Database Users

[TUTORIAL][Radio] Enable NEXUS6 XT1103 4G LTE B1/B8/B9/B19 and also XT1100 B2/B4

As I brought Band3 for NEXUS5, here, we are bringing 4G LTE band1 IMT 2100MHz for users such as, but
not limited to:
China Telecom,
Japan AU/NTT Docomo/Softbank,
Korea LG U+ /SK Telecom,
Philippines Smart,
Thailand DTAC/TrueMove-H
according http://en.wikipedia.org/wiki/List_of_LTE_networks#Asia and more:
Czech Republic Vodafone
Poland Play/P4
according http://en.wikipedia.org/wiki/List_of_LTE_networks#Europe
20150412 UPDATE: we are in Trial of more bands,as attachment names at POST#33:
Band 2 and band 4 for XT1100 View attachment 3257101
and Band 1 and band 8 or Band 1/9/19 or Band 1/8/9/19 for XT1103 View attachment 3257100
I am sorry below English language is not good, it is come from Google Translation^_^ from my Chinese post.
attachment docx is more clear since more detail images can are attched inside:
EN:View attachment 3187257
CN:View attachment 3187214
NEXUS 6 US MOTO XT1103 Band1 Enablement Tutorials
Foreword:
With the US version NEXUS6 XT1103 Chinese users, most of them come for China Telecom
, but is there such a telecommunications in many indoor shopping centers and car parks, do 4G LTE band1 2100MHz coverage, but also greater bandwidth than band3 15MHz with 20MHz bandwidth with China Telecom license.
What is a pity, XT1103 band1 RF front-end is shipped out without factory calibration, so only official usage is [email protected] only for China Telecom.In fact, as NEXUS5 band3 enablement, NEXUS6 RF front-end hardware also left a tiny space to enable it. The following tutorial is the first edition, With more extensive testing,It will needs correction on your demands.
I am sorry I do not have English version computer to reworks the Chinese screen captures,
I believe you have some way to understand around.​
STEP1: using TWRP backup EFS
you can nexus6 of TWRP-Backup-EFS. More insurance after the phone Root, you canalso EFS Professional to backup your original EFS.
Thus, When need to restore the original state , Just use TWRP-Restore- to select the original EFS and slide the button to restore any changed below. ​
STEP2: Install the driver Moto BP Tools Driver
Mobile side: the phone off, then press the power button + volume down key, enter fastboot mode, use the volume keys to select BP Tools, and then turn the power button to confirm. Open usb diag device port.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
View attachment 3187207 View attachment 3187208
1. Connect your phone to your computer, then prompted to install "diag_mdm" drive (or right-click "My Computer" and select "Properties" - "Device Manager" to install "diag_mdm" drive)
2. Right-click on the "diag_mdm", select "Update Driver Software" and then select "Browse my computer for driver software."
3. Select "choose from a list of device drivers in your computer."
4. Select "Show all devices", the "Next" button.
5. select "Disk"
6. Click "Browse"
7. Select the folder where you drive, point to open after selecting "momdm", then OK.
8. Select the "Motorola USB Diagnostic Port", click "Next."
9, warning, Click "Yes"
10, in the Device Manager port as shown below to show that the installation was successful (Note: The port number com93 vary)
​
STEP3: Write qcn
Phone side: the phone off, then press the power button + volume button, enter fastboot mode, use the volume keys to select BP Tools, and then turn the power button to confirm, so you can open the usb diag device port.
1.the installation QPST. Do not use lower version 2.7 build 422, otherwise it will not recognize the device. please find such installation by yourself.
2. open QPST configuration, the first point of Ports tab, select the device displayed, the first point below "remove", Prompt window popuped, and then point "Yes".
3, Chick "Add New Port".
4. Select the port of your device com port, and then "OK" button.
5, open the folder points QPST Software Download, click on "Restore" tab, click Browse to select the desired brush into qcn file:
View attachment XT1100_LTE_B1_To_XT1103_24226_6735_6736_RxAdded_TxOverrided.qcn.zip
(Here, the only difference vs nexus5 enabled band3 ,XT1103 purchased from Google Play, MOTO did not change default SPC, 000000),
Check Allow phone / file ESN mismatch, the final blow: Point Start, Errors box appears Could not Reset the Phone error normal, qcn has finished writing, after using the Power button off, then boot directly out LTE signal, the restart, do not use QuickBoot like Reboot, to ensure safety.
​
FINALLY: Check Whether Band1 Enablement successful methods
Method 1: Insert China telecom USIM cards, confirming a place where band1 with LTE Cell ID can be found with the end of HEX is 00,01,02,03,04,05 of LTE base stations (in the dial-up interface, enter * # * # 4636 # * # *, open "mobile phone information ", the" Set preferred network type "to LET ONLY, and then find the" Location: LAC = 7101 CID = 1924c01 "in this column, the CELL ID is inside this CID.
Method 2: Use the LTE Discovery watch band states.
NOTE: These two methods are there GCI (CID) guessing band, is only applicable to some of operators such as China Telecom, the absence of good planning China Unicom 4G CellID, and also China Mobile is not applicable for this .
[email protected]， we have LTE Discovery update to 3.19， support NEXUS6 display the real MODEM LTE Band!! thanks for Danial and his great team!!
​While you want to Check real band PC tool QXDM may help if you have such tool, menu path is View-LTE- RRC layer-RRC/NAS Status Screen- Frequency band, wait for 10mintues for update or use airplane mode on/off to Tigger update.
In case you are not in LTE covered area, but just want to check the qcn is applied or not, reset your phone in boot loader mode, select BP TOOLS again,them use QXDM-view-NV Browser-Item 06828- read to get the value, it should be 1099830466655 for add band1 while stock default is 1099830466654,
Other qcn XT1103 add:
B1/8 1099830466783
B1/9/19 1099830729055
B1/8/9/19 1099830729183
XT1100 add:
B2/4 1099646632415, @default 1099646632405
Here we must thank:
Q39705630 enthusiastic and efficient testing and Draft this tutorial V0.1 version;
Q562552826 provide XT1103 of qcn file, doing preliminary analysis;
Q386499038 provide XT1100 qcn file, do the final release qcn file parameter reference;​
Other Reference Tutorial IN Chinese:
1. CN version band1 enablement:
http://bbs.gfan.com/android-7863761-1-1.html
2.NEXUS6 RF parameters such as PC-side backup method qcn
http://bbs.gfan.com/android-7741730-1-1.html
3. Some tools on LTE band1 signal monitoring
http://bbs.gfan.com/android-7684876-1-1.html​

。chinese here hei
Sent from my SPH-L720 using XDA Premium 4 mobile app

Could you send the xt1100'qcn to me? Q2954103426 . If I retore xt1100's qcn to xt1103, it only can make xt1103 support band same as xt1100?

