[HOWTO] Getting root on your Thunderbolt from start to finish - Mac OS X

[IISiDeK1CKII]

After having nearly hung myself trying to figure out the whole SDK thing, what the hey ADB was and all that jazz, I thought I would give the rest of the people out there a step by step guide on getting from stock to root in no time. If you follow this guide, you won't spend the hours I did on google, XDA and irc trying to get where I am. This stuff can be confusing, and I am only here to make it less so.

Disclaimer: If you destroy your phone, I take no responsibility for it. You are performing this at your own risk.

I take no credit for the root process itself, there are people much smarter than I who worked on this. I used the method outlined here by jcase. I am simply compiling this and making it easy for people (much like myself) who had no prior experience be able to have root.

Credits (from original post here)
Scotty2, jamezelle, jcase, and all of Team AndIRC
Testers, especially ProTekk and Trident
Thanks to scotty2 for WPThis
Busybox was pulled from a CyanogenMod ROM, source should be available here
psneuter was pulled from somewhere, credit to scotty2, source here
All firmware credit goes to 911sniper
Jaroslav from Android Police for editorial help
If I missed anyone in the credits, it was unintentional and I will fix it soon. Lots of people had their hands in on this project.

Original warnings, posted by jcase:

Pros
Root with read/write access to /system
Ability to downgrade and flash any RUU (i.e. signed firmware)
S-OFF
Fully unlocked bootloader
All ThunderBolts survived testing

Cons
Voids warranty
Could brick your phone if you aren’t careful

The method of rooting your Android device as described in the article herein is solely for enthusiasts and not for the faint of heart.

IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA.

Android Police and Team AndIRC disclaim all liability for any harm that may befall your device, including, but not limited to: bricked phones, voided manufacturer warranties, exploding batteries, etc.

The instructions below assume you already have a strong familiarity with adb command lines – this is not for beginners.*

*I made this guide as seamless and easy as possible. I have tested this 4 times now with success each time. Just follow every step to a T and there will be no problems. The warning is there to tell you what could happen if you don't listen very well...

Step 1: Download the Android SDK

http://developer.android.com/sdk/index.html

Step 2: Get into the SDK

After downloading, you should have a package named android-sdk_r10-mac_x86.zip in your downloads folder. Unzip it and move it to your desktop, to make life easier on yourself.

*Stop here right now if you have no idea what terminal is... shame on you, also this might be slightly more technical than you thought. No worries, I am going to hold your hand through it all*

Step 3: Get ADB

You can search as hard as you want to in that SDK and you won't find ADB. It's not there, leave it to google to be smug and leave a "ADB's not here sucka!!" readme in the file... cheeky muppets. Regardless of my personal feelings, You need to get ahold of the ADB. Easy enough to do. Open the tools folder located in the android-sdk-mac_x86 folder. Click on "android" (it's right next to google's smug readme...), and wait until it pulls up the screen seen below.

Once you've gotten here, click "available packages" on the left and install Android SDK Platform-tools, revision 3. Let it go through it's process and click close. Now, go back to your android-sdk-mac_x86 and you'll have the folder titled "Platform-tools", open it and, TA-DA! You have adb, don't click it... you don't need to.

Step 4: Prepare your phone for rooting.

Make sure your phone is fully charged before beginning. Go to Menu>Settings>Applications>Developer> and turn on USB Debugging. I had my phone on Disk Drive the entire procedure, I'm not sure if it had any benefits other than convenience, but, granted, it helped.

Step 5. Setup terminal for ADB.

To this point, you haven't had to open terminal on your own. It is probably still open from when you installed the platform-tools folder from the android executable file. If it is, right click (control click) the terminal icon, click new window and then click basic. If you closed it haphazardly (shame on you!) you need to open it. It is located in your application folder, in another folder titled Utilities.

Once you get to the terminal screen, you should see a white box, with the name of your computer, followed by the place your currently "located." A ~ means you are in your home folder. For fun, type the following into your terminal window.

touch test_file.txt

Now, navigate to your home folder and there is a text file there for you. Pretty neat, eh?

