please help upgrade hw6925 - Sable

Hi XDA Gurus
I have an hw6925. It was unlocked by entering a code.
On the page for selecting my network I see a single button "Find Network". It gives no control to select a network by hand or to set a preferred network. I basically have only the top button of the three you can see in the attachment below.
In theory I should have those options... I have a hw6940 with those options and even the ATT/Cingular website for this model shows that I should have those options. (see http://www.wireless.att.com/answer-center/main.jsp?t=solutionTab&ps=solutionPanels&solutionId=54869).
The phone is also unable to detect that it is roaming. (The roaming triangle symbol never appears when I am roaming, and the activesync roaming schedule is never used.)
It is not clear to me why I am missing these options but I believe it may be because the firmware is not the last version. The Asset Viewer shows that the ROM is 1.30CIN.03ENG (bootloader G.39) and the Radio firmware is 1.02.00. My hw6940 shows firmware 1.48NA.00ENG (Bootloader G.39) and Radio firmware 1.08.00.
I really need to have these options so I am trying to understand how to upgrade my phone. There is no newer firmware for this model offered on neither the HP nor the ATT/Cingular sites. The HP site has the upgrade for both the main and radio firmware, but will not allow me to flash those to my hw6925.
I'm pretty technical but I dont have much experience with these HTC devices.
So, my questions:
1. Does anybody know a simple reason why I dont have the network functions in my hw6925? Is it because of the radio firmware? or the general firmware? or something else?
2. Assuming it is the firmware, any idea how I can upgrade it? Do you think it is possible to use something like HPRUU.EXE to read the radio firmware from my hw6540 and then load it onto the hw6925? Or am I likely to brick it that way? (Can I backup my hw6925 firmware, try it, and if it fails then reload the hw6925 firmware?)
3. Any other ideas how to convert it to a generic hw6945?
Your help is really appreciated!
Thanks
Ron

if anybody else finds this and needs to solve this problem too, I have found a solution.
indeed the issue is not with the ROMs.
there is some feature used by cingular to disable these features, and it is controlled somehow by the SIM card. you can see discussion of this in these two threads:
http://forum.xda-developers.com/showthread.php?t=284201
http://forum.xda-developers.com/showthread.php?t=266794
The solution is to edit the registry under HKLM\Security\Phone\, and set these values:
L: 0
ManualDisable: 1
PreferredDisable: 1
All three should be set to 0. (In my case I did not have a PreferredDisable at all, I added the DWORD entry just to be sure).
In the threads listed some people complained that these values were reset to 1 during reboot. In my case (with no cingular SIM, since my unit is unlocked) I did not have this problem.
Hope this will save somebody else a few hours of searching...
Ron

