[Thunderbolt Android Development] IISiDeK1CKII:
After having nearly hung myself trying to figure out the whole SDK thing, what the hey ADB was and all that jazz, I thought I would give the rest of the people out there a step by step guide on getting from stock to root in no time. If you follow this guide, you won't spend the hours I did on google, XDA and irc trying to get where I am. This stuff can be confusing, and I am only here to make it less so.

Disclaimer: If you destroy your phone, I take no responsibility for it. You are performing this at your own risk.

I take no credit for the root process itself, there are people much smarter than I who worked on this. I used the method outlined here by jcase. I am simply compiling this and making it easy for people (much like myself) who had no prior experience be able to have root.

*I made this guide as seamless and easy as possible. I have tested this 4 times now with success each time. Just follow every step to a T and there will be no problems. The warning is there to tell you what could happen if you don't listen very well...

Step 1: Download the Android SDK

http://developer.android.com/sdk/index.html

Step 2: Get into the SDK

After downloading, you should have a package named android-sdk_r10-mac_x86.zip in your downloads folder. Unzip it and move it to your desktop, to make life easier on yourself.

*Stop here right now if you have no idea what terminal is... shame on you, also this might be slightly more technical than you thought. No worries, I am going to hold your hand through it all*

Step 3: Get ADB

You can search as hard as you want to in that SDK and you won't find ADB. It's not there, leave it to google to be smug and leave a "ADB's not here sucka!!" readme in the file... cheeky muppets. Regardless of my personal feelings, You need to get ahold of the ADB. Easy enough to do. Open the tools folder located in the android-sdk-mac_x86 folder. Click on "android" (it's right next to google's smug readme...), and wait until it pulls up the screen seen below.

Once you've gotten here, click "available packages" on the left and install Android SDK Platform-tools, revision 3. Let it go through it's process and click close. Now, go back to your android-sdk-mac_x86 and you'll have the folder titled "Platform-tools", open it and, TA-DA! You have adb, don't click it... you don't need to.

Step 4: Prepare your phone for rooting.

Make sure your phone is fully charged before beginning. Go to Menu>Settings>Applications>Developer> and turn on USB Debugging. I had my phone on Disk Drive the entire procedure, I'm not sure if it had any benefits other than convenience, but, granted, it helped.

Step 5. Setup terminal for ADB.

To this point, you haven't had to open terminal on your own. It is probably still open from when you installed the platform-tools folder from the android executable file. If it is, right click (control click) the terminal icon, click new window and then click basic. If you closed it haphazardly (shame on you!) you need to open it. It is located in your application folder, in another folder titled Utilities.

Once you get to the terminal screen, you should see a white box, with the name of your computer, followed by the place your currently "located." A ~ means you are in your home folder. For fun, type the following into your terminal window.

touch test_file.txt

Now, navigate to your home folder and there is a text file there for you. Pretty neat, eh?

Now, we need to navigate to adb. Go to your android-sdk-mac_x86 folder, open it. Now, go back to terminal, type cd and drag the folder Platform-tools to the terminal window. You should see a green dot with a plus sign in it, that means you can add the folder to the terminal window. It should read something like this:

cd /Users/Your Computer's Name/Downloads/android-sdk-mac_x86/platform-tools

If you moved the android-sdk-mac_x86 folder (Like I did) after downloading it, it will only be slightly different. (My folder was in my home folder, so it just says /users/my computer/android-sdk-mac_x86/platform-tools)

Once you do this, you are ready to begin.

Step 6: GAIN ROOT!!!!11!!

Take a moment, breathe, cry, caress your phone... No, it really isn't that bad. I am what many consider a hypochondriac, I say I am just more "down to earth."

Glass half empty, half full, etc. we begin. I've slightly modified these to make them usable for us Apple guys. (All that has been changed is the adding of a "./" to the beginning of ever adb.)

Step 1

First, download these files:

RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.0103_2r_NV_8k_1.37_9k_1.52_release_

165253 (md5sum : aae974054fc3aed275ba3596480ccd5b):

Multiupload mirror

GalaxySense mirror

DroidSite mirror

Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : 3b359efd76aac456ba7fb0d6972de3af):

Multiupload mirror

GalaxySense mirror

DroidSite mirror

Custom RUU mirrors (md5sum : aff07b8256628a175c40938d408fa16f):

Multiupload mirror

GalaxySense mirror

(Personally, I extracted the exploit.zip folder, and the RUU_MECHA to my platform-tools folder so I never had to cd anywhere. I strongly recommend you do the same. I put the Custom RUU [PG05IMG.zip] on my desktop, so I didn't get it confused later in the process)

Step 2

Note that adb is required.

