Database Users

[GUIDE] My Bell Canada flashing/rooting procedure

Update: I upgraded my phone with XXKI3 2.3.5 firmware, from XXKH3.
The lag is gone, definitely a big improvement compared to XXKH3 version. The phone is very responsive and fast. Quadrant shows 4200+, pretty impressive:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
The bootloader was updated, you cannot reset anymore your phone with a download jig. However, Intratech uploaded the old bootloader:
Intratech said:
If you've already flashed a full package from elsewhere and cannot reset your binary counter using the Jig just flash this package in the PDA or Bootloader (Yes both will work) section of Odin to replace the bootloaders and then you can reset the counter: http://www.multiupload.com/LQQBRQVJUD
Click to expand...
Click to collapse
Personally, I flashed the file with Odin (PDA).
The phone ring is set to silent, instead of default "Over the horizon" ringtone. Make sure you change it, your phone is not broken. See the complete list of changes, related to previous ROM.
Guide
I'm posting this procedure in a separate thread, as is easier to be linked into different forum posts. My Bell Canada phone came originally with the UGKG2 firmware, so everything listed below is based on my own experience with this version, I do not know or confirm it will work with other firmware. I currently run the official (?) XXKI3 Gingerbread 2.3.5 firmware, downloaded from samfirmware.com site (see details below). This is a wipe device release.
Personally, I read that other people flashed their phones with a different firmware... but I did not wanted to do it on my phone. I sticked with the same family XXKGx, just to be safe. Please read Electroz's explanation below.
There are 3 types of release builds: leaked, Frankenstein (compiled and tested by devs, based on demand) and official (Kies updates).
The procedure is simple (I presume you are familiar with Odin, Download Mode &Co.):
1) Get yourself the stock firmware and kernel (thank you Intratech)
2) Setup your drivers properly, avoid the Kies insanity (see below)
3) Flash the new firmware (my flash procedure, you can/should skip Re-Partition/PIT as Intratech explained)
4) Flash phone with CF-Root (I used the CF-Root-SGS2_XX_OXA_KI3-v4.1-CWM4.zip file)
5) Wipe (cache + factory reset)
6) Uninstall all Samsung crap and install additional system apps (i.e. Car Home)
7) Flash back the stock KI3 kernel (thank you Intratech, password: [email protected])
8) Wipe (cache + factory reset)
9) Connect your device to a download jig, to reset the flash counter (old bootloader needed)
Phone & Modem Drivers Setup
Note: This procedure was tested with Windows 7 Ultimate 64bits. If you already installed Kies, uninstall all related software/drivers and clean your registry. Or do a clean Windows install just to be safe.
1) With your anti-virus off, put your phone in Download mode and connect the USB cable. Windows Update will start to download right away the modem and USB drivers. Make sure you select the Windows Update option, when asked into driver install window.
2) Once the modem drivers installed, disconnect the cable, reboot the phone in normal mode and reconnect the cable again. A new set of drivers will be installed for the rest of USB interface.
Important: You need do it in the SPECIFIC order mentioned above, or else the modem drivers will not be installed and you will not be able to use properly Odin. I know this because I tried the other way around.
Initial Phone Setup
Once the phone rebooted, you will be welcomed to the Android Setup.
1) First, set the language from English UK to whatever you like.
A Network warning related to Date and Time will pop, tap on Cancel.
2) Tap the Android robot and setup your phone.
There is NO need to change any other settings, the phone will automatically detect the Bell network.
If for some reason it does not, once you completed your basic setup go to:
Settings > Wireless and Network > Mobile networks > Network operators
It will start the scanning and pop 3 Bell networks, pick the first one. Again, this is in case your phone does not work with calls, voicemail or SMS.
Notes
You should uninstall the CWM app once you flashed back the stock kernel, is half useless. I tested the new Superuser app from Android Market, it will properly upgrade to latest version and also upgrade the su binary on XXKI3 firmware. If you plan to poke around your phone with the Terminal, you will lose all the fancy Linux commands. (grep etc.)
Personally, I purchased ChainsDD's Superuser Elite key. It will allow you to pin protect your rooted device, among other useful things that are planned to be added (built-in terminal). I upgraded Superuser to version 3 and everything works properly.
Battery Power Savings
I always leave my phone with all default options, including screen auto-adjust. The only options I turn off are:
Settings > About phone > Software update > Auto update Disabled
Settings > Applications > Samsung Apps > Off
Personally, I have no idea who started the battery calibration myth in S2. It is useless to "overcharge" the battery, as the software has a check to stop automatically the charge once the battery is 100% while the battery itself has a build-in controller that can't be wiped.
Example of battery stats with the phone in idle mode for approx. 18hrs (86%) and 109hrs (2%):
Running Services
I use Wifi N with a Cisco E4200 DD-WRT (phone at 20"), these are my running services:
Code:
PID USER VSZ STAT COMMAND
1 root 508 S /init
2 root 0 SW [kthreadd]
3 root 0 SW [ksoftirqd/0]
4 root 0 SW [migration/0]
5 root 0 SW [watchdog/0]
9 root 0 SW [events/0]
11 root 0 SW [khelper]
15 root 0 SW [async/mgr]
16 root 0 SW [pm]
19 root 0 SW [suspend]
20 root 0 SW [sync_system_wor]
151 root 0 SW [s5p-tmu]
337 root 0 SW [sync_supers]
339 root 0 SW [bdi-default]
341 root 0 SW [kblockd/0]
356 root 0 SW [khubd]
359 root 0 SW [kseriod]
394 root 0 SW [irq/331-max8997]
434 root 0 SW [kmmcd]
527 root 0 SW [kondemand/0]
540 root 0 SW [pet_watchdog/0]
549 root 0 SW [khungtaskd]
550 root 0 SW [kswapd0]
599 root 0 SW [aio/0]
612 root 0 SW [crypto/0]
1237 root 0 SW [sec_jack_wq]
1240 root 0 SW [irq/350-sec_hea]
1245 root 0 SW [spi_gpio.3]
1262 root 0 SW [svnet_txq]
1274 root 0 SW [file-storage]
1300 root 0 SW [irq/328-mxt224_]
1306 root 0 SW [irq/325-k3g]
1312 root 0 SW [irq/326-proximi]
1315 root 0 SW [cm3663_light_wq]
1316 root 0 SW [cm3663_prox_wq]
1366 root 0 SW [mali_dvfs]
1369 root 0 SW [mali-pmm-wq]
1378 root 0 SW [sii9234_wq]
1379 root 0 SW [irq/481-mhl_int]
1380 root 0 SW [irq/496-mhl_wak]
1383 root 0 SW [irq/343-max1704]
1394 root 0 SW [kstriped]
1396 root 0 SW [kmpathd/0]
1398 root 0 SW [kmpath_handlerd]
1399 root 0 SW [ksnapd]
1400 root 0 SW [kconservative/0]
1414 root 0 SW [ktflash_requlat]
1429 root 0 SW [usbhid_resumer]
1432 root 0 SW [binder]
1441 root 0 SW [irq/333-IPC_HOS]
1452 root 0 SW [mmcqd]
1481 root 0 SW [l2cap]
1482 root 0 SW< [krfcommd]
1488 root 0 SW [dynamic hotplug]
1501 root 0 SW [melfas_touchkey]
1506 root 0 SW [fimc0_iqr_wq_na]
1509 root 0 SW [fimc1_iqr_wq_na]
1512 root 0 SW [fimc2_iqr_wq_na]
1515 root 0 SW [fimc3_iqr_wq_na]
1518 root 0 SW [hdcp work]
1529 root 0 SW [tvout resume wo]
1535 root 0 SW [sec-battery]
1538 root 384 S /sbin/ueventd
1761 root 0 SW [Si4709_wq]
1782 root 0 SW [jbd2/mmcblk0p9-]
1784 root 0 SW [ext4-dio-unwrit]
2563 root 0 SW [jbd2/mmcblk0p7-]
2564 root 0 SW [ext4-dio-unwrit]
2566 root 0 SW [jbd2/mmcblk0p1-]
2567 root 0 SW [ext4-dio-unwrit]
2570 root 0 SW [jbd2/mmcblk0p10]
2571 root 0 SW [ext4-dio-unwrit]
2579 system 868 S /system/bin/servicemanager
2580 root 6616 S /system/bin/vold
2581 system 1972 S /system/bin/notified_event
2583 root 732 S /system/bin/debuggerd
2584 radio 9512 S /system/bin/rild
2585 system 4624 S /system/bin/npsmobex
2586 system 8476 S /system/bin/drexe
2590 bluetoot 1372 S /system/bin/dbus-daemon --system --nofork
2591 root 932 S /system/bin/installd
2592 keystore 1804 S /system/bin/keystore /data/misc/keystore
2594 system 14192 S /system/bin/tvoutserver
2595 shell 800 S /system/bin/sh /system/bin/rtc_log.sh
2612 shell 780 S /system/bin/immvibed
2907 wifi 2644 S /system/bin/wpa_supplicant -Dwext -ieth0 -c/data/wifi/bcm_su
3374 media 56536 S < /system/bin/mediaserver
3375 root 15472 S /system/bin/netd
3376 root 126m S zygote /bin/app_process -Xzygote /system/bin --zygote --star
3391 system 276m S system_server
3496 root 0 SW [iscan_sysioc]
3497 root 0 SW [dhd_watchdog]
3498 root 0 SW [dhd_dpc]
3499 root 0 SW [dhd_sysioc]
3502 system 152m S com.android.systemui
3511 app_99 168m S com.sec.android.inputmethod.axt9
3521 radio 155m S com.android.phone
3522 app_66 148m S android.process.media
3528 app_53 134m S com.sec.pcw.device
3532 system 134m S com.samsung.bt.avrcp
3536 bluetoot 134m S com.broadcom.bt.app.system
3544 app_12 176m S com.sec.android.app.twlauncher
3604 app_54 173m S com.google.process.gapps
3631 app_12 148m S android.process.acore
3688 app_84 135m S com.sec.android.app.FileTransferManager
3777 app_36 137m S com.sec.android.widgetapp.weatherclock
3927 app_38 136m S com.sec.android.widgetapp.apnews
4193 app_91 137m S com.sec.android.app.clockpackage
4220 app_16 137m S com.android.providers.calendar
