Share this Story

How to: Root the HTC Thunderbolt and Unlock the Bootloader


The amazing hackers in the Android community took on the HTC Thunderbolt the minute it was released and stumbled upon some not-so-exciting news.  It had been completely locked down like no other HTC device in history.  While many were quick to yell at HTC, I’m pointing fingers at Verizon and will save further comment for another time.  The good news is, Team AndIRC and Scotty2 weren’t about to be stopped and permanently rooted it while also unlocking the bootloader and providing S-OFF.

So who’s ready for some TBolt unlocking?  Before you say yes, you need to be thoroughly warned.  This requires adb, a mega-list of commands and is one of the most intense rooting procedures I’ve seen in a long time.  You are essentially, flashing old system software, unlocking the bootloader, and then re-flashing the release software with S-OFF to open your phone up.  Again, this is intense and should only be attempted by those familiar with adb.  

*This is not for beginners.

*Fully charge your device before proceeding.

*Read the entire list of instructions at least once through.

*I have not attempted this, but our man Picolas has with success.

*Again, this is not for beginners. This could brick your phone.

Step 1


First, download these files:

RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253 (md5sum : aae974054fc3aed275ba3596480ccd5b):

Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : 3b359efd76aac456ba7fb0d6972de3af):

Custom RUU mirrors (md5sum : aff07b8256628a175c40938d408fa16f):

Step 2

Note that adb is required.

Push misc.img, busybox, and psnueter using the following commands:

adb push psneuter /data/local/
adb push busybox /data/local/
adb push misc.img /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox

Step 3

This step will gain temp root and flash the custom misc.img. Run:

adb shell

Now the shell should display “$”.



You will now be kicked out of adb, and adb will restart as root. Let’s confirm the md5 of misc.img:

adb shell

At this point, the shell should display “#”.


/data/local/busybox md5sum /data/local/misc.img

Output should be “c88dd947eb3b36eec90503a3525ae0de.” If it’s anything else, re-download the file and try again.

Now let’s write misc.img:

dd if=/data/local/misc.img of=/dev/block/mmcblk0p17

Step 4

Here you will rename the downgrade RUU as PG05IMG.zip and place it on your SD card. Then, run the following command:

adb reboot bootloader

Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.  Once done, reboot and delete PG05IMG.zip from your SD card.

Set up the two part exploit, to gain root and unlock MMC.

Push wpthis, busybox, and psnueter:

adb push psneuter /data/local/
adb push busybox /data/local/
adb push wpthis /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
adb shell chmod 777 /data/local/wpthis

Step 5

Next, enter the following commands:

adb shell
To unlock eMMC:
adb shell

Step 6

Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.

To push the eng bootloader:

adb push hbooteng.nb0 /data/local/
adb shell
/data/local/busybox md5sum /data/local/hbooteng.nb0

If the output does not match “6991368ee2deaf182048a3ed9d3c0fcb” exactly, stop, delete it, and re-download it. Otherwise, continue.

Now we will write the new bootloader.

dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

Confirm proper write:

/data/local/busybox md5sum /dev/block/mmcblk0p18

If the output does not match “6991368ee2deaf182048a3ed9d3c0fcb,” try again; if it still doesn’t work, seek help from chat.andirc.net in channel #thunderbolt.

Now, reboot your phone and put the custom RUU (PG05IMG.zip) on your SD card. Then flash it. This will upgrade you to release firmware with an S-OFF bootloader.

Next, run this command:

adb reboot bootloader

After it flashes, you will be running release firmware with S-OFF.

Step 7

Push SU, busybox, and psneuter:

adb push psneuter /data/local/
adb push busybox /data/local/
adb push su /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox

To gain root:

adb shell

The following will remount /system and set up SU:

adb shell
mount -o remount,rw -t ext3 /dev/block/mmcblk0p25 /system
/data/local/busybox cp /data/local/su /system/xbin/su
chown 0:0 /system/xbin/su
chmod 6755 /system/xbin/su

Step 8

Install Superuser from the Market.

Reboot your phone. You should now have full root permissions.

