Database Users

Root menu access to Diagnostic version (.1122)

SO I upgraded to nodo and had to hard rest. I updated my phone with official nodo release for At&t. I did ##634# and it would not download the previous version of the diagnostic program; only the new version that does not let you get to the root menu. I have a work around for the moment with the new version of the diagnostic program version (.1122)
in the new diagnostic program type *#32489# after that you can use the back button on screen three times and you are at the root menu of the diagnostic program. Maybe someone might be able to find a direct input number but for now this is to my knowledge the only way.
Update- All other updates and codes are in conjunction with the diagnosis codes thread.
when trying to access audio menu type in the following, since its a slightly different code than the previous version.
Increase your default volume.
*#0002*28345#
Click Get under the Device Gain (max/min)
In the first box keep the number 7
In the second box put 16000
In the third box put 0
Click Set
Click Start
Click the home button.
Restart your phone. To verify the setting took click the get button and it should show your values.

[HowTo] [VZW XT907/926 RAZR M/HD] Unlock US GSM Carriers Using RadioComm

Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!

<Reserved>

Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?

Yehudah said:
Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?
Click to expand...
Click to collapse
Running RAZR M in US on straight talk now. Works wonderful!!!

Thanks a lot! im a total noob when it comes to most of this, but it worked perfect for me!!

Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?

Skrilax_CZ said:
Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?
Click to expand...
Click to collapse
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.

Remember to install the latest Motorola drivers and *especially* highlight the entire 01 and type 00. I was backspacing only the 1 and it did not "stick" when writing. So HIGHLIGHT, don't backspace. Works perfectly.

is it possible to write the NV item to the Droid 4 then edit ? ?
cellzealot said:
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.
Click to expand...
Click to collapse

Can I use a similar way to unlock XT902(Japanese Razr M)? I can't find 8322 in XT902.......

Followed instructions and worked perfectly. The key for me was the latest Motorola drivers AND the Motorola USB cable that came with the phone. I tried other cables that both charged and synced but the only that worked for this was the Moto cable. Using Win XP SP3 ( 12 year old OS on brand new work laptop. WTF!)

i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.

AKG0214 said:
i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.
Click to expand...
Click to collapse
Boost - No
Cricket - No
They're both cdma. This is to allow the GSM side (SIM CARD based) of the phone to work on other carriers. With that said, your best options are
Net10, Straight Talk, ATT, T-Mobile, Simple Mobile, H20, Orange, and there's a plethora of others out there. Post paid and pre-paid.
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.

after boot, it is set back to 01 again @ address 8322
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
cellzealot said:
Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!
Click to expand...
Click to collapse
---------- Post added at 11:14 PM ---------- Previous post was at 10:48 PM ----------
tried again for couple of times, this time it actually works.
maybe last time I reboot the phone too early?
sipida said:
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
Click to expand...
Click to collapse

Glad you got it working. There is no VZW software on the phone capable of writing to the radio NV, so it's not being reverted by anything.
If anyone else has similar issues I would suggest trying the NV/SEEM method as that will definitely write the item properly.

queberican351 said:
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.
Click to expand...
Click to collapse
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.

Does this tutorial unlock mobile data usage on other carriers. I cannot seem to get data working on my XT907 in Australia. GSM and MMS work fine, so why doesnt Data?

I don't know for certain because I only have experience with domestic US GSM carriers, but I tend to doubt it.
You can try it and see and revert it easily if it doesn't work. You can also try flashing the Telstra XT905 NON-HLOS.bin(modem) and fsg.mbn(carrierEFS/NVM config).
This was the method used to get US GSM service on XT907 before the method shown here was discovered.
It works but is limited to GSM/EDGE data services here in the US.
I am inclined to think it is some other problem with the device because it should work as a global capable phone by default.

dsdd said:
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.
Click to expand...
Click to collapse
If it has a sim lock and you can acquire the code open your dialer and press #073887* (#0SETUP*) and it'll prompt you for the code.

Several people have PMd me questions about this method and I would much prefer that they be posted here in the thread so that everyone may benefit from the information.
Please include as much information about your PC and driver versions and be as thorough as possible in explaining your problems.