Related

[MYSTERY] Unlocked SGS can't make calls

I recently bought a second-hand SGS, supposedly locked to 3. The firmware was from 3 UK, but when I punched in *#7465625# it showed all locks are OFF.
Hot for tasty Froyo, first thing i did was to upgrade from the branded Eclair ROM the phone came with to an unbranded stock Froyo ROM. Kies gave me a hard time so I used ODIN. Then I inserted my SIM and realized I could not make calls or even register on my GSM network. (Had not tried the SIM before, so I don't know if the flash caused this)
I found out that the flash had changed my Product Code to KOR, but I managed to change it using THIS GUIDE. However, the step "rm -rf /efs/nv_data.bin.md5" did not work as it was write/read protected. After reboot, the SIM didn't work so I did the "busybox chown 1001:1001 /efs/nv_data.bin". The procedure changed the Pcode to H3G, which I think is the original code, although I was going for XEE.
IMEI has not changed (*#06# gets same no. as is printed below battery)
I live in Sweden, my present CSC is XEE, Product Code is H3G. Network Control Key is 00000000, could this be related?
I considering doing the Product Code change procedure again and see if I can change it too XEE hoping that will fix it, but I'm not even sure this is related to my problem.
Other than that, I'm running out of ideas. However, I'm new to the SGS scene. I'm reaching out for someone with more experience to give me some new ideas.
I've spent hours and hours at this and I've googled like possessed. If I'm being a noob or have overlooked something, let me know - just tell me what I should do to fix this phone.
Go into Settings > Wireless and Network > Mobile Networks and check that Network Mode reads as auto mode. Then open Access Points Names and check that APNs are listed that suit your carrier.
If all of that checks out, go into an app like SGS Tools and use the secret code to check Band Selection.
Thanks for your reply!
I have inserted APN for data. Though, is this really necessary just for 2G calls and SMS?
When I choose "Select Automatically" in Settings/Wireless and network/Mobile Networks/Network Operators then I sometimes get "Registered on network". Then, when trying to call, I get "Data network not available". Band Selection (from SGS Tools secret codes) show:
= BAND SELECTION =
[1] AUTOMATIC []
[2] WSCDMA BAND []
[3] GSM BAND []
[4] COMBI BANDS []
When I select the network operator manually, I get "Unable to select network. Select automatically".
An alternative Go to Rom Kitchen build a rom with
XWJS8 > Hardcore Kernel >CSC CPW > Modem JPY and whatever else you require that should give all UK main networks .
http://romkitchen.org/sgs/?s=generator
jje
losdrivare said:
Thanks for your reply!
I have inserted APN for data. Though, is this really necessary just for 2G calls and SMS?
When I choose "Select Automatically" in Settings/Wireless and network/Mobile Networks/Network Operators then I sometimes get "Registered on network". Then, when trying to call, I get "Data network not available". Band Selection (from SGS Tools secret codes) show:
= BAND SELECTION =
[1] AUTOMATIC []
[2] WSCDMA BAND []
[3] GSM BAND []
[4] COMBI BANDS []
When I select the network operator manually, I get "Unable to select network. Select automatically".
Click to expand...
Click to collapse
I got Data Network not available when I was investigating my phone (that is, messing about) and changed my Network Mode. Go to Settings > Wireless and Network > Network Mode and choose GSM/WCDMA Auto mode. If you don't have connection, then try first GSM Only, then WCDMA Only...then back to both.
And yes, you need to have a data network connection to make calls. Not sure why. Must be something to do with billing.
I would hate to be right but are you sure, as you've bought it second hand, that it hasn't been registered as stolen? Do you know any history of the phone?
Product code should be GT-I9000HKDXXX, where XXX should be your CSC which is XEE that makes it: GT-I9000HKDXEE, you should not use H3G at all.
double post...sorry
JJEgan said:
An alternative Go to Rom Kitchen build a rom with
XWJS8 > Hardcore Kernel >CSC CPW > Modem JPY and whatever else you require that should give all UK main networks .
Click to expand...
Click to collapse
Thanks, but I would need the Swedish networks. The phone is from UK whereas I live in Sweden and have a Swedish operator (halebop).
rschenck said:
I got Data Network not available when I was investigating my phone (that is, messing about) and changed my Network Mode. Go to Settings > Wireless and Network > Network Mode and choose GSM/WCDMA Auto mode. If you don't have connection, then try first GSM Only, then WCDMA Only...then back to both.