Step 9

Finally, install ROM Manager and flash the ThunderBolt recovery.


If you have problems getting SU to work, a couple extra reboots will likely fix it. If you still have problems, come to the chat: irc.andirc.net #thunderbolt or use http://chat.andirc.net:9090/?channels=#thunderbolt.

And for those of you that have completed this, please leave any tips you can in the comments.

*Last note* – We’ll sit back and hope for something simpler from the guys at unrevoked, but it could be a bit.

Via:  XDA, Android Police

  • Pete61

    What carriers can I use ? Does it have to be on a contract can I use month to month and can I use Sprint ,Ty to those who share their knowledge Pete.

  • Richbbqs

    Does anyone know if rooting the thunderbolt will allow AutoAnswer apps to work again?
    The MODIFY_PHONE_STATE permission was marked as “for system use only” in Android 2.3.While this was never intended for developers and publicly endorsed by Google, there are hundreds
     of apps in the marketplace using it. Unfortunately, a seemingly innocent checking by the Android folks has now crippled many popular apps for Android 2.3+.

  • Droid-life Pat

    I always forget the SD card must be FAT32. It gets me every time.

  • I need some help, for some reason i get to step 4 and where you go to flash the file it just checks it, does not flash it. All the md5 checksums match, and I have rooted my wifes TB using the same instructions. My adb is up to date with revision 12, I just cant see why it won’t work. please help

  • can anyone

  • Panda_rec

    I had an issue with step 4 when you Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. I does not ask me to upgrade is there a reason why? And one more thing does it matter if the 3 downloaded files are in winrar files?

  • Matthew

    It worked perfectly!!!
    I now have a ROOTED ThunderBolt and can do what I want and not what Verizon tells me I can do or not do!!

    The only thing to remember (From a mistake that I made) is in “Step 4” you have to rename the “RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253” TO “PG05IMG.zip” and not just upload the file already named “PG05IMG.zip”.

    To make the steps 4 and 6 easier rename the file “RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253” TO “PG05IMG-Step4.zip” and the file “PG05IMG.zip” TO “PG05IMG-Step6.zip” So you don’t mix them up like I did, but don’t forget to change them to “PG05IMG.zip” once you have uploaded them to the SD Card.

    Also you have to unzip the file “exploits.zip” and copy the unziped files to the SDK “platform-tools” folder.

    Good Luck ALL And Have Fun….. This is not that hard; Only take about 1 1/2 hour with downloading all the files that are needed! 🙂


  • Ybortacoman

    Had to run process a couple times but if you follow steps it does work. As mentioned, it took a couple of reboots to get superuser to take control. Good job guys (from a complete noob).

  • sdrivel

    Little vague on Step 9.. I followed the instructions (carefully while watching the video), but am unclear about what to do after I install the ROM Manager. I installed ROM Manager, clicked on ‘Flash ClockworkMod Recover’ hit ok, rebooted, but never got the clockworkMod screen. (video @ 12:17)… Is there something else i should do? RootExplorer app is working (can rename files to rid bloatware), but Titanium Backup says I’m not rooted…

    • sdrivel

      nevermind… had to hit ‘get busybox’ in titanium backup…

  • Corbijn

    I am a COMPLETE virgin noob. New to Android, new to ADB, learned what “root” meant about 2 weeks ago.

    If my noob ass can follow these instructions and succesfully root my TB, then anyone should be able to.

    TIPS for other noobs:
    extract EXPLOIT.zip into the same directory as ADB.exe
    I had this page up in one window, the video in another (had to pause and rewind a million times), and I was able to do this.

    Maybe because I was going really slow, but it took just over an hour.

    Now I just need a recommendation on a good app to remove the bloatware.


  • Leearmijo91

    at first i chickened out and went with the 1click way tried it day after day. didnt work.. decided to do it this way with adb worked instantly first time..

  • This may be a dumb question but I am still new to this, do I have to unzip the exploits.zip folder to somewhere in particular? Sorry if that’s a horrible question but it cannot stat psneuter. If anyone can answer that would be great!

