Source:
http://forum.xda-developers.com/gala...ds-to-t2886059Use your phone anywhere
Have you ever wondered why your phone doesn't work nearly as well when you travel?
Or tried to change carriers only to be told that you'd need to buy a different version of your high end phone for it to work properly?
It's happened to a lot of us and there is no good reason for it. Other than greedy carriers that is.
Most phones should work on a lot more bands. And have good reception when roaming. The S5 in particular is one of the first phones that is fully capable of working on every GSM and LTE frequency in the world. So.. why doesn't it actually do that? Well because your carrier doesn't want to make it easy for you to leave. And because Samsung and other manufacturers want to force you to buy a new phone everytime you change telephone companies. So they put restrictions in your phone to limit how many bands you can use. Wouldn't you rather have your phone work on all carriers?
This guide will show you how to do that.
Okay okay, I'm convinced already.
I don't want to read any more. I'm a power user (or reckless).. just show me how to do the hack!
The lawyers made us do it
We have to post an obligatory warning
We don't think that this mod will cause you any problems. But we can't guarantee that.
You assume all risks if you proceed, including the risk that your phone might object, meltdown, brick or void your warranty.
Quick Start Guide
CLICK TO HIDE CONTENT
This mod makes a night and day difference when you travel, roam or change carriers. It's a dramatic improvement.
But it's not an easy, one click process. There are a lot of steps to add this to your phone.
And due to minor differences between brands (finding the hidden USB settings menu), it may take a little experimenting to succeed. So this mod won't be for everyone. But if you have some patience, you can add a lot of bands to your phone. Just post in the thread and we'll figure it out as we go. This Quick Start guide will show you how to add bands to a Samsung S5. It can also be used on dozens of other Samsung, Sony, LG, HTC, Nexus, etc phones with minor differences in the steps here. I'll add comments for other brands when I have them. If you get stuck anywhere, post in the thread for guidance.
The Mod:
Step by step guide
1. You need a phone with a Qualcomm processor that has been rooted.
2. If you need to root your phone, click on the button below for guidance. Otherwise skip to step 3.
CLICK TO HIDE CONTENT
How to root your phone
There are a lot of XDA threads explaining how to root your phone. Towel root will work with almost all phones (and doesn't increment the Samsung Knox flag, if you care about that). You need a pre June 6, 2014 firmware build for the original Towel Root method to work. Otherwise, downgrade to an older firmware first (Use Odin software for Samsung), then root with Towel root. Or you can look for the modified Towel root that is said to work with newer firmware (unconfirmed by me). Another excellent root method is CF-Autoroot which works with most popular phones.
3. If you are running a custom ROM and kernel that were compiled from source code, well done. Skip to Step 4.
Otherwise click on the button below for more information.
CLICK TO HIDE CONTENT
Custom ROM & kernel
Qualcomm apparently reads XDA too and appears to have added some anti-tamper code to keep this hack or similiar mods from working. Drat! Until we figure out exactly what they added, you will need a custom ROM & kernel for this mod to work. This works because a kernel made from scratch won't have the anti-tamper code in it. Probably you only need the custom kernel and not the full custom ROM (unconfirmed). Configurations known to work include CM11 + Ark kernel. And Phoenix V3 ROM + kernel. But any custom ROM + kernel that is made from source, rather than modified stock will probably work fine. If anyone is still running Jelly Bean (firmware versions 4.2.2. and below), you probably don't have the anti-tamper code and won't need a custom ROM or kernel.
You can go ahead and try adding bands without a custom kernel. It probably won't work, but you can leave the custom kernel as the very last step if you want to and see if adding bands without a custom kernel succeeds. Note that installing a custom kernel on a Samsung phone will increment the Knox flag if you care about that (the Knox flag might affect a warranty claim).
If you have a Verizon or ATT phone, you should know that these two carriers do something that almost no other carrier does. These two carriers lock the bootloader which prevents installing a custom kernel in the normal manner. The Safestrap program can emulate another ROM, but we won't know if that is sufficient or not for this mod. If you are with Verizon or ATT, let us know if you were able to add bands or not.
Follow this link for details about the Phoenix ROM + kernel for the S5.
You can find CM11 downloads here for various phones. Then look for an XDA support thread for your phone.
Ark kernel
4. Download and install QPST. We will use this program to edit your phone settings. This runs best on Windows XP. But you can use Windows 7 (and probably Win 8, if you must). Right click on setup.exe (not the .msi file) and choose run as adminstrator.
5. Download and install QXDM. We will use this program to "write enable" your phone settings. QXDM won't work unless QPST is also installed, so you need both programs. Right click on setup.exe and choose run as administrator to install.
6. Open the USB settings screen on your phone. Change USB from AP to CP. And USB settings from MTP + ADB to RNDIS + DM + Modem mode (after you have finished making edits in your phone's memory, remember to revert the original settings in this screen).
