Hello, everyone! I was hoping maybe you could give me your opinion on the following issue:
About a year ago I purchased a Moto X Play XT1562 in Europe with dual sim support (Asian ROM). I knew beforehand that I'd probably have limited LTE coverage in my country (Argentina), since the bands used by carriers here are B4 and B28, and XT1562 only supports B28 (which is used mostly for coverage in suburbs and rural areas). Band 4 is the main band used in Argentina for LTE coverage in cities and XT1563 is the model that supports it.
For quite some time I've had the theory that most phones should support more bands than they show, and that the differences between various models of the same phone are there to introduce region restrictions, which in turns means that some LTE bands are disabled and that it should be possible to somehow enable them by tweaking the software. For what I've read, there seems to be some support for my theory: there's a thread in this very same forum which claims that it should be possible to unlock all LTE bands in devices with Qualcomm processors by rooting the phone, installing a custom ROM and kernel and changing a few values.
LINK: https://forum.xda-developers.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059
Now, I'd really want that to be the last thing I try. I've rooted my phone before and I even unrooted it by flashing stock ROM, so I know my way around, but flashing a custom ROM and kernel are things I'd rather not do right now.
So, that brings me to my second theory: since XT1562 and XT1563 are basically the same device, their hardware specifications are the same and only differ in the LTE bands they support... and since LTE bands seem to be software-restricted...
1) Could it be possible to unlock Band 4 by flashing XT1563 stock ROM to my XT1562 Moto X Play?
2) Has anyone tried to do that (even by mistake) without bricking the device?
3) If there's no option but to flash a custom ROM and kernel, does anyone know for sure if LTE bands in Moto X Play are software restricted? Or is there a hardware limitation?
Probably my secornd theory won't work because I don't think the solution would so simple, and there would be threads about it... but I guess I don't lose anything by asking
Thank you!! =)
Just realized this thread shouldn't go in General. Could someone please move it to Q&A? Thanks!
The frequency bands that your phone supports is region specific (as you guessed) and has legal implications. And just like your device IMEI, these values are found in the non-volatile memory of your phone. The values are basically on partitions that are much secure and not so easily editable (like by fastboot or recovery). But nevertheless, the values are "software" only, and so it must be possible to edit the values anyway (just like it is possible to edit the IMEI), one way of doing so is using Qualcomm software as in the link you had posted.
But this varies from device to device, vendor to vendor, so your second theory could actually work on our phones (really don't think so though).
While it might be possible to run ROMs for XT1563 on XT1562, the baseband/ modem for XT1563 would not work on XT1562; it would probably make your device show "unknown" for IMEI, and so you would get no SIM network. Flashing back the modem for XT1562 would probably fix it.
You could always try and find out...
You would need the NON-HLOS.bin and fsg.mbn files from the XT1563 stock image to try, and the same files from the XT1562 stock to revert back.
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
There's chance that you would be stuck with an "unknown" IMEI and then you would have to manually edit volatile memory values after all. This all is just theory, someone who has tried or someone who has more knowledge will be able to help you better.
DragonClawsAreSharp said:
The frequency bands that your phone supports is region specific (as you guessed) and has legal implications. And just like your device IMEI, these values are found in the non-volatile memory of your phone. The values are basically on partitions that are much secure and not so easily editable (like by fastboot or recovery). But nevertheless, the values are "software" only, and so it must be possible to edit the values anyway (just like it is possible to edit the IMEI), one way of doing so is using Qualcomm software as in the link you had posted.
But this varies from device to device, vendor to vendor, so your second theory could actually work on our phones (really don't think so though).
While it might be possible to run ROMs for XT1563 on XT1562, the baseband/ modem for XT1563 would not work on XT1562; it would probably make your device show "unknown" for IMEI, and so you would get no SIM network. Flashing back the modem for XT1562 would probably fix it.
You could always try and find out...
You would need the NON-HLOS.bin and fsg.mbn files from the XT1563 stock image to try, and the same files from the XT1562 stock to revert back.
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
There's chance that you would be stuck with an "unknown" IMEI and then you would have to manually edit volatile memory values after all. This all is just theory, someone who has tried or someone who has more knowledge will be able to help you better.
Click to expand...
Click to collapse
Thank you for your kind reply =)
So, if I understood correctly, there's no need to flash the full XT1563 stock image. I'd just have to flash those two files from XT1563 stock rom, and then if it doesn't work then I'd just flash the XT1562 files again, which I already have. Seems worth to try and with low risk of bricking my phone.
