I was trying to use the files downloaded by Navifirm, but my Lumia 930 was only being detected by the Windows Phone Recovery Tool. So I tried to force it to use the files of the other product code. For that, I tried to change the product code on the memory and it just worked, even when the files weren't previously downloaded.
The only things you need is a memory editor, I used Cheat Engine, and the Windows Phone Recovery Tool.
First, simply open the Recovery Tool
View attachment 3257818
If you aren't sure of your product code it would be good to open the folder where the tool download its files, usually C:\ProgramData\Microsoft\Packages. If you already know your product code, you can jump to step five.
View attachment 3257822
In the Recovery Tool, click on your phone. It will show the version installed and the version that you can install.
View attachment 3257821
Doing that will populate the folder, and there you can see a file with your phone model, the product code (In my case 059W306), and the firmware it can download. You just need the product code.
View attachment 3257817
I won't teach in depth how to use Cheat Engine or where to download it. It should be easy to attach the Recovery Tool process to it anyway (File -> Open Process -> Select the process WindowsPhoneRecoveryTool.exe). Then, choose the value type String, mark the checkbox Unicode, put your product code on the field and click "First Search" . Doing that will populate the table in the left with the places in memory where it appears. Select all and click the red arrow. Then select all addresses and double-click the value. Input the product code you want. (In my case, 059W0X5). Click OK and it should be ready.
View attachment 3257816
Now you can go back to the Recovery tool and install the new firmware. It won't show any message that the product code was changed, but you can see it will download it.
View attachment 3257820
If in doubt, you can check in the folder that it's indeed downloading the newest firmware for the product code you input, not the former.
View attachment 3257819
That's it. You will download and install the new firmware using a single tool. Easy as that.
Do it at your own risk. Best regards!
good job:good:
Can you change models as well? I want to flash a firmware with Denim but my Lumia 1020 only has 4 variants for RM-877. All have Cyan. I want to go to RM-875. Can you recommend me a product code that is unbranded with Denim?
TIA
thaddyusmaximus said:
Can you change models as well? I want to flash a firmware with Denim but my Lumia 1020 only has 4 variants for RM-877. All have Cyan. I want to go to RM-875. Can you recommend me a product code that is unbranded with Denim?
TIA
Click to expand...
Click to collapse
You can't.
Reply to thaddyusmaximus
thaddyusmaximus said:
Can you change models as well? I want to flash a firmware with Denim but my Lumia 1020 only has 4 variants for RM-877. All have Cyan. I want to go to RM-875. Can you recommend me a product code that is unbranded with Denim?
TIA
Click to expand...
Click to collapse
Yeah I have the same phone. You have to flash to Cyan the OWA update to Denim.
nice work, however if you are trying to unbrand ATT 1020; it wont work.
Dude.........Thank you so much for this. T mobile still hasn't released the denim update for the lumia 635. I unbranded it and now i have the lastest firmware!!!
For those of you with the lumia 635 here is the unbranded product code
Naked/unbranded North American multi-variant (RM-975 VAR NAM 4R CV)
Product type: RM-975
Product code: 059W4X2
Unfortunately this still doesn't get around the "pre-portico" AT&T 920 issue. It will not work on a branded ATT 920
failed on lumia 925 att branded
beka909 said:
failed on lumia 925 att branded
Click to expand...
Click to collapse
For unbranded your device (from AT&T ROM), use this tutorial.
anaheiim said:
For unbranded your device (from AT&T ROM), use this tutorial.
Click to expand...
Click to collapse
that means that I will be able to flash other product code after debranding ?
beka909 said:
that means that I will be able to flash other product code after debranding ?
Click to expand...
Click to collapse
You can flash the ROMs covering the RM-893 product type.
anaheiim said:
You can flash the ROMs covering the RM-893 product type.
Click to expand...
Click to collapse
okay but lumia 925 has no SD card support..
beka909 said:
okay but lumia 925 has no SD card support..
Click to expand...
Click to collapse
Indeed, I had not noticed that the Lumia 925 does not have a micro-SD port. So, you can't.
anaheiim said:
Indeed, I had not noticed that the Lumia 925 does not have a micro-SD port. So, you can't.
Click to expand...
Click to collapse
I also have Lumia 635 ATT version and If I change to 000-GB and RM-974 XXXXX do I get update for RM-974 instead of RM-975 and my phone become eu version ?
beka909 said:
I also have Lumia 635 ATT version and If I change to 000-GB and RM-974 XXXXX do I get update for RM-974 instead of RM-975 and my phone become eu version ?