4234 app_100 134m S com.sec.android.daemonapp.accuweather
4255 app_78 159m S com.google.android.gm
4333 app_81 174m S com.cooliris.media
4366 app_119 144m S com.google.android.apps.reader
4376 app_103 170m S com.levelup.beautifulwidgets
4435 app_37 138m S com.sec.android.widgetapp.stockclock
4453 app_16 138m S com.android.calendar
4476 system 156m S com.android.settings
4486 app_112 177m S com.google.android.music
4633 app_82 137m S com.sec.android.app.fm
4752 app_40 135m S com.sec.android.app.samsungapps.una
6623 app_68 185m S < com.google.android.apps.maps
9014 dhcp 916 S /system/bin/dhcpcd -ABK eth0
10732 graphics 139m S com.sec.android.app.screencapture
11958 system 138m S com.wssyncmldm
11989 system 135m S com.sec.android.providers.drm
11997 app_1 139m S com.smlds
12037 app_102 139m S com.skype.raider
13094 app_5 141m S jackpal.androidterm
13136 app_115 135m S com.noshufou.android.su
13170 app_68 149m S com.google.android.apps.maps:NetworkLocationService
13180 app_68 144m S com.google.android.apps.maps:FriendService
13503 app_83 141m S com.sec.android.app.FileTransferServer
13579 root 0 SW [flush-179:0]
13646 shell 1684 S /sbin/ext/busybox sh /sbin/sleep 3600
13651 shell 1676 S /sbin/ext/busybox /sbin/sleep 3600
13707 app_68 154m S com.google.android.apps.maps:HotpotService
13788 system 135m S com.android.MtpApplication
13825 app_5 796 S /system/bin/sh -
13858 root 796 S sh -
13966 root 1684 S /sbin/ext/busybox sh /sbin/ps
13971 root 1716 R /sbin/ext/busybox /sbin/ps
CSC (Cell Site Controller)
The default CSC setting in XXKI3 is KOR. You can check it with: *#272*{IMEI}#
where the {IMEI} value represents the 15 digits of your IMEI (International Mobile Equipment Identity).
I personally used the default option (KOR) and the phone works perfect, with great reception:
There are some people who wonder if they should change the CSC. I will quote Intratech on this matter as he answered perfectly to my question:
Intratech said:
Some people do and some just use the CSC packaged with whichever firmware they flash. As long as your APN and SMS/MMS settings are ok there is no need to flash another CSC package.
Click to expand...
Click to collapse
Fast Dormancy
Some people noticed that their network idle on 3G, instead of HSPA+. That is absolutely normal, because of the "fast dormancy" feature. If enabled, HSPA+ will rapidly disconnect from the network once the information is sent or received. That will penalize the actual network you are on, unless the carrier network and your phone talk to each other in a way that takes battery life as well as network congestion into consideration. For this to work, both networks and smartphones have to implement a standardized version of the fast dormancy feature. Bell Canada supports this feature and by default Fast Dormancy is enabled into XXKI3 firmware.
You can check it with: *#9900#
You should call your carrier to see if they have it implemented. Probably your tech support will look like you are speaking Chinese and escalate it to a more knowledgeable guy. This is the average download speed I get on XXKI3 (network is switching automatically on HSPA+):
There are some reports where people confirmed that the UGKG2 build allowed you to reach faster download speeds (up to 9MB). Personally I think 6MB over a cell network is already more than perfect for tethering, not to mention that there are many factors to be taken into consideration when you deal with a wireless transmission. (location, tower antenna, weather, etc.)
Random Restart
The screen needs minimum 500Mhz to get out of Sleep Mode. Some custom ROM's use a low voltage or "underclock" feature that reduces the power consumption but also the number of CPU steps. That is what makes your phone crash and reboot randomly. If you use an external sdcard, do a sd wipe just to be safe. It should take several hours, so do it over the night. Personally, I did not experienced any random reboots using neither the XXKH3 or XXKI3 firmware.
Some people might have bad battery contacts on their S2. Basically, the phone shuts down while in your pocket. Clean the battery terminals with some audio head tape cleaner and cotton swabs, than make sure the contacts are proper.
You could also have a RAM (hardware) issue. Bad memory degrades fast so you will see your random reboots pop at a faster frequency. If you did all the above and still experience random reboots, run adb logcat to see what is going on at that specific moment. If you get error codes like:
Code:
code 1 (SEGV_MAPERR), fault addr 00000000
you are dealing with bad memory unfortunately and need to service your phone.
Manage system apps with Terminal
Personally, I decided to stick with a terminal for now, I feel more comfortable to see what is going on with my own eyes in my phone. A good alternative to Terminal would be the SystemApp Remover, is faster and more robust compared to Titanium Backup as it does only one task (backup/remove system apps).
I did an output list of all the packages:
Code:
$ pm list packages -f >> /sdcard/packages 2>&1
so I know now where each package is located and what is the associated name.
All I have to do is run:
Code:
$ su
# rm -f /system/app/package.{apk,odex}
# pm clear PACKAGE
# pm uninstall PACKAGE
Running "mount | grep system" tells me right away where and how /system is mounted:
Code:
/dev/block/mmcblk0p9 on /system type ext4 (ro,relatime,barrier=1,data=ordered)
so all I have to do is change the mount perms to write, instead of read:
Code:
# mount -o remount,rw /dev/block/mmcblk0p9 /system
Package Manager commands:
Code:
# pm
usage: pm [list|path|install|uninstall]
pm list packages [-f] [-d] [-e] [-u] [FILTER]
pm list permission-groups
pm list permissions [-g] [-f] [-d] [-u] [GROUP]
pm list instrumentation [-f] [TARGET-PACKAGE]
pm list features
pm list libraries
pm path PACKAGE
pm install [-l] [-r] [-t] [-i INSTALLER_PACKAGE_NAME] [-s] [-f] PATH
pm uninstall [-k] PACKAGE
pm clear PACKAGE
pm enable PACKAGE_OR_COMPONENT
pm disable PACKAGE_OR_COMPONENT
pm setInstallLocation [0/auto] [1/internal] [2/external]
The list packages command prints all packages, optionally only
those whose package name contains the text in FILTER. Options:
-f: see their associated file.
-d: filter to include disbled packages.
-e: filter to include enabled packages.
-u: also include uninstalled packages.
The list permission-groups command prints all known
permission groups.
The list permissions command prints all known
permissions, optionally only those in GROUP. Options:
-g: organize by group.
-f: print all information.
-s: short summary.
-d: only list dangerous permissions.
-u: list only the permissions users will see.
The list instrumentation command prints all instrumentations,
or only those that target a specified package. Options:
-f: see their associated file.
The list features command prints all features of the system.
The path command prints the path to the .apk of a package.
The install command installs a package to the system. Options:
-l: install the package with FORWARD_LOCK.
-r: reinstall an exisiting app, keeping its data.
-t: allow test .apks to be installed.
-i: specify the installer package name.
-s: install package on sdcard.
-f: install package on internal flash.
The uninstall command removes a package from the system. Options:
-k: keep the data and cache directories around.
after the package removal.
The clear command deletes all data associated with a package.
The enable and disable commands change the enabled state of
a given package or component (written as "package/class").
The getInstallLocation command gets the current install location
0 [auto]: Let system decide the best location
1 [internal]: Install on internal device storage
2 [external]: Install on external media
The setInstallLocation command changes the default install location
0 [auto]: Let system decide the best location
1 [internal]: Install on internal device storage
2 [external]: Install on external media
Removed System Apps
This is the list of /system apps I removed from XXKI3 firmware:
BuddiesNow.apk
Days.apk
DigitalClock.apk (I use Beautiful Widgets instead)
Email.apk (I use Gmail only)
EmailWidget.apk
GameHub.apk
GenieWidget.apk
install_flash_player.apk
Kies.apk
KiesAir.apk
kieswifi.apk
Kobo.apk
MiniDiary.apk
MusicHub_U1.apk
MusicPlayer.apk (I use Google Music instead)
PolarisOffice.apk
PressReader.apk
ReadersHub.apk
SamsungApps.apk
SamsungAppsUNA3.apk
SamsungIM.apk
SecretWallpaper1.apk
SecretWallpaper2.apk
SevenEngine.apk
ShareApp.apk
SnsAccountFb.apk
SnsAccountLi.apk
SnsAccountMy.apk
SnsAccountTw.apk
SnsDisclaimer.apk
SnsImageCache.apk
SnsProvider.apk
SocialHub.apk
VoiceToGo.apk (I use Car Home instead)
Zinio.apk
Apps ported to Galaxy S2
Some of my favorite apps, not available into Market and ported to Galaxy S2:
Google Car Home
Market Access
Google+ 2.0 (works with a Google Apps account)
Terms
ROM - software stored into read-only memory. ROM retains its contents even when the phone is turned off. ROM is referred to as being nonvolatile, whereas RAM is volatile.
Kernel - portion of the OS that handles drivers, hardware control and access for the rest of the OS.
Modem - handles the communication with your carrier.
Root - superuser privileges in any Linux OS.