And yes, you need to have a data network connection to make calls. Not sure why. Must be something to do with billing.
Click to expand...
Click to collapse
Weird, I was sure APN is only required for MMS and Internet, not for calls and SMS. Anyway, I have APN so that's not it.
ross_ctr said:
I would hate to be right but are you sure, as you've bought it second hand, that it hasn't been registered as stolen? Do you know any history of the phone?
Click to expand...
Click to collapse
No, I don't and I can't be 100% sure it's not stolen. However, I have a bill of sale with all his information and I know where he lives so if that's the case, it can be sorted.
[Ramad] said:
Product code should be GT-I9000HKDXXX, where XXX should be your CSC which is XEE that makes it: GT-I9000HKDXEE, you should not use H3G at all.
Click to expand...
Click to collapse
I think you are right, and I managed to change it so now both CSC and Product Code reads XEE, which should be correct for Sweden. However, the problem remains the same.
There is a possible solution from HERE, however it seems rather ...old. Having no other ideas I'll try it unless someone comes up with a better idea:
Richthofen said:
Possible problems (I had them all due trying different thing to solve it):
No service.
There is no service even a functional SIM card is inserted.
You cannot receive or make calls, receive or send sms, etc (obviously).
Freeze / lock-down.
The phone will not react to anything besides pressing power key.
You cannot unlock the display to enter PIN code.
Wrong PIN code.
The phone will not accept any PIN code on any SIM (even the correct one ).
Phone displays "wrong PIN code" message even the try counter (three strikes you know) does not change.
Product code changed to KOR.
= Blocked Kies updates (without a registry "hack")
Here is how to fix any or all of them:
Downgrade to I9000XWJM9 firmware with Odin (as usual).
Remove SIM card from the phone (to be able to boot in first place) and start the phone.
Gain root access and install "Root Explorer" (or similar), ADB works too.
Open Root Explorer and go to the "EFS" folder in the root.
Check the date on .nv_data.bak and .nv_data.bak.md5 files.
If it is earlier than 08/26/2010 you´re clear, if it is later then you may stop reading.
Once the date has been checked, select files nv_data.bin and nv_data.bin.md5 simultaneously and delete (yes, delete) them. Reboot the phone.
Now your phone is in the same condition (atleast permanent memory wise) as it was prior I9000XXJPC update.
There is a safety feature I would call "a dead mans switch".
If the current nv_data files are deleted, the phone will make new nv_data files from the .bak (backup) files (if they excist). The new nv_data files will be signed automatically so they pass the checks (none of the errors listed above will occur). However if they do not excist, the phone will just write an empty / test file (= IMEI corrupted, no service, etc). Also if you just rename .bak files they will have wrong signatures and the same problems will occur.
There is no bootloaders included, so it is safe to flash for everyone.
Click to expand...
Click to collapse
Have you tried doing a factory reset? May not work but may be worth a try.
Could only be either apn related (doubtful), faulty sim or stolen/lost phone. Unless hardware related.
Sent from my GT-I9000 using XDA App
losdrivare said:
Thanks, but I would need the Swedish networks. The phone is from UK whereas I live in Sweden and have a Swedish operator (halebop).
XEE-JS1 Nordic (default XWJS7) CSC then .
jje
Click to expand...
Click to collapse
JJEgan said:
losdrivare said:
Thanks, but I would need the Swedish networks. The phone is from UK whereas I live in Sweden and have a Swedish operator (halebop).
XEE-JS1 Nordic (default XWJS7) CSC then .
jje
Click to expand...
Click to collapse
Thanks, it seems a long shot but I will try it tomorrow.
I've already flashed the phone to XWJM9 with correct CSC folllowing the guide in my previous post. Restoring nv_data.bin and nv_data.bin.md5 from the .bak files didn't help, the .bak files were just three days old so the data there might have been contaminated.
As far as I can tell there's either a hardware fault, the phone is stolen, or I've messed up the precious data in /EFS by my first ODIN flash, before I did the back-up. Every guide should have that backup procedure as first step, mine didn't. :'(
I've mailed my operator so hopefully I'll get an answer tomorrow to whether the IMEI is blocked.
"No service" sucks...
Click to expand...
Click to collapse