Hi, I messed up my NV values and I can't get signal anymore. Can you please post original XT1103 QCN file so we can restore the backup? Thanks.

Done! Working here in philippines smart user here! Thanks OP!

MrDreamSky said:
。chinese here hei
Click to expand...
Click to collapse
Yes. I can not Choose where I was born, But I can choose whether I can contribute.
While American Dream is on the Sky, Chinese Dream is running on the ground even we are weak, I am expecting to contribute for the global. haha

MaxChuang said:
Could you send the xt1100'qcn to me? Q2954103426 . If I retore xt1100's qcn to xt1103, it only can make xt1103 support band same as xt1100?
Click to expand...
Click to collapse
No, you can not enable all the band but some, and it need some technical filtering job,
RF front end hardware is arm and body of RF driver software soul.
I will try to bring band8, but need more weeks to find time gap during my work.

messedupqcn said:
Hi, I messed up my NV values and I can't get signal anymore. Can you please post original XT1103 QCN file so we can restore the backup? Thanks.
Click to expand...
Click to collapse
Please note the normal QPST-Software Download backup qcn will not works for restoring,
and older QPST-RF NV Item manager backuped Qcn can not cover all RF nv now, so it is also not good choice for you to restore Solutions for your issue,
Soution1. In case you only lost your signal after you use 4636-Phone Info-Select UMTS band- US band, Try to set NV00441 to 0xFFFF with this qcn, by QPST-Software Download, an old post is here:
http://forum.xda-developers.com/nexus-6/help/help-locked-nexus-to-usa-band-t2975290/page2
Solution2. for others failture reason, To NEXUS6 reflash the factory images will help to reset all your nv from backup eMMC partition,
How to is here: http://forum.xda-developers.com/nexus-6/general/guide-flash-factory-images-nexus-6shamu-t2954008

Just wondering though, the com should be com93? Ir it could be any digit? Because i got com25 and i still insist it im flashing..it worked but it cannot tell the band im using that should be band 1.

Azlun said:
No, you can not enable all the band but some, and it need some technical filtering job,
RF front end hardware is arm and body of RF driver software soul.
I will try to bring band8, but need more weeks to find time gap during my work.
Click to expand...
Click to collapse
Thanks for your contribution !
I am curious if carrier aggregation can be configured ,too.

Yeah, I would like to know if carrier aggregation can be configured

Azlun said:
Please note the normal QPST-Software Download backup qcn will not works for restoring,
and older QPST-RF NV Item manager backuped Qcn can not cover all RF nv now, so it is also not good choice for you to restore Solutions for your issue,
Soution1. In case you only lost your signal after you use 4636-Phone Info-Select UMTS band- US band, Try to set NV00441 to 0xFFFF with this qcn, by QPST-Software Download, an old post is here:
http://forum.xda-developers.com/nexus-6/help/help-locked-nexus-to-usa-band-t2975290/page2
Solution2. for others failture reason, To NEXUS6 reflash the factory images will help to reset all your nv from backup eMMC partition,
How to is here: http://forum.xda-developers.com/nexus-6/general/guide-flash-factory-images-nexus-6shamu-t2954008
Click to expand...
Click to collapse
Thanks! Is fastboot flash radio enough to restore everything to normal? :laugh:
edit: looks like you have to reflash everything. Oh well.
---------- Post added at 06:28 AM ---------- Previous post was at 06:14 AM ----------
I restored the factory image and it's fine. There's a bug with the current factory image where it doesn't flash system and userdata when you run flash-all.sh, but it seems to have flashed the nv value backup without that. I didn't reflash system and userdata manually so I get to keep my phone without wiping.
Any idea why line 6828 in NV browser says 268501086 in my XT1103? According to LTE band calculator, this means the phone supports band 2/3/4/5/7/17/29. But Google Play says the phone supports 2/3/4/5/7/12/13/17/25/26/29/41. Any idea why this supports seemingly less bands?
Looks like some Moto X have this band configuration, but my Nexus 6 shouldn't. Can someone confirm their stock line 6828?

Will this change stick even after a firmware upgrade, say, after upgrading to Lollipop 5.1?
Is this technique applicable to a D820 Nexus 5 as well?

mimsiroll said:
Just wondering though, the com should be com93? Ir it could be any digit? Because i got com25 and i still insist it im flashing..it worked but it cannot tell the band im using that should be band 1.
Click to expand...
Click to collapse
COMxx is depand on PC, it can be any number.

