Follow along with the video below to see how to install our site as a web app on your home screen.
Note: This feature may not be available in some browsers.
glad you got it.for others that see this, the fix would be to remove PG05IMG from the sd card. you can do this by booting the phone normally,then mount sd card as disc drive to pc,or by using a file manager.
in the event of a non working phone,simply put the sd into a card reader.
so are ya re-rooted?![]()
4)open the DHDDowngrade.zip file,then the folder contained inside of it. transfer "Fre3vo" into the tbolt2 folder with adb/fastboot.(ignore the rest of the files in DHDDongrade,fre3vo is the only one you need)
how do i do this part?
nevermind. literally just copied and pasted the fre3vo into the other folder. everything works nowrooted once again.
Where is the tbolt2 folder and how do i use adb/fastboot to transfer fre3vo into it....
1)download miniadb_tbolt2.zip from here: mini-adb_tbolt2.zip
md5: ef01f616471673d3eeb71b4cac4b8118
have you read the original post? this is the first step:
you do not use adb or fastboot to trasnfer fr3evo to tbolt2.
steps 1-4 are explaining as clearly as i can where the files come from and what you need to do... you need to download the tbolt2 .zip file. unzip it,move it to the root of C on your computer. download the dhddowngrade and move fre3vo by any means that you are comfortable(copy/paste,drag/drop,right click/send to) it literally does not matter how you move fre3vo,as long as you end up with the tbolt2 folder on the root of your computers C drive with fre3vo inside of it.
try going back to the orginal post,and carefully follow the driections there,and we can go from there with whatever you are still confused with.



everything on the first page has been updated for 2.11.605.9,sir. this is the safest way IMO,to return to stock,as simply running an RUU overtop of custom firmware may thru a security warning,wich should be recoverable by re-running the RUU,but sometimes not,in wich case youre up a creek without a paddle until new RUUs come out
installing the firmware first,the hboot second always works out and gets you back to stock without risking being stuck in bootloader with a security warning
if you rooted with revoutionary,youll need to remove the permanent hboot to send the phone back to vzw,those directions are there too.
so my advice would be to just follow directions on the first page. read thru them first,holler if youh ave questions![]()
Sounds good. I wasn't sure if I had to do it that way because I read through a conversation on page 5 where you directed someome to do that. Now I'll unroot the old phone and root the new one today. Thanks!


i may recomend different things for different situations. for example,"im selling a phone i want to make it s on and stock" i try and encourage folks to leave the phone s-off.
phone is broken and goin back to vzw,then it needs to be s-on
if you want to quote a particular post,i can tell you the logic that i used to recomend whatever i did![]()
this thread is dedicated to the current known methods of rooting the thunderbolt.
i will do my best to change this post as these methods are modified or become outdated,and keep the best,current methods here.
after root see the Thunderbolt ROM list for a list of roms,kernels and mods
for some extra info and "how to"s of rooting see http://androidforums.com/thunderbolt-all-things-root/353591-how-some-root-terminology.html
if youre reading this and considering rooting your device,a word of warning:
DO NOT ever attempt to accept an OTA while rooted and running a custom recovery.
an official OTA update needs the stock recovery to apply it. attempting to take an OTA without the stock recovery can result in a failed harmless attempt,a fixable bootloop,or even a brick. so please... dont do it.
and now,on with the info. enjoy
Revolutionary
a new method has just become available that does not wipe your data. this is 100% the best,and most reccomended way to root your thunderbolt at this time.
see this page for info:
Revolutionary
and a video from nate mills:
How to Root - HTC Thunderbolt (No Data Wipe! Newest & Fastest) - YouTube
special note: the minor OTA to firmware number 2.11.605.9 patches the exploit used by revolutionary. there are 2 options:
1)several users have reported being able to downgrade to 2.11.605.5 simply by running an RUU for that firmware,despite an s-on hboot wich would normally prevent you from going backwards in version numbers. PG05IMG and .EXE files for this version are available in post 4. (needs verified)
*please note that downgrading WILL wipe your personal data
2) achieve temp root via another means,then run revolutionary(this method follows)
feel free to do wichever is most comfortable
__________________________________________________________________________________
how to root 2.11.605.9/2.11.605.19 WITHOUT downgrading
as usual,i take no credit- i just put it together
credits:
-jelly doughnut for pointing me to this thread,and the Desire HD guys for this thread.
