I was planning to get a new phone with a great display, and that was exactly when RP2 went on sale. I'm otherwise satisfied with the phone, but single SIM is definitely a deal breaker in China. Given that I could not find any other phone matching my criteria, I decided to get the RP2 and tried to enable dual SIM on it. Till now I've had some success, and here is what I have done.
If you have strong demand for dual SIM like I do, you may try these steps. This thread, however, is NOT a proper nor complete guide on this topic. It is just a record of my trials - they are highly experimental, risky, and potentially broken. There is absolutely no guarantee on signal quality, stability, power consumption or even the success rate. Your device can be permanently damaged if any detail goes wrong. Make sure you understand all the risks and you are able to justify every command before typing it to your phone!
I do appreciate suggestions for the correct way, though. Comments are greatly welcomed!
My environment
QPST 2.7.477 - only PDC is used here, so any version with standalone PDC tool might do the job. But new versions required if you want to use other tools.
QXDM Professional 3.14.1144 - this one is optional. It's used to tweak some parameters, but dual SIM does work without the tweaks.
Qualcomm USB drivers 2.1.2.0 from 2015/7/8 - older versions might work as well.
Windows 10, 1803
arter97's kernel and Magisk-patched stock kernel images readily at hand. The latter can be obtained by patching a stock kernel image in Magisk Manager with "Keep dm-verity/avb 2.0" UNTICKED. I had the latter installed on the phone.
Make sure root shell can be obtained during boot with ALL kernel images. This is an important recovery approach if the phone bootloops.
Steps
I've gone through a tricky path to confirm that there is indeed a second IMEI in the phone prior to the steps, which supported follow-up researching. This thread will not cover this part as this is merely trial-and-error. I will provide suggestions on diag connection though.
1. make a backup of all partitions on the phone, leaving out system, vendor and userdata partitions of course. There are 88 partitions in my backup.
2. make a QCN backup of modem NV. This step could be optional as modemst1/2 has already been backed-up in previous step - I'm not sure about this, and have completed this step whatsoever.
3. make a backup of /vendor/etc/vintf/manifest.xml, and add slot2 instances to the following HALs:
android.hardware.radio - this one has 2 interfaces, and both of them need the slot2 addition
vendor.qti.hardware.radio.am
vendor.qti.hardware.radio.qtiradio - this one has 2 versions, and both of them need the slot2 addition
4.
Code:
adb shell su -c setprop persist.radio.multisim.config dsds
5. find any USB mode with rmnet in /vendor/etc/init/hw/init.msm.configfs.rc, and switch to it. I used "diag,serial_cdev,rmnet,dpl,adb", and that's
Code:
adb shell su -c setprop sys.usb.config diag,serial_cdev,rmnet,dpl,adb
6. Windows shows a lot of new USB devices. Force-install Qualcomm WWAN driver for the RmNet device. I chose "Network Adapters -> Qualcomm -> Qualcomm HS-USB WWAN Adapter 90B8", but anything named after "Qualcomm HS-USB WWAN Adapter" should do.
7. open PDC. There are 3 dual SIM (DSDS) hardware profiles available:
SR_DSDS-LA-7+7_mode-SDM845
SR_DSDS-WD-7+7_mode-SDM845
SR_DSDS-WP8-7+7_mode-SDM845
The one with WP8 in its name can be ignored, and here comes the hard choice.
I tried the WD one in the first place: activated it in the context menu on Sub0 then Sub1, and clicked Activate twice. PDC complained about malformed packet after second click, and the profile was shown as Active on Sub0, and Pending on Sub1. Nothing bad happened after a reboot, regardless of the errors above. Two SIM slots were present in About Phone, and second IMEI is correctly shown there as well. Upon inserting two SIM cards I got dual VoLTE online, and everything behaved like a normal dual SIM SDM845 device. There were some little glitches though: once or twice a day signal bars disappeared and popped up again in a few seconds. Mobile data also stuttered at random times, though not frequent - sometimes mobile data was stable for the whole day. I was satisfied with the results, and made another backup of partitions.
Then I started comparing the WD and LA profiles. I quickly realized that LA marked the phone as DSDS while WD as SS in the device_mode NV entry (I honestly had no idea why dual SIM just worked with WD). There were other differences unknown to me, but LA seemed more "correct" and I decided to switch to this profile. After deactivating WD on both Sub0 and Sub1, I activated LA on Sub0 but not Sub1. The phone could still make use of two SIMs, but without VoLTE on either card. LTE was still available for both cards though. The glitches with WD were mostly gone (data still stuttered but recovered much faster), and the phone SEEMED cooler and battery SEEMED to drain slower.
Finally I could not understand the lack of VoLTE and switched back to WD (still Sub0 only). This time only the first SIM card could register on IMS/VoLTE. The second one registered on LTE but not IMS, regardless of default data card selection. Activating WD on Sub1 did not solve the problem. Manual checks/corrections on the differences between WD and LA made no effect either. I had to flash the backup made after first WD trial, and dual VoLTE worked again.
I came to the following conclusion after this step:
a. hardware profiles may be applied to Sub0 only (can anyone confirm this?)
b. a profile may not be completely reverted after applying. That is to say, same profile status does not mean same baseband behavior.
c. LA profile does not support VoLTE for some reason.
d. if you want dual VoLTE, your best bet would be activating WD on Sub0 and Sub1 right after previous steps, though Sub1 won't accept the setting.
e. mobile data may stutter with dual SIM (this could also be the fault of my service provider however)
Any clarification on this step is appreciated. If you want to enable dual SIM, you have to make your own choice here. Just remember to backup before every change.
8. apply some NV changes from LA on WD base:
ue_usage_setting: from DATA_CENTRIC to VOICE_CENTRIC
device_mode: from SS to DSDS
disable_global_mode: from 1 to 0
I failed to find any difference after these changes. this step could be optional. I myself use the phone as daily driver with these changes though.
That's all. Don't worry, I'm confused as you Everything just works or fails without any valid reason
Other Details
1. RP2 uses the same SIM card slot as Samsung. I filed an card tray from Samsung S7 so that it fits RP2. Its size naturally() fits RP2, just make it as thin as Razer's tray and it will work.
2. if you want to restore a modemst1/2 backup, do that in TWRP. If this needs to be done in Android system, stop vendor.rmt_storage first.
3. if the phone reboots to recovery right after booting to lock screen, this could be SIM count in baseband and system diverging. Run
Code:
adb shell su -c setprop persist.radio.multisim.config ss
during boot to see if this fixes the problem. If it does, restore all backups then start all over.
4. QPST does not recognize the diag port from the phone upon USB connection. Do this so that diag port works:
Code:
# in adb shell, assuming USB mode has already been switched
su
setenforce 0
stop vendor.per_mgr
# wait a few sec until QPST recognizes SDM845 on the diag port
start vendor.per_mgr
# SDM845 disappears and re-appears after a few sec, and QPST is usable
5. arter97's kernel disables diag drivers, and QPST could never recognize the phone. You have to use stock kernel if you intend to use anything other than PDC.
Screenshots and photos:
Screenshot of About Phone:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Screenshot of dual VoLTE:
Photos of the filed card tray inside RP2:
The original Samsung tray:
And after filing:
Reserved for minor fixes
that's interesting
i have tried this, but the second imei doesn't appears what am I doing wrong?
ps: i find second imei in QCN backup
IMG
I finally got it
i updated to rom deodexed and zipalign from Warrior1988
after that I looked at the settings, the second Imei appeared
then I put sim card, android recognizes then it worked
PS: i modded SIM Card with MicroSD, now i have dual SIM with MicroSD :laugh:
IMG
unfortunately, now i see this message on starting, but starts normally (don't shutdown) :victory:
IMG
Update: you can remove this with command
reboot "dm-verity enforcing"
Hey man! What sim card tray did you use and how did you modify it for dual SIM and sdcard?
Using a command to reverify the DM will get rid of the red text and boot
th3cavalry said:
Hey man! What sim card tray did you use and how did you modify it for dual SIM and sdcard?
Using a command to reverify the DM will get rid of the red text and boot
Click to expand...
Click to collapse
I did this method, and used default sim card tray
and thanks for command
So I'm stuck at step 7. I have the both SIM slots showing in the phone but no IMEI for SIM2. When I open PDC it doesn't show anything.
When we add the slot2, do we add slot1,slot2 or do we add a whole nother line in the file for slot2?
Did you have any issues with PDC in the beginning?
updateing said:
I was planning to get a new phone with a great display, and that was exactly when RP2 went on sale. I'm otherwise satisfied with the phone, but single SIM is definitely a deal breaker in China. Given that I could not find any other phone matching my criteria, I decided to get the RP2 and tried to enable dual SIM on it. Till now I've had some success, and here is what I have done.
If you have strong demand for dual SIM like I do, you may try these steps. This thread, however, is NOT a proper nor complete guide on this topic. It is just a record of my trials - they are highly experimental, risky, and potentially broken. There is absolutely no guarantee on signal quality, stability, power consumption or even the success rate. Your device can be permanently damaged if any detail goes wrong. Make sure you understand all the risks and you are able to justify every command before typing it to your phone!