messedupqcn said:
Thanks! Is fastboot flash radio enough to restore everything to normal? :laugh:
edit: looks like you have to reflash everything. Oh well.
---------- Post added at 06:28 AM ---------- Previous post was at 06:14 AM ----------
I restored the factory image and it's fine. There's a bug with the current factory image where it doesn't flash system and userdata when you run flash-all.sh, but it seems to have flashed the nv value backup without that. I didn't reflash system and userdata manually so I get to keep my phone without wiping.
Any idea why line 6828 in NV browser says 268501086 in my XT1103? According to LTE band calculator, this means the phone supports band 2/3/4/5/7/17/29. But Google Play says the phone supports 2/3/4/5/7/12/13/17/25/26/29/41. Any idea why this supports seemingly less bands?
Looks like some Moto X have this band configuration, but my Nexus 6 shouldn't. Can someone confirm their stock line 6828?
Click to expand...
Click to collapse
1: Is fastboot flash radio enough to restore everything to normal?
Az:I never try, may be you can try when you have enough partition backuped.
2. for nv6828, the stock default is 1099830466654
and after my qcn written, it should be changed to 1099830466655 (add band1)
in fact there is many other nv added and overrided, so a EFS backup before qcn write in is suggested.
I can not understand why your value become an unknow one.
<!-- Add Band1 in LTE bands over XT1103
default 1099830466654 decially = binary:
00000000 00000000 00000001 00000000 00010011 00000001 00011000 01011110B
(band 41 29/26/25 17 13/12 7/5/4/3/2 )
= 1099830466655 decially = binary:
00000000 00000000 00000001 00000000 00010011 00000001 00011000 01011111B
(band 41 29/26/25 17 13/12 7/5/4/3/2/!1!)
** other referenece,
ONLY Band8 = 128
-->
<NvItem id="6828" subscriptionid="0" name="NV_LTE_BC_CONFIG_I" mapping="direct" encoding="dec" index="0">1099830466655,0</NvItem>

Biggster said:
Will this change stick even after a firmware upgrade, say, after upgrading to Lollipop 5.1?
Is this technique applicable to a D820 Nexus 5 as well?
Click to expand...
Click to collapse
1 my NV items will be kept in EFS until a factory restore including erase EFS partition to trigger factory EFS restoring.
so OTA upgrade will be fine, but next factory image whole reflashing will erase nv items in this qcn.
That is MOTO design while LG NEXUS5 have not such issue.
2. NEXUS5 D820 can enabled band3 band8 in the same way if you are in track of http://forum.xda-developers.com/google-nexus-5/general/radio-enable-lte-band-3-nexus-5-d820-t2928561
but qcn in that post will NOT bring CDMA+LTE 1xSRLTE dual-stanby working, it is still in LTE only mode.
why NEXUS6 support 1xSRLTE is come from facotry by default, DI4.0 new modem firmware and trigger by right carrier_policy.xml from m_bing.

Hmm, I seem to remember my line 6828 was the same unknown value before I changed anything. Stock. Then when I flashed your qcn, it became the 1099830466655. I have no idea why my phone came with less bands stock. it is XT1103 Bought from moto US store. no way to test it either, until I am out of the US

Solved.
Anyone know how to get the SPC/MSL code if it's not all zeros? My N6 is Amazon sprint version but I'm using it out of US.
Sent from my Nexus ⑥

XT1100 to XT1103?
Is it possible to convert an XT1100 to an XT1103? Is it a hardware thing?
I would like to enable band 2 and 4 in the XT1100, is that at all possible?
I have both an XT1103 (borrowed) and my own, an XT1100. Could I copy the NV values from the 1103 onto the 1100? Would it cause any damage to try?
I dont mind formatting, but I also don't want a brick.
Thanks,
Sam.

How could I enable LTE band 4? Really thats the only one I need to enable. Any help is much appreciated. I am more than willing to test as well.

[GUIDE] Enable LTE bands on surnia

After some trial and error I was able to successfully enable LTE band 12 on my xt1527 with the 5.1 baseband. This procedure only seems to work with the stock ROM, but then after it's done you might need to install a custom ROM like Cyanogenmod to actually make use of all the bands. Many people have done a lot of previous work to make this possible and they deserve credit, so don't forget to hit thanks on the linked threads. It might be possible to unlock different bands on the different models depending on what the radio will support. I have done my best to try to make sure that this is thorough, but there could be errors, so please let me know if any of the steps need to be revised or corrected.
**** Please note that by doing this it may be possible to permanently damage your phone, make it unable to access mobile networks, or cause radio interference, so you are doing this at your own risk! I am not responsible for any problems! ***
1. Be on a stock ROM (only tested on 5.0.2 and 5.1, see forums for how to restore stock ROM if you need help) Update: also works on 6.0
2. Make sure the Motorola Device Manager is installed https://motorola-global-portal.custhelp.com/app/answers/detail/a_id/88481
3. Select "BP Tools" from the bootloader menu (power off, hold vol-down, power on). The phone will look like it's booting normally.
4. You need to enable usb debugging in developer options. In Windows device manager you should see 3 USB devices without drivers loaded. I picked the first device and updated the driver by selecting Browse computer / Let me pick, and selecting Ports (Com&LPT), Motorola, Motorola QC Diag port. See this post for more info http://forum.xda-developers.com/showpost.php?p=54338876&postcount=3 You should now see Motorola QC Diag Port (COMx)
5. Install QPST and QXDM from steps 4 and 5 in this thread http://forum.xda-developers.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059
6. In QXDM select Communications and you should see the COMx that you saw in Device Manager. Make sure the Target Port has this COM port selected as well. If it's not connecting double check that the driver is still loaded in Device Manager.
7. In the View box select NV Browser towards the top of the list, and in the window that opens choose LTE for Category filter.
8. The value that we want is in location 6828. Click on it and choose Read. Write this number down in case you have a problem! Convert this number to binary (I use Windows calculator) and these are your current LTE bands. Read from right to left and 0 means the band is disabled, 1 is enabled.
For example, the xt1527 has LTE bands 2,4,5,7, and 17 per the Motorola website.
The value in location 6828 is 65626, or 0001 0000 0000 0101 1010‬ in binary.
Code:
Binary Value 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 1 1 0 1 0
Active Bands[B] - - - 17 - - - - - - - - - 7 - 5 4 - 2 -[/B]
All Bands 20 ? ? 17 ? ? ? ? 12 ? ? ? ? 7 6 5 4 3 2 1
As you can see from this example, each bit corresponds to an LTE band being on or off. Different models (xt1521, xt1528, etc.) will obviously have different bands enabled. To help fill in the missing info on the bands please post a reply with your model, the value of 6828, and the bands that your phone supports according to Motorola.
To enable band 12, I changed the bit in that position to a 1 and converted the entire binary number back to decimal.
Code:
Binary Value 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 1 1 0 1 0
Active Bands[B] - - - 17 - - - - 12 - - - - 7 - 5 4 - 2 -[/B]
All Bands 20 ? ? 17 ? ? ? ? 12 ? ? ? ? 7 6 5 4 3 2 1
So this new binary number 0001 0000 1000 0101 1010 = 67674 in decimal.
9. After you have calculated your new value, type it into the 6828 input field and click Write.
10. Reboot to recovery, make a backup of the stock ROM, and then install your favorite custom ROM, such as Cyanogenmod. The stock ROM might still restrict bands even if they have been enabled in the baseband. You can use the LTEdiscovery app to check your bands, and there are probably other apps as well.
11. If you have any problems try writing the original value that you wrote down earlier back into location 6828 (you did write it down, right?). If that doesn't work, see the modem thread, or extract NON-HLOS.bin and fsg.mbn from your stock image and flash them using the following commands in fastboot.
Code:
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
Good luck, and don't forget that with the extended range LTE bands you might have data but not be able to make a voice call. You would have to go into Network settings and change the preferred network type to 3G to make an emergency call. Maybe a future project will be looking into putting the baseband from other SD410 devices that support VoLTE on surnia and then using this method to set the correct bands... Something to think about.
Update 17 Oct, 2016: Unknown bands have been replaced with question marks. Driver and utility installation instructions have been updated.