*make sure you thank jelly in this post
-sele and crew at HTC Thunderbolt Forum for what i like to call the "mini adb" concept
1)download miniadb_tbolt2.zip from here: mini-adb_tbolt2.zip
md5: ef01f616471673d3eeb71b4cac4b8118
2)set up adb:
-extract miniadb_tbolt2.zip and place the unzipped folder onto the root of your C\ drive on your PC
-open a command window. windows 7,click on start bubble,type "command" in the search box. a small black window should open up
3)download DHD Downgrade folder
4)open the DHDDowngrade.zip file,then the folder contained inside of it. transfer "Fre3vo" into the tbolt2 folder with adb/fastboot.(ignore the rest of the files in DHDDongrade,fre3vo is the only one you need)
5)in your command window: change to the tbolt2 directory by typing:
cd c:\mini-adb_tbolt2 (your promt should change to c:\mini-adb_tbolt2>)
*note that in the next few steps,anything in bold type is an adb command. you can directly copy from this window,and paste into your command window to eliminate typos.
6)enable usb debugging,plug in your phone via usb. select "charge only" mode.
7)make sure adb is seeing your phone:
adb devices (should return your serial number)
8) enter the commands from your link,one at a time,hit enter after each:
adb push fre3vo /data/local/tmp
adb shell chmod 777 /data/local/tmp/fre3vo
adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF
9)make sure it worked. when you see "exploiting device" then your command prompt again:
adb shell (if your prompt changes to a # youre good to go)
10)run revolutionary again. this time it will work really fast. you can have it install clockwork if you wish to use that recovery.
10)flash the superuser 3.07 files linked on revolutionarys info page
youre done
heres what youll see in the command window(red are my inputs,blue are just additional comments):
Code:Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\Scott>[COLOR="Red"]cd c:\tbolt2[/COLOR] c:\tbolt2>[COLOR="Red"]adb devices[/COLOR] * daemon not running. starting it now * * daemon started successfully * List of devices attached HTxxxxxx device c:\tbolt2>[COLOR="red"]adb push fre3vo /data/local/tmp[/COLOR] 956 KB/s (9796 bytes in 0.010s) c:\tbolt2>[COLOR="red"]adb shell chmod 777 /data/local/tmp/fre3vo[/COLOR] c:\tbolt2>[COLOR="red"]adb shell /data/local/tmp/fre3vo -debug -start F0000000 -end FFFFFFFF[/COLOR] fre3vo by #teamwin Please wait... Attempting to modify ro.secure property... fb_fix_screeninfo: id: msmfb smem_start: 802160640 smem_len: 3145728 type: 0 type_aux: 0 visual: 2 xpanstep: 0 ypanstep: 1 line_length: 1920 mmio_start: 0 accel: 0 fb_var_screeninfo: xres: 480 yres: 800 xres_virtual: 480 yres_virtual: 1600 xoffset: 0 yoffset: 0 bits_per_pixel: 32 activate: 16 height: 94 width: 56 rotate: 0 grayscale: 0 nonstd: 0 accel_flags: 0 pixclock: 0 left_margin: 0 right_margin: 0 upper_margin: 0 lower_margin: 0 hsync_len: 0 vsync_len: 0 sync: 0 vmode: 0 Buffer offset: 00000000 Buffer size: 8192 Scanning region f0000000... Scanning region f00f0000... Scanning region f01e0000... Scanning region f02d0000... Scanning region f03c0000... Scanning region f04b0000... Scanning region f05a0000... Scanning region f0690000... Scanning region f0780000... Scanning region f0870000... Scanning region f0960000... Scanning region f0a50000... Scanning region f0b40000... Scanning region f0c30000... Scanning region f0d20000... Scanning region f0e10000... Scanning region f0f00000... Scanning region f0ff0000... Scanning region f10e0000... Scanning region f11d0000... Scanning region f12c0000... Scanning region f13b0000... Scanning region f14a0000... Scanning region f1590000... Scanning region f1680000... Scanning region f1770000... Scanning region f1860000... Scanning region f1950000... Scanning region f1a40000... Scanning region f1b30000... Scanning region f1c20000... Scanning region f1d10000... Scanning region f1e00000... Scanning region f1ef0000... Scanning region f1fe0000... Scanning region f20d0000... Scanning region f21c0000... Scanning region f22b0000... Scanning region f23a0000... Scanning region f2490000... Scanning region f2580000... Scanning region f2670000... Scanning region f2760000... Scanning region f2850000... Scanning region f2940000... Scanning region