Now, we need to navigate to adb. Go to your android-sdk-mac_x86 folder, open it. Now, go back to terminal, type cd and drag the folder Platform-tools to the terminal window. You should see a green dot with a plus sign in it, that means you can add the folder to the terminal window. It should read something like this:

cd /Users/Your Computer's Name/Downloads/android-sdk-mac_x86/platform-tools

If you moved the android-sdk-mac_x86 folder (Like I did) after downloading it, it will only be slightly different. (My folder was in my home folder, so it just says /users/my computer/android-sdk-mac_x86/platform-tools)

Once you do this, you are ready to begin.

Step 6: GAIN ROOT!!!!11!!

Take a moment, breathe, cry, caress your phone... No, it really isn't that bad. I am what many consider a hypochondriac, I say I am just more "down to earth."

Glass half empty, half full, etc. we begin. I've slightly modified these to make them usable for us Apple guys. (All that has been changed is the adding of a "./" to the beginning of ever adb.)

Step 1
First, download these files:

RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.0103_2r_NV_8k_1.37_9k_1.52_release_
165253 (md5sum : aae974054fc3aed275ba3596480ccd5b):
Multiupload mirror
GalaxySense mirror
DroidSite mirror

Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : 3b359efd76aac456ba7fb0d6972de3af):
Multiupload mirror
GalaxySense mirror
DroidSite mirror

Custom RUU mirrors (md5sum : aff07b8256628a175c40938d408fa16f):
Multiupload mirror
GalaxySense mirror

(Personally, I extracted the exploit.zip folder, and the RUU_MECHA to my platform-tools folder so I never had to cd anywhere. I strongly recommend you do the same. I put the Custom RUU [PG05IMG.zip] on my desktop, so I didn't get it confused later in the process)

Step 2

Note that adb is required.

Push misc.img, busybox, and psnueter using the following commands:

./adb push psneuter /data/local/
./adb push busybox /data/local/
./adb push misc.img /data/local/
./adb shell chmod 777 /data/local/psneuter
./adb shell chmod 777 /data/local/busybox

Step 3

This step will gain temp root and flash the custom misc.img. Run:

./adb shell

Now the shell should display "$".
Run:

/data/local/psneuter

You will now be kicked out of adb, and adb will restart as root. Let’s confirm the md5 of misc.img:
./adb shell
At this point, the shell should display "#".
Run:

/data/local/busybox md5sum /data/local/misc.img

Output should be "c88dd947eb3b36eec90503a3525ae0de." If it’s anything else, re-download the file and try again.
Now let’s write misc.img:

dd if=/data/local/misc.img of=/dev/block/mmcblk0p17
exit

Step 4

Here you will rename the downgrade RUU (RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.0103_2r_NV_8k_1.37_9k_1.52_release_165253_signed.zip) as PG05IMG.zip and place it on your SD card. Then, run the following command:

./adb reboot bootloader

Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.

**Make sure to Re-enable USB Debugging!!! (Menu>Settings>Applications>Development>USB debugging)**

Set up the two part exploit, to gain root and unlock MMC.

Push wpthis, busybox, and psnueter.
./adb push psneuter /data/local/
./adb push busybox /data/local/
./adb push wpthis /data/local/
./adb shell chmod 777 /data/local/psneuter
./adb shell chmod 777 /data/local/busybox
./adb shell chmod 777 /data/local/wpthis

Step 5
Next, enter the following commands:

./adb shell
/data/local/psneuter
To unlock eMMC:
./adb shell
/data/local/wpthis
exit

Step 6

Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.

To push the eng bootloader:

./adb push hbooteng.nb0 /data/local/
./adb shell
/data/local/busybox md5sum /data/local/hbooteng.nb0

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb" exactly, stop, delete it, and re-download it. Otherwise, continue.

Now we will write the new bootloader.

dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

Confirm proper write:

/data/local/busybox md5sum /dev/block/mmcblk0p18

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn’t work, seek help from chat.andirc.net in channel #thunderbolt.
DO NOT REBOOT.