Now, if that doesn't work, then my only option would be to use the other method. I don't want to try that one yet because I don't have everything figured out: I'm stuck in step 6, "Open the USB settings screen on your phone." I haven't yet found the correct code to input in the phone's dial screen to edit USB settings. I think in Android 6 the USB options have all been moved to developer mode, but I'm not 100% sure yet.
floydian86 said:
Thank you for your kind reply =)
So, if I understood correctly, there's no need to flash the full XT1563 stock image. I'd just have to flash those two files from XT1563 stock rom, and then if it doesn't work then I'd just flash the XT1562 files again, which I already have. Seems worth to try and with low risk of bricking my phone.
Now, if that doesn't work, then my only option would be to use the other method. I don't want to try that one yet because I don't have everything figured out: I'm stuck in step 6, "Open the USB settings screen on your phone." I haven't yet found the correct code to input in the phone's dial screen to edit USB settings. I think in Android 6 the USB options have all been moved to developer mode, but I'm not 100% sure yet.
Click to expand...
Click to collapse
At step 6, you are basically trying to connect the phone to your PC in a vulnerable mode (Modem + Diag mode) so you could access the NV. On Moto phones this is not really possible by dialing a service code I think.
Did you try to boot your phone in BP tools (or QCOM?) mode from fastboot? Then connect to PC and it should be connected in diag mode (check in Device Manager to confirm). You might need some specific drivers, see last thread, or may be Google.
There is a lot of discussion about this on the internet (for other devices, mostly). Mostly because people with locked devices that work only on specific carriers use a similar edit of values in NV of the phone to get out unlocked.
I think you should Google and try out some of the things people have been suggesting.
Read here, post number 21, for example (the entire thread is pretty informative): https://forum.xda-developers.com/moto-x/moto-x-qa/unlock-lte-bands-moto-x-t2933475/
And here (for Moto X Play),
http://forum.xda-developers.com/moto-x-play/help/trouble-writing-nv-settings-moto-x-play-t3368261
Edit: Most of these NV and QPST threads do seem to repeatedly point out that writing on the NV is extremely risky.
DragonClawsAreSharp said:
At step 6, you are basically trying to connect the phone to your PC in a vulnerable mode (Modem + Diag mode) so you could access the NV. On Moto phones this is not really possible by dialing a service code I think.
Did you try to boot your phone in BP tools (or QCOM?) mode from fastboot? Then connect to PC and it should be connected in diag mode (check in Device Manager to confirm). You might need some specific drivers, see last thread, or may be Google.
There is a lot of discussion about this on the internet (for other devices, mostly). Mostly because people with locked devices that work only on specific carriers use a similar edit of values in NV of the phone to get out unlocked.
I think you should Google and try out some of the things people have been suggesting.
Read here, post number 21, for example (the entire thread is pretty informative): https://forum.xda-developers.com/moto-x/moto-x-qa/unlock-lte-bands-moto-x-t2933475/
And here (for Moto X Play),
http://forum.xda-developers.com/moto-x-play/help/trouble-writing-nv-settings-moto-x-play-t3368261
Edit: Most of these NV and QPST threads do seem to repeatedly point out that writing on the NV is extremely risky.
Click to expand...
Click to collapse
Thanks again!
So, I flashed the XT1563 modem files. It took me a while because when I unrooted my phone, I also locked the bootloader (I honestly don't know why I did it), so I had to unlock it again and of course make a back-up.
While at first it seemed that I'd be stuck with "unknown" IMEI just as you said, after a minute or so both sim cards started working. I still don't know if it worked, though, because I haven't yet seen the 4G sign on my phone, but I did notice a change: after flashing the files I started getting the H+ sign (H was the best I'd get before, both here and in Europe, even after flashing an XT1562 stock image). So, it wasn't a complete waste of time
It could be that LTE reception is just bad where I live, but I doubt it because other phones have 4G connection here. I'll see what happens tomorrow in another place, but but most likely I'll have to try with a custom image and kernel, so I'll take a look at the links you have provided.
EDIT: in Europe the best I'd get was 4G, of course. What I wanted to point out was that H was the best 3G connection I'd get anywhere.
floydian86 said:
Thanks again!
So, I flashed the XT1563 modem files. It took me a while because when I unrooted my phone, I also locked the bootloader (I honestly don't know why I did it), so I had to unlock it again and of course make a back-up.