yqed said:
I'm posting this procedure in a separate thread, as is easier to be linked into different forum posts. My Bell Canada phone came originally with the UGKG2 firmware, so everything listed below is based on my own experience with this version, I do not know or confirm it will work with other firmware. I currently run the official (?) XXKG3 Gingerbread 2.3.4 firmware, downloaded from samfirmware.com site (see details below).
Personally, I read that other people flashed their phones with a different firmware... but I did not wanted to do it on my phone. I sticked with the same family XXKGx, just to be safe.
Click to expand...
Click to collapse
This is wrong. I'm not sure where you got that XXKG3 is remotely the same as UGKG2, but here's an explanation of the firmware version numbers:
This is standard across most Samsung Phones.
I9000 = Model #
UG = Carrier/Area code. For example, XX = Europe, UG = Bell Mobility Canada.
K = Year = 2011
G = Month = July (H = August, I = September)
2 = Revisions that month for the specific region (aka. UG, XX, XW).
A lot of people on here think the last 3 digits are important and that if you have 2 KG3 firmware that they are the same. However, this is not the case.
You need to go by all 5 letters due to the fact that each firmware is customized by different groups at Samsung. And to prove this, just look at KG2. There are 2.3.3 KG2's and there are 2.3.4 KG2's.
It's actually possible that one area's KG2 could have been newer than another area's KG4. The best way to check, is to look at the build date in the Build.prop for each firmware.
But your assuming that KGx means they're the same is wrong. All that those numbers mean is what month/revision the firmware is. Samsung has several different teams producing firmware independently of each other for different regions. The only letters that mean the firmwares are similar are the country/carrier code (ie. UG, XX, XW).
Also, your idea of what Official firmware is, is flawed. Just because it's on samfirmware, DOES NOT make it official. Most of their firmwares are leaked test builds. If it's not released on Kies, it's not official.

Thanks for the great explanation, much appreciated. It should help many people understand better how the versioning works. About the "official" part, that's the reason why I mark it with a (?). As you said very well, it is official once is released by Samsung through updates.
The thread is related to my own experiences with the Europe MULTI firmware, based on the fact that a Bell phone specs are identical to the Europe model.
Edit: I upgraded to XXKH3 firmware successfully just now, everything works great.

I currently have a Bell branded SGSII with baseband version UGKG2.
I originally flashed it with CF-Root-SGS2_ZS_OZS_KG2-v4.1-CWM4.zip and then I re-flashed it with the original UGKG2 Stock Kernel from Bell.
Now my phone is rooted and stock.
Any positive/negative feedback from users running XXKH3 firmware (2.3.4) would be very much appreciated.

thvpham said:
I currently have a Bell branded SGSII with baseband version UGKG2.
I originally flashed it with CF-Root-SGS2_ZS_OZS_KG2-v4.1-CWM4.zip and then I re-flashed it with the original UGKG2 Stock Kernel from Bell.
Now my phone is rooted and stock.
Any positive/negative feedback from users running XXKH3 firmware (2.3.4) would be very much appreciated.
Click to expand...
Click to collapse
I ran the KH3 firmware briefly with no issues. The only annoying this was when using the program monitor widget I would experience some lag or choppiness when switching homescreens(same on KG6/KH4). On the positive side the gps accuracy and lock time was greatly improved.

Aha, I had no idea as I don't use that widget... thanks for the tip.
I usually hold the Home button until the Task Manager pops, to see the running apps. But I got used already to press the Back key every time I deal with an app... that automatically closes it.
About the GPS, the accuracy is greatly improved indeed. It takes me 1-3secs max to get a lock (with wireless networks disabled) and the accuracy is always 5meters.
Edit: There is a new Digital Clock service running now... I have no idea what makes it start, please let me know. I use Beautiful Widgets on my home screen.

The digital clock service should be part of the digital clock widget. You can try to end the process under running services and see if it stops it.

I downloaded the XXKH3 firmware but I'm not sure which files I should be using with Odin (Bootloader, PDA, Phone & CSC).

KayvinM said:
The digital clock service should be part of the digital clock widget. You can try to end the process under running services and see if it stops it.
Click to expand...
Click to collapse
I use Beautiful Widgets, so DigitalClock.apk should not be starting... Weird.
I just uninstalled the system app, no more running services. It was wasting my battery for nothing.
thvpham said:
I downloaded the XXKH3 firmware but I'm not sure which files I should be using with Odin (Bootloader, PDA, Phone & CSC).
Click to expand...
Click to collapse
See step 3 and skip the PIT file (re-partition unchecked). Also see the Update note into OP.

thvpham said:
I downloaded the XXKH3 firmware but I'm not sure which files I should be using with Odin (Bootloader, PDA, Phone & CSC).
Click to expand...
Click to collapse
I ended up re-downloading the XXKH3 from Intratech's thread and it was much easier flashing the one PDA file.
Now do I need to flash the XXKH3 stock kernel or my default stock Bell kernel?

You need the XXKH3 stock kernel, Intratech has it linked below the actual firmware link.

does it matter if CSC changes?
right now, (before root + update firmware), I still have BMC....
but once it's changed, would that create problems? If yes, what kind of problems. If no, then why do we care about CSC?

Personally, I used the samfirmware files and the phone works great. The pda.bell.ca info is present into ASN also.

Thanks for the responses everyone.
I ended flashing the stock XXKH3 kernel with the firmware. So far the upgrade has been good to me, I noticed improved battery life for the first 18 hours of usage. I will continue to use this build until I find something that is more stable and efficient then this.

A BIG THANK YOU!!!! I finally rooted and unlocked.
Originally: UGKF6
Now: XXKG5
Thanks for the guide!!!
Just 1 question though, do I HAVE TO do a factory after root? Any problem if I don't?

One thing is sure, the battery life degraded compared to XXKG3 firmware.
XXKG3 | XXKH3 (about 4hrs lost)
When I took the screenshot on KG3, I was using the phone for about 2 hours to read a book (notice the sudden drops because of the white screen), while the KH3 was always in sleep mode. So ya, there is a significant change in battery life with a tradeoff for the GPS gains.
I updated the OP.
clb09 said:
A BIG THANK YOU!!!! I finally rooted and unlocked.
Originally: UGKF6
Now: XXKG5
Thanks for the guide!!!
Just 1 question though, do I HAVE TO do a factory after root? Any problem if I don't?
Click to expand...
Click to collapse
Just curious, why you did not used the KH3 to take advantage of amazing GPS? The battery life should be a bit better also, compared to KG5. What do you mean by "do a factory"? You will lose root only if you flash back the firmware, flashing the kernel will not delete the su binary. You want to keep your phone rooted.
I strongly recommend you to spend $1 and get ChainsDD's Superuser Elite key, it will allow you to pin protect your rooted device. I upgraded to 3.0 Beta4 and everything works properly. Worth the dollar in so many ways, not just for securing the su access.