I do appreciate suggestions for the correct way, though. Comments are greatly welcomed!
My environment
QPST 2.7.477 - only PDC is used here, so any version with standalone PDC tool might do the job. But new versions required if you want to use other tools.
QXDM Professional 3.14.1144 - this one is optional. It's used to tweak some parameters, but dual SIM does work without the tweaks.
Qualcomm USB drivers 2.1.2.0 from 2015/7/8 - older versions might work as well.
Windows 10, 1803
arter97's kernel and Magisk-patched stock kernel images readily at hand. The latter can be obtained by patching a stock kernel image in Magisk Manager with "Keep dm-verity/avb 2.0" UNTICKED. I had the latter installed on the phone.
Make sure root shell can be obtained during boot with ALL kernel images. This is an important recovery approach if the phone bootloops.
Steps
I've gone through a tricky path to confirm that there is indeed a second IMEI in the phone prior to the steps, which supported follow-up researching. This thread will not cover this part as this is merely trial-and-error. I will provide suggestions on diag connection though.
1. make a backup of all partitions on the phone, leaving out system, vendor and userdata partitions of course. There are 88 partitions in my backup.
2. make a QCN backup of modem NV. This step could be optional as modemst1/2 has already been backed-up in previous step - I'm not sure about this, and have completed this step whatsoever.
3. make a backup of /vendor/etc/vintf/manifest.xml, and add slot2 instances to the following HALs:
android.hardware.radio - this one has 2 interfaces, and both of them need the slot2 addition
vendor.qti.hardware.radio.am
vendor.qti.hardware.radio.qtiradio - this one has 2 versions, and both of them need the slot2 addition
4.
Code:
adb shell su -c setprop persist.radio.multisim.config dsds
5. find any USB mode with rmnet in /vendor/etc/init/hw/init.msm.configfs.rc, and switch to it. I used "diag,serial_cdev,rmnet,dpl,adb", and that's
Code:
adb shell su -c setprop sys.usb.config diag,serial_cdev,rmnet,dpl,adb
6. Windows shows a lot of new USB devices. Force-install Qualcomm WWAN driver for the RmNet device. I chose "Network Adapters -> Qualcomm -> Qualcomm HS-USB WWAN Adapter 90B8", but anything named after "Qualcomm HS-USB WWAN Adapter" should do.
7. open PDC. There are 3 dual SIM (DSDS) hardware profiles available:
SR_DSDS-LA-7+7_mode-SDM845
SR_DSDS-WD-7+7_mode-SDM845
SR_DSDS-WP8-7+7_mode-SDM845
The one with WP8 in its name can be ignored, and here comes the hard choice.
I tried the WD one in the first place: activated it in the context menu on Sub0 then Sub1, and clicked Activate twice. PDC complained about malformed packet after second click, and the profile was shown as Active on Sub0, and Pending on Sub1. Nothing bad happened after a reboot, regardless of the errors above. Two SIM slots were present in About Phone, and second IMEI is correctly shown there as well. Upon inserting two SIM cards I got dual VoLTE online, and everything behaved like a normal dual SIM SDM845 device. There were some little glitches though: once or twice a day signal bars disappeared and popped up again in a few seconds. Mobile data also stuttered at random times, though not frequent - sometimes mobile data was stable for the whole day. I was satisfied with the results, and made another backup of partitions.
Then I started comparing the WD and LA profiles. I quickly realized that LA marked the phone as DSDS while WD as SS in the device_mode NV entry (I honestly had no idea why dual SIM just worked with WD). There were other differences unknown to me, but LA seemed more "correct" and I decided to switch to this profile. After deactivating WD on both Sub0 and Sub1, I activated LA on Sub0 but not Sub1. The phone could still make use of two SIMs, but without VoLTE on either card. LTE was still available for both cards though. The glitches with WD were mostly gone (data still stuttered but recovered much faster), and the phone SEEMED cooler and battery SEEMED to drain slower.
Finally I could not understand the lack of VoLTE and switched back to WD (still Sub0 only). This time only the first SIM card could register on IMS/VoLTE. The second one registered on LTE but not IMS, regardless of default data card selection. Activating WD on Sub1 did not solve the problem. Manual checks/corrections on the differences between WD and LA made no effect either. I had to flash the backup made after first WD trial, and dual VoLTE worked again.
I came to the following conclusion after this step:
a. hardware profiles may be applied to Sub0 only (can anyone confirm this?)
b. a profile may not be completely reverted after applying. That is to say, same profile status does not mean same baseband behavior.
c. LA profile does not support VoLTE for some reason.
d. if you want dual VoLTE, your best bet would be activating WD on Sub0 and Sub1 right after previous steps, though Sub1 won't accept the setting.
e. mobile data may stutter with dual SIM (this could also be the fault of my service provider however)
Any clarification on this step is appreciated. If you want to enable dual SIM, you have to make your own choice here. Just remember to backup before every change.
8. apply some NV changes from LA on WD base:
ue_usage_setting: from DATA_CENTRIC to VOICE_CENTRIC
device_mode: from SS to DSDS
disable_global_mode: from 1 to 0
I failed to find any difference after these changes. this step could be optional. I myself use the phone as daily driver with these changes though.
That's all. Don't worry, I'm confused as you Everything just works or fails without any valid reason
Other Details
1. RP2 uses the same SIM card slot as Samsung. I filed an card tray from Samsung S7 so that it fits RP2. Its size naturally() fits RP2, just make it as thin as Razer's tray and it will work.
2. if you want to restore a modemst1/2 backup, do that in TWRP. If this needs to be done in Android system, stop vendor.rmt_storage first.
3. if the phone reboots to recovery right after booting to lock screen, this could be SIM count in baseband and system diverging. Run
Code:
adb shell su -c setprop persist.radio.multisim.config ss
during boot to see if this fixes the problem. If it does, restore all backups then start all over.
4. QPST does not recognize the diag port from the phone upon USB connection. Do this so that diag port works:
Code:
# in adb shell, assuming USB mode has already been switched
su
setenforce 0
stop vendor.per_mgr
# wait a few sec until QPST recognizes SDM845 on the diag port
start vendor.per_mgr
# SDM845 disappears and re-appears after a few sec, and QPST is usable
5. arter97's kernel disables diag drivers, and QPST could never recognize the phone. You have to use stock kernel if you intend to use anything other than PDC.
Click to expand...
Click to collapse
th3cavalry said:
So I'm stuck at step 7. I have the both SIM slots showing in the phone but no IMEI for SIM2. When I open PDC it doesn't show anything.
When we add the slot2, do we add slot1,slot2 or do we add a whole nother line in the file for slot2?
Click to expand...
Click to collapse
PDC works for me from the beginning. Please check:
1. Did you install the correct driver for the RmNet device?
2. There is a combo box in PDC window with nothing selected by default. Could you choose HS-USB WWAN Adapter in its dropdown list?
th3cavalry said:
So I'm stuck at step 7. I have the both SIM slots showing in the phone but no IMEI for SIM2. When I open PDC it doesn't show anything.
When we add the slot2, do we add slot1,slot2 or do we add a whole nother line in the file for slot2?
Click to expand...
Click to collapse
for me the second IMEI only worked after I installed this https://forum.xda-developers.com/razer-phone-2/development/rom-mr1-stock-deodexed-zipalign-t3916502
and to PDC work i used this driver https://androidfilehost.com/?fid=11410963190603864074
Wait, so... Even though this is a single-SIM phone, it has a second IMEI in it, and the hardware to read a second SIM? All they had to do to make this officially dual-SIM was make a slightly different SIM tray and change the hardware profile?
Gamesoul Master said:
Wait, so... Even though this is a single-SIM phone, it has a second IMEI in it, and the hardware to read a second SIM? All they had to do to make this officially dual-SIM was make a slightly different SIM tray and change the hardware profile?
Click to expand...
Click to collapse
Maybe they need more resources to fine tune dual SIM experiences (if they have not given up the plan for this variant). For example modem could crash when IMS registration states change on both slots simultaneously (this is why my signal bars disappear from time to time), and radio performance could be drastically degraded when two slots are registered on different bands. Making a product market-ready takes much more resources than making in happen in lab, and Razer might not want to invest that much in this area.
updateing said:
Maybe they need more resources to fine tune dual SIM experiences (if they have not given up the plan for this variant). For example modem could crash when IMS registration states change on both slots simultaneously (this is why my signal bars disappear from time to time), and radio performance could be drastically degraded when two slots are registered on different bands. Making a product market-ready takes much more resources than making in happen in lab, and Razer might not want to invest that much in this area.
Click to expand...