I think this is a great tutorial! I wonder if by adding the USA band (which I have achieved in the past) other carriers could be used? Just thinking out loud.

hydroman202 said:
I think this is a great tutorial! I wonder if by adding the USA band (which I have achieved in the past) other carriers could be used? Just thinking out loud.
Click to expand...
Click to collapse
It's possible to make changes to 2G/3G bands also, so it might work if you add the right bands and the radio hardware supports the frequencies.

spiked_mistborn said:
It's possible to make changes to 2G/3G bands also, so it might work if you add the right bands and the radio hardware supports the frequencies.
Click to expand...
Click to collapse
First thing i thought..
I was assuming this was a hardware issue more than a software config issue.
I had done similar on phones before too so i see what your doing
but i had no knowledge on doing this with more recent phones.
I use to use com ports with QPST (a Qualcom leaked tool) and some other phone tools..
to clone my one pay/go phone from one company to another or vice versa.
I cloned them back & forth because sometimes i bought the wrong type of minutes LOL
For example i had my favorite phone from Telus and i sometimes used another one from Virgin
Different phones totally Samsung + LG and both ran very different systems too.
But get this..
I actually cloned EVERYTHING.
Data settings + MEID / Phone # and even managed to get free unlimited TX messages which were suppose to be 50 cents each. HAHAHAHA
I told my brother and his wife and they laughed and he said you got it on you?
I pulled out both and he phoned then txt'd me
And both phones received the call and received the TXT simultaneously.
So.. OP
Thanks for the info i might want to play around with that sometime.
I had struggled losing LTE support to on my Canadian Telus phone before after using US retail firmware.
I had to put it into 3G mode
So i am curious if this will actually work properly though.
Just because you change a setting does not necessarily mean there is actual physical hardware support for it.
I learned something i think here cool good work!
I like the manually installing Windows Drivers tip too.
I tried side-loading for the first time the other day and i had to manually install the driver for it to work.
So lets see if people come forward proving this works.. i hope so
EDIT:
I will be clicking Thanks simply for showing me what the "BP Tools" was for hahahha

spiked_mistborn said:
It's possible to make changes to 2G/3G bands also, so it might work if you add the right bands and the radio hardware supports the frequencies.
Click to expand...
Click to collapse
I talked with a sprint rep, according to him, anyone on my particular carrier (sprint), needs an msl code to change two specific values (I can't remember the names right this second) to reprogram it to a different carrier. I'm not sure about it, but there it is if anyone wants to give it a shot. I think one of the values was mdn, if that helps.

Wondering if it works on the Marshmallow update too ?

xpmule said:
I use to use com ports with QPST (a Qualcom leaked tool) and some other phone tools..
...
I will be clicking Thanks simply for showing me what the "BP Tools" was for hahahha
Click to expand...
Click to collapse
QPST will interface with this phone also, but it seems to be out of date because it doesn't read the full range of NV values. It would probably work for making 2G/3G or other changes like you mentioned, but it wouldn't read any LTE related values.
BP tools probably stands for "baseband programming" or something similar.

clee666 said:
Wondering if it works on the Marshmallow update too ?
Click to expand...
Click to collapse
I never updated past the 5.1 bootloader, so I haven't tested it, but if you try booting with the BP tools option and see the 3 devices missing drivers let us know.

spiked_mistborn said:
I never updated past the 5.1 bootloader, so I haven't tested it, but if you try booting with the BP tools option and see the 3 devices missing drivers let us know.
Click to expand...
Click to collapse
Either i am crazy or the new Marshmallow Bootloader removed the Wifi Flash option.
I seen it before on lollipop now i don't on 6.0.

spiked_mistborn said:
I never updated past the 5.1 bootloader, so I haven't tested it, but if you try booting with the BP tools option and see the 3 devices missing drivers let us know.
Click to expand...
Click to collapse
I never updated away from 5.0.2, I didn't wan't to lose LTE Band 12.

clee666 said:
I never updated away from 5.0.2, I didn't wan't to lose LTE Band 12.
Click to expand...
Click to collapse
Before doing this I had gone back to the 5.0.2 baseband to get band 12 back, but the wifi reboot issues were starting to get annoying. Being able to add band 12 to the later basebands is nice because I don't have the wifi reboot issues and it's much more stable.

This guide is awesome

Can activate all bands? xD or is bad idea?