Now, reboot your phone and put the custom RUU (PG05IMG.zip) on your SD card. Then flash it. This will upgrade you to release firmware with an S-OFF bootloader.

**Make sure to Re-enable USB Debugging!!! (Menu>Settings>Applications>Development>USB debugging)**

Next, run this command:

./adb reboot bootloader

After it flashes, you will be running release firmware with S-OFF.


Step 7

Push SU, busybox, and psneuter.
./adb push psneuter /data/local/
./adb push busybox /data/local/
./adb push su /data/local/
./adb shell chmod 777 /data/local/psneuter
./adb shell chmod 777 /data/local/busybox

To gain root:

./adb shell
/data/local/psneuter

The following will remount /system and set up SU:

./adb shell
mount -o remount,rw -t ext3 /dev/block/mmcblk0p25 /system
/data/local/busybox cp /data/local/su /system/xbin/su
chown 0:0 /system/xbin/su
chmod 6755 /system/xbin/su

Step 8
Install Superuser from the Market.
Reboot your phone. You should now have full root permissions.

Step 9
Finally, install ROM Manager from the market, enter ROM Manager and flash the ThunderBolt recovery.

If you have problems getting SU to work, a couple extra reboots will likely fix it. If you still have problems, come to the chat: irc.andirc.net #thunderbolt or use http://chat.andirc.net:9090/?channels=#thunderbolt.

And there you go. You now have root. That was fun right? The irc is absolutely invaluable if you are having any trouble. The people there are really helpful and knowledgable. They won't talk down to you, just try to help.

Again, thank you to the people who made this possible, You all are awesome. the work that had to be done to make this user friendly is beyond amazing.

If I missed anything, please let me know. I might have missed something, I haven't slept all night.

 

[Stevez48]

Quite the thorough walk through. Nice job!

Sent from my ADR6400L using Tapatalk

 

[bmcclure937]

Looks like a nice walk-through.

I may suggest including all of your steps for configuring the SDK and then simply referencing the official root guide... because if that would get updated then you would have old instructions on this thread.

It is not that hard for people to type the ./ in front of every command...

Alternatively (and recommended), you could provide a more thorough guide and include instructions on adding the SDK platform-tools directory to the PATH environment variable. Once this is added, the user can use adb whenever they want, they do not have to change directories to the SDK! This also allow for using the command without needing the leading ./

 

[IISiDeK1CKII]

I knew people would come in who knew something... You both are right. The problem I was having was the same many of my friends and people on here were having, they kept getting a -bash: adb: command not found. I am working on fixing my .bash_profile, but until I get that fixed, this tutorial is the best I've got.

 

[gadsden]

I knew people would come in who knew something... You both are right. The problem I was having was the same many of my friends and people on here were having, they kept getting a -bash: adb: command not found. I am working on fixing my .bash_profile, but until I get that fixed, this tutorial is the best I've got.

I am excited try try this, thank you so much for writing this up. I get very confused doing these things the first time and didn't realize you could do this on mac by adding the prefix in the commands. So, now that I know that, I am hoping to try it!

One question.....and this is a total newbie question, sorry..... In the steps that have several commands like this one:

Set up the two part exploit, to gain root and unlock MMC.
Code:

Push wpthis, busybox, and psnueter.
./adb push psneuter /data/local/
./adb push busybox /data/local/
./adb push wpthis /data/local/
./adb shell chmod 777 /data/local/psneuter
./adb shell chmod 777 /data/local/busybox
./adb shell chmod 777 /data/local/wpthis

Should the commands all be ran individually, or all at the same time just on their own lines? Like, can I just copy all six commands and paste them in just like this then hit enter? Or do I need to run them all one at a time?

 

[jayhammy]

I am excited try try this, thank you so much for writing this up. I get very confused doing these things the first time and didn't realize you could do this on mac by adding the prefix in the commands. So, now that I know that, I am hoping to try it!

One question.....and this is a total newbie question, sorry..... In the steps that have several commands like this one:


Should the commands all be ran individually, or all at the same time just on their own lines? Like, can I just copy all six commands and paste them in just like this then hit enter? Or do I need to run them all one at a time?