Click to collapse
Makes sense. I suppose I shouldn't trivialize the process. It mostly just surprises me that the hardware (and some of the software) is there at all. They must have had plans to do dual-SIM up until almost the last minute, because otherwise I can't imagine why they wouldn't save the money needed to put that extra hardware in there. And I can't imagine they'll release any such thing at this point. They basically shut down their mobile phone division, and haven't even released a software update in months.
hey guys..
enabling diag is workig on android 8.1.? it was using on pie but didnt work on oreo...anyone faced wtih this pb..?
Code:
aura:/ $ su
aura:/ # setprop sys.usb.config diag,serial_cdev,rmnet,dpl,adb
aura:/ #
---------- Post added at 02:27 PM ---------- Previous post was at 02:10 PM ----------
t-mobile_mda said:
hey guys..
enabling diag is workig on android 8.1.? it was using on pie but didnt work on oreo...anyone faced wtih this pb..?
Code:
aura:/ $ su
aura:/ # [B]setprop sys.usb.config diag,serial_cdev,rmnet,dpl,adb[/B]
aura:/ #
Click to expand...
Click to collapse
i think it is not working on oreo..tried again on pie and worked again...
Code:
C:\Users\X\Desktop\Razer\Phone_2\Root\8.1>adb shell
aura:/ $ su
aura:/ # [B]setprop sys.usb.config diag,serial_cdev,rmnet,dpl,adb[/B]
C:\Users\X\Desktop\Razer\Phone_2\Root\8.1>
hey again guys..
can anyone pls sahre the modemst parts..? single sim or dual it doesnt metter..
lrwxrwxrwx 1 root root 15 1970-03-18 15:27 modemst1 -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 1970-03-18 15:27 modemst2 -> /dev/block/sdf3
dd if=/dev/block/sdf2 of=/sdcard/sdf2
dd if=/dev/block/sdf3 of=/sdcard/sdf3
w.b.r.
What are the chances of breaking my phone with these steps?
Just like anything else, trial and error.
So does this kill WiFi calling?
I tried this and I jacked it up a bit. i got it to get both SIMs working (TMOUS and KT). The WiFi calling for TMOUS stopped working and also if I went to "Mobile Data" it reset the radio and never opened the menu. So i tried to revert and it got stuck in a boot loop and when i did get in the cell was completely not working, No sim, no IMEI. Luckily i flashed an older ROM (shipped 8.1MR0) and progressively upgraded through the ROMs from there and have service again. This tells me that the Stock Razer Images from their developer site don't have 'everything' for a full restore.
t-mobile_mda said:
hey again guys..
can anyone pls sahre the modemst parts..? single sim or dual it doesnt metter..
lrwxrwxrwx 1 root root 15 1970-03-18 15:27 modemst1 -> /dev/block/sdf2
lrwxrwxrwx 1 root root 15 1970-03-18 15:27 modemst2 -> /dev/block/sdf3
dd if=/dev/block/sdf2 of=/sdcard/sdf2
dd if=/dev/block/sdf3 of=/sdcard/sdf3
w.b.r.
Click to expand...
Click to collapse
Grab the Stock ROM for your version then extract it: https://developer.razer.com/razer-phone-dev-tools/factory-images/
All of them have "modem.img" used in there flash script in this command:
Code:
%fastboot_cmd% flash modem_a modem.img
%fastboot_cmd% flash modem_b modem.img
I don't think this works on 9MR2
Related
Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!
<Reserved>
Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?
Yehudah said:
Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?
Click to expand...
Click to collapse
Running RAZR M in US on straight talk now. Works wonderful!!!
Thanks a lot! im a total noob when it comes to most of this, but it worked perfect for me!!
Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?
Skrilax_CZ said:
Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?
Click to expand...
Click to collapse
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.
Remember to install the latest Motorola drivers and *especially* highlight the entire 01 and type 00. I was backspacing only the 1 and it did not "stick" when writing. So HIGHLIGHT, don't backspace. Works perfectly.
is it possible to write the NV item to the Droid 4 then edit ? ?
cellzealot said:
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.
Click to expand...
Click to collapse
Can I use a similar way to unlock XT902(Japanese Razr M)? I can't find 8322 in XT902.......
Followed instructions and worked perfectly. The key for me was the latest Motorola drivers AND the Motorola USB cable that came with the phone. I tried other cables that both charged and synced but the only that worked for this was the Moto cable. Using Win XP SP3 ( 12 year old OS on brand new work laptop. WTF!)
i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.
AKG0214 said:
i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.
Click to expand...
Click to collapse
Boost - No
Cricket - No
They're both cdma. This is to allow the GSM side (SIM CARD based) of the phone to work on other carriers. With that said, your best options are
Net10, Straight Talk, ATT, T-Mobile, Simple Mobile, H20, Orange, and there's a plethora of others out there. Post paid and pre-paid.
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.
after boot, it is set back to 01 again @ address 8322
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
cellzealot said:
Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!
Click to expand...
Click to collapse
---------- Post added at 11:14 PM ---------- Previous post was at 10:48 PM ----------
tried again for couple of times, this time it actually works.
maybe last time I reboot the phone too early?
sipida said:
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
Click to expand...
Click to collapse
Glad you got it working. There is no VZW software on the phone capable of writing to the radio NV, so it's not being reverted by anything.
If anyone else has similar issues I would suggest trying the NV/SEEM method as that will definitely write the item properly.
queberican351 said:
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.
Click to expand...
Click to collapse
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.
Does this tutorial unlock mobile data usage on other carriers. I cannot seem to get data working on my XT907 in Australia. GSM and MMS work fine, so why doesnt Data?
I don't know for certain because I only have experience with domestic US GSM carriers, but I tend to doubt it.
You can try it and see and revert it easily if it doesn't work. You can also try flashing the Telstra XT905 NON-HLOS.bin(modem) and fsg.mbn(carrierEFS/NVM config).
This was the method used to get US GSM service on XT907 before the method shown here was discovered.
It works but is limited to GSM/EDGE data services here in the US.
I am inclined to think it is some other problem with the device because it should work as a global capable phone by default.
dsdd said:
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.
Click to expand...
Click to collapse
If it has a sim lock and you can acquire the code open your dialer and press #073887* (#0SETUP*) and it'll prompt you for the code.
Several people have PMd me questions about this method and I would much prefer that they be posted here in the thread so that everyone may benefit from the information.
Please include as much information about your PC and driver versions and be as thorough as possible in explaining your problems.
Main thread: http://forum.xda-developers.com/z3-compact/general/unlock-bands-regions-z3c-root-required-t2940959
Originial thread here: http://forum.xda-developers.com/cro...ad-progress-please-leave-im-updating-t2871269
This thread server as a step-by-step guide for the unlocking process, but please takecare of all your personal/important information before modding your phone.
It is your own responsibility to backup all your data, including online and offline backup. I take no responsibility for any broken devices/sdcards/your house going down on fire and everything else.
This mod in fact does NOT unlock any sim lock, don't ask such a question.
And I do NOT think it will unlock [email protected], [email protected] (TBC, no such environment)
What you need:
Sony Xperia Z3 Compact (can be D5803/5833/SO-02G...)
Firmware rooted
Win7 PC with z3c ADB driver installed (I use the one come with flashtool)
QPST / QXDM / mzTool / z3c diag driver (http://goo.gl/pyN5fo, password: [email protected])
terminal emulator installed on z3c (can be optional, but will be easier when switching engineer mode on usb)
Give thanks to @BlackSoulxxx
Optional: FlashTool
Optional: Firmware stock FTF, the version must match your z3c running build (in case of recovery) you can get using XperiFirm
The following Guide assume you have: gain root access, installed SuperSU on phone, installed QPST/QXDM on PC.
I only tested on my D5833 and SO-02F, using Windows 7 Pro x64 SP1.
My originial plan is modding my SO-04E, to enable LTE in my area.
But I pass it to my girlfriend few days before I found this mod.
(her F-07E always boot to safe-mode, should be hardware failure)
Part 1: Connect to the phone's diagnostics mode
1. Enable superuser access in SuperSU if you have disabled it.
2. Go to: Setting -> Developer Option, make sure you turn on "Developer Option" on the top and turn OFF "USB Debugging"
3. Open terminal emulator, type the following command one by one:
Code:
su
setprop persist.usb.eng 1
4. Turn on "USB Debugging" under "Developer Option"
5. Connect your phone to PC via USB. Windows should found a few new hardware, wait until all driver installation fail.
6. Open "Device Manager" in "Computer Management", you should see some device named same as your device model, icons with yelow exclaimation mark.
7. Right-Click the first one, select Properties. Go to Detials tab, and under "Property" label, find the item called "Hardware Ids".
8. There should be some lines under the label Value. Notice the longest one, which should end with something like MI_01/MI_02 etc.
9. Your job is to find the correct device, which should end with MI_04. If you cannot find such device, either you have done something wrong, or your PC's usb fail to operate correctly. In later case, please switch to another PC. (My first trial end with this situation)
10. Once you find the correct device, go to Driver tab and press "Update Driver". Install the usb diag driver from the package, when asked about driver signature, just force insall it. Please make sure driver build match your window build, and do NOT use x86 driver on x64 windows.