Anyone managed to use the Verizon version on T-Mobile band 12?

clee666 said:
I never updated away from 5.0.2, I didn't wan't to lose LTE Band 12.
Click to expand...
Click to collapse
I don't remember if I did or not, is there anyway to check for LTE Band 12 to see if I still have it?
And if I did is there any way to restore it?
---------- Post added at 06:23 PM ---------- Previous post was at 06:17 PM ----------
spiked_mistborn said:
Before doing this I had gone back to the 5.0.2 baseband to get band 12 back, but the wifi reboot issues were starting to get annoying. Being able to add band 12 to the later basebands is nice because I don't have the wifi reboot issues and it's much more stable.
Click to expand...
Click to collapse
Can I reflash the original stock rom to get baseband 12 back, before installing a cyanogenmod update?

dreyeth said:
I don't remember if I did or not, is there anyway to check for LTE Band 12 to see if I still have it?
And if I did is there any way to restore it?
Click to expand...
Click to collapse
You can use an app like LTE Discovery to check when you are in a known band 12 area. I have an area near me that I drive through frequently surrounded by farms where I get a strong band 12 signal, but basically no service if I just have band 4. You could also check the value in NV location 6828 and use the method in the OP to calculate your current LTE bands.
dreyeth said:
Can I reflash the original stock rom to get baseband 12 back, before installing a cyanogenmod update?
Click to expand...
Click to collapse
That should work, but CM13 works best with 5.1 and newer basebands. You will likely have wifi and reboot issues. That was the whole reason for finding a way to add band 12 to newer basebands.

ijasonx said:
Can activate all bands? xD or is bad idea?
Click to expand...
Click to collapse
Probably a bad idea. The RF hardware in the phone can only physically support a few different frequencies, and it might vary by model, so probably only Motorola and Qualcomm know what will actually work. Best case if you try to activate all bands would be you just don't get a signal, worst case maybe you melt something in the phone radio, or get agents from your government radio frequency enforcement agency show up in black vans and take you away.

realdreams said:
Anyone managed to use the Verizon version on T-Mobile band 12?
Click to expand...
Click to collapse
Are you getting LTE band 4 on T-Mobile currently? It might work. If you try it let us know.

spiked_mistborn said:
You can use an app like LTE Discovery to check when you are in a known band 12 area. I have an area near me that I drive through frequently surrounded by farms where I get a strong band 12 signal, but basically no service if I just have band 4. You could also check the value in NV location 6828 and use the method in the OP to calculate your current LTE bands.
That should work, but CM13 works best with 5.1 and newer basebands. You will likely have wifi and reboot issues. That was the whole reason for finding a way to add band 12 to newer basebands.
Click to expand...
Click to collapse
Did everyone have them? and across all the various original modem firmware?
Also amongst the firmware that have band 12 is there one that was more up to date then the others?
Band 12 got stripped out of all the 5.1 firmware and all the 5.0 or older firmware had band 12, which probable
means no right?

dreyeth said:
Did everyone have them? and across all the various original modem firmware?
Also amongst the firmware that have band 12 is there one that was more up to date then the others?
Band 12 got stripped out of all the 5.1 firmware and all the 5.0 or older firmware had band 12, which probable
means no right?
Click to expand...
Click to collapse
Band 12 was and still is active on the XT1526.
Band 12 was active on the XT1527's launch firmware, but was removed in the first OTA update.
The other models did not have Band 12.

Yotaphone 2 signal boost trick/unlock band ?

Helo from Slovenia,
perhaps i found a way to boost signal or unlock bands in Yotaphone 2.
Go to android secret menu *#*#4636#*#*
Then go information about phone menu and scroll down.
There is a option for choosing priority band, normaly its choosen LTE/WCDMA
Klick on this and switch the options to TD-SCDMA,GSM/WCDMA and LTE or TD-SCDMA,LTE,CDMA,EvDo GSM, WCDMA
Now watch the signal boosting
I checked same locations driving yesterday and today with car. Where i yesterday got no signal, today i got fully edge signal.
And no signal outage today no matter the location
Check this option and let me know if it works there too. I tried on Android 4.4.3 and 5 work both.

I put the first one, but how can I see the difference? the problems was not getting the 2G signal at all if I force in 2G. But if I force it now, your suggested settings will change.
What is the difference between TD-SCDMA,GSM/WCDMA and LTE or TD-SCDMA,LTE,CDMA,EvDo GSM, WCDMA?
May I ask you which mobile operator you have and which radio & firmware you use on your YotaPhone2?

TheArt. said:
I put the first one, but how can I see the difference? the problems was not getting the 2G signal at all if I force in 2G. But if I force it now, your suggested settings will change.
What is the difference between TD-SCDMA,GSM/WCDMA and LTE or TD-SCDMA,LTE,CDMA,EvDo GSM, WCDMA?
May I ask you which mobile operator you have and which radio & firmware you use on your YotaPhone2?
Click to expand...
Click to collapse
you have to go to spots/locations where you got no signal before and try it now ?

Setting your phone to the wrong settings so it fails over to 2G will no doubt improve your signal strength no end. But personally I would prefer to get fast internet on the move, and leave your radio settings well alone!
There are apps you can get that are called 'signal boosters' they just work by turning off your phone radio and then on again. If you were not connected to a nearby cell but one farther away this will 'boost your signal' ...
You're probably experiencing either or both of these effects. as well as the 4G effect - which is that if you have a local 4G aerial all the cellphones that can do so will be connecting to that, leaving you free to connect to an empty 3G cell instead with lots of bandwidth. Maybe not what you had planned to do, but actually improving your performance by setting the wrong settings

Did anyone already find the secret USB menu code to put the device into Modem mode? As the YotaPhone has a Qualcomm processor, this could be used to enable additional LTE bands, which really would help with reception like in [GUIDE] Add all GSM and LTE bands to your phone.

seems cool! We have to test

Crazyphil01 said:
Did anyone already find the secret USB menu code to put the device into Modem mode? As the YotaPhone has a Qualcomm processor, this could be used to enable additional LTE bands, which really would help with reception like in [GUIDE] Add all GSM and LTE bands to your phone.
Click to expand...
Click to collapse
Modem mode can setted by change buildprop sys.usb.config=diag.
Next read this.

w()$k said:
Modem mode can setted by change buildprop sys.usb.config=diag.
Next read this.
Click to expand...
Click to collapse
Ah, I haven't noticed that post, so we're making progress but no clear results yet :fingers-crossed:
here on XDA there's also this thread about unlocking frequencies: https://forum.xda-developers.com/yotaphone-one/help/unlocking-additional-radio-basebands-t3523000

TD-WCDMA won't work in spain. TD stands for Time Division and many countries work with FD (Frecuency Division)

Hi,
I am much interested in changing the LTE of YD206, has anyone suceed yet on this phone? A tuto would be really awesome! As I am new to android it would definitly help!
@TheArt. could you eventually translate the post please? My russian is far not good enought and google translated does not make much sens...! Did you succeed modifying the bands?