[HowTo] [VZW XT907/926 RAZR M/HD] Unlock US GSM Carriers Using RadioComm

Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!
<Reserved>
Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?
Yehudah said:
Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?
Click to expand...
Click to collapse
Running RAZR M in US on straight talk now. Works wonderful!!!
Thanks a lot! im a total noob when it comes to most of this, but it worked perfect for me!!
Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?
Skrilax_CZ said:
Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?
Click to expand...
Click to collapse
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.
Remember to install the latest Motorola drivers and *especially* highlight the entire 01 and type 00. I was backspacing only the 1 and it did not "stick" when writing. So HIGHLIGHT, don't backspace. Works perfectly.
is it possible to write the NV item to the Droid 4 then edit ? ?
cellzealot said:
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.
Click to expand...
Click to collapse
Can I use a similar way to unlock XT902(Japanese Razr M)? I can't find 8322 in XT902.......
Followed instructions and worked perfectly. The key for me was the latest Motorola drivers AND the Motorola USB cable that came with the phone. I tried other cables that both charged and synced but the only that worked for this was the Moto cable. Using Win XP SP3 ( 12 year old OS on brand new work laptop. WTF!)
i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.
AKG0214 said:
i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.
Click to expand...
Click to collapse
Boost - No
Cricket - No
They're both cdma. This is to allow the GSM side (SIM CARD based) of the phone to work on other carriers. With that said, your best options are
Net10, Straight Talk, ATT, T-Mobile, Simple Mobile, H20, Orange, and there's a plethora of others out there. Post paid and pre-paid.
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.
after boot, it is set back to 01 again @ address 8322
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
cellzealot said:
Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!
Click to expand...
Click to collapse
---------- Post added at 11:14 PM ---------- Previous post was at 10:48 PM ----------
tried again for couple of times, this time it actually works.
maybe last time I reboot the phone too early?
sipida said:
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
Click to expand...
Click to collapse
Glad you got it working. There is no VZW software on the phone capable of writing to the radio NV, so it's not being reverted by anything.
If anyone else has similar issues I would suggest trying the NV/SEEM method as that will definitely write the item properly.
queberican351 said:
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.
Click to expand...
Click to collapse
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.
Does this tutorial unlock mobile data usage on other carriers. I cannot seem to get data working on my XT907 in Australia. GSM and MMS work fine, so why doesnt Data?
I don't know for certain because I only have experience with domestic US GSM carriers, but I tend to doubt it.
You can try it and see and revert it easily if it doesn't work. You can also try flashing the Telstra XT905 NON-HLOS.bin(modem) and fsg.mbn(carrierEFS/NVM config).
This was the method used to get US GSM service on XT907 before the method shown here was discovered.
It works but is limited to GSM/EDGE data services here in the US.
I am inclined to think it is some other problem with the device because it should work as a global capable phone by default.
dsdd said:
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.
Click to expand...
Click to collapse
If it has a sim lock and you can acquire the code open your dialer and press #073887* (#0SETUP*) and it'll prompt you for the code.
Several people have PMd me questions about this method and I would much prefer that they be posted here in the thread so that everyone may benefit from the information.
Please include as much information about your PC and driver versions and be as thorough as possible in explaining your problems.

