Neophyte

    I was wondering, has anybody done this using a Mac? If so, then would I have to run terminal in su to perform the rooting of my phone?

  • XiriX12

    I had tried this process and using the videos that nat3mil posted on YT. I have gotten to step 4 and made it to the part where it is supposed to ask if i want to upgrade. Well it does not. It keeps going to bootloader and so i cant do anything past that. Is there an explanation? I have also just read the one-click root seems easier. If i try that do i need to undo any of what i have done so far? Any help is greatly appreciated i am a longtime BB user but am only a few weeks on the Android platform.


    • dotson

      Rename it and take the .zip off the end of the name and that should be your fix

  • Shea

    When I try to run Rom Manager, I get this error. An error occurred while attempting to run privileged commands"

    Any suggestions?

  • Shea

    Also, I went through all the step and followed the directions completely to the T. Titanium backup says that I do not have root access.

  • Bud206

    I did the Easy Root method and had a computer problem before the last flash now I have the 605.10, I tried to run the "return to stock by jcase". It wont work I don't have root, should I just do the Unlock Bootloader by jcase ? Thanks for your Help

  • Bud206

    Should have said the computer problem was a blue screen and reboot, the phone and computer seem to be working fine.
    Thanks for any Help !

  • XiriX12

    I have one more question before i initiate the root process. I read certain things in the guide like "Set up the two part exploit, to gain root and unlock MMC." does this mean that this is going to be done in the following lines being entered into the cmd? or do i need to set something up on my own? Also in step 6 when i put the custom RUU on the SD card and "Flash it" what exactly is flashing. Pardon me if it is something simple. I just want to make sure that i get everything correct. Thanks

  • TrueABM

    Successfully rooted and installed several root required apps but Titanium is the only one that isn't working. It's not able to get root access. Questions if my tbolt is rooted and Rom has Busybox. Suggestions/help pls

    • TrueABM

      Problem solved.

  • daveg

    I am stuck at the same place as several other people namely end of step 6 where I reboot into bootloader to flash the second RUU. I get stuck in the "loop" during flashing of checking PG05IMG.zip then bounced back to home screen of bootloader without an option to update. I have checked MD5sum, deleted and re-downloaded RUU, and confirmed it is named properly. Any ideas?

  • cybertrekker

    I successfully rooted!! Yes! However when I go to "fix permissions" in rom manager I get this error msg: "An error occurred while attempting to run privileged commands!"
    Ok I give?
    I tried the IRC chat and could not log in? I clicked on the link above put in my screen name with #thunderbolt and got a pop up error about a server restarted and to refresh screen did that and nothing? I'm batting one for three... at least I rooted!! ;)

  • XiriX12

    Well i need to express how easy this root method was. I followed it to the T and after solving my typing .zip i had ZERO issues with the process. I thank all of the developers and all the people that commented and answered some of my own questions.

    I am now rooted and looking to set up my Tbolf the way i want to!

    Thanks again

  • JohnMac

    Just rooted my Thunderbolt this morning. Thank you to all the people that worked on this rooting!

  • Birdman5666

    ok im a noob to android phones n hacking n rooting stuff but ive allways wanted to learn how. now i know there is a few links at the top that educates a lil bit on rooting but i want to know as much as possible about this stuff before i try nething on my htc thunderbolt its my first droid phone so be patient with me lol. i dont want to f up my phone so if neone could help n give me some more links to stuff i should read up on n get edumacated on itd be greatly appreciated.

  • Birdman5666

    oh n another thing for some stupid reason my comp wont detect my sd card wen i put in my computer so if neone has any ideas on how to fix this thatd be awesome all i have is a motorola micro sd adapter n it aint working, i have like three of them n none of them work lol.

  • sgtguthrie

    Worked perfectly! Thanks everyone!

    I know there's automated methods now, but I would rather know where the problem was in the process if I had any. Only hickup was that when i'd reboot i had to turn off usb debugging and back on for it to connect. I certainly learned a lot from this process...

    Thanks again!!!

  • Josh

    Help! I was able to go through the whole process without any problems, however now that it is back up it is not able to find my correct location. The weather and apps think I am in Koulikoro Africa (I am in New Jersey). Also after installing superuser and trying to run titanium backup it tells me I don't have root access..