UNLOCK LTE BAND B20 - 800Mhz and B38
I will translate here the work of three 4pda users who must be thanked a lot for their work! unkernet, ssho and BoyNG. Thank also to mamant1988 who put everything together.
The original 4pda guide can be found here (in russian): http://4pda.ru/forum/index.php?showtopic=797643&view=findpost&p=59716629
UNLOCK B20 LTE BAND ON YD206​
Starting point is a rooted YD206 with latest RU 134 firmware, TWRP and ADB-USB-debug enabled. Do this procedure carefully and write down all the modifications and default values. The changes are performed on NVRAM level, so flashing firmwares will not affect them. Flashing firmwares will, however, affect modified baseband, as any other "radio" part as usual.
Download here the .zip archive which contains what is needed for this guide, including some screenshots of how things should be displayed.
Download the modified baseband RU-CN here and put it into the internal memory of the phone: it will be flashed in the end.
Install QPST and QXDM Qualcomm programs on Windows, they are in the above archive.
Enable the installation of unsigned drivers in Windows (like this). This is needed to install drivers for the diagnostical port later on.
Download Terminal Emulator from Play Store.
In the Terminal, write the following to get root access:
Code:
su
then:
Code:
setprop sys.usb.config diag,adb
Connect the phone via USB to the PC, in the Device Manager it should pop up as "Android Device" or similar, without a specific driver.
Right click on it and perform these actions: update drivers, search on this computer, choose driver from already installed drivers, show all devices, next, install from disk, there point to the .inf file corresponding to your system (32bit -> x86, 64bit -> x64) found in \YotaLTE\Modified HTCDiagDriver\Win x64HtcUsbMdmV64.inf (for 64bit).
After installation, go to properties of this new driver HTC USB Modem and check the number of the port displayed there, COM3 or COM4, for example.
Lower the 38400 value which you find there, click OK.
Execute as an admin C:\Program Files (x86)\Qualcomm\QPST\bin\QPSTConfig.exe.
Choose the second section Ports, then "Add new port".
In the field Port put the one which was displayed in the modem section, COM3 for example.
In Port Label field write "Yota" or whatever, and then OK.
In the first section Active Phones the smartphone should be displayed.
KEEP QPSTConfig.exe PROGRAM OPENED.
Also, start C:\Program Files (x86)\Qualcomm\QXDM\Bin\QXDM.exe using admin privileges
Here, click Option, then Communications.
In the Target Port choose the same port as before, then OK.
Click View, New, Common, NV Browser. In the Category Filter choose LTE.
Choose 06828 LTE BC Config and then press "read".
Correct the number you see, for example 1099511627781 in 1099512152069 for B20 and click Write to save.
Close all the programs, and reboot the phone directly into TWRP (VOL UP + POWER), here find the update_S01_003_4240_RU1_M05_patched.zip baseband and flash it.
At this point it is advised to clean dalvik cache and cache with TWRP.
Done! Reboot.
If it is not working, reset everything by flashing stock baseband, putting back the values changed above and start again. It is not necessary to flash the modified RU-CN baseband, if with the CN one the phone is performing at 100%. I suggest to flash to see the differences. By the way, remember to unlock one band at a time.
To unlock B38 band (there is lack of information about YD206 already having it or not) the number is 1236951105541. For example, if the initial number found in LTE config was: 1236950581253, it means that the bands LTE B1/B3/B38/B41 were active. To verify by yourself download LTE Band Calculator.
Some attempts have been made also to unlock B7 band, but without success for now. It seems that the baseband crashes after a second when triying to connect to that LTE band. Further research needed!

After all the hassle I just went through to obtain a YD201 instead of a YD206 so I could have Band 20
Great news for YD206 owners anyway, thanks for sharing!

hippy dave said:
After all the hassle I just went through to obtain a YD201 instead of a YD206 so I could have Band 20
Great news for YD206 owners anyway, thanks for sharing!
Click to expand...
Click to collapse
Me too.
Tried drivers installation with a yd201 (just for take a look about the wifi issue) and they are not compatible.
I guess modifying the inf files would do the trick.

Hi, I try to unlock LTE band, but su command doesn't work in terminal .... it said su: not found.

velociraptor68 said:
Hi, I try to unlock LTE band, but su command doesn't work in terminal .... it said su: not found.
Click to expand...
Click to collapse
Do you have root? Do you give root permission to Terminal Emulator?

Just did the procedure, can't confirm if it's working on 800MHz B20 yet because I can't find a way to force it or even know if its available in my region from my Network, because I live in the city and they use mostly the 1800MHz, 2G Only works correctly and it seems that somehow it also solves the Proximity Sensor, I will give feedback at how it behaves tomorrow when I will be on the move, but until now everything seems well and smooth, Many Thanks for the persons that worked on the fix, I guess Yota should be hiring! And to @TheArt who translates all the good stuff!

band17
Hello,
Would it work to unlock band 17 At&t? Is that enough modify config 6828 number by calculator?

Hello,
I am from Bosnia and got Yotaphone 2 from China (YD206) and installed latest RU software 1.132, but I noticed that my phone only works in big cities. As soon as I leave for the countryside, there is no signal/service.
Is there another version of software I can try to upgrade to, to get these bands in the countryside as well, or the problem is with the limitation of phone's hardware?
Thanks!