    • Corbijn

      I’m getting the exact same error.

      • Corbijn

        Got it harry, unzip files into same directory as ADB.exe

  • This is probably a stupid question, but i am new to adb. Do I have to unzip the exploits zip folder to somewhere in particular?

  • Clipfootball10

    It might be a dumb question but do you have to download all 8 of those links??

    • I believe you just download the three different files, there is just multiple places to download them from.

    • Playtime

      I haven’t started yet, but it looks like its just one folder in each section. (All folders in same section have the same folder name)

  • Mylockandroid

    super duper success. probably was easier all in all than the iphone first gen original JB and unlock command line method, but not by much.

  • Jprz0818

    I sse this hard to do im afraid im going to mess up my phone. Is there anyone who is willig to do it for me that is familiar or has done this before. Please let me know

  • Mylockandroid

    pre-downloaded all needed stuff and setup my sdk manager USB inf file to support tbolt, added adb in so i can launch the shell direct from run prompt. should be ready to root and install the de-bloat adrynalyne rom soon as this phone is in hand tomorrow. can’t wait.

  • Booboolala2000

    will wait for unrevoked. That is some serious work there brother

  • Memtenn

    So everything works fine till I get to step four. I cannot flash this downgraded Rom. I go into bootloader and it just will not flash it. Should I redownload the Rom. It flashes and says image could not be found with more messages but it goes so fast I can’t read the rest and goes back to the bootloader option screen. Any ideas? Been working on this four days now. It is not as easy as you would think…

  • morty

    There is no real “bloat” with a stock TB. Yes it has a few apps on it that you will never use, but those are not running in the background, at least on my phone, and therefore pose no threat. There is no issue here.

  • Anonymous

    i just finished this process…i was pretty intimidated at first, but i did a lil research on adb, then went for it…it’s not as bad as it looks 🙂

  • Anonymous

    i just finished this process…i was pretty intimidated at first, but i did a lil research on adb, then went for it…it’s not as bad as it looks 🙂

  • Raptor007

    I may give it a roll tonight, its been a while since I used adb, I just need to read up on how to use it again.

  • Sputnick

    Another locked bootload….sheez. I just bought another Moto OG Droid. I think I will have OG Droids for the next few years unless a trully open phone is released on Verizon. C’mon Nexus!!

  • Eseyfried79

    My only issue is that I really like a many aspects of Sense and am hesitant to flash a custom ROM. This is really a great phone

  • Eseyfried79

    Rooted mine this weekend and loving it.

  • MK17

    I don’t understand what locking bootloaders does for the phone manufacturers…

    Out of the millions of devices they sell a small percentage root, so whats the big deal with letting people who have the capability to do what they want with it. The worse thing I can think of that you could do is cook the processor, but there are very few people who would be willing to push that far.

    Am I completely ignorant here? The only other thing I could see is wifi tether, but that only hurts Verizon.

    • I don’t know, but this _could_ be one of the reasons: If someone bricks their phone, their most likely to take it back to the store for a return, and get a new one for free (if they are within the return period of the store they bought it, _or_ if they have a protection plan). The phone companies lose money when they have to replace a phone for free.

      • Matthew

        They don’t lose anything except a few dollars for shipping it back to the manufacturer.

        Do you really think that it cost them anywhere near $300 for them to get the ThunderBolt?
        Or for that matter anywhere near the “Retail” of almost $600…. Sorry but it only cost them around $100-150 for each device and the ones that are returned to the manufacturer are sent back to the as a “New” device so they can resell it.

    • Booboolala2000

      I agree with Kellex, its probably Verizon. Even if HTC puts out updates Verizon has the final word. Maybe HTC will release their own workaround. Motorola said they would look into it on future devices and they did for the XOOM.

  • Sjf707

    whats the point in rooting? does it make the phone work better?