    • sgtguthrie

      The location thing has nothing to do with root. Go to settings, location, and uncheck Google location service and check VZW. Don't ask me why...as for titanium, go to "problems" and let it install busybox. It's version will stay in the titanium folder on your SD, and it will work fine after that.

  • josh

    Ok so i installed the new busybox and titanium is now working, thanks! I unchecked the Google locator but the weather widget won't work without it. Is there any way to fix that?

  • amboy360

    I had an issue with step 4 when you Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. I does not ask me to upgrade is there a reason why? And one more thing does it matter if the 3 downloaded files are in winrar files?

  • amboy360

    I had an issue with step 4 when you Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. I does not ask me to upgrade is there a reason why? And one more thing does it matter if the 3 downloaded files are in winrar files? Please I need to know.

  • Emily

    Can I re-root it, let's say, if I have an s-on bootloader instead of an s-off? or will that somehow brick it?

  • dave inkeles

    it must be s-OFF to be rooted. Start at #1 again and move forward SLOWLY.
    If you don't get to s-OFF then we'll start again until you are rooted

    • dave

      Remember....you MUST rename your 2 large files PG05IMG!!! Also do NOT include .zip as the file already has it but it's hidden. I ran into that several times.
      One file is 459mb and the other is 399mb.
      Download them but DO NOT OPEN THEM. Send the entire zip file to your sd card and your phone will open it by itself.

  • Emily

    Alright. Thanks so much for your speedy response :D you guys are amazing

  • dave

    Open a file on your desktop and name it whatever you want. Emily for example.
    You cannot put 2 files with the same name in the same folder so rename one (temporarily) PG05IMG459 and the other PG05IMG399. Before you extract the 459mb to your phone, take off the 459 and send it as PG05IMG...just like that. It will open and you will gain temporary root.

  • dave

    Remember, after you go through to step 6 (a little later) you will do the same thing but this time with the 399mb file. You MUST remove the 399 from the PG05IMG and send it exactly like that PG05IMG and you will gain final root. DO NOT ADD .ZIP to either file or you will not gain root. It is already attached to the PG05IMG. You just can't see it because it is hidden. Don't worry about it. IT WILL WORK.
    As soon as you complete step 4 you will notice at the top of the bootloader screen that it now says s-OFF......Hoooowahhhh

  • Emily

    So neither file should be a "zip"? They should just be normal folders?

  • dave

    That is correct. It will not recognize anything besides PG05IMG..

  • doug

    Need some help here. Get to step 4 renamed fill to PG05IMG.zip only 1 zip
    and get to bootloader and it says no image found. Have downloaded all there listed and the top of the page and get the same problem and ideas on whats going on? please help.


  • dave

    Doug, Read the previous posts that I sent to Emily. Get rid of the .zip. It is already there (you just can't see it) You are renaming these files PG05IMG (nothing else). You can't have 2 files with the same name so you are renaming them PG05IMG, but only one at a time.

  • ChuckM

    I have rooted with s off, Rom Manager shows up in SU, unable to "fix permissions" in Rom Manager, says: "error occurred while attempting to run privileged commands" any suggestions?

  • http://evmls.com Daniel Reynolds

    Your instructions were right on! First time rooting my phone! Thank you very much! I will never rock stock again. Goodbye bloatware!

  • Chris coughlin

    The video already shows 3 folders on his computer... Am I suppose to download all 8 mirrors? And when I do they come up as files not 3 folders that's in the end of video 1. I'm confident in rooting my phone just want to get started correctly. Any help would be appreciated. Ty

  • dave

    @ Chuck....Download Titanium Backup and click problems. It will ask to fix busybox. You say yes and the problem will be solved.

    @ Chris...I understand it's a little confusing.
    Download one from each. Just use each Galaxy. Three different downloads. You will notice that the first file is 459mb, the second one under mirrors with busybox etc... is very small and the third is 399 mb.

    Keep asking if you still have troubles. We'll get you rooted.

    • Chris coughlin

      Ty for the reply and help gonna start root here in a few min.

  • Chris coughlin

    I dont get an update option on step four . Any help would be great.

  • dave

    Ok. When you get to step 4 you MUST change the name of the file to PG05IMG.
    Do NOT add .zip to the file and Do NOT open the file...It MUST be kept in its zip state. The program will open it automatically

    • chris coughlin

      yup...got it. had to delete the file i use later so my phone would allow me to name the file exactly like i need to. it would automatically put 2 behind it because i have another file named the same way. it took the update and im movin on thru the steps. appreciate your help.