While at first it seemed that I'd be stuck with "unknown" IMEI just as you said, after a minute or so both sim cards started working. I still don't know if it worked, though, because I haven't yet seen the 4G sign on my phone, but I did notice a change: after flashing the files I started getting the H+ sign (H was the best I'd get before, both here and in Europe, even after flashing an XT1562 stock image). So, it wasn't a complete waste of time
It could be that LTE reception is just bad where I live, but I doubt it because other phones have 4G connection here. I'll see what happens tomorrow in another place, but but most likely I'll have to try with a custom image and kernel, so I'll take a look at the links you have provided.
EDIT: in Europe the best I'd get was 4G, of course. What I wanted to point out was that H was the best 3G connection I'd get anywhere.
Click to expand...
Click to collapse
Dial *#*#4636#*#* (4636 stands for INFO) on dialer and you can select LTE only from network modes to force 4G detection. In this mode, it will pick 4G network (4G only, even if its weak), whenever it's available.
To really check supported bands by your phone, I think you would need to use the QPST app, it was possible earlier by *#*#SERVICE#*#*, the service menu. Maybe somewhere in *#*#2486#*#*?
Edit: I can think of two scenarios now. The sad one... while you flashed the XT1563 modem (that supports LTE Band 4, 8, etc. (values on the lower row, check attached), your NV still says it supports 19 and 8 and so on (not 4). This could mean you are now able to use only 8 (and the other common bands supported by the two variants) and neither of 19 or 4.
Or, Moto X Play decides which bands it supports depending only on the modem files, and you actually managed to get working LTE band 4 on your XT1562. .
DragonClawsAreSharp said:
Dial *#*#4636#*#* (4636 stands for INFO) on dialer and you can select LTE only from network modes to force 4G detection. In this mode, it will pick 4G network (4G only, even if its weak), whenever it's available.
To really check supported bands by your phone, I think you would need to use the QPST app, it was possible earlier by *#*#SERVICE#*#*, the service menu. Maybe somewhere in *#*#2486#*#*?
Edit: I can think of two scenarios now. The sad one... while you flashed the XT1563 modem (that supports LTE Band 4, 8, etc. (values on the lower row, check attached), your NV still says it supports 19 and 8 and so on (not 4). This could mean you are now able to use only 8 (and the other common bands supported by the two variants) and neither of 19 or 4.
Or, Moto X Play decides which bands it supports depending only on the modem files, and you actually managed to get working LTE band 4 on your XT1562. .
Click to expand...
Click to collapse
I did try to select LTE only, but it didn't work.
I also tried using service menu, but I didn't find any of the tests to be useful to check which LTE bands are supported.
About the scenarios you propose, I also thought maybe all I achieved was to restrict LTE bands to the ones supported by both models :S. At work my phone picks band 28, but both models support it, so there's no way to check it by discarding...
There's a third possibility, though, which is that both models' modems are exactly the same and bands are only limited by NV.
After work I'll see which custom roms and kernels are there for X Play and start studying the process to edit NV. Still it might not be possible to do so because the post claims that rom and kernels must be compiled from source code, so the ones made from stock won't work... That means I depend on there someone making a rom and kernels that meet those requirements.
In the second link, the person says he can't save the changes he makes to the NV, which is what is supposed to happen if you're using stock rom and kernel, according the link I've shared.
So, I ended up editing the NV in order to remove Band 4 restriction. It took me a while because I had to figure out how to bypass all the obstacles I found on the way but, once everything was set up, the process was quite simple.
I had to boot my phone in BP Tools mode and configure the QC Diag port driver correctly. Also, I had to use a newer version of QPST because the one I donwloaded first didn't work.
The tutorial claims that your phone must be rooted and that you need a custom rom and kernel in order to avoid the "anti-tamper" mechanisms in newer Qualcomm devices. My first approach was not to do such things (i.e.: unrooted phone with stock rom and kernel).
I edited the NV values as suggested in order to enable Band 4. The good news are that the custom values that I added didn't revert back to the original ones after I rebooted and also that I didn't brick my phone and it's working properly
Right after I rebooted my phone, it picked 4G signal, but after just a few seconds it switched to H. I forced my device to LTE only, and it connected to 4G, but then again it completely lost signal. My phone does pick LTE Band 28 sometimes, but not at my place, so I thought that I must have been picking up Band 4 (I tried to leave it set to LTE only, but it picked no signal at all).