Push misc.img, busybox, and psnueter using the following commands:

./adb push psneuter /data/local/
./adb push busybox /data/local/
./adb push misc.img /data/local/
./adb shell chmod 777 /data/local/psneuter
./adb shell chmod 777 /data/local/busybox

Step 3

This step will gain temp root and flash the custom misc.img. Run:

./adb shell

Now the shell should display "$".

Run:

/data/local/psneuter

You will now be kicked out of adb, and adb will restart as root. Let’s confirm the md5 of misc.img:

./adb shell

At this point, the shell should display "#".

Run:

/data/local/busybox md5sum /data/local/misc.img

Output should be "c88dd947eb3b36eec90503a3525ae0de." If it’s anything else, re-download the file and try again.

Now let’s write misc.img:

dd if=/data/local/misc.img of=/dev/block/mmcblk0p17
exit

Step 4

Here you will rename the downgrade RUU (RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.0103_2r_NV_8k_1.37_9k_1.52_release_165253_signed.zip) as PG05IMG.zip and place it on your SD card. Then, run the following command:

./adb reboot bootloader

Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.

Once done, reboot and delete PG05IMG.zip from your SD card.

**Make sure to Re-enable USB Debugging!!! (Menu>Settings>Applications>Development>USB debugging)**

Set up the two part exploit, to gain root and unlock MMC.

Push wpthis, busybox, and psnueter.
./adb push psneuter /data/local/
./adb push busybox /data/local/
./adb push wpthis /data/local/
./adb shell chmod 777 /data/local/psneuter
./adb shell chmod 777 /data/local/busybox
./adb shell chmod 777 /data/local/wpthis

Step 5

Next, enter the following commands:

./adb shell
/data/local/psneuter
To unlock eMMC:
./adb shell
/data/local/wpthis
exit

Step 6

Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.

To push the eng bootloader:

./adb push hbooteng.nb0 /data/local/
./adb shell
/data/local/busybox md5sum /data/local/hbooteng.nb0

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb" exactly, stop, delete it, and re-download it. Otherwise, continue.

Now we will write the new bootloader.

dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

Confirm proper write:

/data/local/busybox md5sum /dev/block/mmcblk0p18

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn’t work, seek help from chat.andirc.net in channel #thunderbolt.

DO NOT REBOOT.

Now, reboot your phone and put the custom RUU (PG05IMG.zip) on your SD card. Then flash it. This will upgrade you to release firmware with an S-OFF bootloader.

**Make sure to Re-enable USB Debugging!!! (Menu>Settings>Applications>Development>USB debugging)**

Next, run this command:

./adb reboot bootloader

After it flashes, you will be running release firmware with S-OFF.

Step 7

Push SU, busybox, and psneuter.
./adb push psneuter /data/local/
./adb push busybox /data/local/
./adb push su /data/local/
./adb shell chmod 777 /data/local/psneuter
./adb shell chmod 777 /data/local/busybox

To gain root:

./adb shell
/data/local/psneuter

The following will remount /system and set up SU:

./adb shell
mount -o remount,rw -t ext3 /dev/block/mmcblk0p25 /system
/data/local/busybox cp /data/local/su /system/xbin/su
chown 0:0 /system/xbin/su
chmod 6755 /system/xbin/su

Step 8

Install Superuser from the Market.

Reboot your phone. You should now have full root permissions.

Step 9

Finally, install ROM Manager from the market, enter ROM Manager and flash the ThunderBolt recovery.

If you have problems getting SU to work, a couple extra reboots will likely fix it. If you still have problems, come to the chat: irc.andirc.net #thunderbolt or use http://chat.andirc.net:9090/?channels=#thunderbolt.

And there you go. You now have root. That was fun right? The irc is absolutely invaluable if you are having any trouble. The people there are really helpful and knowledgable. They won't talk down to you, just try to help.

Again, thank you to the people who made this possible, You all are awesome. the work that had to be done to make this user friendly is beyond amazing.

If I missed anything, please let me know. I might have missed something, I haven't slept all night.