Part 2: Unlock GSM/CDMA band(s)
11. Go to Start -> All Programs -> QPST, open "QPST Configuration". In the "Ports" tab, click the "Add New Port..." button in lower right corner.
12. In the Add New Port window, untick the option called "Show Serial and USB/QC Diagnostic ports only".
13. You should find an entry with the name saying z3c USB Modem. Select it and press OK.
14. Make sure the newly added port is "Enabled", under "Phone" block is MSM8974, Link is "USB".
15. Keep the configuration application running in background. Close the application will loose your connection to the phone.
16. Navigate to the installation path of QPST, in the /bin folder, find and execute "RF_NV_Manager.exe".
17. Go to "Setting" -> Comport, select the correct port you created in step 14.
18. In the top menu, "File" -> "Read from Phone". It should start reading your phone but take times.
19. After reading operation finished, in the lower left panel find the item with number 1877 (NV_RF_BC_CONFIG_I).
20. In the right panel, take a note on the originial value in case of recovery need.
21. Open mzTool, under "Band Preference (Bit info)", select "Decimal" under "Input Radax". In the "RF BC Config", enter the number you noted at step 20. It will list out all your current band supported by your headset, in the bit information box.
22. Still in mzTool, go to next tab named "Band Preference (NV Value)", select the band(s) you need. You can select all, but I personally recommand what you really need plus "[60] Reserved for BC10-1700", at lest those originally come with your phone.
23. After selecting band(s) you need, Copy the decimal value in the "RF BC Config" box below the selection area, and remove all space in between.
24. Go back to QPST again, find item #1877 (NV_RF_BC_CONFIG_I), paste the new value you calculated in step 23 into the right panel, and press the "Write NV"Button.
25. Go to "File" -> "Write Changes NV Items To Phone".
26. Close and reopen "RF_NV_Manager.exe", repeat step 17-19. If #1877 show you the value same as the one you calculated in step 23, then you are OK to proceed. If it revert back to the originial value (you should noted down at atep 20), sorry this mod is NOT for your headset and proceed to last part for quitting diagnositc mode.
27. Close RF NV Manager, unplug your headset and reboot it. If you got reception after reboot, then you are good. Please give thanks to @BlackSoulxxx
27a. Open dialer, type *#*#7378423#*#* (*#*#SERVICE#*#*), goto "Service info" -> "Configuration", you should see your unlocked band. If not, that means your phone reset it while reboot. You can do nothing unless you know how to disable the reset.
27b. If your phone cannot get signal after the mod, flash your phone with the stock FTF, do NOT select anyone under "Wipe:", select all under "Exclude:" but keep "BASEBAND" selected. This should flash the originial baseband firmware, hence remove this mod.
27c. If you still cannot get any reception, flash the whole stock FTF. This will wipe all your data, but reset it to factory installed status.
28. You are done for this section, you may continue for LTE band(s) unlock, or jump to last part for quitting diagnositc mode.
Part 3: Unlock LTE band(s)
29. Make sure you have unlocked "[60] Reserved for BC10-1700" in previous part.
30. Go to Start -> All Programs -> QXDM Professional, open "QXDM Professional". In the top menu select "Option" -> "Communication".
31. Under "All Ports in System:" select your port (should me same port as you use in QPST) and press "OK. QXDM should load all data automatically once you press ok.
32. In top menu, select "View" -> "New" -> "Common" -> "NV Browser". In the newly opened window, select "LTE" next to the "Category Filter".
33. Select the item with ID 06828 (Description = LTE BC Config, Full Path Name = LTE_BC_CONFIG). It should display "input" and "Value" of 0 under "Fields".
34. Press the "Read" button in the lower right corner, it should show a non-zero number under "Value". Please also write it down for recovery.
35. Convert the number, noted at step 34, to binary form. It will show which LTE bands your phone currently supported ...
35a. Start reading from right to left, the 1st digit from the right (right-most) will be corresponding to LTE Band 1, the 2nd digit will be for LTE Band 2, the 3rd digit will be for LTE Band 3. So the rule will be [ N-th digit will be for LTE Band N ].
35b. For each digit, 1 means the phone support that particular band while 0 means no support. For example in D5833, it should be 549890031829 = "1000000000001000000000000000000011010101" (LTE Band 1,3,5,7,8,28,40).
35c. So if you want to unlock some LTE band(s), filp such bit to 1. In case you have a gap like band 28-40, make sure you fill it with 0, or you will fail to unlock such channel.
36. Please work out our own value that suit your need. In my case I need LTE Band 1,3,5,7,8,9,19,21,28,38,39,40,41 so my value will be "11110000000001000000101000000000111010101" = 2061719830997
37. Go back to QXDM, double-click the 0 under "Input", replace it with the number you calculated at step 36 in decimal form.
38. Write the value to your phone by pressing the "Write" button next to "Read" button.
39. Close and reopen QXDM. Repeat step 31-35 and double check the number under "Value".
40. Close QXDM, unplug your phone and reboot it. If you got reception after reboot, then you are good. Please give thanks to @BlackSoulxxx
40a. Open dialer, type *#*#7378423#*#* (*#*#SERVICE#*#*), goto "Service info" -> "Configuration", you should see your unlocked band. If not, that means your phone reset it while reboot. You can do nothing unless you know how to disable the reset.
40b. If your phone cannot get signal after the mod, flash your phone with the stock FTF, do NOT select anyone under "Wipe:", select all under "Exclude:" but keep "BASEBAND" selected. This should flash the originial baseband firmware, hence remove this mod.
40c. If you still cannot get any reception, flash the whole stock FTF. This will wipe all your data, but reset it to factory installed status.
41. If you still cannot connect via LTE, open dialer and type *#*#4636#*#* (*#*#INFO#*#*), find "preferred network" and select "LTE".
41a. If it fail to connect, either is hardware restriction, or more software setting has to be done (some carrier has different APN for 3G/LTE)
42. You are done for this section, please continue for quitting diagnositc mode.
Part 4: Quit Diagnostics mode
43. Unplug your headset if you still connect it.
44. Turn off "USB Debugging" in "Developer Option".
45. Open terminal emulator, type the following command one by one:
Code:
su
setprop persist.usb.eng 0
46. You may either turn on "USB Dibugging", or just leave it as is.
46a. You can also turnoff superuser access in SuperSU, to enjoy Puzzle and Dragon (JP).
99. Don't forget to give thanks to @BlackSoulxxx
Thanks very much for this guide... before I attempt it, a dumb question;
Is this only of benefit for people that roam internationally often? Or can it improve the phone signal overall? (im in the UK)
Kind regards
Still Lte band 20 is not working in D5833, while it is listed in service menu((( I guess there are some hardware differences in radio module between D5833 and D5803
mamumba said:
Still Lte band 20 is not working in D5833, while it is listed in service menu((( I guess there are some hardware differences in radio module between D5833 and D5803
Click to expand...
Click to collapse
Thanks for the confirmation.
I own D5833, but live in Europe, and the available LTE bands in my country are 3 and 20.
I guess I won't be able to use the band 20, shame.
Can anyone, who own D5803 using this manual copy configuration of their phone in QXDM and PM me this file?
Wow, Much thanks. Very good. Great guide...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Excellent guide I will try it later, I had a D5833 and I need to get working the LTE 1700/2100 band
Noob question;
If you flash the FTF BASEBAND to revert de mod to it's original state, flashing the BASEBAND of a D5803 FTF to a D5833 model would not do the same trick?? (i suposse not but I'm asking anyway )
nmercy said:
Excellent guide I will try it later, I had a D5833 and I need to get working the LTE 1700/2100 band
Noob question;
If you flash the FTF BASEBAND to revert de mod to it's original state, flashing the BASEBAND of a D5803 FTF to a D5833 model would not do the same trick?? (i suposse not but I'm asking anyway )
Click to expand...
Click to collapse
You may try that, I won't take any production device on such risk anymore:angel:
Why do you flash d5803 Baseband to d5833 device ?
Quick note: someone reported Band4 AWS will not work even we modded the phone to support it ...
Every time I try this, I get a note that write protection on and read only? What am I doing wrong?
i want to try this with a xperia m2 model d2306 i need the band 3 for my lte please some help
Works great for me. Thanks heaps.
Has anyone successfully done this with a a D5803 to unlock TMobile's LTE Band 12 (700mHz)?
I have D5833 and tried to enable LTE band 4(AWS) and 2 to use it with T-Mobile.
Sadly, it doesn't work. The configuration page tells me that both 4 and 2 are enabled, but my phone can't get the signal.
I guess it's because of a hardware difference between D5833 and D5803
Quick note that worked for me on Windows 8 though I don't know if it's the limitation.
When I try to enter the new decimal for 3g bands, it doesn't seem to matter what I choose because as long as I select band 60 the software won't accept the number because its too long. If I change to selecting hex then there's fewer digits and it writes to the phone correctly without issue.
Anybody manage to unlock LTE band 20 ( 800 MHz ) on D6653 ( Z3 ) ???