Click to expand...
Click to collapse
I flashed with Microsoft image designer but no LTE support detected for flashed att version to EU in Georgia republic,,,
so Bands doenst change
i mean what are you trying to convey...you said your lumia 930 was only detected by pc...What does it mean......
actually can you tell me what are you trying to convey through this tutorial???
Are you trying to tell that we can actually flash lumia 930's firmware into other model like lumia 830????
please make yourself clear....
Thank you so much! I'm so glad I was able to get Denim on my AT&T Lumia 635 GoPhone. It is insanely faster now.
lumia 620
Thanks for the informative tutorial::good:
I can't do it! Cheat Engine didn't find my product code! In my case 059X1N6 (Lumia 435 Free France ROM)
How can I do it?
Thanks in advance.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Caution: I'm not responsible for any damage that can occur trying my methods in your devices. Just proceed if you're an advanced user and conscious about what I'm doing here. Read this again. And again.
Hello. I've been searching a lot about this and after searching in lots of russian/chinese forums I've found that inside boot.img there is a config_init.sh file that loads phone's configuration depending on the phone's SKUID and many other parameters:
Attempt #1 - Change config_init.sh file
Code:
# software configuration related boot actions
#please sync to RF BAND
FULL_BAND=8
WW_BAND=0
TW_BAND=1
CN_BAND=2
US_BAND=3
TR_BAND=4
TEST_BAND=12
# ZX550ML RF BAND
WW_US_BAND=15
TW_CN_JP_BAND=0
WW_TEST_BAND=1
TW_TEST_BAND=8
# project ID
ZE550ML=23
ZE551ML=31
ZR550ML=28
ZX550ML=27
ZE551ML_CKD=30
RFSKUID_DETECT=$(cat /sys/module/intel_mid_sfi/parameters/rf_sku_id)
PROJID_DETECT=$(cat /sys/module/intel_mid_sfi/parameters/project_id)
COUNTRY_CODE=$(cat /factory/PhoneInfodisk/country_code)
log -p i -t config_init "PROJID: $PROJID_DETECT ,RFSKUID: $RFSKUID_DETECT"
if [ -n "$PROJID_DETECT" ]; then
case $PROJID_DETECT in
"$ZE550ML" | "$ZE551ML" | "$ZE551ML_CKD")
if [ "$COUNTRY_CODE" = "TH" ]; then
echo "V1_DSDA_ZE550ML_TH" > /config/local_config
elif [ -n "$RFSKUID_DETECT" ]; then
case $RFSKUID_DETECT in
"$FULL_BAND")
echo "V1_DSDA_ZE550ML_FULL" > /config/local_config
;;
"$WW_BAND")
echo "V1_DSDA_ZE550ML_WW" > /config/local_config
;;
"$TW_BAND")
echo "V1_DSDA_ZE550ML_TW" > /config/local_config
;;
"$CN_BAND")
echo "V1_DSDA_ZE550ML_CN" > /config/local_config
;;
"$US_BAND")
echo "V1_DSDA_ZE550ML_US" > /config/local_config
;;
"$TR_BAND")
echo "V1_DSDA_ZE550ML_TR" > /config/local_config
;;
"$TEST_BAND")
echo "V1_DSDA_ZE550ML_TEST" > /config/local_config
;;
*)
echo "V1_DSDA" > /config/local_config
;;
esac
else
echo "V1_DSDA" > /config/local_config
fi
;;
"$ZX550ML")
if [ -n "$RFSKUID_DETECT" ]; then
case $RFSKUID_DETECT in
"$WW_US_BAND")
echo "V1_SINGLE_ZX550ML_WW" > /config/local_config
;;
"$TW_CN_JP_BAND")
echo "V1_SINGLE_ZX550ML_WW" > /config/local_config
;;
"$WW_TEST_BAND")
echo "V1_SINGLE_ZX550ML_WW" > /config/local_config
;;
"$TW_TEST_BAND")
echo "V1_SINGLE_ZX550ML_WW" > /config/local_config
;;
*)
echo "V1_SINGLE_ZX550ML" > /config/local_config
;;
esac
else
echo "V1_SINGLE_ZX550ML" > /config/local_config
fi
;;
*)
echo "V1_DSDA" > /config/local_config
;;
esac
else
echo "V1_DSDA" > /config/local_config
fi
CONFIG_PATH=/local_cfg
PROPS_FILE=init.props
# Get selected software configuration
config=`cat /config/local_config`
mount -o bind /system/etc/catalog/$config /local_cfg
log -p i -t config_init "Activating configuration $config"
# Set properties for the selected configuration
# read all FeatureTeam's init.props file
for f in /local_cfg/*/init.props
do
while read l; do
# Ignore empty lines and comments
case "$l" in
''|'#'*)
continue
;;
esac
# Set property
setprop `echo ${l/=/ }`
done < $f
done
Based on this I expect we can change it in a way we can load WW information and so unlock LTE bands.
