[Root+ROM+RUU] This will root your TB and install BAMF 1.5nte and the leaked RUU.

[Adrynalyne]

All root credit still goes to AndIRC and crew. ​

Rooting The ThunderBolt – Updating The Radio – And Installing BAMF 1.5

From Adrynalyne: This totally awesome wtfomgroflbbq ungodly large PG05IMG.zip contains the latest of everything 1.13.605.7 has to offer plus engineering hboot for s-off, BAMF 1.5, BAMF 4.4.2 kernel, clockwork, and custom boot splash by gadget!

Pros
Root with read/write access to /system
Ability to downgrade and flash any RUU (i.e. signed firmware)
S-OFF
Fully unlocked bootloader
Latest RUU installed
BAMF 1.5nte installed

Cons
Voids warranty
Could brick your phone if you aren’t careful

The method of rooting your Android device as described in the article herein is solely for enthusiasts and not for the faint of heart.

IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA. IT WILL WIPE YOUR DATA.

Android Police and Team AndIRC and Adrynalyne disclaim all liability for any harm that may befall your device, including, but not limited to: bricked phones, voided manufacturer warranties, exploding batteries, etc.

The instructions below assume you already have a strong familiarity with adb command lines – this is not for beginners.


Credits
Adrynalyne for the Custom RUU, BAMF, and Kernel
Scotty2, jamezelle, jcase, and all of Team AndIRC
dsb9938 for writing this, testing, boot ani, and just being an overall great guy
Testers, especially ProTekk and Trident
Gadget for boot splash and ani
Thanks to scotty2 for WPThis
Busybox was pulled from a CyanogenMod ROM, source should be available here
psneuter was pulled from somewhere, credit to scotty2, source here
All firmware credit goes to 911sniper
If I missed anyone in the credits, it was unintentional and I will fix it soon. Lots of people had their hands in on this project.

Please read the instructions in full before you start. Also, make sure your battery is fully charged before taking the plunge.

Step 1

First, download these files:

RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253 (md5sum : aae974054fc3aed275ba3596480ccd5b) THIS IS THE DOWNGRADE RUU USED IN STEP 4:
Multiupload mirror
GalaxySense mirror
DroidSite mirror

Mirrors for the package (contains busybox, wpthis, psneuter, su, readme.txt, misc.img, and hbooteng.nb0) (md5sum : 3b359efd76aac456ba7fb0d6972de3af) THIS IS THE EXPLOITS FILE:
Multiupload mirror
GalaxySense mirror
DroidSite mirror

BAMF/Leaked RUU mirrors (md5sum : ede0dc842ab676080befe2ae01c74cd3) THIS IS THE CUSTOM RUU USED IN STEP 7:
Single Source

Step 2

Note that adb is required.

Push misc.img, busybox, and psnueter using the following commands:

adb push psneuter /data/local/
adb push busybox /data/local/
adb push misc.img /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox

Step 3

This step will gain temp root and flash the custom misc.img. Run:

adb shell

Now the shell should display "$".

Run:

/data/local/psneuter

You will now be kicked out of adb, and adb will restart as root.

Let’s confirm the md5 of misc.img:

adb shell

At this point, the shell should display "#".

Now run:

/data/local/busybox md5sum /data/local/misc.img

Output should be "c88dd947eb3b36eec90503a3525ae0de." If it’s anything else, re-download the file and try again.

Now let’s write misc.img:

dd if=/data/local/misc.img of=/dev/block/mmcblk0p17
exit

Step 4

Here you will rename the downgrade RUU (RUU_Mecha_VERIZON_WWE_1.03.605.10_Radio_1.02.00.01 03_2r_NV_8k_1.37_9k_1.52_release_165253) as PG05IMG.zip and place it on your SD card (put the phone in drive mode and just copy it with your OS). Then, run the following command:

adb reboot bootloader

Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.

Step 5

Set up the two part exploit, to gain root and unlock MMC.

Push wpthis, busybox, and psnueter:

adb push psneuter /data/local/
adb push busybox /data/local/
adb push wpthis /data/local/
adb shell chmod 777 /data/local/psneuter
adb shell chmod 777 /data/local/busybox
adb shell chmod 777 /data/local/wpthis

Gain root (this will once again throw you out of adb):

adb shell
/data/local/psneuter

Unlock MMC:

adb shell
/data/local/wpthis
exit

Step 6

Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.

To push the eng bootloader:

adb push hbooteng.nb0 /data/local/
adb shell
/data/local/busybox md5sum /data/local/hbooteng.nb0

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb" exactly, stop, delete it, and re-download it. Otherwise, continue.

Now we will write the new bootloader.

dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

Confirm proper write:

/data/local/busybox md5sum /dev/block/mmcblk0p18

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn’t work, seek help from http://chat.andirc.net:9090/?channels=#root. DO NOT REBOOT.

Reboot.

Step 7

Now, put the custom leaked RUU (Adrynalyne.1.5.PG05IMG.zip) on your SD card by putting the phone in drive mode and copying it with your OS. Now rename it to PG05IMG.zip.

Then using an md5sum type program, check the md5sum and make sure it matches ede0dc842ab676080befe2ae01c74cd3, if it does not, redownload it. (Here is a free windows md5summer).

Next, run this command:

adb reboot bootloader

Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.

After it flashes, you will be running BAMF 1.5nte with S-OFF on the latest leaked RUU.

Please Note: One of the TP images will be bypassed while flashing, this is normal. Also, on first boot, there will be no boot sound, this is normal.

Please make a nand backup in Rom Manager after you go thorugh phone set up.

Rom Manager, SuperUser, and Titanium Backup are already installed.

ClockWork Recovery 3.0.2.5 is already installed.

If you have problems, come to the chat: irc.andirc.net #root or use http://chat.andirc.net:9090/?channels=#root.


.