Do you guys think it's possible or is it hardware limitation ( hope not ) ?
bofis said:
Has anyone successfully done this with a a D5803 to unlock TMobile's LTE Band 12 (700mHz)?
Click to expand...
Click to collapse
Bump. In the same boat (D5803 on T-Mobile) and wondering if it is worth performing all of the steps to unlock Band 12.
Please follow the updated directions provided by Bendrexl below before attempting any other methods.
bendrexl said:
Here's a roundup of essential steps from this thread that worked for me...
:good: HUGE THANKS to: Whoareyou, docna, caspar347, Dishe
Prepare for battle:
Ensure your Verizon Moto E 2015 is configured for USB debugging.
Ensure your Verizon Moto E 2015 has airplane mode enabled.
Ensure your PC/Mac has the Android SDK Platform Tools installed & accessible via your terminal / command line (added to $PATH var).
Download 5.0.2 factory image: http://forum.xda-developers.com/moto-e-2015/general/stocks-firmwares-moto-e-t3113235/page2?nocache=1 (Thanks to caspar347!)
Unzip / expand this .zip archive.
Open a terminal session in the directory you just unzipped (containing NON-HLOS.bin & fsg.mbn)
Execute!
In your terminal with phone plugged in:
$ adb reboot bootloader (your phone should now reboot into bootloader, wait for this)
$ fastboot flash modem NON-HLOS.bin
$ fastboot erase modemst1
$ fastboot erase modemst2
$ fastboot flash fsg fsg.mbn
$ fastboot reboot (WAIT for phone to fully boot before continuing)
$ adb shell (your command prompt will change to something like [email protected]_cdma:/ $. If you get kicked out of the session while entering the next commands, just type adb shell again and pick up where you left off)
[email protected]_cdma:/ $ pm clear com.android.providers.telephony
[email protected]_cdma:/ $ settings put global preferred_network_mode 9
[email protected]_cdma:/ $ settings put global preferred_network_mode1 9
[email protected]_cdma:/ $ settings put global preferred_network_mode2 9
[email protected]_cdma:/ $ pm hide com.motorola.setupwizard.phoneservice (optional)
[email protected]_cdma:/ $ exit (or just unplug & reboot phone)
$ adb reboot (or just unplug & reboot phone)
On the phone:
Turn off Airplane mode
Open Settings app > More > Cellular Networks
Ensure Preferred network type selected is "4G (recommended)"
Under Access Point Names, add the appropriate APNs for your specific carrier. (for Fi data, I only needed "h2g2").
Disable all Verizon apps through settings or Titanium Backup. (Optional)
CREDITS: Whoareyou, docna, caspar347, Dishe
Click to expand...
Click to collapse
IF YOUR DEVICE IS RUNNING 5.1, FOLLOW THE GREEN INSTRUCTIONS!
In order to attempt to get Verizon/Motorola to push out a new update with a fix for the removal of the option to switch to GSM, please sign this petition on Change.org and share it to anyone who you know will sign it! https://www.change.org/p/verizon-daniel-s-mead-stop-carrier-locking-motorola-moto-e-lte-xt1528
Background Info: I work at Walmart in the Connection Center, and today I had a customer wanting to switch to Family Mobile from AT&T, so I showed them our Family Mobile devices and T-Mobile Devices, they didnt seem interested in them and said they wanted somthing that had Android 5.0 Lollipop, I thought about it for a minute and remembered that the Moto E (2015) shipped with Lollipop installed, I also knew that Verizon phones come unlocked, so I showed them the device and they decided to go with it, they bought the Family Mobile Micro SIM starter kit, and the Moto E, but once I powered it on, I couldn't get it to connect to Family Mobile, so I tried to access the advanced radio menu (*#*#4636#*#*) to no avail, but I eventually got it working, with full LTE support, heres how:
POSSIBLE SIM SWAP WORKAROUND (Reported by wogeboy):
Disable vzwAPNpermissions.apk and vzwAPNservice.apk using this program: http://bit.ly/1HHyVao
I have not tested this as I dont have a VZW Moto E to test it on.
5.1 Updated Instrcutions:
With the SIM you want to use the the phone :
1. Put the phone into Airplane mode (I'm not sure this is needed, but it doesn't hurt)
2. Go to Settings -> About Phone and tap on "Build Number" until it says you are in Developer Mode (~10 times)
3. Go back one menu, and right above About Phone there should now be an option for Developer Options, go into that.
4. Turn on USB Debugging
5. Connect the phone to your computer and type "adb shell" in your CMD window
6. Run the following commands in adb shell :
pm clear com.android.providers.telephony
settings put global preferred_network_mode 9
settings put global preferred_network_mode1 9
settings put global preferred_network_mode2 9
7. Turn off Airplane mode
8. Power off and Restart the phone
9. Open up the settings app, go to the mobile networks panel, select "Prefered Network Mode" and change it to "4G"
10. Input the appropriate APNs for your specific carrier
11. (Optional). Disable all Verizon apps through settings or Titanium Backup.
CREDIT: docna
.
5.0.2 Instructions:
1. Power on the device with the GSM SIM card in the SIM card slot
2. Connect to WiFi and complete Google Sign-In
3. Go to the Play Store and search "Network" download the first app (A white circle with a black phone in it) (This will allow us access to the advance radio options)
4. Open the "Network" shortcut
5. Change the radio mode from "CDMA/LTE PRL" to "GSM/LTE Auto"
6. Open up the settings app, go to the mobile networks panel, select "Prefered Network Mode" and change it to "4G"
7. Input the appropriate APNs for your specific carrier
8 (Optional). Disable all Verizon apps through settings or Titanium Backup.
The only thing I couldnt solve was how to remove the "SIM Card is not from Verizon Wireless" error in the status bar permanently, but thats just an annoyance, and causes no usability decrease.
This Works!
Thanks a lot, had been trying to get the GSM working. The "Network" app in the Play Store give access to the hidden radio selection menu. Verizon was able to disable all other way to enter the radio selection menu but this one did it. I think there is a apk file somewhere which disables the annoying "NOT verizon SIM" message. I will post here if I find that works.
That's a lot easier than poking around in NVram! Thanks, OP. And yeah, there's a Setup app or something you need to freeze for then sim error. I'll have to get mine out and find it.
Here are screen snaps. The VZ phone is actually picking up LTE for Ting (T-Mobile).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Nice. This is definitely some progress. Still waiting for the sprint version to be unlocked.
Whoareyou said:
Background Info: I work at Walmart in the Connection Center, and today I had a customer wanting to switch to Family Mobile from AT&T, so I showed them our Family Mobile devices and T-Mobile Devices, they didnt seem interested in them and said they wanted somthing that had Android 5.0 Lollipop, I thought about it for a minute and remembered that the Moto E (2015) shipped with Lollipop installed, I also knew that Verizon phones come unlocked, so I showed them the device and they decided to go with it, they bought the Family Mobile Micro SIM starter kit, and the Moto E, but once I powered it on, I couldn't get it to connect to Family Mobile, so I tried to access the advanced radio menu (*#*#4636#*#*) to no avail, but I eventually got it working, with full LTE support, heres how:
1. Power on the device with the GSM SIM card in the SIM card slot
2. Connect to WiFi and complete Google Sign-In
3. Go to the Play Store and search "Network" download the first app (A white circle with a black phone in it) (This will allow us access to the advance radio options)
4. Open the "Network" shortcut
5. Change the radio mode from "CDMA/LTE PRL" to "GSM/LTE Auto"
6. Open up the settings app, go to the mobile networks panel, select "Prefered Network Mode" and change it to "4G"
7. Input the appropriate APNs for your specific carrier
8 (Optional). Disable all Verizon apps through settings or Titanium Backup.
The only thing I couldnt solve was how to remove the "SIM Card is not from Verizon Wireless" error in the status bar permanently, but thats just an annoyance, and causes no usability decrease.
Click to expand...
Click to collapse
Thanks a ton for this! Do you know what the APN setting should be for T-Mobile? That's my current challenge. Every site has a different opinion. Including T-Mobile.
APN: fast.t-mobile.com
MMSC: http://mms.msg.eng.t-mobile.com/mms/wapenc
that should be all you have to set
Method Works on SPRINT AND BOOST too
Thanks
This method works on Boost and Sprint too.
Tested in INDIA working fine with indian GSM carriers.
Whoareyou said:
Background Info: I work at Walmart in the Connection Center, and today I had a customer wanting to switch to Family Mobile from AT&T, so I showed them our Family Mobile devices and T-Mobile Devices, they didnt seem interested in them and said they wanted somthing that had Android 5.0 Lollipop, I thought about it for a minute and remembered that the Moto E (2015) shipped with Lollipop installed, I also knew that Verizon phones come unlocked, so I showed them the device and they decided to go with it, they bought the Family Mobile Micro SIM starter kit, and the Moto E, but once I powered it on, I couldn't get it to connect to Family Mobile, so I tried to access the advanced radio menu (*#*#4636#*#*) to no avail, but I eventually got it working, with full LTE support, heres how:
1. Power on the device with the GSM SIM card in the SIM card slot
2. Connect to WiFi and complete Google Sign-In
3. Go to the Play Store and search "Network" download the first app (A white circle with a black phone in it) (This will allow us access to the advance radio options)
4. Open the "Network" shortcut
5. Change the radio mode from "CDMA/LTE PRL" to "GSM/LTE Auto"
6. Open up the settings app, go to the mobile networks panel, select "Prefered Network Mode" and change it to "4G"
7. Input the appropriate APNs for your specific carrier
8 (Optional). Disable all Verizon apps through settings or Titanium Backup.