  • dave

    Remember...You MUST name the third file
    the same thing again (399mb file) also.

  • chris coughlin

    completed the process...first time ever rooting a phone. thank you justin for posting all this information(the videos were great help) and thank you dave for your help. anyone who is interested in trying this just follow all the directions down to the t and you will be fine. thanks again everyone!!!! :)

  • dave

    Awesome. Now the fun starts.
    Pick a rom... I went with "The Perfect Storm". I am stable to 1.62GHZ.
    There are so many to choose from.
    Put this, Android Forums, and XDA on your desktop. New stuff daily.
    Have fun!!!

  • chris coughlin

    Ok will do. I'll start with the Rom u suggested since I'm a beginer at this. One question...is it ok to delete apps I don't use now or should I freeze them out with a root app?

  • dave

    Freeze them or uninstall them with Titanium Backup. Also install SETCPU. Imperative for changing your speeds.
    86 that stock junk. You didn't spend the last few hours rooting for stock.
    Go to one of the forums and load something to your liking. There is SOOOOOO much to choose from. Get some speed. I loaded the
    Thunderbolt_1766_v2. It flies and you wont be using 1GHZ anymore. More Like 1.76 GHZ. A lot faster and equally stable.
    Just my favorite for the moment but new roms are coming out every third day or so. It's awesome. I'm new to this also but it is fun to play.

  • chris coughlin

    Thanx man! Really appreciate all the input and help!

  • jeff c

    Hello, I rooted my phone last night and this process worked perfect, I just got caught on the double .zip in step four. My phone was rooted with s-off. Now here is my problem, I flashed a new kernal today using rom manager, I made sure It was compatiable with a T-bolt it flashed properly and is still on my phone but I LOST ROOT!. When I go Into bootloader It just starts to update the last PG05IMG 399mb file without giving me a chance to get into recovery. and states "do not power off device". Ive tried three times. everything I had acess to is gone. I cant find anybody else who has had this problem. HELP???? any ideas do I have to do the whole process over????

    • dotson

      Hey man all you need to do is rename that zip file and put something at the end like PG05IMG.zip.bak and then you can get into recovery:)

      • jeff c

        Thanks good Idea. did that , can get to recovery now. still have s-off. so some of its still there. I used root checker from the market and it gave me a line: /system/bin/su: no such file or directory /system/xbin/su: no such file or directory

        SU binary not found in the system declared PATH
        It also stated that busybox is not in the declared path.

        the only xbin codes are in step 7. do i need to repeat the process from there or do i have to un-root the whole thing and start from scratch?????

        Thanks for helping a NOOB.

  • dave

    @ Jeff C.,
    Did you download Titanium backup?? If yes, open it and click on problems. click on busybox and you should be good.

    • Jeff C

      I do have Titanium. It says also I have no root. I let it download a new busybox with no luck. Thanks

  • dave

    OK! No problem. Go back to step 7.
    Your pushing of su did not take. It happens.
    Start with step 7 and report back to me

    • Jeff C

      Ill do that after I get home later and let you know. THANKS

    • jeff c

      dave, that did it. repeated step 7. rebooted. flashed new kernal, I GOT FULL ROOT BACK!!!!!!!


  • dave

    It's SHOWTIME!!! Download SetCPU and Astro file manager.

  • Joey G

    I had to bail on step 4 last night. Had zero problems and will be ready to continue tonight. My question is do I need to start over from step 2 or can I just pick up at step 5??

  • Joey G

    OH!! Thank you for the wonderful tutorial and yours and everyone elses work. I thank you in advance for your response!!

  • dave

    If you have temporary root (s-OFF) then just continue...If not, (s-ON) then start again and remember you MUST change BOTH of the files to PG05IMG not PG05IMG.ZIP before loading them and DO NOT OPEN EITHER FILE
    (The 459mb or the 399MB). Your phone will do it automatically!!!

    • Joey G

      That was super fast response!! I really appreciate the quick reply. I just checked and it says (s-on) so it looks like I will be able to start fresh which is what I wanted to do anyway!! One more question...If rooted will I still get OTA updates?? The reason I am asking is because I am rooting to get rid of bloatware and make some appearance changes--nothing to crazy--just do not want to get in over my head too fast...I want to "wade" in the lake before I swim in the ocean!! haha