Code:
Update #1
#RFSKUID_DETECT=$(cat /sys/module/intel_mid_sfi/parameters/rf_sku_id)
RFSKUID_DETECT=$WW_BAND # this will set RFSKUID_DETECT=0
Changelog:
Update #1: Without changing RFSKUID it will load configuration as if it was WW version;
Attempt #2 - Change XML files
Code:
Change this file content /system/etc/catalog/V1_DSDA_ZE550ML_CN/telephony_config/V1_DSDA_ZE550ML_CN_726x.xml
In line where is mentioned (4g_active_bands) change bands to the wanted bands, as well as in the next 3 lines. Below there are 2 images to help you.
V1_DSDA_ZE550ML_WW_726x.xml example
V1_DSDA_ZE550ML_CN_726x.xml example
Changelog:
Update #1: Change 4G bands in XML file;
In order to unpack/repack boot.img you can use this great tool: http://forum.xda-developers.com/showthread.php?t=2319018
As my Zenfone 2 (CN) didn't arrive yet I cannot start testing this yet.
I expect you to help me discussing about this and replying with your opinions, if this is or not a good way or something else..
Best wishes
João Ramos
Reserved
hello ! !
I am also wainting for my zenfones to arrive (i bought 3) ! !
If i can help with something after just ask ! ! Lest hope there is a method to unlock some LTE bands, as we now LTE Band 20 (800Mhz) is one of the most important to us ! !
PS: i am form Portugal too
x4nick8r said:
hello ! !
I am also wainting for my zenfones to arrive (i bought 3) ! !
If i can help with something after just ask ! ! Lest hope there is a method to unlock some LTE bands, as we now LTE Band 20 (800Mhz) is one of the most important to us ! !
PS: i am form Portugal too
Click to expand...
Click to collapse
Hi there.
For now I really believe this method is reliable, as it will load WW configuration files.. if there are no hardware differences between WW and CN versions (which I believe share the same modem -> Intel 7262) it will work I guess :good:
Here in Portugal for example Vodafone uses 800MHz, 1800MHz and 2600MHz. As far as we have 1800MHz I don't know if we'll have some LTE signal.. we'll have to wait to see! Thanks for your support
FYI, what this does is build local config directory which further allow to load the files specific to WW or CN etc.I tried once to copy WW files to CN but no change in band support.
Have you still got radio working? I read here in XDA that there could be a kind of mechanism to sign files and so the file won't be loaded.. This way we don't touch .xml files. Have you tried this method?
Hi, im from Portugal too and have zenfone2 since July, and this is very interesting for me, but i wouldnt know to where to start to test it since im not very expert in this matters...
But i hope it works..
Let me see if i get it. I need to unpack boot.img, replace config file in it, pack it back up and flash it to get this tested?
If so, that did not work, still getting H+ only and code 2 in /sys/module/intel_mid_sfi/parameters/rf_sku_id
I have 551ML, WW version and I need Band 38 (LTE TD 2600 MHz) to use it in my country (Romania). How can I enable it?
Trimis de pe dispozitivul meu Asus ZenFone 2
bravas said:
I have 551ML, WW version and I need Band 38 (LTE TD 2600 MHz) to use it in my country (Romania). How can I enable it?
Trimis de pe dispozitivul meu Asus ZenFone 2
Click to expand...
Click to collapse
We are working in it [emoji16]
Enviado desde mi ASUS_Z00AD mediante Tapatalk
Intel 7262 + Intel 2230 suports all LTE Frequencies on-Chip, the load of modem radio fw is prior to the boot rom of the phone.
i'm guessing with some work, with a FULLdump of a WW version of zenfone 2 (modem radio / baseband) it will be possible to enable the needed frequencies.