What you use to remove system app.
Thanks

Fizwiz said:
What you use to remove system app.
Thanks
Click to expand...
Click to collapse
I use Titanium Backup PRO. It allows me to backup, freeze and uninstall the unwanted apps.

One thing i have see with the XXKH3. With the KG2 im stable on H+, now im switching between 3G and H+.
Anyone else?

See Fast Dormancy info in OP. Is normal and the intended way to save you battery and bandwidth congestion.

QPST - Backup/Restore modem-config

How to get into Diag mode:
1) open dialer
2) enter: *#*#717717#*#*
3) you'll see a toast "diag mode enabled"
To disable diag-mode enter the same code again.
How to install drivers in Windows:
1) download and extract xiaomi_mi2_diag_driver.zip
2) after you've connected your phone in diag mode you'll see very much devices
3) choose custom source to search for driver and select the extracted folder.
4) only 3 of the devices will install it doesn't matter we don't need the others.
How to configure QPST:
1) open QPST configuration from start menu
2) on tab "ports" click on "Add new Port"
3) you should see two qualcom ports in the list. choose one and click OK.
4) if displayed phone name is SURF9615, you've selected the correct one. otherwise add the second device, too

But why?
Hello M1cha,
I'm sorry if this is obvious but what exactly can I use this for
Is it changing my IMEI?
And if so, why would I want to change it?
Again, I'm sorry if the answer is obvious and I'm just asking a stupid question.
Unrelated question:
Do you know if Xiaomi.eu will really shut down or not? I can't seem to get straight answers on the Q&A forum

Redme Note LTE TD
Hello
I used your guide and http://forum.xda-developers.com/cro...ad-progress-please-leave-im-updating-t2871269
to unlock the WCDMA frequencies on my Redmi NOTE LTE TD ... bought in china .... everything OK ... but the phone works on GPRS ... I have also tried using the menu * # * # 4636 # * # * .. but nothing ..
do you have same idea ??
thank you !

Gobbenobber said:
Hello M1cha,
I'm sorry if this is obvious but what exactly can I use this for
Is it changing my IMEI?
And if so, why would I want to change it?
Again, I'm sorry if the answer is obvious and I'm just asking a stupid question.
Unrelated question:
Do you know if Xiaomi.eu will really shut down or not? I can't seem to get straight answers on the Q&A forum
Click to expand...
Click to collapse
On mi2 u can't change the IMEI because it's locked.
But you can change several settings and unlock bands.
I don't think MA shuts down soon but Marks ups and downs are very annoying.
mzz75 said:
Hello
I used your guide and http://forum.xda-developers.com/cro...ad-progress-please-leave-im-updating-t2871269
to unlock the WCDMA frequencies on my Redmi NOTE LTE TD ... bought in china .... everything OK ... but the phone works on GPRS ... I have also tried using the menu * # * # 4636 # * # * .. but nothing ..
do you have same idea ??
thank you !
Click to expand...
Click to collapse
Maybe these bands really aren't supported by hardware?

m11kkaa said:
On mi2 u can't change the IMEI because it's locked.
But you can change several settings and unlock bands.
I don't think MA shuts down soon but Marks ups and downs are very annoying.
Maybe these bands really aren't supported by hardware?
Click to expand...
Click to collapse
but when I enable WCDMA ..i can see the network [0]=CellInfoWcdma ..... but the type of network is still GPRS ... maybe some setting?

I don't think so. That's the normal behavior if a band isn't supported.
You can even enabled LTE but it won't work because the hw doesn't support it.

Modem Dead
I'm sorry to bother you again, but I have a big problem ..... with Qualcomm QPST I have a modified live parameters for the WCDMA network, but now the modem does not work anymore (2g, 3g, lte) and I can not connect the phone with QPST (say NO pHONE) .... I can do something ??
thanks

Well you have to restore the parameters to the original ones. I hope you made a backup.

m11kkaa said:
Well you have to restore the parameters to the original ones. I hope you made a backup.
Click to expand...
Click to collapse
I can not do the restore ... QPST Configurator does not see the phone ... or is there another method ??

Is it possible to enable wcdma band 900 MHz on mi2s?

orlanddon said:
Is it possible to enable wcdma band 900 MHz on mi2s?
Click to expand...
Click to collapse
I'd like to know that, too

i have one of the first batch of mi2 without wcdma 900 and it's very important to my operator so you know if it's hw supported or not? If i mess up with miflash i will restore everything or not? After a wipe i must repeat all the procedure?

Does somebody know which code it is for Redmi2? *#*#717717#*#* doesn't work... I want to try to unlock LTE band 20 (800Mhz), do you think any chance?

Any of you have got unlock 900MHz 3G on MI2 with this ?
Very interested in.
regards

I tried the tips but something's wrong :
QPST is ok i see my phone MI2 : APQ8064
With RF NV manager i got the error when i read from phone :
NvManager::getNvItemsFromPhone( const string comPort ) - QpstServer::sendSyncImpl - Bad response from phone (DM packet commands 19-24)
Again when i tried to make a backup :
"Memory Backup failed"
"Disk Error while writing to file"
Really stange... any advise ?

m11kkaa said:
How to get into Diag mode:
1) open dialer
2) enter: *#*#717717#*#*
3) you'll see a toast "diag mode enabled"
To disable diag-mode enter the same code again.
How to install drivers in Windows:
1) download and extract xiaomi_mi2_diag_driver.zip
2) after you've connected your phone in diag mode you'll see very much devices
3) choose custom source to search for driver and select the extracted folder.
4) only 3 of the devices will install it doesn't matter we don't need the others.
How to configure QPST:
1) open QPST configuration from start menu
2) on tab "ports" click on "Add new Port"
3) you should see two qualcom ports in the list. choose one and click OK.
4) if displayed phone name is SURF9615, you've selected the correct one. otherwise add the second device, too
Click to expand...
Click to collapse
Hi M1cha, I'd like to so a backup, but I can't let it work.
My problems start from the biginning: when I enter the code I got no toast message. I tried to connect anyway the phone (when is on, with and without debug option), but I don't see much devices, only the usual MI2 MTP.
Suggestions? Could be ROM releated?

Fortinho said:
Hi M1cha, I'd like to so a backup, but I can't let it work.
My problems start from the biginning: when I enter the code I got no toast message. I tried to connect anyway the phone (when is on, with and without debug option), but I don't see much devices, only the usual MI2 MTP.
Suggestions? Could be ROM releated?
Click to expand...
Click to collapse
yes, this works in MIUI only

m11kkaa said:
yes, this works in MIUI only
Click to expand...
Click to collapse
Still problems :/
I got this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
And If I try to update drivers individually, only one will successfull install. It's normal?
Anyway, after that, I don't know how to open QPST configuration from start menu. What start menu?
Thank you.

Fortinho said:
Still problems :/
I got this:
And If I try to update drivers individually, only one will successfull install. It's normal?
Anyway, after that, I don't know how to open QPST configuration from start menu. What start menu?
Thank you.
Click to expand...
Click to collapse
Up.

Fortinho said:
If I try to update drivers individually, only one will successfull install. It's normal?
Click to expand...
Click to collapse
I don't know but you will see after with qpst if it works.
Fortinho said:
I don't know how to open QPST configuration from start menu. What start menu?
Click to expand...
Click to collapse
What windows do you've got?
With Seven : Start menu is bottom left on your screen
With 8 : go on the mosaic screen (where you have all your program) and type QPST. You will find QPST configuration