  • Anonymous

    I was thinking about getting this till I saw the root procedure I am not familiar with adb

  • Unconsciousflo

    Awesome job devs..great directions…a lil adb never hurt nobody 🙂 this thing is flying now

  • Anonymous

    Try as they might, the hackers always win in the end. Carriers, give up and save your tricks for a closed system like WP7 or iOS, because android is too open for you to lobotomize. 😀

  • Too bad I own a Mac

    • ryeguy

      me too =(

      • mobileT83

        VMware Fusion… that is how I rooted my OG Droid 2 years ago

    • Mylockandroid

      so do i

  • Anonymous

    lol… this looks like fun… too bad I don’t have a Thunderbolt 🙁

  • Dmota25

    When they can create something easy like z4root.. I willl
    Paid anything for come with easy way!!

    • What that supposed to be English, or did you just make up your own language?

  • lu270bro

    I rooted this way. It’s not difficult if you can follow directions. I had to ” adb devices” a few times along the way after reboots and the temp roots to make sure device was connected, but no pickups. Just follow the directions. Plus if you do it this way I personally think it helps you become familiar with the android system and less reliant on help threads and such.

    • Hoot352

      For someone who would like to learn more about things like this to be able to undertake this task with more confidence. How would you suggest I go about that? I don’t want to become reliant on apps and threads on how to do this or that. I want to learn how to dig into the brains of this device and know what I’m doing.

  • What happens to the phone when HTC and Verizon release Gingerbread for Thunderbolt?

    I’m new to Android (loving my Thunderbolt! I only had a BlackBerry before), but I’ve hacked flip phones before. Would someone provide a point list of the benefits to rooting? I know some benefits (bloatware removal, I assume free hotpsot forever, custom ROMs), but I’d like to see a full list before I commit the time.

    • Hoot352

      One of the better information pieces on this I found at

      Rooting Explained + Top 5 Benefits Of Rooting Your Android Phone
      Posted by Sarah Morrow in Mods, Tips

    • Eseyfried79

      At that point someone will put out a ROM for the stock update that has root. You will not accept the OTA update because usually they remove root. In some cases (droid 1) lock down the phone.

  • JJ

    I finished doing this a few hours ago. It’s not too difficult, just a lot of copying and pasting in adb.

  • to risky, not playing around with my new thunderbolt

    • Sputnick

      Would you recommend the phone to others?

    • Mylockandroid

      whats so hard about typing commands in. yeah, the setup to have adb and everything ready to DO the commands is the hardest part.

  • Anonymous

    A video walk-through would be pretty strait forward. Any chance of one of those?

  • In this case I’m glad Apple has so many holes in which to run exploits to gain root-access. Jailbreaks come just as fast as a new iOS revision. But, with that said the DevTeam, (among others) only have to focus on one device, not multiple ones like android. I’m glad to see this work being put together. I’ve rooted many Android phones, but none to the extent of this one. I’m sure unrevoked will come through, or many others. I really like this HTC device, but it’s VERY apparent carriers and manufactures are locking more and more devices down. So well for “open android” This was not Googles intent, and I hope things change coarse soon.

    • LivinFree

      I couldn’t agree more. And if you think these locks are bad just wait til you see what they are working on for down the road. And it will affect all carriers and all devices.

      What I also find funny is the fact that everyone goes ape crap about HTC for not locked bootloader like Moto device and low and behold they put out a device with a locked bootloader. I realize they got around it but the fact of the matter is this stuff will NOT be this easy forever the handwriting is on the wall.

  • Anonymous

    Wasn’t one of the selling points for this phone within the Android rooting community the fact that it was supposed to be easy to root?

    • Dodgesityballer

      No, one of the selling points for this phone was that it would be able to be rooted AT ALL! Which it obviously is so its still has a valid “selling point.”

  • this was intense, but not that difficult, instructions are very precise, just copy paste the commands to avoid any mistakes, took me about 1 hour, TOTALLY WORTH IT
    works perfect, clock work, rom manager, backups!

    • Sputnick

      How do you like the phone in general?

      • its fantastic, now with removing the bloatware and changing the phone to 3g only, battery is awesome, smooth, great screen, overall its a very sweet phone, no complaints other than the damn battery case is such a pain to remove but its all good

  • Anonymous

    I’m keeping this thing stock at least until the warranty expires. This thing is so awesome I really don’t see a need to root it beyond removing the bloatware, and even that isn’t a big deal since they are just dummy icons not really taking up much space on the phone.