How modify a qcn file to enable AWS band

Hi.
I come from another post looking for a solution to my dilemma (http://forum.xda-developers.com/galaxy-s5/help/switch-stock-rom-t2866861#post55236673), thanks to fffft member found that I can open the band 4 of my cell S5 using the QPST program, however I can not find a modified .qcn file that corresponds to my model (G900F).
What I have done is make a backup of my original .qcn (which understand not share because there goes my IMEI) and I need advice from someone who knows that is the parameter that should change to open the AWS band 4.
Much appreciate your help.
I see that nobody has answered, if it was not for lack of cooperation, or because no one has had this problem.
Continue researching and achieve get qcn file G900M, which is super, but not left so installed as well, the QPST program generates an error and does not let install, so proceeded to compare them to see how different they are, and actually they are very different in their hexadecimal setting.
The issue now is, I need someone to tell me what are the parameter I have to modify my original qcn (my G900F) to enable AWS band 4.
Thank you for your help.
..
Hello again fffft.
I will try to explain everything in the best way. I can not send the file qcn G900M, because I have understood that within the IMEI can be identified, and the first thing I asked the person I give it to me was that change could not deliver it to anyone.
Now step by step to do was the following (taken from this forum http://forum.xda-developers.com/showthread.php?t=2291589 ):
Install phoneutil.apk in my phone.
Install QPST 2.7 build 323.
Choose the usb connection “RNDIS + DM + MODEM” from the menu that comes by typing *#0808#.
On the Ports tab of the program QSPT set the COM port corresponding to the cell (seeing that port recognizes the cell through Device Manager).
Choose “Start Clients” and choose “SOFTWARE DOWNLOAD”.
Hit the “Restore” tab, set port to COM number, choose the QCN file, and start.
Attached two images, one in which it is seen that the process is running smoothly, and a second in which shows the error.
With regard to your question about the RMNET protocol, for I must say I have no idea regards, because as I said I am still a newbie.
Finally and with respect to qcn file G900T me would be very very difficult to get the file G900M was relatively easy (not as easy lol) but because here in my country is the model that is sold, but the model does not get G900T no way.
I remain attentive to your suggestions, and thanks again for the help.
..
I thought S5 supports AWS band as well as other bands? I bought S5 from Rogers and use it with Wind mobile (Canada).
..
Hi.
Well, with my answer are attached to the two qcn files, not if it's okay to post them because I do not know which is the information that I'm giving, but I'll trust you fffft.
Review the entries with IMEI and clear, making this process and I thought this would be a very good explanation of why not to overwrite the original file leaves the cell, because the second IMEI not for the phone, but even if this were true, no understand how in the above forum they spread a qcn file for S4 that everyone could use.
Anyway, I hope that with this we can advance the issue to see if I can get out of this mess.
Thanks again.
..
Ok fffft, I found the parameter you say, but now my question is, as I edit the file qcn? I need some special program?
Loperaco said:
Ok fffft, I found the parameter you say, but now my question is, as I edit the file qcn? I need some special program?
Click to expand...
Click to collapse
Well, download the program XVI32 to edit the hexadecimal, apparently was successful but eventually the program generated the same mistake I had already seen, indicating "Could not reset the phone. COmmunication Errors Occurred".
Will you help me?
..
Hi there.
I have an interesting fact to share, because I could not properly complete the process to overwrite the qcn file then started to review the QPST program and its functions, among these I found the display content on qcn files through this for any entries who had been unable to write and determine that it was possible to write the file so qcn "hot" (ie directly on the phone) Oh and surprise! when I saw that the code / parameter that indicated fffft if I had changed even though the restore process had not been successful.
Anyway achieved modify the parameter in question and probe the cell after this, but still not achieve even connect AWS band 4, so despite the success the result was a failure.
Knowing this now accept suggestions from all of you experts.
..
Got a little further, but the bands did not get enabled...
fffft said:
Docx? Shouldn't those be .qcn files?
Anyway, you should try encouraging someone to post a NV dump from their 900T for comparison. You can check the existing AWS threads to confirm, but as I recall to enable AWS on earlier Galaxy models, required editing NV_RF_BC_CONFIG_l from 80 03 e8 04 to 80 03 e8 06
So ostensibly you will want to make the same change on your 900F. Comparing your NV to a 900T would lend confidence to that presumption.
.
Click to expand...
Click to collapse
fffft, Laperaco,
I am pursuing the same Band change as described here and have an update of the things that I was able to discover:
1) I was able to use QPST and pull NV backup from my phone - see my JJ_ATT_S5_Bands_Tester_No_IMEI (IMEI removed in Line 550)
**Note that I was not able to restore any QCN back to my phone in either USB mode (and I think this is what Loperaco was talking about), but...
2) I was able to program my phone directly using RF NV Item Manager, but did not get desired results (see below):
- a) I changed 1877 NV_RF_BC_CONFIG_l from 80 03 e8 04 to 80 03 e8 06 and nothing changed - i.e. radio still worked and I was still getting EDGE (no HSPA+)
- b) I tried changing the next line 1878 NV_RF_HW_CONFIG_I from f6 to 2c, because I saw that in another QCN file I found online. That actually "killed" my radio altogether, at least until I changed it back to f6
- c) Upon further inspection of the SM-N900T file I found online (too big to upload here), I saw that there are quite a few differences, which leads me to believe that additional configurations must be made to take advantage of the HSPA+ bands.
!! Please !! If someone with T-Mobile SGS5 looking at this, could you pull your QCN, mask IMEI if you'd like and post it here for comparison.
Otherwise, fffft, do you have any other thoughts regarding the changes needed...?
Last note that files are posted as .qcn.txt, becuase forum does not allow posting of qcn file extensions. Just remove .txt and you will have original qcn.
Thanks,
JJ
fffft said:
Your reluctance to document what you have done in detail is unfortunate because it prevents us from confirming that you did as you summarized or possibly discern any errors along the way. Nor did you tell us how you concluded that the phone did not connect to AWS, whether the changes were persistent after a reboot or what the service mode showed for activity after using the diagnostic menu to lock the handset to AWS, et cetera.