f2a30000... Scanning region f2b20000... Scanning region f2c10000... Scanning region f2d00000... Scanning region f2df0000... Scanning region f2ee0000... Scanning region f2fd0000... Scanning region f30c0000... Scanning region f31b0000... Scanning region f32a0000... Scanning region f3390000... Scanning region f3480000... Scanning region f3570000... Scanning region f3660000... Scanning region f3750000... Scanning region f3840000... Scanning region f3930000... Scanning region f3a20000... Scanning region f3b10000... Scanning region f3c00000... Scanning region f3cf0000... Scanning region f3de0000... Scanning region f3ed0000... Scanning region f3fc0000... Scanning region f40b0000... Scanning region f41a0000... Scanning region f4290000... Scanning region f4380000... Scanning region f4470000... Scanning region f4560000... Scanning region f4650000... Scanning region f4740000... Scanning region f4830000... Scanning region f4920000... Scanning region f4a10000... Scanning region f4b00000... Scanning region f4bf0000... Scanning region f4ce0000... Scanning region f4dd0000... Scanning region f4ec0000... Scanning region f4fb0000... Scanning region f50a0000... Scanning region f5190000... Scanning region f5280000... Scanning region f5370000... Scanning region f5460000... Scanning region f5550000... Scanning region f5640000... Scanning region f5730000... Scanning region f5820000... Scanning region f5910000... Scanning region f5a00000... Scanning region f5af0000... Scanning region f5be0000... Scanning region f5cd0000... Scanning region f5dc0000... Scanning region f5eb0000... Scanning region f5fa0000... Scanning region f6090000... Scanning region f6180000... Scanning region f6270000... Scanning region f6360000... Scanning region f6450000... Scanning region f6540000... Scanning region f6630000... Scanning region f6720000... Scanning region f6810000... Scanning region f6900000... Scanning region f69f0000... Scanning region f6ae0000... Scanning region f6bd0000... Scanning region f6cc0000... Scanning region f6db0000... Scanning region f6ea0000... Scanning region f6f90000... Scanning region f7080000... Scanning region f7170000... Scanning region f7260000... Scanning region f7350000... Scanning region f7440000... Scanning region f7530000... Scanning region f7620000... Scanning region f7710000... Scanning region f7800000... Scanning region f78f0000... Scanning region f79e0000... Scanning region f7ad0000... Scanning region f7bc0000... Scanning region f7cb0000... Scanning region f7da0000... Scanning region f7e90000... Scanning region f7f80000... Scanning region f8070000... Scanning region f8160000... Scanning region f8250000... Scanning region f8340000... Scanning region f8430000... Scanning region f8520000... Scanning region f8610000... Scanning region f8700000... Scanning region f87f0000... Scanning region f88e0000... Scanning region f89d0000... Scanning region f8ac0000... Scanning region f8bb0000... Scanning region f8ca0000... Scanning region f8d90000... Scanning region f8e80000... Scanning region f8f70000... Scanning region f9060000... Scanning region f9150000... Scanning region f9240000... Scanning region f9330000... Scanning region f9420000... Scanning region f9510000... Scanning region f9600000... Scanning region f96f0000... Scanning region f97e0000... Scanning region f98d0000... Scanning region f99c0000... Scanning region f9ab0000... Scanning region f9ba0000... Scanning region f9c90000... Scanning region f9d80000... Scanning region f9e70000... Scanning region f9f60000... Potential exploit area found at address f9fd6200:e00. Exploiting device... c:\tbolt2>[COLOR="red"]adb shell[/COLOR] # [COLOR="Blue"]<-indicates that you have temp root access[/COLOR]
__________________________________________________________________________________
how to unroot
the revolutionary method of rooting uses a sneeky hboot exploit,and replaces your stock 1.04.0000 or 1.05.0000 bootloader with a modified permanent hboot. it not only gives you all the same fashboot flash abilities as the original engineering bootloader,but it very effectively blocks other hboots for overwriting it. its good,as you will remain s-off if you accidentally flash a full RUU,or accept an OTA,but makes it a little trickier to remove.