Miroslav1999 said:
Hello,
I am from Bosnia and got Yotaphone 2 from China (YD206) and installed latest RU software 1.132, but I noticed that my phone only works in big cities. As soon as I leave for the countryside, there is no signal/service.
Is there another version of software I can try to upgrade to, to get these bands in the countryside as well, or the problem is with the limitation of phone's hardware?
Thanks!
Click to expand...
Click to collapse
Whats the coverage in your contry?
Maybe outside big cities there are not mobile connection in the frequency that yotaphone can support

borekon said:
Whats the coverage in your contry?
Maybe outside big cities there are not mobile connection in the frequency that yotaphone can support
Click to expand...
Click to collapse
GSM : 900 (E-GSM) 1800 (DCS)
UMTS: B1(2100) UMTS B8 (900 GSM)
That is what I found out from google. I am not sure what is the better way to find out what Yota covers and what is available here.
If someone knows please let me know.
If I perhaps flash the phone with EU software rather than RU which I currently have, would that unlock some bands?

[GUIDE] How to enable additional LTE bands

This guide will add LTE bands 2, 4, 12, 17, 23, 28, to Motorola G5 XT1676. Other variants may work as well, but are not tested.
Other bands are possible, you need to copy those specific RFNV files and PolicyMan files from a phone that supports those bands to your device.
Disclaimer: Unlocking LTE bands may be illegal in your area. Please check local laws before doing so.
I am not responsible for bricked/damaged devices/angry service providers/FCC violations/fried radios/etc. as a result of these modifications. Use at your own risk.
Software included may be subject to copyright.
I was able to unlock US LTE bands on my XT1676 by copying calibration data to the modem's NVRAM from my XT1671.
Here is how to do so:
1. Install QPST and QXDM Professional and drivers. Follow guide https://forum.xda-developers.com/2015-moto-g/general/unlocking-bands-moto-g-2015-partially-t3283608 for driver install.
Google is your friend for finding QPST/QXDM. I used QPST Version 2.7 Build 460 and QXDM 03.12.714.
The driver I used was "Motorola QC Diag Port" - Version 5.1.0.0 (3/1/2013)
2. Install TWRP 64 bit
3. CRITICAL -- Backup your MODEM, MODEMST1 and MODEMST2 in TWRP.
If anything goes wrong, or if you want to revert - you need these backup files. I backed these files up using ADB inside TWRP.
dd if=/dev/block/bootdevice/by-name/modem of=/sdcard/backup/modem
dd if=/dev/block/bootdevice/by-name/modemst1 of=/sdcard/backup/modemst1
dd if=/dev/block/bootdevice/by-name/modemst2 of=/sdcard/backup/modemst2
4. Install an Oreo 64-bit rom and root your device
5. Boot device and enter diagnostic mode by entering the following commands into terminal or ADB over network.
su -c 'echo 0 > /sys/class/android_usb/android0/enable'
su -c 'echo 22B8 > /sys/class/android_usb/android0/idVendor'
su -c 'echo 2EC1 > /sys/class/android_usb/android0/idProduct'
su -c 'echo diag > /sys/class/android_usb/android0/f_diag/clients'
su -c 'echo diag > /sys/class/android_usb/android0/functions'
su -c 'echo 1 > /sys/class/android_usb/android0/enable'
6. Device will enter diag mode. Check that driver is installed in device manager. "Motorola QC Diag Port" under Ports (COM & LTP)
7. Open QXDM Professional, open NV browser. If dual sim device, check dual sim box and select sim slot you want to modify.
8. Adjust item 06828 to 17592185995263 in the input field and press write to upload the new value. This will unlock all LTE bands the device is calibrated for.
If your device already has calibration data for these bands, you may not need to perform the next steps. You can check your LTE bands using Network Signal Guru (Step 14)
To add calibration data:
9. Close QXDM, and Open QPST. go to Start Clients > EFS Explorer. Select your device from the window and use SPC code 000000
10. Navigate to EFS > NV > item_files > rfnv
11. Copy calibration data files (enablebands.zip) into RFNV. Do not overwrite if any already exist.
12. Return to EFS root, navigate to policyman.
13. Replace files device_config and rat_mask and rat_mask_Subscription01
These files are from an XT1671, and may limit or remove bands. You may need to find the device_config and rat_mask files from other Moto G5 variants if you want those bands.
14. Install netowrk signal guru (https://play.google.com/store/apps/details?id=com.qtrun.QuickTest&hl=en_US)
Enable desired LTE bands.
15. Reboot device, LTE should now work on those bands.
If you find your phone is screwed up, restore your backup of ModemST1 and ModemST2 using TWRP.
Restore by entering TWRP, connecting ADB and entering the following:
dd if=/sdcard/backup/modem of=/dev/block/bootdevice/by-name/modem
dd if=/sdcard/backup/modemst1 of=/dev/block/bootdevice/by-name/modemst1
dd if=/sdcard/backup/modemst2 of=/dev/block/bootdevice/by-name/modemst2
-------------------------------------------------------------------------------------------
The calibration data and policyman files from my XT1671 are attached as enablebands.zip
NV_Item spreadsheet is attached if anyone wants to identify LTE calibration data files from other G5 variants. This spreadsheet is not complete and is missing many files for some LTE bands, but it's all we have for now.
Also attached is SpecialCalibrationData.zip. The contents of these files differed across identical phones. I suspect each device gets its own calibration data at the factory for each band, and these files contain that data for certain bands. This could explain why the upstream signal is much weaker for band 4 on my patched XT1676 device than the XT1671 the calibration data was copied from. If anyone has any insight into these files, and how to fine-tune them to fix poor calibration issues - I'd love to hear it.
Good luck.

Awesome work, thanks for your time! I buy an xt1676 in Ukraine and live in Argentina. We use band 4 and 28 for LTE, but the xt1676 only have the band 28. I gonna try this and comment later.

Have you tried this on your XT1671? If so, would it enable Band 20 LTE on the XT1671? It seems like it should since the XT1676 has it natively.

bonchien said:
Have you tried this on your XT1671? If so, would it enable Band 20 LTE on the XT1671? It seems like it should since the XT1676 has it natively.
Click to expand...
Click to collapse
I imagine it would work. The hard part will be finding the B20 calibration data from the 1676's nvram.