[TUTORIAL][Radio] Enable NEXUS6 XT1103 4G LTE B1/B8/B9/B19 and also XT1100 B2/B4

As I brought Band3 for NEXUS5, here, we are bringing 4G LTE band1 IMT 2100MHz for users such as, but
not limited to:
China Telecom,
Japan AU/NTT Docomo/Softbank,
Korea LG U+ /SK Telecom,
Philippines Smart,
Thailand DTAC/TrueMove-H
according http://en.wikipedia.org/wiki/List_of_LTE_networks#Asia and more:
Czech Republic Vodafone
Poland Play/P4
according http://en.wikipedia.org/wiki/List_of_LTE_networks#Europe
20150412 UPDATE: we are in Trial of more bands,as attachment names at POST#33:
Band 2 and band 4 for XT1100 View attachment 3257101
and Band 1 and band 8 or Band 1/9/19 or Band 1/8/9/19 for XT1103 View attachment 3257100
I am sorry below English language is not good, it is come from Google Translation^_^ from my Chinese post.
attachment docx is more clear since more detail images can are attched inside:
EN:View attachment 3187257
CN:View attachment 3187214
NEXUS 6 US MOTO XT1103 Band1 Enablement Tutorials
Foreword:
With the US version NEXUS6 XT1103 Chinese users, most of them come for China Telecom
, but is there such a telecommunications in many indoor shopping centers and car parks, do 4G LTE band1 2100MHz coverage, but also greater bandwidth than band3 15MHz with 20MHz bandwidth with China Telecom license.
What is a pity, XT1103 band1 RF front-end is shipped out without factory calibration, so only official usage is [email protected] only for China Telecom.In fact, as NEXUS5 band3 enablement, NEXUS6 RF front-end hardware also left a tiny space to enable it. The following tutorial is the first edition, With more extensive testing,It will needs correction on your demands.
I am sorry I do not have English version computer to reworks the Chinese screen captures,
I believe you have some way to understand around.​
STEP1: using TWRP backup EFS
you can nexus6 of TWRP-Backup-EFS. More insurance after the phone Root, you canalso EFS Professional to backup your original EFS.
Thus, When need to restore the original state , Just use TWRP-Restore- to select the original EFS and slide the button to restore any changed below. ​
STEP2: Install the driver Moto BP Tools Driver
Mobile side: the phone off, then press the power button + volume down key, enter fastboot mode, use the volume keys to select BP Tools, and then turn the power button to confirm. Open usb diag device port.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
View attachment 3187207 View attachment 3187208
1. Connect your phone to your computer, then prompted to install "diag_mdm" drive (or right-click "My Computer" and select "Properties" - "Device Manager" to install "diag_mdm" drive)
2. Right-click on the "diag_mdm", select "Update Driver Software" and then select "Browse my computer for driver software."
3. Select "choose from a list of device drivers in your computer."
4. Select "Show all devices", the "Next" button.
5. select "Disk"
6. Click "Browse"
7. Select the folder where you drive, point to open after selecting "momdm", then OK.
8. Select the "Motorola USB Diagnostic Port", click "Next."
9, warning, Click "Yes"
10, in the Device Manager port as shown below to show that the installation was successful (Note: The port number com93 vary)
​
STEP3: Write qcn
Phone side: the phone off, then press the power button + volume button, enter fastboot mode, use the volume keys to select BP Tools, and then turn the power button to confirm, so you can open the usb diag device port.
1.the installation QPST. Do not use lower version 2.7 build 422, otherwise it will not recognize the device. please find such installation by yourself.
2. open QPST configuration, the first point of Ports tab, select the device displayed, the first point below "remove", Prompt window popuped, and then point "Yes".
3, Chick "Add New Port".
4. Select the port of your device com port, and then "OK" button.
5, open the folder points QPST Software Download, click on "Restore" tab, click Browse to select the desired brush into qcn file:
View attachment XT1100_LTE_B1_To_XT1103_24226_6735_6736_RxAdded_TxOverrided.qcn.zip
(Here, the only difference vs nexus5 enabled band3 ,XT1103 purchased from Google Play, MOTO did not change default SPC, 000000),
Check Allow phone / file ESN mismatch, the final blow: Point Start, Errors box appears Could not Reset the Phone error normal, qcn has finished writing, after using the Power button off, then boot directly out LTE signal, the restart, do not use QuickBoot like Reboot, to ensure safety.
​
FINALLY: Check Whether Band1 Enablement successful methods
Method 1: Insert China telecom USIM cards, confirming a place where band1 with LTE Cell ID can be found with the end of HEX is 00,01,02,03,04,05 of LTE base stations (in the dial-up interface, enter * # * # 4636 # * # *, open "mobile phone information ", the" Set preferred network type "to LET ONLY, and then find the" Location: LAC = 7101 CID = 1924c01 "in this column, the CELL ID is inside this CID.
Method 2: Use the LTE Discovery watch band states.
NOTE: These two methods are there GCI (CID) guessing band, is only applicable to some of operators such as China Telecom, the absence of good planning China Unicom 4G CellID, and also China Mobile is not applicable for this .
[email protected]， we have LTE Discovery update to 3.19， support NEXUS6 display the real MODEM LTE Band!! thanks for Danial and his great team!!
​While you want to Check real band PC tool QXDM may help if you have such tool, menu path is View-LTE- RRC layer-RRC/NAS Status Screen- Frequency band, wait for 10mintues for update or use airplane mode on/off to Tigger update.
In case you are not in LTE covered area, but just want to check the qcn is applied or not, reset your phone in boot loader mode, select BP TOOLS again,them use QXDM-view-NV Browser-Item 06828- read to get the value, it should be 1099830466655 for add band1 while stock default is 1099830466654,
Other qcn XT1103 add:
B1/8 1099830466783
B1/9/19 1099830729055
B1/8/9/19 1099830729183
XT1100 add:
B2/4 1099646632415, @default 1099646632405
Here we must thank:
Q39705630 enthusiastic and efficient testing and Draft this tutorial V0.1 version;
Q562552826 provide XT1103 of qcn file, doing preliminary analysis;
Q386499038 provide XT1100 qcn file, do the final release qcn file parameter reference;​
Other Reference Tutorial IN Chinese:
1. CN version band1 enablement:
http://bbs.gfan.com/android-7863761-1-1.html
2.NEXUS6 RF parameters such as PC-side backup method qcn
http://bbs.gfan.com/android-7741730-1-1.html
3. Some tools on LTE band1 signal monitoring
http://bbs.gfan.com/android-7684876-1-1.html​

。chinese here hei
Sent from my SPH-L720 using XDA Premium 4 mobile app

Could you send the xt1100'qcn to me? Q2954103426 . If I retore xt1100's qcn to xt1103, it only can make xt1103 support band same as xt1100?

Hi, I messed up my NV values and I can't get signal anymore. Can you please post original XT1103 QCN file so we can restore the backup? Thanks.

Done! Working here in philippines smart user here! Thanks OP!

MrDreamSky said:
。chinese here hei
Click to expand...
Click to collapse
Yes. I can not Choose where I was born, But I can choose whether I can contribute.
While American Dream is on the Sky, Chinese Dream is running on the ground even we are weak, I am expecting to contribute for the global. haha

MaxChuang said:
Could you send the xt1100'qcn to me? Q2954103426 . If I retore xt1100's qcn to xt1103, it only can make xt1103 support band same as xt1100?
Click to expand...
Click to collapse
No, you can not enable all the band but some, and it need some technical filtering job,
RF front end hardware is arm and body of RF driver software soul.
I will try to bring band8, but need more weeks to find time gap during my work.

messedupqcn said:
Hi, I messed up my NV values and I can't get signal anymore. Can you please post original XT1103 QCN file so we can restore the backup? Thanks.
Click to expand...
Click to collapse
Please note the normal QPST-Software Download backup qcn will not works for restoring,
and older QPST-RF NV Item manager backuped Qcn can not cover all RF nv now, so it is also not good choice for you to restore Solutions for your issue,
Soution1. In case you only lost your signal after you use 4636-Phone Info-Select UMTS band- US band, Try to set NV00441 to 0xFFFF with this qcn, by QPST-Software Download, an old post is here:
http://forum.xda-developers.com/nexus-6/help/help-locked-nexus-to-usa-band-t2975290/page2
Solution2. for others failture reason, To NEXUS6 reflash the factory images will help to reset all your nv from backup eMMC partition,
How to is here: http://forum.xda-developers.com/nexus-6/general/guide-flash-factory-images-nexus-6shamu-t2954008

Just wondering though, the com should be com93? Ir it could be any digit? Because i got com25 and i still insist it im flashing..it worked but it cannot tell the band im using that should be band 1.

Azlun said:
No, you can not enable all the band but some, and it need some technical filtering job,
RF front end hardware is arm and body of RF driver software soul.
I will try to bring band8, but need more weeks to find time gap during my work.
Click to expand...
Click to collapse
Thanks for your contribution !
I am curious if carrier aggregation can be configured ,too.