Of particular value would be a before and after NV dump from your phone, alongside a 900T NV dump. Which would illustrate both the required changes and any progress made with the attempted write.
To reply to your question, two obvious possibilities are apparent
1. That you changed the parameter as you summarized and that was insufficient to effect the desired change. Which would mean that the required parameter is different for the S5 than preceding Galaxy models for some reason e.g. that a different parameter needs editing or that radio changes are needed as well, even though that was not the case for the S3 & S4.
2. That you made some inadvertent error in your procedure that you didn't discern. No one can look for possible errors in the absence of you providing a detailed, step by step description of what you did though.
.
Click to expand...
Click to collapse
Ok ok, let me see how I can solve this.
First of all is not reluctance, I tried to be clear in how I do things, but I'll try again:
1. I bought a model of cell G900F that has disabled the AWS band 4.
2. I tried using the QPST program to replace the qcn file with one that corresponded to a G900M model, since in this model if the band 4 is enabled, but the process to make it in the program generated the error "Could not reset the phone. Communication Errors Occurred ".
3. I do not know how or if the QPST program writes an error log, so I do not know where to look it can be sent. I explain how to install and run the program each button is a bit wasteful, but I followed the steps in this forum http://forum.xda-developers.com/showthread.php?t=2291589
4. After this, and having received suggestions from fffft, I tried modifying the original qcn file from my phone, because I thought that perhaps the problem was because they were different models and finally the phone would not allow me to put a qcn file of another model. The modifications I did was change the parameter NV_RF_BC_CONFIG_l from 80 03 e8 04 to 80 03 e8 06. This is done by the program XVI32 modifying the hexadecimal.
5. I tried again using the option to restore the qcn file in QPST program, but got the same error "Could not reset the phone. Communication Errors Occurred".
6. I assumed I had to think of something else so it was when using the RF NV Manager (included in the installation program QSPT) for locate the actual file contents qcn on my phone, and I realized that despite the error obtained in restoring the file using the QPST program the parameter indicated in paragraph 4 of this list if it had changed.
7. I proceeded to check the signal and actually still had no access to the 4G network, the most that is connected to the HSDPA + network.
8. I read the comments from fffft and now I'm writing this.
I hope I was clear in my problem and have made a good step by step.
Now the issue is that:
A. I do not know how to access the diagnostic menu that enables or disables the AWS band, so I do not understand fffft what you're talking about.
B. I agree that modify only the parameter in question is not sufficient, otherwise the matter would be solved.
C. It is possible that I made ​​a mistake as you point out, I finally am new to this, but still I explained my process so I am attentive to suggestions.
Thanks for the help.
JJ_Boja said:
fffft, Laperaco,
I am pursuing the same Band change as described here and have an update of the things that I was able to discover:
1) I was able to use QPST and pull NV backup from my phone - see my JJ_ATT_S5_Bands_Tester_No_IMEI (IMEI removed in Line 550)
**Note that I was not able to restore any QCN back to my phone in either USB mode (and I think this is what Loperaco was talking about), but...
2) I was able to program my phone directly using RF NV Item Manager, but did not get desired results (see below):
- a) I changed 1877 NV_RF_BC_CONFIG_l from 80 03 e8 04 to 80 03 e8 06 and nothing changed - i.e. radio still worked and I was still getting EDGE (no HSPA+)
- b) I tried changing the next line 1878 NV_RF_HW_CONFIG_I from f6 to 2c, because I saw that in another QCN file I found online. That actually "killed" my radio altogether, at least until I changed it back to f6
- c) Upon further inspection of the SM-N900T file I found online (too big to upload here), I saw that there are quite a few differences, which leads me to believe that additional configurations must be made to take advantage of the HSPA+ bands.
!! Please !! If someone with T-Mobile SGS5 looking at this, could you pull your QCN, mask IMEI if you'd like and post it here for comparison.
Otherwise, fffft, do you have any other thoughts regarding the changes needed...?
Last note that files are posted as .qcn.txt, becuase forum does not allow posting of qcn file extensions. Just remove .txt and you will have original qcn.
Thanks,
JJ
Click to expand...
Click to collapse
Hi JJ.
We are indeed talking about the same issue, however I see a difference and that is that despite not having the band 4 AWS enabled on your phone, this only gives you the edge band, however my phone without enabling the band 4 gives me HSDPA+, so my question, just out of curiosity, is what is the frequency at which your operator transmits the EDGE network?
Loperaco said:
5. I tried again using the option to restore the qcn file in QPST program, but got the same error "Could not reset the phone. Communication Errors Occurred".
6. I assumed I had to think of something else so it was when using the RF NV Manager (included in the installation program QSPT) for locate the actual file contents qcn on my phone, and I realized that despite the error obtained in restoring the file using the QPST program the parameter indicated in paragraph 4 of this list if it had changed.
Click to expand...
Click to collapse
Laperaco,
1) I was also unable to load qcn file from backup even without modifications, so...
2) I made modifications directly to the phone using RF NV Item Manager*
*Note from my post that changing line 1877 made no difference in connectivity for me.
3) This specific connection is below (although it naturally fluctuates):
Network Type: EDGE:2
GSM RSSI: -89db (63%) 12 asu
GSM Signal Strength: 13db (42%)
Preferred Network Type is LTE/GSM autio (PRL)*
*Non-GSM selections (WCDMA, LTE-only, etc) simply do not connect, so no HSPA+ for me
JJ
JJ_Boja said:
Laperaco,
1) I was also unable to load qcn file from backup even without modifications, so...
2) I made modifications directly to the phone using RF NV Item Manager*
*Note from my post that changing line 1877 made no difference in connectivity for me.
3) This specific connection is below (although it naturally fluctuates):
Network Type: EDGE:2
GSM RSSI: -89db (63%) 12 asu
GSM Signal Strength: 13db (42%)
Preferred Network Type is LTE/GSM autio (PRL)*
*Non-GSM selections (WCDMA, LTE-only, etc) simply do not connect, so no HSPA+ for me
JJ
Click to expand...
Click to collapse
Ok JJ, we are going through the same steps, we must wait for more help, I'll keep researching but I see that not many people have our problem.
I have a question is that with that code or through option that could see data that you send me.
Any information or change that has put it in the post.
..