Hey! I'm gonna try this, here in Argentina we almost don't have band 28 and it's annoying af. Do you have Telegram so I can contact you quickly? If you don't, can you create one? Is this *really* dangerous? Thanks a LOT

Just want to add that this works even on a Treble-enabled 32 bit Oreo ROM as well. My world-enabled xt1676 now supports US LTE bands much more effectively. Thanks jfarre20!

Do I need this in Europe/Germany?

Thanks a lot for this information (about the app Network Signal Guru). Finally I can lock the LTE bands that I don't want to use (very slow bands). A lot of months searching how to do it and finally I found it thanks to you. Really a lot of thanks sir.
Regards.

Suitable for Xiaomi Redmi Note 8 Pro?
krafg said:
Thanks a lot for this information (about the app Network Signal Guru). Finally I can lock the LTE bands that I don't want to use (very slow bands). A lot of months searching how to do it and finally I found it thanks to you. Really a lot of thanks sir.
Regards.
Click to expand...
Click to collapse
Would this work for Xiaomi Redmi Note 8 Pro? Please, give us some light! :fingers-crossed:

Will this work for a SD625 device, the Lenovo P2? I need b5 & b28 here in PH.

Can anybody confirm if this method actually works? I'd like to add LTE band 4 to my Motorola G5 XT1676.

Band Lock Via QXDM (Ineffective ?!)

Have anyone tried this method ?
I tried it recently. Did everything correctly, but after rebooting the device ; no effect.!!
:crying:
So i rechecked again via QXDM for LTE BC CONFIG & LTE BC CONFIG DIV for the values,it was the same which i gave
So, Anyone tried ?
Got it working ?
or
Same Result as mine ?

Hello. I am trying hard to add LTE band 4 to this device. I have QPST "talking" to the phone and QXDM "talking" to QPST's service programming. But when I try to read almost any item, I get an error - Item Not Active (or something like that). I am using the latest QPST I can find 2.7.474 and the latest QXDM I can find 3.14.594. This all worked fine against my test phone - a Note 3 - but I am getting nowhere fast with the Zenfone. Perhaps it is because the Zenfone is 64 bit and the tools I have are not new enough? I welcome any suggestions. Thanks

Nokia, OnePlus and Asus Zenfone Max Pro M1 does not have a programmable radio firmware like Motorola via QPST, QXDM. Network parameters are pre-installed in mcfg_sw.mbn files, also the per carrier volte parameters are embedded in this folder. mcfg_sw.mbn files can be deleted and installed by QFIL in QPST. Nokia 1 , an entry level phone has LTE band 41 which Asus does not. These files no not contain any serial numbers or IMEI mappings so can be flashed. A few guides are there for Pixel phones where they have used OnePlus mcfg_sw.mbn to enable German carrier VOLTE. The available bands in Asus Zenfone Max Pro can be locked unlocked by Network Signal Guru APK after root.

dr.faramroze said:
Nokia, OnePlus and Asus Zenfone Max Pro M1 does not have a programmable radio firmware like Motorola via QPST, QXDM. Network parameters are pre-installed in mcfg_sw.mbn files, also the per carrier volte parameters are embedded in this folder. mcfg_sw.mbn files can be deleted and installed by QFIL in QPST. Nokia 1 , an entry level phone has LTE band 41 which Asus does not. These files no not contain any serial numbers or IMEI mappings so can be flashed. A few guides are there for Pixel phones where they have used OnePlus mcfg_sw.mbn to enable German carrier VOLTE. The available bands in Asus Zenfone Max Pro can be locked unlocked by Network Signal Guru APK after root.
Click to expand...
Click to collapse
Thanks for this tip/info. A friend of mine, not understanding, purchased an Asus Zenfone Max Pro M1 for himself that was made for use in India (I think). But he is in the USA on T-Mobile and needs different frequency bands that those that are supported. Because he has to use a TMobile CellSpot device at his home (due to no signal from any towers) he needs:
Band 4 LTE (2100 MHz)
Band 2 UMTS/WCDMA/HSPA (1900 MHz)
And neither of these are supported on the model he purchased. I was hoping to succeed in adding LTE 4 to his device using the Qualcomm tools. But I was not successful in doing so. Following some online guides I was able to change the supported LTE bands on an old Note 3 (not able to actually test them though) so that Network Signal Guru showed them in its list of frequencies. But I could not even read the data for this on the Zenfone. From what you say this now makes some sense to me.
Is it somehow possible to add these bands (at least the LTE 4) to the Zenfone? I know the Network Signal Guru can block bands. But I did not think it could add or remove them. If you can point me to something regarding this process, if possible, that would be great. Thanks

dr.faramroze said:
Nokia, OnePlus and Asus Zenfone Max Pro M1 does not have a programmable radio firmware like Motorola via QPST, QXDM. Network parameters are pre-installed in mcfg_sw.mbn files, also the per carrier volte parameters are embedded in this folder. mcfg_sw.mbn files can be deleted and installed by QFIL in QPST. Nokia 1 , an entry level phone has LTE band 41 which Asus does not. These files no not contain any serial numbers or IMEI mappings so can be flashed. A few guides are there for Pixel phones where they have used OnePlus mcfg_sw.mbn to enable German carrier VOLTE. The available bands in Asus Zenfone Max Pro can be locked unlocked by Network Signal Guru APK after root.
Click to expand...
Click to collapse
Just went looking again for Network Signal Guru on Play Store. It no longer exists! Even the link at QTRUN no longer works. Rats! Anyone have a good source for this or know what happened here?

You mean this? My backup from what was available on the playstore last month.....can be trusted.
MD5 Checksum ccfb4ab7ddd9708b2299c57d7e74b654
SHA-1 Checksum f6e99855875c35ad64d7b51c21a95b1fee135c5d

Cookie Ninja said:
You mean this? My backup from what was available on the playstore last month.....can be trusted.
MD5 Checksum ccfb4ab7ddd9708b2299c57d7e74b654
SHA-1 Checksum f6e99855875c35ad64d7b51c21a95b1fee135c5d
Click to expand...
Click to collapse
Yes indeed. Thanks very much!