Yeah, I would like to know if carrier aggregation can be configured

Azlun said:
Please note the normal QPST-Software Download backup qcn will not works for restoring,
and older QPST-RF NV Item manager backuped Qcn can not cover all RF nv now, so it is also not good choice for you to restore Solutions for your issue,
Soution1. In case you only lost your signal after you use 4636-Phone Info-Select UMTS band- US band, Try to set NV00441 to 0xFFFF with this qcn, by QPST-Software Download, an old post is here:
http://forum.xda-developers.com/nexus-6/help/help-locked-nexus-to-usa-band-t2975290/page2
Solution2. for others failture reason, To NEXUS6 reflash the factory images will help to reset all your nv from backup eMMC partition,
How to is here: http://forum.xda-developers.com/nexus-6/general/guide-flash-factory-images-nexus-6shamu-t2954008
Click to expand...
Click to collapse
Thanks! Is fastboot flash radio enough to restore everything to normal? :laugh:
edit: looks like you have to reflash everything. Oh well.
---------- Post added at 06:28 AM ---------- Previous post was at 06:14 AM ----------
I restored the factory image and it's fine. There's a bug with the current factory image where it doesn't flash system and userdata when you run flash-all.sh, but it seems to have flashed the nv value backup without that. I didn't reflash system and userdata manually so I get to keep my phone without wiping.
Any idea why line 6828 in NV browser says 268501086 in my XT1103? According to LTE band calculator, this means the phone supports band 2/3/4/5/7/17/29. But Google Play says the phone supports 2/3/4/5/7/12/13/17/25/26/29/41. Any idea why this supports seemingly less bands?
Looks like some Moto X have this band configuration, but my Nexus 6 shouldn't. Can someone confirm their stock line 6828?

Will this change stick even after a firmware upgrade, say, after upgrading to Lollipop 5.1?
Is this technique applicable to a D820 Nexus 5 as well?

mimsiroll said:
Just wondering though, the com should be com93? Ir it could be any digit? Because i got com25 and i still insist it im flashing..it worked but it cannot tell the band im using that should be band 1.
Click to expand...
Click to collapse
COMxx is depand on PC, it can be any number.

messedupqcn said:
Thanks! Is fastboot flash radio enough to restore everything to normal? :laugh:
edit: looks like you have to reflash everything. Oh well.
---------- Post added at 06:28 AM ---------- Previous post was at 06:14 AM ----------
I restored the factory image and it's fine. There's a bug with the current factory image where it doesn't flash system and userdata when you run flash-all.sh, but it seems to have flashed the nv value backup without that. I didn't reflash system and userdata manually so I get to keep my phone without wiping.
Any idea why line 6828 in NV browser says 268501086 in my XT1103? According to LTE band calculator, this means the phone supports band 2/3/4/5/7/17/29. But Google Play says the phone supports 2/3/4/5/7/12/13/17/25/26/29/41. Any idea why this supports seemingly less bands?
Looks like some Moto X have this band configuration, but my Nexus 6 shouldn't. Can someone confirm their stock line 6828?
Click to expand...
Click to collapse
1: Is fastboot flash radio enough to restore everything to normal?
Az:I never try, may be you can try when you have enough partition backuped.
2. for nv6828, the stock default is 1099830466654
and after my qcn written, it should be changed to 1099830466655 (add band1)
in fact there is many other nv added and overrided, so a EFS backup before qcn write in is suggested.
I can not understand why your value become an unknow one.
<!-- Add Band1 in LTE bands over XT1103
default 1099830466654 decially = binary:
00000000 00000000 00000001 00000000 00010011 00000001 00011000 01011110B
(band 41 29/26/25 17 13/12 7/5/4/3/2 )
= 1099830466655 decially = binary:
00000000 00000000 00000001 00000000 00010011 00000001 00011000 01011111B
(band 41 29/26/25 17 13/12 7/5/4/3/2/!1!)
** other referenece,
ONLY Band8 = 128
-->
<NvItem id="6828" subscriptionid="0" name="NV_LTE_BC_CONFIG_I" mapping="direct" encoding="dec" index="0">1099830466655,0</NvItem>

Biggster said:
Will this change stick even after a firmware upgrade, say, after upgrading to Lollipop 5.1?
Is this technique applicable to a D820 Nexus 5 as well?
Click to expand...
Click to collapse
1 my NV items will be kept in EFS until a factory restore including erase EFS partition to trigger factory EFS restoring.
so OTA upgrade will be fine, but next factory image whole reflashing will erase nv items in this qcn.
That is MOTO design while LG NEXUS5 have not such issue.
2. NEXUS5 D820 can enabled band3 band8 in the same way if you are in track of http://forum.xda-developers.com/google-nexus-5/general/radio-enable-lte-band-3-nexus-5-d820-t2928561
but qcn in that post will NOT bring CDMA+LTE 1xSRLTE dual-stanby working, it is still in LTE only mode.
why NEXUS6 support 1xSRLTE is come from facotry by default, DI4.0 new modem firmware and trigger by right carrier_policy.xml from m_bing.

Hmm, I seem to remember my line 6828 was the same unknown value before I changed anything. Stock. Then when I flashed your qcn, it became the 1099830466655. I have no idea why my phone came with less bands stock. it is XT1103 Bought from moto US store. no way to test it either, until I am out of the US

Solved.
Anyone know how to get the SPC/MSL code if it's not all zeros? My N6 is Amazon sprint version but I'm using it out of US.
Sent from my Nexus ⑥

XT1100 to XT1103?
Is it possible to convert an XT1100 to an XT1103? Is it a hardware thing?
I would like to enable band 2 and 4 in the XT1100, is that at all possible?
I have both an XT1103 (borrowed) and my own, an XT1100. Could I copy the NV values from the 1103 onto the 1100? Would it cause any damage to try?
I dont mind formatting, but I also don't want a brick.
Thanks,
Sam.

How could I enable LTE band 4? Really thats the only one I need to enable. Any help is much appreciated. I am more than willing to test as well.

[GUIDE] Enable LTE bands on surnia

After some trial and error I was able to successfully enable LTE band 12 on my xt1527 with the 5.1 baseband. This procedure only seems to work with the stock ROM, but then after it's done you might need to install a custom ROM like Cyanogenmod to actually make use of all the bands. Many people have done a lot of previous work to make this possible and they deserve credit, so don't forget to hit thanks on the linked threads. It might be possible to unlock different bands on the different models depending on what the radio will support. I have done my best to try to make sure that this is thorough, but there could be errors, so please let me know if any of the steps need to be revised or corrected.
**** Please note that by doing this it may be possible to permanently damage your phone, make it unable to access mobile networks, or cause radio interference, so you are doing this at your own risk! I am not responsible for any problems! ***
1. Be on a stock ROM (only tested on 5.0.2 and 5.1, see forums for how to restore stock ROM if you need help) Update: also works on 6.0
2. Make sure the Motorola Device Manager is installed https://motorola-global-portal.custhelp.com/app/answers/detail/a_id/88481
3. Select "BP Tools" from the bootloader menu (power off, hold vol-down, power on). The phone will look like it's booting normally.
4. You need to enable usb debugging in developer options. In Windows device manager you should see 3 USB devices without drivers loaded. I picked the first device and updated the driver by selecting Browse computer / Let me pick, and selecting Ports (Com&LPT), Motorola, Motorola QC Diag port. See this post for more info http://forum.xda-developers.com/showpost.php?p=54338876&postcount=3 You should now see Motorola QC Diag Port (COMx)
5. Install QPST and QXDM from steps 4 and 5 in this thread http://forum.xda-developers.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059
6. In QXDM select Communications and you should see the COMx that you saw in Device Manager. Make sure the Target Port has this COM port selected as well. If it's not connecting double check that the driver is still loaded in Device Manager.
7. In the View box select NV Browser towards the top of the list, and in the window that opens choose LTE for Category filter.
8. The value that we want is in location 6828. Click on it and choose Read. Write this number down in case you have a problem! Convert this number to binary (I use Windows calculator) and these are your current LTE bands. Read from right to left and 0 means the band is disabled, 1 is enabled.
For example, the xt1527 has LTE bands 2,4,5,7, and 17 per the Motorola website.
The value in location 6828 is 65626, or 0001 0000 0000 0101 1010‬ in binary.
Code:
Binary Value 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 1 1 0 1 0
Active Bands[B] - - - 17 - - - - - - - - - 7 - 5 4 - 2 -[/B]
All Bands 20 ? ? 17 ? ? ? ? 12 ? ? ? ? 7 6 5 4 3 2 1
As you can see from this example, each bit corresponds to an LTE band being on or off. Different models (xt1521, xt1528, etc.) will obviously have different bands enabled. To help fill in the missing info on the bands please post a reply with your model, the value of 6828, and the bands that your phone supports according to Motorola.
To enable band 12, I changed the bit in that position to a 1 and converted the entire binary number back to decimal.
Code:
Binary Value 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 1 1 0 1 0
Active Bands[B] - - - 17 - - - - 12 - - - - 7 - 5 4 - 2 -[/B]
All Bands 20 ? ? 17 ? ? ? ? 12 ? ? ? ? 7 6 5 4 3 2 1
So this new binary number 0001 0000 1000 0101 1010 = 67674 in decimal.
9. After you have calculated your new value, type it into the 6828 input field and click Write.
10. Reboot to recovery, make a backup of the stock ROM, and then install your favorite custom ROM, such as Cyanogenmod. The stock ROM might still restrict bands even if they have been enabled in the baseband. You can use the LTEdiscovery app to check your bands, and there are probably other apps as well.
11. If you have any problems try writing the original value that you wrote down earlier back into location 6828 (you did write it down, right?). If that doesn't work, see the modem thread, or extract NON-HLOS.bin and fsg.mbn from your stock image and flash them using the following commands in fastboot.
Code:
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
Good luck, and don't forget that with the extended range LTE bands you might have data but not be able to make a voice call. You would have to go into Network settings and change the preferred network type to 3G to make an emergency call. Maybe a future project will be looking into putting the baseband from other SD410 devices that support VoLTE on surnia and then using this method to set the correct bands... Something to think about.
Update 17 Oct, 2016: Unknown bands have been replaced with question marks. Driver and utility installation instructions have been updated.