Also, when I'm at work, it sometimes picks Band 28, but signal must be very weak because it never lasts more than a few minutes, after which goes back to H.
So far I'm not sure if the mod worked because I can't find a way to see which bands my phone currently supports or which LTE band it's connected to. I tried an app called LTE Discovery, but it labels it as "unknown band" (I suspect that my phone needs to be rooted in order for that feature to work).
Right now, I'm thinking of three possible things that could have happened:
1) The mod worked and LTE signal is just very poor by my place.
2) It worked and it connected to Band 4 for a few seconds, but then the anti-tamper mechanism detected that situation and software-blocked it (without reverting NV changes I made). In this case, I'll have to flash a custom kernel and see what happens.
3) There's a hardware limitation after all, in which case there's nothing I can do (I don't think this is the case)
Right now I'm at work and my phone has been picking up 4G for over an hour already. Since it usually only lasts a few minutes (connected to Band 28), then I guess there are reasons to be optimistic that it worked after all and it is currently using Band 4.
If I succeed, I'll open a new thread with a tutorial for Moto X Play.
I'll keep updating my progress on the issue in order to leave a record of everything I tried. Also, it could be helpful to other people who are trying to do the same thing or maybe someone who has done this before will see this and point me in the right direction . Again, if I succeed I'll write a more detailed guide.
I can confirm that what I did so far didn't work, I've modified the necessary NV values and even flashed Squid kernel, but still no success: I'm definitely not picking Band 4 anywhere, only Band 28.
While flashing the custom kernel, I also wanted to use the opportunity to root my phone, but for some reason I soft-bricked it in the process, so I had to flash XT1562 stock rom again (with XT1563 modem). This reverted the NV values to the default ones, so I had to customize them again.
The user fffft says that custom rom and kernel are needed in order to avoid the anti-tamper code, but also that it is most likely in the kernel. I could try another kernel, maybe Phoenix, but if that doesn't work either, then we can confirm that the anti-tamper code is actually in stock rom.
This leaves three final possibilities to succeed in unlocking LTE Band 4:
_Flashing another custom kernel
_Flashing a custom rom
_Flashing the whole XT1563 stock rom, as I proposed at first, and see what happens. If this works, this should both set the NV values to enable XT1563 default LTE bands (which includes Band 4) and also set a different anti-tamper code, which should not bother. Worst case scenario I'll soft-brick my phone again and I'll have to flash XT1562 rom.
Daily update:
First thing I tried yesterday was what I wanted to do from the beginning, which is to flash the whole XT1563 rom on XT1562. Kids, don't try that at home! At first it looks like it's working and that the device is going to boot normally, but then it gets stuck in the apps configuration screen or after the boot animation.
The only thing left now was to try with a custom rom, so I flashed Cyanogenmod 13 and Squid kernel. This, however, brought other issues: for some reason, when booting the phone in BP tools mode or Qcom, the device's QC Diag Port isn't detected by PC. It seems to be something implied to happen with custom roms: https://forum.xda-developers.com/moto-g-2014/help/diagnostic-mode-moto-g-flashing-cm-12-1-t3254756
Has this happened to any of you? Is there a way around it?
I also found this: http://www.howardforums.com/showthread.php/1692461-HTC-Evo-and-Cyanogenmod-Diagnostic-mode
There they mention that changes should be made on stock image and just then install the custom rom. That would mean to flash stock image, then change the required NV values, and finally install the custom rom.
That makes some sense, but unless I can find a way to enable Diag mode on Cyanogenmod, this will be the last thing I try and if it doesn't work then I'll give up
floydian86 said:
Daily update:
First thing I tried yesterday was what I wanted to do from the beginning, which is to flash the whole XT1563 rom on XT1562. Kids, don't try that at home! At first it looks like it's working and that the device is going to boot normally, but then it gets stuck in the apps configuration screen or after the boot animation.
The only thing left now was to try with a custom rom, so I flashed Cyanogenmod 13 and Squid kernel. This, however, brought other issues: for some reason, when booting the phone in BP tools mode or Qcom, the device's QC Diag Port isn't detected by PC. It seems to be something implied to happen with custom roms: https://forum.xda-developers.com/moto-g-2014/help/diagnostic-mode-moto-g-flashing-cm-12-1-t3254756
Has this happened to any of you? Is there a way around it?