You hit enter after each of those commands.

 

[jayhammy]

I'm AMAZED at how well this went! I'd been avoiding ADB on windows, plus avoiding all the 1-click options as they didn't work correctly on VMWare/WinXp on my Mac Pro. So, I saw this post and decided to take the leap.

THANK YOU!!!! My device is now rooted and working flawlessly.

 

[jcase]

Nice write up, I completely avoided the whole ADB setup subject, due to a lack of mac/windows knowledge. Glad the community can come through.

Can you please paste in my warnings, full credits and links to the GPL (this part if very important to us) sources if you are going to base this on our stuff. Just take them from the original post please.


~jcase

 

[xCHPx]

I ALWAYS had to put the

./

before adb so it would be "./adb" for anything that started with adb. I see you missed it a couple times and that concerns me. I followed the original tut by jcase and put ./adb instead of plain adb and everything worked perfect. Just my 2¢.

 

[gadsden]

Looks like a nice walk-through.

I may suggest including all of your steps for configuring the SDK and then simply referencing the official root guide... because if that would get updated then you would have old instructions on this thread.

It is not that hard for people to type the ./ in front of every command...

Alternatively (and recommended), you could provide a more thorough guide and include instructions on adding the SDK platform-tools directory to the PATH environment variable. Once this is added, the user can use adb whenever they want, they do not have to change directories to the SDK! This also allow for using the command without needing the leading ./

I really didn't realize until today that I could just as easily perform a manual root on a mac as a windows machine. So, I am trying to learn about this, been doing a bunch of reading. I am interested in what you are mentioning about adding SDK platform-tools directory to the PATH environment. On a mac, what environment should I be using? I am a little confused about the options listed on the Andorid Developer website. It seems Eclipse is what everything is all about primarily, but I have no clue which one to use. Perhaps I ought to just not worry about all that right now and just follow these steps to root my TB? I'm not really after doing anything other than rooting and flashing ROMs, so is it really necessary to set all that up?

I ALWAYS had to put the

./

before adb so it would be "./adb" for anything that started with adb. I see you missed it a couple times and that concerns me. I followed the original tut by jcase and put ./adb instead of plain adb and everything worked perfect. Just my 2¢.

Regarding the ./ Are you saying that we need to use that in front of these commands even though it's not listed in the steps?

adb reboot bootloader
adb shell

Other than that, the steps in this post work, right? I have everything downloaded and got as far as getting ADB, but I don't want to go any further if this isn't really as comprehensive as its made out to be.

 

[xCHPx]

Regarding the ./ Are you saying that we need to use that in front of these commands even though it's not listed in the steps?

adb reboot bootloader
adb shell

Yes otherwise i don't believe it will work.

 

[IISiDeK1CKII]

Wow! I really didn't think this would get quite as much attention. I think I need to do some more solid work and clean this up a bit. Now, for the individual responses:

@Gadsden: You're very welcome. I kept thinking, this is impossible! But, with a little Red Hat experience and some awesome google skills, I got this.

@Jayhammy: You're welcome man. Enjoy!

@jcase: Of course I can. I never really thought this would gain so many views. There aren't words to explain how psyched I am to see you talking directly to me... lol, I will give full credit to everyone, as soon as I post this

@xCHPx: I posted this after a long night, with no sleep. I knew I would miss something. The cool thing about that is if you copy and pasted the command without ./ in front of it, it would simply not run. There is really no way to mess this up.

@gadsden (pt.2): Hypothetically speaking, you don't need to do ANYTHING other than what I've listed. If you decide to start developing themes, apps, etc. you'd have to worry about eclipse. I made a mistake on the two things listed there, every adb command must have ./ in front of it. I simply overlooked it when typing this up. There was a lot of stuff to be typed.

 

[djcyph]

thanks for the walk-through!

i have 2 quick questions...

for say like this step:

./adb shell
/data/local/psneuter
To unlock eMMC:
./adb shell
/data/local/wpthis
exit

ur hitting enter after shell correct? the /data/... doesnt need a program command like ./adb before it correct? same with all other lines with no ./adb in front of them?

also for this:

Step 9
Finally, install ROM Manager and flash the ThunderBolt recovery.

im assuming ROM Manager is in market like Super User but i dont know what flash the Thunderbolt recovery means...could u explain that?