I think this is a great tutorial! I wonder if by adding the USA band (which I have achieved in the past) other carriers could be used? Just thinking out loud.

hydroman202 said:
I think this is a great tutorial! I wonder if by adding the USA band (which I have achieved in the past) other carriers could be used? Just thinking out loud.
Click to expand...
Click to collapse
It's possible to make changes to 2G/3G bands also, so it might work if you add the right bands and the radio hardware supports the frequencies.

spiked_mistborn said:
It's possible to make changes to 2G/3G bands also, so it might work if you add the right bands and the radio hardware supports the frequencies.
Click to expand...
Click to collapse
First thing i thought..
I was assuming this was a hardware issue more than a software config issue.
I had done similar on phones before too so i see what your doing
but i had no knowledge on doing this with more recent phones.
I use to use com ports with QPST (a Qualcom leaked tool) and some other phone tools..
to clone my one pay/go phone from one company to another or vice versa.
I cloned them back & forth because sometimes i bought the wrong type of minutes LOL
For example i had my favorite phone from Telus and i sometimes used another one from Virgin
Different phones totally Samsung + LG and both ran very different systems too.
But get this..
I actually cloned EVERYTHING.
Data settings + MEID / Phone # and even managed to get free unlimited TX messages which were suppose to be 50 cents each. HAHAHAHA
I told my brother and his wife and they laughed and he said you got it on you?
I pulled out both and he phoned then txt'd me
And both phones received the call and received the TXT simultaneously.
So.. OP
Thanks for the info i might want to play around with that sometime.
I had struggled losing LTE support to on my Canadian Telus phone before after using US retail firmware.
I had to put it into 3G mode
So i am curious if this will actually work properly though.
Just because you change a setting does not necessarily mean there is actual physical hardware support for it.
I learned something i think here cool good work!
I like the manually installing Windows Drivers tip too.
I tried side-loading for the first time the other day and i had to manually install the driver for it to work.
So lets see if people come forward proving this works.. i hope so
EDIT:
I will be clicking Thanks simply for showing me what the "BP Tools" was for hahahha

spiked_mistborn said:
It's possible to make changes to 2G/3G bands also, so it might work if you add the right bands and the radio hardware supports the frequencies.
Click to expand...
Click to collapse
I talked with a sprint rep, according to him, anyone on my particular carrier (sprint), needs an msl code to change two specific values (I can't remember the names right this second) to reprogram it to a different carrier. I'm not sure about it, but there it is if anyone wants to give it a shot. I think one of the values was mdn, if that helps.

Wondering if it works on the Marshmallow update too ?

xpmule said:
I use to use com ports with QPST (a Qualcom leaked tool) and some other phone tools..
...
I will be clicking Thanks simply for showing me what the "BP Tools" was for hahahha
Click to expand...
Click to collapse
QPST will interface with this phone also, but it seems to be out of date because it doesn't read the full range of NV values. It would probably work for making 2G/3G or other changes like you mentioned, but it wouldn't read any LTE related values.
BP tools probably stands for "baseband programming" or something similar.

clee666 said:
Wondering if it works on the Marshmallow update too ?
Click to expand...
Click to collapse
I never updated past the 5.1 bootloader, so I haven't tested it, but if you try booting with the BP tools option and see the 3 devices missing drivers let us know.

spiked_mistborn said:
I never updated past the 5.1 bootloader, so I haven't tested it, but if you try booting with the BP tools option and see the 3 devices missing drivers let us know.
Click to expand...
Click to collapse
Either i am crazy or the new Marshmallow Bootloader removed the Wifi Flash option.
I seen it before on lollipop now i don't on 6.0.

spiked_mistborn said:
I never updated past the 5.1 bootloader, so I haven't tested it, but if you try booting with the BP tools option and see the 3 devices missing drivers let us know.
Click to expand...
Click to collapse
I never updated away from 5.0.2, I didn't wan't to lose LTE Band 12.

clee666 said:
I never updated away from 5.0.2, I didn't wan't to lose LTE Band 12.
Click to expand...
Click to collapse
Before doing this I had gone back to the 5.0.2 baseband to get band 12 back, but the wifi reboot issues were starting to get annoying. Being able to add band 12 to the later basebands is nice because I don't have the wifi reboot issues and it's much more stable.

This guide is awesome

Can activate all bands? xD or is bad idea?

Anyone managed to use the Verizon version on T-Mobile band 12?

clee666 said:
I never updated away from 5.0.2, I didn't wan't to lose LTE Band 12.
Click to expand...
Click to collapse
I don't remember if I did or not, is there anyway to check for LTE Band 12 to see if I still have it?
And if I did is there any way to restore it?
---------- Post added at 06:23 PM ---------- Previous post was at 06:17 PM ----------
spiked_mistborn said:
Before doing this I had gone back to the 5.0.2 baseband to get band 12 back, but the wifi reboot issues were starting to get annoying. Being able to add band 12 to the later basebands is nice because I don't have the wifi reboot issues and it's much more stable.
Click to expand...
Click to collapse
Can I reflash the original stock rom to get baseband 12 back, before installing a cyanogenmod update?

dreyeth said:
I don't remember if I did or not, is there anyway to check for LTE Band 12 to see if I still have it?
And if I did is there any way to restore it?
Click to expand...
Click to collapse
You can use an app like LTE Discovery to check when you are in a known band 12 area. I have an area near me that I drive through frequently surrounded by farms where I get a strong band 12 signal, but basically no service if I just have band 4. You could also check the value in NV location 6828 and use the method in the OP to calculate your current LTE bands.
dreyeth said:
Can I reflash the original stock rom to get baseband 12 back, before installing a cyanogenmod update?
Click to expand...
Click to collapse
That should work, but CM13 works best with 5.1 and newer basebands. You will likely have wifi and reboot issues. That was the whole reason for finding a way to add band 12 to newer basebands.

ijasonx said:
Can activate all bands? xD or is bad idea?
Click to expand...
Click to collapse
Probably a bad idea. The RF hardware in the phone can only physically support a few different frequencies, and it might vary by model, so probably only Motorola and Qualcomm know what will actually work. Best case if you try to activate all bands would be you just don't get a signal, worst case maybe you melt something in the phone radio, or get agents from your government radio frequency enforcement agency show up in black vans and take you away.

realdreams said:
Anyone managed to use the Verizon version on T-Mobile band 12?
Click to expand...
Click to collapse
Are you getting LTE band 4 on T-Mobile currently? It might work. If you try it let us know.

spiked_mistborn said:
You can use an app like LTE Discovery to check when you are in a known band 12 area. I have an area near me that I drive through frequently surrounded by farms where I get a strong band 12 signal, but basically no service if I just have band 4. You could also check the value in NV location 6828 and use the method in the OP to calculate your current LTE bands.
That should work, but CM13 works best with 5.1 and newer basebands. You will likely have wifi and reboot issues. That was the whole reason for finding a way to add band 12 to newer basebands.
Click to expand...
Click to collapse
Did everyone have them? and across all the various original modem firmware?
Also amongst the firmware that have band 12 is there one that was more up to date then the others?
Band 12 got stripped out of all the 5.1 firmware and all the 5.0 or older firmware had band 12, which probable
means no right?

dreyeth said:
Did everyone have them? and across all the various original modem firmware?
Also amongst the firmware that have band 12 is there one that was more up to date then the others?
Band 12 got stripped out of all the 5.1 firmware and all the 5.0 or older firmware had band 12, which probable
means no right?
Click to expand...
Click to collapse
Band 12 was and still is active on the XT1526.
Band 12 was active on the XT1527's launch firmware, but was removed in the first OTA update.
The other models did not have Band 12.