This is the hardest part of this mod as the USB setting menu is usually hidden and the method to access it is slightly different on some brands. For the S5, you can open it by dialing *#0808# . Other phones may use *#7284# , *#8778# , *#*#8778#*#* , ##3424# or something else entirely. If those codes don't work on your phone, try a Google search for keywords like those below to find out how to open the USB settings menu for your phone:
Google: USB settings <brand> xda
Google: how to use QPST <brand> xda
6a. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
For Sony, the following CLI commands have been reported to work. These may or may not work for other brands.
You can enter these using a terminal emulator app or from an adb shell.
From terminal emulator:
Code:
su
setprop persist.usb.eng 1
setprop usb.rndis.enable 1
echo 1 > /sys/class/usb_composite/modem/enable
Or using adb:
Code:
adb start-server
adb shell
su
setprop persist.usb.eng 1
setprop usb.rndis.enable 1
echo 1 > /sys/class/usb_composite/modem/enable
exit
If you use either of these, remember to revert the USB settings after you finish your phone edits. e.g.
Code:
su
setprop persist.usb.eng 0
setprop usb.rndis.enable 0
echo 0 > /sys/class/usb_composite/modem/enable
6b. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an LGE phone, try the dialer codes here and change the USB mode from AP to CP (Modem mode). If that doesn't work, then it has been reported that the following commands will also enable diagnostic mode for you:
Code:
su
echo 1 > /sys/devices/platform/lg_diag_cmd/diag_enable
setprop sys.usb.config acm,diag,mtp,adb
6c. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an HTC phone, this diagnostic driver may work for your phone.
6d. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an Opo phone, it been reported that the following commands will enable diagnostic mode for your phone.
Code:
su
setprop sys.usb.config diag,adb
6e. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have a custom kernel installed (which has permissive permissions) then you can probably enable diagnostic USB mode from the EFS Professional program menu.
6f. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you cannot find out how to access the USB settings on your phone anywhere, you may be able to force diagnostic mode by installing the Windows USB drivers for your phone in advance. You can download Motorola /Sony/ LG/ HTC/ ASUS/ Huawei /Google, etc drivers here. Otherwise do a Google /XDA search to find USB drivers for your phone. Install the USB driver.
7. Enable USB debugging on your phone. This is a hidden menu. Look for Settings menu > System > About Device > Developer. If you don't see a Developer option, then tap on the firmware build number about ten times to unhide it.
8. Connect your phone to your phone to an USB port on your PC. Do not use an USB hub, connect directly to your computer. Windows will install a diagnostic driver.
9. Open the Windows (Control panel) Device Manager and confirm that you see something like "Samsung Mobile USB Serial Port" listed there. If you see a yellow triangle there > right click and update the driver.
10. Open the "QPST Configuration" program > Ports > Add new port > choose the port labeled diagnostic > OK.
If you do not see a diagnostic port listed and you were not able to explictly able to set USB diagnostic mode earlier, then right click on the driver that Windows has assigned to your phone in the Windows (Control panel) Device Manager > Update Driver Software > Browse. Choose the folder where you extracted the USB driver that you downloaded for your phone. This forces Windows to use the downloaded driver.
11. Now select the QPST Start Clients > Software download > Backup > Start. This saves a backup copy of your phone's stock NV memory to your computer in case you need it later.
12. Navigate to the C:/Program Files/Qualcomm/QPST/bin folder.
13. Right click on ServiceProg.exe > run as administrator.
14. Choose Phone > Read from phone > UMTS System. This will show which 3G bands are currently enabled. Add checkmarks to the additional 3G bands that you would like to add. Resist the temptation to check everything unless you are prepared to troubleshoot possible issues with non-existant bands, slow boot times and other issues. Just add specific bands that you need for another carrier or are missing in the areas you travel. If you aren't sure what to add, then don't check any extra bands for now - you can always come back later after you find out which 3G bands you can actually make use of.
Either way, do not click write to phone yet. And do not close the Service Programming window either.
15. Before we write anything to your phone, we need to write enable the locations we are going to edit. Navigate to the C:/Program Files/Qualcomm/QXDM/bin folder.
16. Right click on QXDM.exe > run as administrator. If you are not adding any new 3G bands at this time, skip to step 21.
17. In the NV Browser window, scroll down to ID 01877 (aka NV 1877) > Read.
Then write "0" to NV 01877 with QXDM. This initializes (write enables) the item for QPST. We need to do the same for several more NV items.
18. Select ID 00441 > Read. > Write "0" to NV 00441 with QXDM. This initializes (write enables) the item for QPST.
19. Select ID 00946 > Read. > Write "0" to NV 00946 with QXDM. This initializes (write enables) the item for QPST.
20. Select ID 02954 > Read. > Write "0" to NV 02954 with QXDM. This initializes (write enables) the item for QPST.
21. If you do not intend to add any new LTE bands, skip to step 24. Otherwise,
Select ID 06828 > Read. > Write "0" to NV 06828 with QXDM. This initializes (write enables) the item for QPST.