I also found this: http://www.howardforums.com/showthread.php/1692461-HTC-Evo-and-Cyanogenmod-Diagnostic-mode
There they mention that changes should be made on stock image and just then install the custom rom. That would mean to flash stock image, then change the required NV values, and finally install the custom rom.
That makes some sense, but unless I can find a way to enable Diag mode on Cyanogenmod, this will be the last thing I try and if it doesn't work then I'll give up
Click to expand...
Click to collapse
On step 14 of the first post you shared, it says you could check the active bands on your phone. Do you see something useful there?
AFAIK, once you successfully edit the NV Memory, the changes are there to stay, even if you reflash stock ROM.
I can confirm one thing. BP tools + stock ROM gives you diag mode, but that doesn't work on AOSP based ROMs. And it seems not even on CM based ROMs. However it should be easier to do it on custom ROMs, try enabling and looking into Developer Options. Or may be some service code in phone app?
https://forum.xda-developers.com/showthread.php?t=1626638
On my phone running an AOSP based ROM, I have files that indicate a possible diag mode at /system/sys/class/Android_USB. Need to dig in more.
If you are not able to get your phone connect in diag mode successfully, the route I would now suggest is this:
1. Flash stock ROM (for XT1562)
2. Flash custom kernel
3. Root the stock ROM (use Magisk)
4. Edit NV Values, make sure it is successfully done (step 14 on the first post you shared?).
5. Check if its working.
6. Format /system, /data, and cache partitions, and flash ROM. So your baseband files (and ofc NV memory) is not affected.
7. Try again.
DragonClawsAreSharp said:
On step 14 of the first post you shared, it says you could check the active bands on your phone. Do you see something useful there?
AFAIK, once you successfully edit the NV Memory, the changes are there to stay, even if you reflash stock ROM.
I can confirm one thing. BP tools + stock ROM gives you diag mode, but that doesn't work on AOSP based ROMs. And it seems not even on CM based ROMs. However it should be easier to do it on custom ROMs, try enabling and looking into Developer Options. Or may be some service code in phone app?
https://forum.xda-developers.com/showthread.php?t=1626638
On my phone running an AOSP based ROM, I have files that indicate a possible diag mode at /system/sys/class/Android_USB. Need to dig in more.
If you are not able to get your phone connect in diag mode successfully, the route I would now suggest is this:
1. Flash stock ROM (for XT1562)
2. Flash custom kernel
3. Root the stock ROM (use Magisk)
4. Edit NV Values, make sure it is successfully done (step 14 on the first post you shared?).
5. Check if its working.
6. Format /system, /data, and cache partitions, and flash ROM. So your baseband files (and ofc NV memory) is not affected.
7. Try again.
Click to expand...
Click to collapse
Thanks!
When I edited the NV, the changes were saved (I closed QPST and QXDM, then rebooted my phone and checked the values). However, when I flashed stock rom, the values reverted to the original ones. I also thought that shouldn't happen, but nevertheless it did :S
About getting Diag mode on custom roms, I took a quick look at developer options but I didn't see anything useful. I read a few posts that claim it can be done using a terminal emulator, so there has to be a way around it.
The steps you mention are the ones I had in mind, except for rooting. Do you think it's really necessary? (phone will be rooted after flashing custom rom, anyway).
I'll try it tonight and see what happens =)
EDIT 1: If I understood correctly, step 14 of the thread I've shared is only for 3G bands, so I don't need to change anything there. LTE bands NV's can only be seen and modified using QXDM and that's where I checked if the changes were saved. However, I have seen that there are a few holes in the tutorial, some of which I had to figure out myself. Maybe there's one extra step I'm missing on QPST? Step 24 seems to indicate otherwise.
EDIT 2: I've found this thread. It's about a Lenovo phone, but chances are they are the same: http://www.teamsuperluminal.org/forums/topic/open-diag-port-in-cm-12-1-for-qpst/
This is what it says: "To open the diag port, connect the phone to a PC and use ADB:
adb shell
su
setprop sys.usb.config diag,adb"
Changing the NV and then flashing custom ROM didn't work (I deleted system, data and cache before but still didn't work).
I tried enabling diag mode using ADB with the code I found but it didn't work. No diag port gets enabled.
I'm ready to give up. It seems it can't be done, at least not on X Play
Unless maybe someone know how to use diag mode on Moto X play running Cyanogenmod?