Asus Laser ZE551KL (Z00T) - add LTE Band 12

In order to make this good phone great it needed two things:
1. VoLTE - that was added by the MM update
2. For US, T-Mobile needs also the LTE band 12. This is VERY close to B17 (both 700MHz bands, blocks "a,b" for 12 and "b" for 17) so enabling it in the radio might work (analog side allowing the extra band). Asus filled with FCC test reports that show Band 12 as "passed" the testing. And somehow choose not to enable it.
What I did for now. I downloaded a package from around here that contains the Qualcom diag software QPST and QXDM Pro. Search for them.
1. Enable USB Debugging on the phone. Plug in the phone and the diag drivers will install (I'm on Windows 10 here, I have installed previously the drivers from Asus). Now the diag mode can be enabled in ADB:
ADB shell (should connect to the phone)
setprop sys.usb.config diag,adb
2. After drivers install automatically (Windows 10), the QPST server recognize the phone on COM4
3. Now the QXDM Pro can read the NV values. I am interested in LTE part - add B12. I recalculated the values for existing ones against the published specs and they matched, so the software that calculate the values seemed to work correctly. For LTE bands 1,2,3,4,5,7,8,17,20 the NV 06828 value is 590047. IMO nothing else need to change in the other sections of NV.
4. Calculated the new value with the band 12 added. New value that resulted is 592095. Insert the value in the field, pressed "Write". Then pressed "Read" and the value was there. Cool, now is time to reboot the phone, to activate the new value.
5. Phone rebooted, nothing different. Read again the NV 06828 and... it's back to the original value! Seems that at reboot the firmware rewrites that value. Not cool!!!
Now I am not sure if the drivers prevent the actual write to the chip or if the firmware re-writes at boot time the OE values.
Luk1337 stated that "/system/bin/rmt_storage overwrites the settings".
Maybe someone can patch that?
PS: This was my inspiration: http://forum.xda-developers.com/showpost.php?p=56577252&postcount=455

If someone is able to enable Band 12 in the firmware, do you think T-Mobile's network will recognize that a ZE551KL running Asus's official version of MM has VoLTE support and immediately allow those phones to use Band 12?

Yes, it has VoLTE now (CM13 too), it is just missing the B12 for T-Mobile.
LE: On CM13 Enhanced LTE is available starting with the 20160707 nightly.

SoNic67 said:
Yes, it has VoLTE now (CM13 too), it is just missing the B12 for T-Mobile.
Click to expand...
Click to collapse
We don't have VoLTE in CM fyi. You just had a testing build with it.

Sorry. Forgot that I was special . I was using lately the SIM in my other phone (that has band 12), so I didn't noticed.
PS: It's the future though, every carrier wants to get rid of all different standards and simplify - LTE equipment is common for everyone.

Update:
Since I had another Snapdragon device, I decided to try it on that too. It's an Alcatel Onetouch Fierce XL sold by MetroPCS (T-Mobile network in US) - Snapdragon 210, MSM8909, Alcatel 5054N. The FCC registration for that phone shows LTE bands 2, 4, 5, 7, 12. The phone has natively Enhanced LTE which include VoLTE and HD audio. Also it has WiFi calling.
Good stuff.
I tried the same procedure as above and read the NV06828. In the MetroPCS phone this was 2058. Using the calculator I find out that the active bands are only 2, 4, 12 (the bands that T-Mobile operates).
Well, band 5 and 17 are needed for AT&T/Cricket (well maybe I needed to add only 5, since AT&T was forced recently by FCC to allow band 12 devices on it's band 17 and they even started selling band 12 devices).
So I did go ahead and change the NV06828 with the new value. Write, Reboot, Read... The setting "sticked"! Now, I don't have a way to test the actual functionality since I would need a Cricket SIM and drive away in a area served only by band 5, but I have a feeling that it will work (because FCC registration includes that band, I assume that the hardware can handle it).

The stock FW, when presented with the "setprop sys.usb.config diag,adb", it just closes the ADB connection, so I cannot enter diag mode like in CM13.

UPDATE: Since I have moved today to AT&T, I don't need the B12 anymore.
However, the stupidity of Asus is overwhelming - the FCC testing letter includes the B12 (passed) for the ZE551KL (Z00TD):
https://apps.fcc.gov/oetcf/eas/reports/GenericSearch.cfm
Search for the FCCID: MSQ Z00TD and hit one of the 700MHz reports. You will get the attached pdf.

Even if OP gave up, some people like me still wants to enable some bands back too.
If you find something, please post (guides, clues, etc) it here.
SoNic67 said:
UPDATE: Since I have moved today to AT&T, I don't need the B12 anymore.
However, the stupidity of Asus is overwhelming - the FCC testing letter includes the B12 (passed) for the ZE551KL (Z00TD):
https://apps.fcc.gov/oetcf/eas/reports/GenericSearch.cfm
Search for the FCCID: MSQ Z00TD and hit one of the 700MHz reports. You will get the attached pdf.
Click to expand...
Click to collapse
It's stupid for clients like us for sure, but for Asus it's market segmentation and planned obsolescence.

I'm the OP. I have asked a support question and Asus said this:
Sorry for the inconvenience and I'll convey your request to the related department for further help on this issue.
Click to expand...
Click to collapse
Whatever...

I have decided to sell my Asus. Sure, I lost money by doing this (the guy who bought it is happy about that I guess), but I now know better than buy from Asus anything. I thought it will be a great unlocked phone, but Asus managed to screw it up for me in several ways. They might fix this issue in later firmware updates, or they might not. I just don't have patience.
It might be a great phone for many users around here, more power to them.
PS: For future reference, those are the original NV values:
Code:
For Asus ZE551KL (Z00TD)
ID Description Name Category Size Value
01877 RF Band Configuration rf_bc_config CDMA 64 562950069289856
00441 Band Class Preference band_pref CDMA 8 0
16 0x380
00946 Expand Band Preference band_pref_16_31 System 8 0
16 0x0EE8
02954 Bits 32 to 63 Of Band Pref band_pref_32_63 System 8 0
32 268566528
06828 LTE BC Config LTE_BC_CONFIG_type.lte.config UINT64 64 590047
LTE_BC_CONFIG_type.lte.config_extUINT64 64 0
06829 LTE BC Config DIV lte_bc_config_div UINT64 64 0
UINT64 64 0
Change to add B12 (but reverts to stock at reboot):
06828 592095

SoNic67 said:
I'm the OP. I have asked a support question and Asus said this:
Whatever...
Click to expand...
Click to collapse
Obviously some pure bull**** from Asus...
SoNic67 said:
I have decided to sell my Asus. Sure, I lost money by doing this (the guy who bought it is happy about that I guess), but I now know better than buy from Asus anything. I thought it will be a great unlocked phone, but Asus managed to screw it up for me in several ways. They might fix this issue in later firmware updates, or they might not. I just don't have patience.
It might be a great phone for many users around here, more power to them.
PS: For future reference, those are the original NV values:
Code:
For Asus ZE551KL (Z00TD)
ID Description Name Category Size Value
01877 RF Band Configuration rf_bc_config CDMA 64 562950069289856
00441 Band Class Preference band_pref CDMA 8 0
16 0x380
00946 Expand Band Preference band_pref_16_31 System 8 0
16 0x0EE8
02954 Bits 32 to 63 Of Band Pref band_pref_32_63 System 8 0
32 268566528
06828 LTE BC Config LTE_BC_CONFIG_type.lte.config UINT64 64 590047
LTE_BC_CONFIG_type.lte.config_extUINT64 64 0
06829 LTE BC Config DIV lte_bc_config_div UINT64 64 0
UINT64 64 0
Change to add B12 (but reverts to stock at reboot):
06828 592095
Click to expand...
Click to collapse
Thanks for the reply and sorry for the delay !
How did you find these values ? Do you have any sources ?
My guess is your modifications always gets erased on reboot because something is write-protected like the RIL, RUU (HTC), CSC (Samsung), etc. It happens on most branded phones an that's a real bummer.
So the next step would be to unlock that part, unfortunately I'm only able to do that on branded HTCs and Samsung phones. But there may be a generic way to do it through adb shell or fastboot for not branded phones ?
Edit: The closest way I've found for that comes from that topic: http://forum.xda-developers.com/zenfone-2-laser/help/ze550kl-stuck-edge-modem-reflashing-t3427402

Values are read by me from my device and hand written in a file.
However, like I said above, I have moved on (to a Moto G4 Plus)...

SoNic67 said:
Values are read by me from my device and hand written in a file.
However, like I said above, I have moved on (to a Moto G4 Plus)...
Click to expand...
Click to collapse
Oh sorry, by sources I mean do you have any links showing you how to change these values ?
Same for links showing you what are the values, where the files are, etc.
Anything is good

First post.

is there a way today to unlock all bands. i just bought the zenfone 2 laser, i can install cyanogenmod 13 on it, but is there a tutorial how to unlock bands once i install cyanogenmod 13?
thank you
Ben