Thanks again!

 

[IISiDeK1CKII]

yeah, I'll explain that in the post but also here. ROM Manager is a program available in the market. If you go to the market and type it in, you'll see it. It's a top hat with a gear behind it.

After you install ROM Manager, You need to touch the first item in the screen, Flash ClockworkMod Recovery. Then you will be good. I am going to update that now in the OP.

 

[gadsden]

yeah, I'll explain that in the post but also here. ROM Manager is a program available in the market. If you go to the market and type it in, you'll see it. It's a top hat with a gear behind it.

After you install ROM Manager, You need to touch the first item in the screen, Flash ClockworkMod Recovery. Then you will be good. I am going to update that now in the OP.

Funny, I had the same exact question. I posted it in the jcase discussion and got the answer there. Definitely put that in the OP, because first timers don't know these things!

 

[IISiDeK1CKII]

Funny, I had the same exact question. I posted it in the jcase discussion and got the answer there. Definitely put that in the OP, because first timers don't know these things!

Fixed it, I overlooked it. I guess I assumed that everyone knew what ROM Manager was... lol. I've been rooting since the Droid 1, so I've always been around people who know these things. Sorry for not clarifying though, I hope my new updated post is more concrete.

 

[bmcclure937]

I really didn't realize until today that I could just as easily perform a manual root on a mac as a windows machine. So, I am trying to learn about this, been doing a bunch of reading. I am interested in what you are mentioning about adding SDK platform-tools directory to the PATH environment. On a mac, what environment should I be using? I am a little confused about the options listed on the Andorid Developer website. It seems Eclipse is what everything is all about primarily, but I have no clue which one to use. Perhaps I ought to just not worry about all that right now and just follow these steps to root my TB? I'm not really after doing anything other than rooting and flashing ROMs, so is it really necessary to set all that up?

You can add the path of the SDK to your $PATH variable. This allows you to run ADB from any directory and not need the ./ in front of every single command.

From terminal, do the following:

ls -la

You should see a file called ".bash-profile within your home directory.

Edit this file and add the path of your SDK to the $PATH variable.

nano .bash-profile

Familiarize yourself with editing files in nano if you have not done this before. It is very simple. Once you have edited and saved the file... run this last command to check if the PATH variable now contains the new path.

echo $PATH

If you get lost or confused... Google is your friend! There is a lot of info on editing the PATH environment variable.

*Please Note* this is not needed for the guide but it does allow you to run ADB from any directory... and without leading ./ in front of all commands.

 

[want a droid]

Thanks for this. I'm going to go to lunch and then get into this. How long did it take everyone to go through this?

 

[IISiDeK1CKII]

You can add the path of the SDK to your $PATH variable. This allows you to run ADB from any directory and not need the ./ in front of every single command.

I've set my path up, and it works when I want it to... but this is easier to do (imho) without getting too far into command line. If I feel I could streamline this by doing such, then I will do so.

edit: And now it is broken again... back to troubleshooting... not quite sure wth I did...

@want a droid: The thing that will take the longest is downloading the files needed. Everything else will take you all of 30 minutes at most.

 

[djcyph]

yeah, I'll explain that in the post but also here. ROM Manager is a program available in the market. If you go to the market and type it in, you'll see it. It's a top hat with a gear behind it.

After you install ROM Manager, You need to touch the first item in the screen, Flash ClockworkMod Recovery. Then you will be good. I am going to update that now in the OP.

Fixed it, I overlooked it. I guess I assumed that everyone knew what ROM Manager was... lol. I've been rooting since the Droid 1, so I've always been around people who know these things. Sorry for not clarifying though, I hope my new updated post is more concrete.

thanks man!

yea im coming from a BB so new to this stuff...i have a PC and im doing long way to learn...doesnt seem hard, simple terminal commands but just want to get everything rights...soon as i do it once, ill be good to go and help out others like u guys