As far as i know ther is NO limitation in hardware in this device.
DiGecko said:
Let me see if i get it. I need to unpack boot.img, replace config file in it, pack it back up and flash it to get this tested?
If so, that did not work, still getting H+ only and code 2 in /sys/module/intel_mid_sfi/parameters/rf_sku_id
Click to expand...
Click to collapse
It's normal to get code 2 in that file. Here we aren't changing that file, just changing the code that this script will load on boot. Have you tried to change the XML file which loads the corresponding file (WW, CN or TW)?
Thanks
x4nick8r said:
Intel 7262 + Intel 2230 suports all LTE Frequencies on-Chip, the load of modem radio fw is prior to the boot rom of the phone.
i'm guessing with some work, with a FULLdump of a WW version of zenfone 2 (modem radio / baseband) it will be possible to enable the needed frequencies.
As far as i know ther is NO limitation in hardware in this device.
Click to expand...
Click to collapse
These are great news. Since there are no hardware differences we're able to unlock all frequencies. So we'll need to find where the modem radio fw is loaded..
BTW, only Intel 7262 supports LTE. Intel 2230 is the modem for the second SIM-Slot.
jopframos said:
These are great news. Since there are no hardware differences we're able to unlock all frequencies. So we'll need to find where the modem radio fw is loaded..
BTW, only Intel 7262 supports LTE. Intel 2230 is the modem for the second SIM-Slot.
Click to expand...
Click to collapse
From Intel papers
The Intel® XMM™ 7262 modem shares the same platform as the Intel® XMM™ 7260 modem, which is now shipping commercially to customers including Samsung.
Delivering category 6 speeds of up to 300 Mbps, the Intel® XMM™ 7262 supports LTE TDD/FDD, WCDMA/HSPA+ and TD-SCDMA, TD-HSPA, and EDGE standards for world markets. The Intel XMM 7262 offers China and the global TD-LTE ecosystem a new cost-effective option for developing mass-market LTE devices. The XMM 7262 modem features:
Global mobility:
o Up to 23 LTE bands on a single SKU for worldwide coverage and roaming
o Multimode design provides seamless connectivity to 2G, 3G and 4G LTE networks.
o Powerful and flexible RF architecture to enable roaming solutions for a world phone market impact.
Carrier Aggregation up to 40 MHz combined bandwidth on a single RF transceiver
High quality, low-power connectivity and voice calling:
o Intel’s second-generation envelope tracking and antenna tuning minimizes power consumption, preserving battery life.
o Power-efficient voice calling over LTE (VoLTE)
Small footprint: Minimized PCB size enables attractive form factors across a range of products, from smartphones and tablets to M2M and connected devices.
We’re proud of our progress and there is more to come. By the end of 2014, we expect to see devices based on the Intel® XMM™ 726x platform available in Australia, China, Europe, Latin America, North America, South Korea and other regions. Onward!
More information on Intel XMM 726x platform is available here.
Visit www.intel.com/mobileto see Intel’s entire portfolio of device, connectivity and network solutions for mobile computing.
Click to expand...
Click to collapse
It will be a matter of time, seek and experiment to unleash the full lte bands.
First thing is to know how and when baseband files are loaded on the phone. Maybe this is firmware related...
So my phone was originally CN, but I changed sku to WW and running latest WW firmware with boot image and all. I have it rooted and have unlocked bootloader with TWRP, so testing things is easy. I changed the file that you modified and repacked and flashed boot.img with no results. If you have anything else to try - let me know.
I used this method to change to WW and got my boot.img and droidboot.img from here. in latest 139 firmware. Whats interesting is even though the phone is running WW firmware and thinks it's on WW sku for OTA, it still loads as CN for the radios.
x4nick8r said:
From Intel papers
It will be a matter of time, seek and experiment to unleash the full lte bands.
First thing is to know how and when baseband files are loaded on the phone. Maybe this is firmware related...
Click to expand...
Click to collapse
I was just wondering that there could be differences in the Asus motherboard or something else...
You have an error in script, because it loads ZX551 settings.
Also there is no sense to work with ramdisk image, because LTE is locked in modem FW, which flashes according to parameters flashed at factory.
The only way to change it is to somehow modify ifwi image.
Right now i have flashed WW version with WW modem at CN phone and WW bands are still not working (even if i manually select 'em with AT commands).
I did it by modifying /factory/PhoneInfodisk/country_code file content to "TH".