for the time being, removal requires ADB to be set up and running and some commands entered in "fastboot" to to allow the permanent hboot to be overwritten. once an "s-on" tool is release,ill take th is part of this guide down.
if you rooted the old skool manual way and have adb setup and working,you can use this guide to remove the permanent hboot.
with Revolutionary,will come a new wave of rooters that have no clue what adb,or fastboot even are. for you folks, Sele and the crew in the "rescue sguad" at HTC Thunderbolt Forum have come up with a really clever way to get the adb basics,and the eng bootloader to flash,with minimal setup and confusion. with their permission,im borrowing it for our guide here.
*WARNING* no siginture or file checks will be done flashing the new bootloader in hboot or fastboot.fastboot will literally flash "lets golf" as a bootloader if you tell it to. DO NOT mess with your hboot unless absolutely neccessary to return to stock for warranty purposes. if youre just tired of being rooted,flash the gingerbread ruu to get back to unrooted firmware and factory recovery. leaving the revolutionary s-off bootloader in place is the safest,and best option,and will not affect your ability to recieve OTAs.
*AGAIN- if youre just following this procedure because youre tired of being rooted,skip this next section and leave the permanent hboot in place. jump to "Putting current stock firmware and s-on back onto the phone" and flash only the first "PG05IMG_no_hboot_2.11.605.9" file(you can flash the 2nd file too if you want,but the permanent hboot will block it)
Setting up adb and removing the permanent hboot if youve never used adb before
1)if you no longer have the htc drivers that you installed when rooting with revolutionary,download them again from here on revolutionarys website.
2)next download *link removed (mirror)to somewhere convenient that youll be able to find it,like your desktop,or a "downloads" folder. it contains the old eng 1.40.2000 s-off hboot,and the bare minumum tools to install it.
3)the following directions were using windows 7 and chrome browser. other OS may be slightly different-the end result is you want unzipped,inside tbolt folder to be on the root of your C: drive.
-find the tbolt.zipdownload
-click on tbolt.zip download and open it.
-inside tbolt.zip,there is a folder labled tbolt. drag it to the root of C:. inside tbolt is the unpermanent hboot and some adb tools.
4) charge your Thunderbolt to 100%
5)click on then "start" bubble in the lower left corner of your screen. type "command" in the search window and hit enter. this will open a small black command window.
6)enter the following command(by typing or copy/paste):
you should see your promt in the window change to: c:\tbolt>Code:cd c:\tbolt
7)enter the follwing command:
check the output on the command window. THIS IS VERY IMPORTANT. the command must equal exactly 6991368ee2deaf182048a3ed9d3c0fcb if it does not,STOP!. delete the tbolt.zip download,and the unzipped tbolt folder from C:,re download and try it again. again,do not procede if the output in your command number does not equal it exactly.Code:md5sums hbooteng.nb0
8)once the number matches,you can continue. copy and paste the following codes into the command window:
the output should be your phones serial numberCode:adb devices
now enter:
this will cause your phone to boot into FASTBOOT mode,wich is a white screen with colored letters.Code:adb reboot bootloader
now enter:
the result again,should be your phones serial number.Code:fastboot devices
9) now youre ready to enter the command to unlock the permanent hboot and flash the new,non permanent one.
to unlock,enter:
write the new hboot:Code:fastboot oem mw 8d08ac54 1 31302E30
Code:fastboot flash hboot hbooteng.nb0
if you select bootloader at this point from the fastboot menu, youll still see the permanent s-off hboot,so select reboot with the volume rocker and power button and let the phone reboot. after it boots,you can adb reboot bootloader again,or power off, then power on/vol down and check that your pink "UNLOCKED" or "REVOLUTIONARY" is gone and you have the old 1.49.2000 bootloader.