[Q] How to return Sprint SG4 config values after config to use in T-Mobile HSPA+

Hello everyone. I have the following question regarding my SG4 device. A while back I configured my sprint phone to use it on T-Mobile HSPA+ bands. I remember following a post (not sure which one it was though as it has been a while) here on XDA for the initial configuration that involved downgrading the modem and then changing some config values. I am trying to return my phone to its previous state; basically want to get return the config values and the modem version same as it was. Can I accomplish this just by installing the stock ROM? Or do I need to go in a put the previous values first? If there is a post out there for this any reference to it would be so helpful for me.
I appreciate the help in advanced! Thanks
UPDATE: this is the post I followed for the initial config. http://forum.xda-developers.com/showthread.php?t=2530610&page=136#post57903485
My device is intl unlocked by sprint customer service but I cannot connect to carrier network. I am suspecting is because of the settings or perhaps the network control setting described on step 8 pasted below? I am OK with losing the domestic unlock settings.
Step 8) Press menu and back twice, you should be on the PHONE CONTROL menu. Select [7] NETWORK CONTROL, select [1] GFC and make sure that it is set to [1]GSM/(E)GPRS/WCDMA REL8 .

Yotaphone 2 signal boost trick/unlock band ?

Helo from Slovenia,
perhaps i found a way to boost signal or unlock bands in Yotaphone 2.
Go to android secret menu *#*#4636#*#*
Then go information about phone menu and scroll down.
There is a option for choosing priority band, normaly its choosen LTE/WCDMA
Klick on this and switch the options to TD-SCDMA,GSM/WCDMA and LTE or TD-SCDMA,LTE,CDMA,EvDo GSM, WCDMA
Now watch the signal boosting
I checked same locations driving yesterday and today with car. Where i yesterday got no signal, today i got fully edge signal.
And no signal outage today no matter the location
Check this option and let me know if it works there too. I tried on Android 4.4.3 and 5 work both.
I put the first one, but how can I see the difference? the problems was not getting the 2G signal at all if I force in 2G. But if I force it now, your suggested settings will change.
What is the difference between TD-SCDMA,GSM/WCDMA and LTE or TD-SCDMA,LTE,CDMA,EvDo GSM, WCDMA?
May I ask you which mobile operator you have and which radio & firmware you use on your YotaPhone2?
TheArt. said:
I put the first one, but how can I see the difference? the problems was not getting the 2G signal at all if I force in 2G. But if I force it now, your suggested settings will change.
What is the difference between TD-SCDMA,GSM/WCDMA and LTE or TD-SCDMA,LTE,CDMA,EvDo GSM, WCDMA?
May I ask you which mobile operator you have and which radio & firmware you use on your YotaPhone2?
Click to expand...
Click to collapse
you have to go to spots/locations where you got no signal before and try it now ?
Setting your phone to the wrong settings so it fails over to 2G will no doubt improve your signal strength no end. But personally I would prefer to get fast internet on the move, and leave your radio settings well alone!
There are apps you can get that are called 'signal boosters' they just work by turning off your phone radio and then on again. If you were not connected to a nearby cell but one farther away this will 'boost your signal' ...
You're probably experiencing either or both of these effects. as well as the 4G effect - which is that if you have a local 4G aerial all the cellphones that can do so will be connecting to that, leaving you free to connect to an empty 3G cell instead with lots of bandwidth. Maybe not what you had planned to do, but actually improving your performance by setting the wrong settings
Did anyone already find the secret USB menu code to put the device into Modem mode? As the YotaPhone has a Qualcomm processor, this could be used to enable additional LTE bands, which really would help with reception like in [GUIDE] Add all GSM and LTE bands to your phone.
seems cool! We have to test
Crazyphil01 said:
Did anyone already find the secret USB menu code to put the device into Modem mode? As the YotaPhone has a Qualcomm processor, this could be used to enable additional LTE bands, which really would help with reception like in [GUIDE] Add all GSM and LTE bands to your phone.
Click to expand...
Click to collapse
Modem mode can setted by change buildprop sys.usb.config=diag.
Next read this.
w()$k said:
Modem mode can setted by change buildprop sys.usb.config=diag.
Next read this.
Click to expand...
Click to collapse
Ah, I haven't noticed that post, so we're making progress but no clear results yet :fingers-crossed:
here on XDA there's also this thread about unlocking frequencies: https://forum.xda-developers.com/yotaphone-one/help/unlocking-additional-radio-basebands-t3523000
TD-WCDMA won't work in spain. TD stands for Time Division and many countries work with FD (Frecuency Division)
Hi,
I am much interested in changing the LTE of YD206, has anyone suceed yet on this phone? A tuto would be really awesome! As I am new to android it would definitly help!
@TheArt. could you eventually translate the post please? My russian is far not good enought and google translated does not make much sens...! Did you succeed modifying the bands?
UNLOCK LTE BAND B20 - 800Mhz and B38
I will translate here the work of three 4pda users who must be thanked a lot for their work! unkernet, ssho and BoyNG. Thank also to mamant1988 who put everything together.
The original 4pda guide can be found here (in russian): http://4pda.ru/forum/index.php?showtopic=797643&view=findpost&p=59716629
UNLOCK B20 LTE BAND ON YD206​
Starting point is a rooted YD206 with latest RU 134 firmware, TWRP and ADB-USB-debug enabled. Do this procedure carefully and write down all the modifications and default values. The changes are performed on NVRAM level, so flashing firmwares will not affect them. Flashing firmwares will, however, affect modified baseband, as any other "radio" part as usual.
Download here the .zip archive which contains what is needed for this guide, including some screenshots of how things should be displayed.