    • Alvinm 77

      It is awesome though!

    • Bacabone

      removing bloat is reason enough

      • FortitudineVincimus

        so is blocking ads, screenshots, force apps to SD, nandroid level backups, wireless tether, overclocking, etc.

        if you root, you can always go back and the twits at VZW would never even know

        • Cali E

          you sir are a tool. seriously have some respect. bring your rooted phone back to me to return it and i would tell you to shove it. VZW employees are more knowledgible than you think in most instances

          • Jred

            how would you know?…

          • KO

            Its very hit or miss unfortunately. I am sure their are many out there that are quite competent at their jobs, but those that I have had contact with unfortunately were exactly as FortitudineVincimus described.

            I am by no means saying that is the case with all of them, but it is kinda scary that some of these people are in the positions they are in.

          • Mylockandroid

            he means roll the phone back and then return it. the only way you couldn’t is if it was a total bootup fail or dead display.

          • Mwds4

            That’s a real professional look at it coming from all mighty VZW employee. Throw a bag of apples onto a pile of crap, one apple may miss the pile but the whole batch is still crap. Your claim of being so knowledgeable just means 1 your a 20 something yr old idiot or you are what you claim but your still crap cause the rest of VZW employees all have colostomy bags for brains

          • JG-unit

            Nop Verizon Employees and Apple Employees are all dumb, this coming from someone who replaced both a jailbroken iphone and a rooted droid X 😛

          • I Totally agree, not that i’m against rooting, “OBVIOUSLY,” I have people all the time coming in “oh my phone is messing I need help or warranty replacement.” A 2 second look over can tell me it has a mod.

          • Matthew

            Hmmm…. You must have not been to the store near me cause they are all retarded!

            I’m sorry but if you can’t even figure out how to turn on the device and you work for VZW in one of there stores then you are RETARDED!!!

        • Cali E

          you sir are a tool. seriously have some respect. bring your rooted phone back to me to return it and i would tell you to shove it. VZW employees are more knowledgible than you think in most instances

    • angermeans

      I will be waiting until cm7 and then I will be taking the plunge even if i am under warranty and even if rooting involves this many steps. I want stock gingerbread and i almost kept my incredible instead of getting the thunderbolt it is so nice. You hear that HTC we need a 4.3 inch dual core phone running stock gingerbread. I would pay almost anything for that. Well within reason of course.

    • Eseyfried79

      Wifi tether on 4GLTE, adfree, removing bloat, access to custom recovery, kernels, Nandroid, titanium backup, root explorer, ect. All that being said, stock is pretty damn nice..

      • Anonymous

        I’d root if I could keep sense 2.0… sense to me is the best ROM available.. if I could just add those extras then I will root any day

        • Eseyfried79

          I hear you… Coming from a Droid, I am not as pumped about custom ROMs as I once was. Sense could use more options, but the apps, especially email, calendar, and phone are awesome. I just wish I had more ADW like options in sense.

          • if sense allowed the options to add more rows and columns i would totally keep it, but damn big ass screen and i can only have it at a 4×4, thats crap lol

  • Dshudson

    Are youserious, I’ll wait for something easier… This retarded, I’m not smart enough for this

  • Mike

    I did this procedure last night and it worked for me. That’s 3 devices I’ve rooted without 1 click methods! Droid, XOOM, and Thunderbolt!

    • vanilla ice

      Nice! But wow. Too long of a process if you ask me. I would wait for z4 if I had thunderbolt. But its good to know you had success. How long did it take you?

      • Mike

        Probably an hour because of some of the downloads. I felt accomplished after I was done though.

    • FortitudineVincimus

      nothing wrong with 1 click root methods IF they work. There is no valor in wasting a bunch of time rooting an old school way just to say you did. I have rooted many phones and if there was a 1 clock root method for them all, IMHO your a chump to waste any more time than needed to root. 1 click root methods will and should become the norm. Hell, we use SetCPU and ROM Manager and BusyBox all to make rooting easier and beneficial, so why not 1 click fast simple quick easy root methods.