The only thing I couldnt solve was how to remove the "SIM Card is not from Verizon Wireless" error in the status bar permanently, but thats just an annoyance, and causes no usability decrease.
Click to expand...
Click to collapse
Hello. It does not work in Ukraine. Tried many operators. Line GSM only emergency calls and all.I choose the network settings and 2G and 3G. Prompt what to do please.
_Z_x_Z_ said:
Hello. It does not work in Ukraine. Tried many operators. Line GSM only emergency calls and all.I choose the network settings and 2G and 3G. Prompt what to do please.
Click to expand...
Click to collapse
The device may not support Ukrainian bands, check with your carrier to see what band they use for HSPA/LTE
I'll have to get mine out and find it.
This only kinda works with T-Mobile. No LTE or 3G, just edge - and that keeps disconnecting and reconnecting about once every minute or so. I'll have to look into the return/exchange policy if I can't get data working.
brotherswing said:
This only kinda works with T-Mobile. No LTE or 3G, just edge - and that keeps disconnecting and reconnecting about once every minute or so. I'll have to look into the return/exchange policy if I can't get data working.
Click to expand...
Click to collapse
You must be in a non-refarmed area, in Shawnee, KS i was able to get Edge/3G/HSPA+/LTE
Whoareyou said:
You must be in a non-refarmed area, in Shawnee, KS i was able to get Edge/3G/HSPA+/LTE
Click to expand...
Click to collapse
Yep. See my snapshot above for Ting GSM (T-Mobile) in Florida. 4G LTE indicated.
I figured it out. With WiFi on my cell signal strength fluctuates wildly, but as soon as I turn off the WiFi the signal settles down, and I get a solid LTE connection averaging about 32Mbps. Strange, but I've seen crazier things.
Side note, the XT1528 is not eligible for the Motorola unlock program, and cannot be rooted by any method currently available. Several "one click root" tools claim to support it, but don't actually work.
Sent from my XT1528 using Tapatalk
Will the boost variant work on net10
Sent from my N800 using XDA Free mobile app
syrkles said:
Will the boost variant work on net10
Sent from my N800 using XDA Free mobile app
Click to expand...
Click to collapse
I personally haven't had any luck with the Sprint variants (Virgin Mobile, Boost) but I also didn't get to try using an activated Sim card, you could try, but I'm not sure
brotherswing said:
I figured it out. With WiFi on my cell signal strength fluctuates wildly, but as soon as I turn off the WiFi the signal settles down, and I get a solid LTE connection averaging about 32Mbps. Strange, but I've seen crazier things.
Side note, the XT1528 is not eligible for the Motorola unlock program, and cannot be rooted by any method currently available. Several "one click root" tools claim to support it, but don't actually work.
Sent from my XT1528 using Tapatalk
Click to expand...
Click to collapse
That root thread won't root the XT1528?
Root must be flashed with a custom recovery, which in turn requires that the boot loader be unlocked. Since the boot loader on the XT1528 can't be unlocked, we can't use that root technique.
brotherswing said:
Root must be flashed with a custom recovery, which in turn requires that the boot loader be unlocked. Since the boot loader on the XT1528 can't be unlocked, we can't use that root technique.
Click to expand...
Click to collapse
Ahh that's for clearing that up for me!
Unlocking more bands (specifically band 12) is on the way, please be patient as there are a lot of bugs with having a modified modem firmware.
I AM NOT RESPONSIBLE FOR ANY DAMAGE DONE TO YOUR DEVICE! YOUR WARRANTY IS VOID IF YOU FOLLOW THIS TUTORIAL!
This took like 2 weeks to figure out, I was about to give up, but then it worked. VoLTE on band 4 and 2 for T-Mobile in the USA!!
I have only tested this on my phone, but it should work on others (assuming it is still an A2). I have not verified if this works for phones converted to the 6X so if you want to try please be careful.
Alright, enough with the warnings and stuff.
1. First, enable usb debugging and plug your phone into your computer.
1. Download qpst and install it. You will also need this file . Just save it somewhere, we will use it in a minute.
2. run the following commands (note that you MUST be rooted to enable this. The mod survives returning to stock unrooted, and even survives OTA so you can unroot when finished if you want.):
'''
adb shell
su
setenforce 0
setprop sys.usb.config diag,serial_cdev,rmnet,adb
'''
3. once installed there should be an entry in your start menu. open the folder labelled qpst and select the program "PDC".
4. click the Device dropdown and select the Qualcomm device. (it may not show up first time, make sure you have installed the drivers for your device)
5. once you select your device you should see a lost of items, this can take a minute depending on the speed of your computer.
6. click the load button and select the mcfg_sw.mbn you downloaded earlier.
7. "Commercial-TMO" should now be a listing in the description. Highlight it and right click on it, hover over "SetSelectedConfig" and select "sub0". Let it load for a bit.
8. it should now say pending on the Sub0 column of the Commercial-TMO. Now click activate and let it load.
9. on your phone, you must disable reigon checking. To do so go to your phone app and type in the following: *#*#86583#*#*
10. reboot your phone.
This worked for me, I have not verified that it works for others yet, so if it works for you, please let me know. Also let me know of any bugs.
Shreenshots below
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Can this phone work on Metro PCS network
I tried and tried, but i cannot get PST to see my phone. I loaded qualcomm drivers and ADB drivers, nothing. Any suggestions?
Daha3ker said:
Unlocking more bands (specifically band 12) is on the way, please be patient as there are a lot of bugs with having a modified modem firmware.
I AM NOT RESPONSIBLE FOR ANY DAMAGE DONE TO YOUR DEVICE! YOUR WARRANTY IS VOID IF YOU FOLLOW THIS TUTORIAL!
This took like 2 weeks to figure out, I was about to give up, but then it worked. VoLTE on band 4 and 2 for T-Mobile in the USA!!
I have only tested this on my phone, but it should work on others (assuming it is still an A2). I have not verified if this works for phones converted to the 6X so if you want to try please be careful.
Alright, enough with the warnings and stuff.
1. First, enable usb debugging and plug your phone into your computer.
1. Download qpst and install it. You will also need this file . Just save it somewhere, we will use it in a minute.
2.once installed there should be an entry in your start menu. open the folder labelled qpst and select the program "PDC".
3. click the Device dropdown and select the Qualcomm device. (it may not show up first time, make sure you have installed the drivers for your device)
4. once you select your device you should see a lost of items, this can take a minute depending on the speed of your computer.
5. click the load button and select the mcfg_sw.mbn you downloaded earlier.
6. "Commercial-TMO" should now be a listing in the description. Highlight it and right click on it, hover over "SetSelectedConfig" and select "sub0". Let it load for a bit.
7. it should now say pending on the Sub0 column of the Commercial-TMO. Now click activate and let it load.
8.on your phone, you must disable reigon checking. To do so go to your phone app and type in the following: *#*#86583#*#*
9. reboot your phone.
This worked for me, I have not verified that it works for others yet, so if it works for you, please let me know. Also let me know of any bugs.
Shreenshots below
Click to expand...
Click to collapse
This sounds scary. I thought volte works on band 12. If the band is missing how would it work. How can you confirm it actually works.
Hi!
I am running into the same issue of two computers (Win 7 and Win 10) that cannot see the phone. Anyone willing to help in getting PDC to see the phone? Thanks!
I have a couple questions for OP
Will this prevent any OTA?
Could you also take a screenshot of 4g while on a call?
What bugs do you experience?
I definitely see that your method unlocks some options in phone info, in the screenshots, but it doesn't necessarily prove anything if you can't see 4g while in a call and see a difference in speed. I notice the difference in speed when trying to do things on a call while on 3g, so if I were to do this I would definitely be able to tell it worked or not.
mymeatb18 said:
I have a couple questions for OP
Will this prevent any OTA?
Could you also take a screenshot of 4g while on a call?
What bugs do you experience?
I definitely see that your method unlocks some options in phone info, in the screenshots, but it doesn't necessarily prove anything if you can't see 4g while in a call and see a difference in speed. I notice the difference in speed when trying to do things on a call while on 3g, so if I were to do this I would definitely be able to tell it worked or not.
Click to expand...
Click to collapse
I would like to know this as well.
Ulver said:
I would like to know this as well.
Click to expand...