Download the modified baseband RU-CN here and put it into the internal memory of the phone: it will be flashed in the end.
Install QPST and QXDM Qualcomm programs on Windows, they are in the above archive.
Enable the installation of unsigned drivers in Windows (like this). This is needed to install drivers for the diagnostical port later on.
Download Terminal Emulator from Play Store.
In the Terminal, write the following to get root access:
Code:
su
then:
Code:
setprop sys.usb.config diag,adb
Connect the phone via USB to the PC, in the Device Manager it should pop up as "Android Device" or similar, without a specific driver.
Right click on it and perform these actions: update drivers, search on this computer, choose driver from already installed drivers, show all devices, next, install from disk, there point to the .inf file corresponding to your system (32bit -> x86, 64bit -> x64) found in \YotaLTE\Modified HTCDiagDriver\Win x64HtcUsbMdmV64.inf (for 64bit).
After installation, go to properties of this new driver HTC USB Modem and check the number of the port displayed there, COM3 or COM4, for example.
Lower the 38400 value which you find there, click OK.
Execute as an admin C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe.
Choose the second section Ports, then "Add new port".
In the field Port put the one which was displayed in the modem section, COM3 for example.
In Port Label field write "Yota" or whatever, and then OK.
In the first section Active Phones the smartphone should be displayed.
KEEP QPSTConfig.exe PROGRAM OPENED.
Also, start C:\Program Files (x86)\Qualcomm\QXDM\Bin\QXDM.exe using admin privileges
Here, click Option, then Communications.
In the Target Port choose the same port as before, then OK.
Click View, New, Common, NV Browser. In the Category Filter choose LTE.
Choose 06828 LTE BC Config and then press "read".
Correct the number you see, for example 1099511627781 in 1099512152069 for B20 and click Write to save.
Close all the programs, and reboot the phone directly into TWRP (VOL UP + POWER), here find the update_S01_003_4240_RU1_M05_patched.zip baseband and flash it.
At this point it is advised to clean dalvik cache and cache with TWRP.
Done! Reboot.
If it is not working, reset everything by flashing stock baseband, putting back the values changed above and start again. It is not necessary to flash the modified RU-CN baseband, if with the CN one the phone is performing at 100%. I suggest to flash to see the differences. By the way, remember to unlock one band at a time.
To unlock B38 band (there is lack of information about YD206 already having it or not) the number is 1236951105541. For example, if the initial number found in LTE config was: 1236950581253, it means that the bands LTE B1/B3/B38/B41 were active. To verify by yourself download LTE Band Calculator.
Some attempts have been made also to unlock B7 band, but without success for now. It seems that the baseband crashes after a second when triying to connect to that LTE band. Further research needed!
After all the hassle I just went through to obtain a YD201 instead of a YD206 so I could have Band 20
Great news for YD206 owners anyway, thanks for sharing!
hippy dave said:
After all the hassle I just went through to obtain a YD201 instead of a YD206 so I could have Band 20
Great news for YD206 owners anyway, thanks for sharing!
Click to expand...
Click to collapse
Me too.
Tried drivers installation with a yd201 (just for take a look about the wifi issue) and they are not compatible.
I guess modifying the inf files would do the trick.
Hi, I try to unlock LTE band, but su command doesn't work in terminal .... it said su: not found.
velociraptor68 said:
Hi, I try to unlock LTE band, but su command doesn't work in terminal .... it said su: not found.
Click to expand...
Click to collapse
Do you have root? Do you give root permission to Terminal Emulator?
Just did the procedure, can't confirm if it's working on 800MHz B20 yet because I can't find a way to force it or even know if its available in my region from my Network, because I live in the city and they use mostly the 1800MHz, 2G Only works correctly and it seems that somehow it also solves the Proximity Sensor, I will give feedback at how it behaves tomorrow when I will be on the move, but until now everything seems well and smooth, Many Thanks for the persons that worked on the fix, I guess Yota should be hiring! And to @TheArt who translates all the good stuff!
band17
Hello,
Would it work to unlock band 17 At&t? Is that enough modify config 6828 number by calculator?
Hello,
I am from Bosnia and got Yotaphone 2 from China (YD206) and installed latest RU software 1.132, but I noticed that my phone only works in big cities. As soon as I leave for the countryside, there is no signal/service.
Is there another version of software I can try to upgrade to, to get these bands in the countryside as well, or the problem is with the limitation of phone's hardware?
Thanks!
Miroslav1999 said:
Hello,
I am from Bosnia and got Yotaphone 2 from China (YD206) and installed latest RU software 1.132, but I noticed that my phone only works in big cities. As soon as I leave for the countryside, there is no signal/service.
Is there another version of software I can try to upgrade to, to get these bands in the countryside as well, or the problem is with the limitation of phone's hardware?
Thanks!
Click to expand...
Click to collapse
Whats the coverage in your contry?
Maybe outside big cities there are not mobile connection in the frequency that yotaphone can support
borekon said:
Whats the coverage in your contry?
Maybe outside big cities there are not mobile connection in the frequency that yotaphone can support
Click to expand...
Click to collapse
GSM : 900 (E-GSM) 1800 (DCS)
UMTS: B1(2100) UMTS B8 (900 GSM)
That is what I found out from google. I am not sure what is the better way to find out what Yota covers and what is available here.
If someone knows please let me know.
If I perhaps flash the phone with EU software rather than RU which I currently have, would that unlock some bands?

Categories

Resources