Justere said:
You have an error in script, because it loads ZX551 settings.
Also there is no sense to work with ramdisk image, because LTE is locked in modem FW, which flashes according to parameters flashed at factory.
The only way to change it is to somehow modify ifwi image.
Right now i have flashed WW version with WW modem at CN phone and WW bands are still not working (even if i manually select 'em with AT commands).
I did it by modifying /factory/PhoneInfodisk/country_code file content to "TH".
Click to expand...
Click to collapse
I didn't edit the PROJID_DETEC variable. Why do you say that?
You should also modify the / sys / module / intel_mid_sfi / parameters / rf_sku_id file too.. Have you tried it?
This won't change anything, I have flashed WW boot.IMG ,droidboot.IMG and recovery.IMG on my CN zenfone 2 and the bands didn't work so I returned back to stock CN.
If boot.img was responsible for the bands then they should have worked when I had the WW boot.img.
jopframos said:
I didn't edit the PROJID_DETEC variable. Why do you say that?
You should also modify the / sys / module / intel_mid_sfi / parameters / rf_sku_id file too.. Have you tried it?
Click to expand...
Click to collapse
WW_US_BAND is for ZX550 model, not for ZE551.
To modify rf_sku_id file we neet to modify kernel sources, recompile and flash it.
As i wrote few month ago:
LTE bands depends on RF_SKU_ID value.
In kernel sources RF_SKU_ID is defined based on "zenfone2.MR7.1-2.18.40\linux\kernel\arch\x86\platform\intel-mid\intel_mid_sfi.c" file.
Possibly, if we change it to static WW value "0", then LTE bands may become available.
Click to expand...
Click to collapse
With Nokia 6.1 plus, I have many unknown issues. Please help me. I have searched google but there is no answer.
1. How is TA-1054, 1083 and 1116 different.
2. DRG 237 and ... what.
3. Unlocked in developer already but why can't unlock the bootloader.
4. What is PL2.
5. 6gb ram and 4gb ram why not use the same rom.
6. Download rom stock nokia 6.1 plus TA-1116 where
Please help me
With Nokia 6.1 plus, I have many unknown issues. Please help me. I have searched google but there is no answer.
1. How is TA-1054, 1083 and 1116 different.
They are the model numbers corresponding to different regions. Some regions have different network bands.
2. DRG 237 and ... what.
These are the software versions numbers. The current one with the August Security patch is 354H.
3. Unlocked in developer already but why can't unlock the bootloader.
Nokia doesn't really want you to tamper with the system. So Bootloader unlocking is not possible at all unless you pay.
4. What is PL2.
PL2 is the codename/model name of Nokia 6(2018)/Nokia 6.1. The code name for 6.1 Plus is Dragon_Sprout/DRG_sprout
5. 6gb ram and 4gb ram why not use the same rom.
Ask Nokia/HMD/FiH. The 6Gig variant has some modifications to the bootloader and system. It is not a very good device for custom ROMS. While the 4Gig is awesome.
6. Download rom stock nokia 6.1 plus TA-1116 where
You can get them from here - Firmwares, But you will need to unlock bootloader before flashing. Although you don't need root to install OTA.zip files.
Happy to answer more questions
CarbonGTR said:
With Nokia 6.1 plus, I have many unknown issues. Please help me. I have searched google but there is no answer.
1. How is TA-1054, 1083 and 1116 different.
They are the model numbers corresponding to different regions. Some regions have different network bands.
2. DRG 237 and ... what.
These are the software versions numbers. The current one with the August Security patch is 354H.
3. Unlocked in developer already but why can't unlock the bootloader.
Nokia doesn't really want you to tamper with the system. So Bootloader unlocking is not possible at all unless you pay.
4. What is PL2.
PL2 is the codename/model name of Nokia 6(2018)/Nokia 6.1. The code name for 6.1 Plus is Dragon_Sprout/DRG_sprout
5. 6gb ram and 4gb ram why not use the same rom.
Ask Nokia/HMD/FiH. The 6Gig variant has some modifications to the bootloader and system. It is not a very good device for custom ROMS. While the 4Gig is awesome.
6. Download rom stock nokia 6.1 plus TA-1116 where
You can get them from here - Firmwares, But you will need to unlock bootloader before flashing. Although you don't need root to install OTA.zip files.
Happy to answer more questions
Click to expand...
Click to collapse
It was great, when you answered my questions, thank you very much. I understood my problems.