Click to collapse
If you want a specific screenshot let me know, I have been using this for a while though with no issues. The Band 12 has a lot of tuning data required and may not be compatible with all a2 devices without buying tuning equipment. (I used a friend's and hoped this was not the case) :/ I will keep working on it though. All is not lost yet.
As for the device not showing in the computer, it does require root as of the pie update because xiaomi disabled diag mode by default... :/
To enable it in the pie update you need to enter the following in adb shell for it to show up in qpst:
su
setprop sys.usb.config diag,adb
Note, do not reboot yet, rebooting resets these values..
Then re- insert the phone into your computer and it should show up.
The nice thing is that this survives ota and root removal once put on so if you want ota you can have it, just unroot once you get the mod working.
Hi Daha3ker,
I tried to enable with the mentioned commands and still PDC cannot see my phone.
Daha3ker said:
If you want a specific screenshot let me know, I have been using this for a while though with no issues. The Band 12 has a lot of tuning data required and may not be compatible with all a2 devices without buying tuning equipment. (I used a friend's and hoped this was not the case) :/ I will keep working on it though. All is not lost yet.
As for the device not showing in the computer, it does require root as of the pie update because xiaomi disabled diag mode by default... :/
To enable it in the pie update you need to enter the following in adb shell for it to show up in qpst:
su
setprop sys.usb.config acm,diag,mtp,adb
setprop persist.sys.usb.config acm,diag,mtp,adb
Note, do not reboot yet, rebooting resets these values..
Then re- insert the phone into your computer and it should show up.
The nice thing is that this survives ota and root removal once put on so if you want ota you can have it, just unroot once you get the mod working.
Click to expand...
Click to collapse
Can't seem to make the phone appear in PDC as well, I've rooted the device with magisk and have tried to input the commands as suggested but it is still not being detected...
This is what I have
Any word on this?
Update, with stock you need to enter the command
setprop sys.usb.config diag,adb
While the phone is plugged in to the computer for it to work. I was using a different set of debug tools.
I had to use the following command to get PDC to work.
su
setenforce 0
setprop sys.usb.config diag,serial_cdev,rmnet,adb
Im running Pixel Experience 20190320 rom with Magisk 18.1.
QPST 2.7.460
I used the QUD.WIN.1.1 Installer-10040.5 drivers on Windows 10 x64.
Could you unroot and relock bootloader and have this continue working and survive OTA updates?
---------- Post added at 11:18 PM ---------- Previous post was at 10:25 PM ----------
Looks like this survives a complete fastboot flash/relock. How would you reverse this and go back to stock?
---------- Post added at 11:30 PM ---------- Previous post was at 11:18 PM ----------
I want to switch back because sometimes when I make calls, it's high pitched and quiet. I can turn off voLTE to go back to the way it was, but would be nice to be stock again.
What bands it's unlocked?
In Brazil is primordial that b28 is unlocked to use Volte (700 MHz)
joaomiguelsm said:
What bands it's unlocked?
In Brazil is primordial that b28 is unlocked to use Volte (700 MHz)
Click to expand...
Click to collapse
Doesn't unlock any bands, just enables voLTE on T-Mobile in the USA. Unfortunately, it's pretty buggy, maybe due to recent updates.
Ulver said:
Doesn't unlock any bands, just enables voLTE on T-Mobile in the USA. Unfortunately, it's pretty buggy, maybe due to recent updates.
Click to expand...
Click to collapse
Oh, sad
This is the worst thin of Xiaomi in Brazil
PDC not recognizing phone
Hi,
I've been trying to get this working off and on for a couple of weeks. I can't get PDC to populate the drop down menu. I am able to get QPST to recognize the phone after doing :
su
setprop sys.usb.config diag,adb in an adb shell. After those commands, the Qualcomm driver loads (according to device manager). QPST configuration finds the phone on COM9. But when I load PDC I get nothing. Any thoughts? The voice calling on 2g in New York is horrible.
Thanks, Mike
mtrohan said:
Hi,
I've been trying to get this working off and on for a couple of weeks. I can't get PDC to populate the drop down menu. I am able to get QPST to recognize the phone after doing :
su
setprop sys.usb.config diag,adb in an adb shell. After those commands, the Qualcomm driver loads (according to device manager). QPST configuration finds the phone on COM9. But when I load PDC I get nothing. Any thoughts? The voice calling on 2g in New York is horrible.
Thanks, Mike
Click to expand...
Click to collapse
im getting same problem... can solve??
pleaaaase... need help.
Hi Let me introduce tutorial, how to enable VoLTE/VoWiFi for some other carriers. All credits goes to @Airpil for his great work with enabling diag port for Pixel 2 phones and to @topjohnwu for his original Magisk project.
UPDATE:
Here is another way by @Vortuks , how to get things working.
Code:
https://github.com/stanislawrogasik/Pixel2XL-VoLTE-VoWiFi
ANOTHER UPDATE:
On Android 11 you can use module VoLTE_enabler_pixel_2_v1_1.zip, but you will myabe need to use SeLinux permissive module too.
BIG UPDATE:
use only on PIE
for android 10 use solution with PDC tool
I created new magisk module with everything needed for enabling VoLTE. Just install VoLTE_enabler_pixel_2_v1_1.zip and enjoy.
this will work only, if there is proper *.mbn for your provider
sometimes is needed to remove/add module after updating monthly updates
sometimes is needed to toggle off/on enhanced 4g LTE mode and go to airplane mode and back
Prerequizites:
your carrier have to support this feature
and you have to enable this feature on operator's side
PC with windows
you must have some luck
Prepare your PC:
google for QPST_2.7.474 and install it
install provided drivers (if they willn't work, google for better)
from provided nokia_mbn_files.zip find the right mcfg_sw.mbn for your carrier, if there isn't any mbn for your carrier, you can try another one, but without warranty
Prepare your phone:
backup everything, what you can especially EFS partition - just for sure
root your phone with provided Magisk.zip
boot up your phone
In Magisk Manager app find and install VoEnablermodule, restart phone
there will be new settings under Settings-Network & internet-Mobile network-Advanced
connect phone to PC and set to charge only mod
in terminal emulator run this commands (this will enable diagnostic port on phone):
Code:
su
setenforce 0
setprop sys.usb.configfs 1 && setprop sys.usb.config diag,serial_cdev,rmnet_gsi,adb
Next steps:
find PDC tool from installed QPST and open
select device from drop-down menu, if it is empty, you will have to reinstall/choose another driver
click load button and find prepared mcfg_sw.mbn file
now right-click on new loaded profile and select SetSelectedConfig - Sub0
and now button Activate
activate provided VoEnabler module via MagiskManager
restart device
and now, if you are lucky one, your VoLTE is working :victory:
Final steps:
if everything is working, you should reinstall original Magisk from twrp
Troubleshhoting:
99,9% of all problems comes with wrong driver
open windows device manager and try to choose another driver for HW like:
Qualcomm HS-USB Modem 9091
Qualcomm HS-USB Diagnostics 9091
Qualcomm HS-USB WWAN Adapter 9091
Is it working?
dial *#*#4636#*#*
Phone information-3dots-IMS service status
If IMS Registration: Registered and Voice over LTE: Available you won
after update with factory images you will have to re-do this steps
Confirmed carriers:
Czech T-mobile
VoLTE - yes
VoWiFi - no
Poland Orange(confirmed by @saperkus)
VoLTE - yes
VoWiFi - yes
Poland Play(confirmed by @saperkus)
VoLTE - yes
VoWiFi - yes
Telenor Bulgariawith Telenor Danemark mbn (confirmed by @pavel5044)
VoLTE - yes
VoWiFi - no
T-Mobile Hungary (Telekom)(confirmed by @hunfatal)
VoLTE - yes
VoWiFi - no
Downloads:
Code:
Drivers:
[url]https://mega.nz/#!oMEHTIbA!0g7ahr8r81Q3ue8LpEy-sfd7FTLEEQlGRi2CJfG_Kq0[/url]
somin.n said:
Hi Let me introduce tutorial, how to enable VoLTE/VoWiFi for some other carriers. All credits goes to @Airpil for his great work with enabling diag port for Pixel 2 phones and to @topjohnwu for his original Magisk project.