      I realize in this case, for now, this is how it has to be done. But I loath when people bust on 1 click root methods as it always come with some sort of arrogance that because one did it the long, slow, painful way… they are better in some way.

      give me a working 1 click any day of the week as I have stuff I want to do in a day and spending an inordinate amount of time and steps just to say I rooted the old school way.. please,

    • Jprz0818

      Do you live in Miami so you can do me the favor and root my phone….cause i cant understand it

    • Jprz0818

      Do you live in Miami so you can do me the favor and root my phone….cause i cant understand it

    • Dodgesityballer

      you call this a “1 click” method!?

  • fartbubbler

    wow. I guess no Z4root for the Tbolt crowd… yet?

  • Two_cents

    this gets you root but I wouldn’t reccomend doing much after its achieved due to the fact that you really can’t nandroid… it goes through but you get errors on whipe/ and back up… CWM needs some tweaking since its so new

    • Anonymous

      Recovery isn’t working correctly yet?

      • Anonymous

        i read the same thing on xda, i don’t think cwr is 100% polished yet for our beloved thunderbolt….but i’m sure koush will be all over it soon 🙂

      • Mrpicolas

        Just data wipe but is being updated and fixed i believe it may be already all that requores is cwm update through rom manager

  • Lilsoccakid724

    I thought people bought the Thunderbolt cause it would easily be unlocked…Why else would anyone still be buying solo-core phones?

    • Troll

      u jelly? no 4-gees 4 u lolz

    • Alvinm 77

      It will be. This is just the raw method. Easier root methods will come soon after and as far as your single core statement, its not what’s under the hood but how it runs. My Thunderbolt run better than my friends Atrix and that was his statement.

      • Rayman411vm

        A friend said the same thing…the thunderbolt is a solid device

        • Jred

          I totally agree. I almost passed this phone up, but in all seriousness it is one of the best looking devices I have ever owned and with solid hardware to go with it.

    • angermeans

      There still is only one dual core phone that even exists or has a release date and that phone is severely been gimped by att. I would say that single core phones will still be relevant for some time to come. Especially since all we see in terms of performance is very small. I have played with the thunderbolt and atrix side by side and I’m telling you that it felt all around faster, but that is just me. I think the thunderbolt is a great phone and that is why I purchased it and from what I have seen this past week (well since thursday) I am far from the only one. Not saying I wouldnt really want a dual core HTC phone on verizin, but until then I will be rocking this phone.

  • Tedd Huff

    Where can I get Unrevoked3 from ave a friend w EVO that needs root access.

  • Works good. Was nice to remove the Verizon bloat..

  • Anonymous

    Thankfully we have free tethering until may 15 until easier root process gets released

    • Anonymous

      interesting, the VZW rep that I bought mine from didn’t say anything about the mobile hotspot going away. He said that I would have it until I got rid of the phone.

      • Anonymous

        U will have the feature. But its only free through mid May.

        • Anonymous

          I specifically asked how long it would be free, I guess I will be going back to VZW tomorrow and talking to this guy (and then possibly a manager).

      • Bacabone

        that is what mine told me. god i hope he was right

  • Alvinm 77

    This is a little too much for me. I’m coming from the Droid X and z4root app lol. I’ll wait for an easier method. Unrevoked3 should have an easier root soon. I’m not in a rush quite yet.

  • Alvinm 77

    This is a little too much for me. I’m coming from the Droid X and z4root app lol. I’ll wait for an easier method. Unrevoked3 should have an easier root soon. I’m not in a rush quite yet.

  • The original EVO 4G unlock/root was using a similar procedure. Complicated, but unlocked the device months before any 1-click roots did it properly and fully.

  • Tedd Huff

    I think I will wait for an app the will do the heavy lifting for me. Hope someone can create on as easy as the old z4 root.

  • JobsH8er

    Too bad im a NOOB @ ADB ;-(