here is what you should see in the command window,the red are my inputs:
Code:Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation. All rights reserved. C:\Users\Scott>[COLOR="Red"]cd c:\tbolt[/COLOR] c:\tbolt>[COLOR="red"]md5sums hbooteng.nb0[/COLOR] MD5sums 1.2 freeware for Win9x/ME/NT/2000/XP+ Copyright (C) 2001-2005 Jem Berkes - http://www.pc-tools.net/ Type md5sums -h for help [Path] / filename MD5 sum ------------------------------------------------------------------------------- [c:\tbolt\] hbooteng.nb0 6991368ee2deaf182048a3ed9d3c0fcb c:\tbolt>[COLOR="red"][COLOR="red"]adb devices[/COLOR][/COLOR] * daemon not running. starting it now * * daemon started successfully * List of devices attached HT126S005970 device c:\tbolt>[COLOR="red"]adb reboot bootloader[/COLOR] c:\tbolt>[COLOR="red"]fastboot devices[/COLOR] HT126S005970 fastboot c:\tbolt>[COLOR="red"]fastboot oem mw 8d08ac54 1 31302E30[/COLOR] ... OKAY [ 0.006s] finished. total time: 0.006s c:\tbolt>[COLOR="red"]fastboot flash hboot hbooteng.nb0[/COLOR] sending 'hboot' (1024 KB)... OKAY [ 0.183s] writing 'hboot'... OKAY [ 0.219s] finished. total time: 0.403s c:\tbolt>
Putting current stock firmware and s-on back onto the phone
after getting the bootloader back to the original s-off,engineering 1.04.2000 hboot download these 2 files:
1)*link removed PG05IMG_no_hboot_2.11.605.9
mirror: https://rapidshare.com/#!download|854p1|2281873735|PG05IMG_no_hboot_2.11.605.9.zip|462614
md5: 3e189b6c85ea7da1e26e12a5cd7b1ab0
2)*link removed PG05IMG_hboot_ONLY_2.11.605.9.zip
mirror:PG05IMG_hboot_ONLY_2.11.605.9.zip
md5: d26b3253358407d459c654e6729a39ca
rename PG05IMG_no_hboot_2.11.605.9.zip to "PG05IMG",move to your sd card,and flash in hboot.
this is important! you must flash the PG05IMG_no_hboot_2.11.605.9.zip first
after successfully flashing that,you will be on unrooted gingerbread with an eng s-off bootloader. delete the PG05IMG file from your sd card. now place the PG05IMG_hboot_ONLY_2.11.605.9.zip on your sd card. check the md5. once youve verified it matches,you can rename PG05IMG and flash it.
again, only flash the hboot file after you have successfully flashed the rom.
now you are 100% stock on latest firmware. unrooted gingerbread 2.11.605.9 with *locked* 1.05.0000 s-on bootloader.
as always,be as cautious as possible doing hboot flashes,and follow directions in the http://androidforums.com/thunderbolt-all-things-root/353591-how-some-root-terminology.html to flash these files if youre unfamiliar with hboot flashing.
*please start a new thread before attempting this if any part of this confuses you. without a bootloader your phone is a paperweight,so we want to help you prior to making any mistakes
__________________________________________________________________________________
*make sure you read this:
[WARNING] Do not downgrade to 1.0xxxxx after root
*some advice for linux/ubuntu users on unrooting can be found in this thread,in post #233,special thanks to user lovebuntu
*last and not least the standard discalaimer. i take no credit for anything listed in this post,i am only responsible for placing the information here in one spot. please do your research before attempting to modify your phone,i take no responsibility if any of the methods listed above aid you in turning yout thunderbolt into an expensive paperweight.
heres a link to the old manual rooting methods thread,for anyone interested: http://androidforums.com/thunderbol...ting-methods-archived-outdated-8-14-11-a.html
I have followed the TUTs to the wire, and I still keep running into this problem. While waiting for the cmd to finish I'll see "Potential exploit area found at address f9f0ba00:600. Payload verification failed." what does this mean and what im i suppose to do now? Please help please
Hello again Android Forums,
I am currently having some issues with my rooted Thunderbolt, due to the 2.11.605.19 update. My phone wants to update, but a green android with an ! mark appears on my phone overnight, draining my battery. Is there any way to update my phone without unrooting or wiping out my memory? If not, then how do I stop my phone from trying to update every day or so (it is getting really annoying?) Lastly, if there is a way to update my phone under these conditions, does it work in general for any future updates?
Thanks,
Bluelantern116

best way would be to flash jrockers rooted stock 2.11.605.19 rom. put the rom onto your sd via a card reader,or by mounting usb storage in recovery.
wipe cache,dalvik cache
do not wipe data/factory reset and you will not lose data or settings
afterward,you can update the radio as a PG05IMG![]()