Prerequizites:
your carrier have to support this feature
and you have to enable this feature on operator's side
PC with windows
you must have some luck
Prepare your PC:
google for QPST_2.7.474 and install it
install provided drivers (if they willn't work, google for better)
from provided nokia_mbn_files.zip find the right mcfg_sw.mbn for your carrier, if there isn't any mbn for your carrier, you can try another one, but without warranty
Prepare your phone:
backup everything, what you can especially EFS partition - just for sure
root your phone with provided Magisk.zip
boot up your phone
In Magisk Manager app find and install VoEnabler module, restart phone
there will be new settings under Settings-Network & internet-Mobile network-Advanced
connect phone to PC and set to charge only mod
in terminal emulator run this commands (this will enable diagnostic port on phone):
Code:
setenforce 0
setprop sys.usb.configfs 1 && setprop sys.usb.config diag,serial_cdev,rmnet_gsi,adb
Next steps:
find PDC tool from installed QPST and open
select device from drop-down menu, if it is empty, you will have to reinstall/choose another driver
click load button and find prepared mcfg_sw.mbn file
now right-click on new loaded profile and select SetSelectedConfig - Sub0
and now button Activate
and now, if you are lucky one, your VoLTE is working :victory:
Final steps:
if everything is working, you should reinstall original Magisk from twrp
Troubleshhoting:
99,9% of all problems comes with wrong driver
open windows device manager and try to choose another driver for HW like:
Qualcomm HS-USB Modem 9091
Qualcomm HS-USB Diagnostics 9091
Qualcomm HS-USB WWAN Adapter 9091
Is it working?
dial *#*#4636#*#*
Phone information-3dots-IMS service status
If IMS Registration: Registered and Voice over LTE: Available you won
Downloads:
Code:
Drivers:
[url]https://mega.nz/#!oMEHTIbA!0g7ahr8r81Q3ue8LpEy-sfd7FTLEEQlGRi2CJfG_Kq0[/url]
Click to expand...
Click to collapse
Hi I am stuck at the terminal emulator step.
when i type in "setenforce 0" the terminal says "couldn't set enforcing status to '0' invalid argument"
i tried googling and tried some stuff but no luck.
Note: Is there something to do with the kernel coz i am on Sultan Kernel and not sure if its build for only enforcing or only permissive.
please get back to me ASAP.
thankyou
royroyal said:
Hi I am stuck at the terminal emulator step.
when i type in "setenforce 0" the terminal says "couldn't set enforcing status to '0' invalid argument"
i tried googling and tried some stuff but no luck.
Note: Is there something to do with the kernel coz i am on Sultan Kernel and not sure if its build for only enforcing or only permissive.
please get back to me ASAP.
thankyou
Click to expand...
Click to collapse
Hi, yeah, my mistake :angel: You have to use "su" command first to allow root access. Full command is:
Code:
su
setenforce 0
setprop sys.usb.configfs 1 && setprop sys.usb.config diag,serial_cdev,rmnet_gsi,adb
And please, don't quote full first post
somin.n said:
Hi, yeah, my mistake :angel: You have to use "su" command first to allow root access. Full command is:
And please, don't quote full first post
Click to expand...
Click to collapse
Yes sorry for replying over the OP.
Yes i knew already to use "su" inorder to grant supersu access, but this didnt work for me and i am not able to proceed. Husssshh..
royroyal said:
Yes sorry for replying over the OP.
Yes i knew already to use "su" inorder to grant supersu access, but this didnt work for me and i am not able to proceed. Husssshh..
Click to expand...
Click to collapse
Hmm, should work? Try to write it, not copy... Try the other command without changing enfonforcing, it is maybe not necessary.
somin.n said:
Hmm, should work? Try to write it, not copy... Try the other command without changing enfonforcing, it is maybe not necessary.
Click to expand...
Click to collapse
Tried to write as well as copying, also tried without the 1st command but no luck.. and as no one has tried this yet aslo not able to know if this is happening with my device only.
royroyal said:
Tried to write as well as copying, also tried without the 1st command but no luck.. and as no one has tried this yet aslo not able to know if this is happening with my device only.
Click to expand...
Click to collapse
Interesting try to restart your phone, open windows device manager, connect phone (now should be detected some new hw), open terminal and write commands and look, if some new hw was detected or if you have some new unknown devices in device manager. You should also look to Airpil's thread for some help.
Code:
[url]https://forum.xda-developers.com/pixel-2-xl/how-to/guide-qxdm-port-activation-pixel-2-xl-t3884967[/url]
somin.n said:
Interesting try to restart your phone, open windows device manager, connect phone (now should be detected some new hw), open terminal and write commands and look, if some new hw was detected or if you have some new unknown devices in device manager. You should also look to Airpil's thread for some help.
Click to expand...
Click to collapse
Will try this and update here
Successfully enable volte on my pixel2,Thanks!
Please provide carrier details in your post guys! With that being said, has anyone got it to work on Straight Talk (Verizon or ATT sim?)
Enable VoLTE for Vodafone in India
Vodafone in India has not provisioned the Pixel 2 till yet for VoLTE despite many people getting after them. A lot of noise was generated by users when Google pointed out that they had done what was required in the Android Pie updates.
Many thanks for this guide as it has helped me to enable VoLTE on my Pixel 2. On checking with *#*#4636#*#* it shows that VoLTE is now provisioned for voice. I now need to connect to any other phone where VoLTE is working and see if it indeed connects using VoLTE.
The only problem I had was in opening the port before using QPST. I had to type in the commands a second time in the terminal and then the port opened allowing me to proceed.
almightysiman said:
Successfully enable volte on my pixel2,Thanks!
Click to expand...
Click to collapse
Hi,
did u do it over the stock rom/kernel or on any custom kernel.
and can u post every step that u did to get it done.
currently i m on pure stock 9.0 pie with locked bootloader on february security patch.
this is my previous comment over the thread..
Hi I am stuck at the terminal emulator step.
when i type in "setenforce 0" the terminal says "couldn't set enforcing status to '0' invalid argument"
i tried googling and tried some stuff but no luck.
Note: Is there something to do with the kernel coz i am on Sultan Kernel and not sure if its build for only enforcing or only permissive.
royroyal said:
Hi,
did u do it over the stock rom/kernel or on any custom kernel.
and can u post every step that u did to get it done.
currently i m on pure stock 9.0 pie with locked bootloader on february security patch.
this is my previous comment over the thread..
Hi I am stuck at the terminal emulator step.
when i type in "setenforce 0" the terminal says "couldn't set enforcing status to '0' invalid argument"
i tried googling and tried some stuff but no luck.
Note: Is there something to do with the kernel coz i am on Sultan Kernel and not sure if its build for only enforcing or only permissive.
Click to expand...
Click to collapse
I am on du rom.you should type su before setenforce 0
Hadookie said:
Please provide carrier details in your post guys! With that being said, has anyone got it to work on Straight Talk (Verizon or ATT sim?)
Click to expand...
Click to collapse
I'm back overseas now, but while I was home for the holidays I used a Straight Talk ATT sim and had no problems using the MagiskHide Props module to manually add the lines from this module:
https://forum.xda-developers.com/apps/magisk/module-v4-volte-enabler-t3649613
It was somewhat inconsistent though. Seemed to only work with certain people I called. Also, I use Google Voice when I'm home, so that may account for the inconsistency.
I haven't tried the method outlined by the OP, though. I've had a solid setup for months now and I'm a bit hesitant to try anything that might kink it up.
Edit:
Now that I think about it, I never checked the IMS Registration to be sure, so I can't be sure if it was actually working, but it would show the "HD" calling icon on the dialer screen when connected, so I just assumed it was working.
Thank you for sharing this guide.
I can confirm, that VoLTE and VoWiFi is working fine in Orange Poland and PLAY (Poland). In case of PLAY, both services are disabled by default. You have to contact with service provider and ask them to enable WiFi Calling. By enabling it, VoLTE will be also enabled.
saperkus said:
Thank you for sharing this guide.
I can confirm, that VoLTE is working in Orange Poland and VoLTE and VoWiFi is working in PLAY (Poland). In case of PLAY, both services are disabled by default. You have to contact with service provider and ask them to enable WiFi Calling. By enabling it, VoLTE will be also enabled.
Click to expand...
Click to collapse
Any chance to get WiFi calling working on Orange PL?
And will this work at all on OG Pixel?
bige93 said:
Any chance to get WiFi calling working on Orange PL?
Click to expand...
Click to collapse
It seems, that I haven't been patient enough in case of Orange PL... I have redone the tests and was able to make VoWiFi to work. There's a need to reboot the device after swapping SIM cards. After reboot, VoWiFi works fine.
bige93 said:
And will this work at all on OG Pixel?
Click to expand...
Click to collapse
You're free to check it. I've checked on Nexus 5X and it didn't work at all.
saperkus said:
It seems, that I haven't been patient enough in case of Orange PL... I have redone the tests and was able to make VoWiFi to work. There's a need to reboot the device after swapping SIM cards. After reboot, VoWiFi works fine.
You're free to check it. I've checked on Nexus 5X and it didn't work at all.
Click to expand...
Click to collapse
Do I have to use some special ("diag") version of the Magisk as it says it the 1st post? Can't find 'magisk diag' for Sailfish.
bige93 said:
Do I have to use some special ("diag") version of the Magisk as it says it the 1st post? Can't find 'magisk diag' for Sailfish.
Click to expand...
Click to collapse
This is a modded version of Magisk, which gives an ability to enable diagnostic port (normally it can't be enabled). It was prepared for Pixel 2 XL, but it also works fine with Pixel 2. I can't tell, if you need to use this version or not. Install standard Magisk version and check if you can enable this port using provided commands. If not, then it's up to you to decide, if you want to check modded version of Magisk or not.
Has anybody tried to install the modified Magisk on android Q Beta yet? I am getting error 1, it doesn't install