22. Select ID 06829 > Read. > Write "0" to NV 06829 with QXDM. This initializes (write enables) the item for QPST.
23. If you wish to add LTE bands and have already calculated a custom value from the instructions in the thread, then use QXDM to write that value to both ID 06829 and ID 06829, writing one item at a time.
Otherwise, write (decimal) "17592185995263" to both ID 06828 and ID 06829, writing one item at a time. This will enable all LTE bands.
Note that LTE edits will only work if your firmware has an LTE modem. If you already have at least one LTE band active, then you are OK. If your current firmware is from a carrier that does not use LTE at all, then you'll also need to update your modem to an LTE capable version as well.
24. Now go back to the Service Programming window that you left open. If you added any new 3G bands, click on write to phone to write the current selection of 3G bands to your phone. Otherwise do not click write, simply continue on to the next step.
25. You are now finished editing the NV values in your phone.
26. Reboot your phone.
27 In the Service Programming screen, choose Phone > Read from phone > UMTS System to confirm that your new 3G band selection are persistent. If they revert and you don't have a custom kernel installed, this confirms that you will need a custom kernel for this mod to work.
28. In the QXDM NV Browser screen, scroll down to ID 06828 > Read. Note the value.
29. In the QXDM NV Browser screen, scroll down to ID 06829 > Read. Note the value.
ID 06828 and ID 06829 should both show the custom value that you wrote. i.e. "17592185995263" (or hex "0xFFFFFFF3FFF") or the custom value, if you had used one.
30. Remember to change your USB settings back to normal mode, e.g. on the S5, dial *#0808# again and choose USB = AP and USB Settings = MTP + ADB > Click OK.
31. Celebrate! And let us know about your success (or sticking points).
32. You can test your results by checking whether your phone uses the new bands when you roam onto other systems that use them. Or if you have a SIM card for an alternate carrier. To tell if your phone is using the new bands, you can look at the current band being used in the Service menu or with various apps, e.g. LTE Discovery.
.
So now what?
Well, if you decided to jump in and follow the Quick Start Guide.. that's it. The Quick Start Guide has everything that you need to add new bands to your phone. Unless you run into difficulties, you don't need anything else. The guide is a bit terse as I don't have a lot of spare time to rewrite or polish it. But all of the important information is there.
If something doesn't make sense or you get stuck somewhere, you can (and should) try a quick search for details. If that doesn't resolve your issue, then post in this thread for help. If you want to learn more about how this works, why more bands is a good thing. Or how to make custom edits that choose particular frequency bands, then keep reading this post and the rest of the thread.
This is a proven working method, despite a few trolls claiming otherwise. It's also new territory and there are model specific quirks.
If you run into problems, most likely you missed a step somewhere. Less likely, you may have discovered something new that needs to be unraveled.
The purpose of this thread is to discuss new findings and suggest ways to improve this method.
This is not a support thread, although if you make an effort to provide enough detail about your situation, someone will probably try to help you.
Is this mod hard to do?
No. There really isn't anything hard about it. But it's not a one click kind of mod either. These are recent discoveries and there are a lot of steps needed to make these changes. Samsung doesn't want to make it easy for you - they'd rather sell you another phone. In particular, there is one hidden menu (USB settings) that is hard to find because it's in a different place on almost every brand of phone. So we have to Google around for details and experiment a bit to find the hidden menu for some brands. But the mod works. If you have a little patience and don't get frustrated at temporary obstacles, then you can add bands to your phone!
One surprising finding was that people with older phones were having better results. Why? It seems that Qualcomm quietly added some anti-tamper code into recent Android versions to keep us from doing this. It's almost like they read our forum and know what we're trying to mod. But they wouldn't spy on us like that, would they?
We don't know where the anti tamper code was added yet but we found that we can avoid it on newer phones by installing a custom kernel & ROM. So until we discover where they added the anti tamper stuff, you also need a custom kernel & ROM (probably the custom kernel is the essential part) to make this mod work. Unless you happen to have an older phone that is still running Jelly bean (4.2.2) firmware. So that's it in a nutshell.
Okay. So give me a quick overview again
Our phones have artificial restrictions in them so that they only work properly on the original carrier. If you travel (roam) or change phone companies, your phone won't work 100% because it will have gaps in coverage. It will be missing some of the frequency bands that the other carrier uses. This isn't a technological limitation. It's just your wireless carrier siphoning more money out of your pocket by forcing you to buy a new phone when you change carriers.
This mod has a lot of steps in it, so it won't be for everyone. But if you have some patience or enjoy a challenge then it's a great way to really improve how well your phone works when you roam onto another carrier. There are three parts to this mod. You need:
1. A phone with a Qualcomm processor, that is rooted.
2. (For now) Install a custom ROM & kernel to get rid of the anti-tamper code
3. Edit six values in your phone's non volatile (NV) memory to enable a lot of additional frequency bands
That's it. It takes about thirty steps to do those three things but nothing really good ever turns out to be easy, right?