Fixing 0 IMEI

Hello. I've been getting a lot of emails on how to do that and i thought i should make a thread here.
Now you got to have the original box in which there is the imei written. I don't take any credit for this guide as i didn't write it but i found it somewhere here but it doesn't exist anymore. I'm not responsible for any damage may happen to your phone. I did it several times after flashing official 2.3.5.
It has worked fine with my IDEOS X5 U8800.
1. Tools
a. Drivers for U800 32bit win 7 (tested and work )
http://www.2shared.com/file/fnP5fc8G/u8800Drivers.html
b. Drivers for Android 32 and 64 bit win 7 (not tested )
http://www.2shared.com/file/ZNZ4Q0lk...012_09_12.html
c. Software for restore
http://www.2shared.com/file/xBxUOnPz/DFS.html
2. Enable debugging by USB in the settings.
In call type * # * # 2846579 # * # * http://postimage.org/image/tnj4s2dyj/
3. Go to ProjectMenu -> Background settings -> Usb port settings put the Manufacture mode and corfim.
4. Go again to ProjectMenu -> Background settings -> Qualcomm backround open settings put the background open. Password 0 and corfim.
5. Go again to ProjectMenu -> Background settings -> Log setting -> Log switch put log on and corfim.
6. Now conect your phone to pc and install the drivers.
You must see this at your device manager http://postimage.org/image/5lrm61agd/
7. Instal DFS and run.
8. Click Ports, select the port with the signature DBAdapter Reserved Interface (double click) to close.
http://postimage.org/image/3l3bmfyzr/
9. In the DM select Qualcomm.
http://postimage.org/image/6bmt1908z/
10) Press the SPC, the bottom will Device Unlocked.
11) Select Programming and in the IMEI write yours and press Write.
http://postimage.org/image/dmbp29q35/
13) Check Imei, may appear after a reboot, if not try a few more times to try to set the port speed to 115200 (box to the left of DM)
Check IMEI *#06#
As soon as the IMEI restored change:
* # * # 2846579 # * # * -> ProjectMenu -> Background settings -> Usb port settings to put on the Manufacture mode google mode (or normal if you do not get up google)
* # * # 2846579 # * # * -> ProjectMenu - > Background settings -> Qualcomm backround open settings put close
Good luck..

Thanks a lot... now I got my imei back. But now I have one another problem, I installed ics rom and now my wifi Mac id is 00:00:00:00:00:00. Are they related?
Sent from my U8800 using XDA Premium 4 mobile app

I don't think so. But I've already replied somewhere on how to fix mac address. Search
Sent from my U8800 using xda app-developers app

Didn't work for me
Cybergiannis said:
Hello. I've been getting a lot of emails on how to do that and i thought i should make a thread here.
Now you got to have the original box in which there is the imei written. I don't take any credit for this guide as i didn't write it but i found it somewhere here but it doesn't exist anymore. I'm not responsible for any damage may happen to your phone. I did it several times after flashing official 2.3.5.
It has worked fine with my IDEOS X5 U8800.
1. Tools
a. Drivers for U800 32bit win 7 (tested and work )
http://www.2shared.com/file/fnP5fc8G/u8800Drivers.html
b. Drivers for Android 32 and 64 bit win 7 (not tested )
http://www.2shared.com/file/ZNZ4Q0lk...012_09_12.html
c. Software for restore
http://www.2shared.com/file/xBxUOnPz/DFS.html
2. Enable debugging by USB in the settings.
In call type * # * # 2846579 # * # * http://postimage.org/image/tnj4s2dyj/
3. Go to ProjectMenu -> Background settings -> Usb port settings put the Manufacture mode and corfim.
4. Go again to ProjectMenu -> Background settings -> Qualcomm backround open settings put the background open. Password 0 and corfim.
5. Go again to ProjectMenu -> Background settings -> Log setting -> Log switch put log on and corfim.
6. Now conect your phone to pc and install the drivers.
You must see this at your device manager http://postimage.org/image/5lrm61agd/
7. Instal DFS and run.
8. Click Ports, select the port with the signature DBAdapter Reserved Interface (double click) to close.
http://postimage.org/image/3l3bmfyzr/
9. In the DM select Qualcomm.
http://postimage.org/image/6bmt1908z/
10) Press the SPC, the bottom will Device Unlocked.
11) Select Programming and in the IMEI write yours and press Write.
http://postimage.org/image/dmbp29q35/
13) Check Imei, may appear after a reboot, if not try a few more times to try to set the port speed to 115200 (box to the left of DM)
Check IMEI *#06#
As soon as the IMEI restored change:
* # * # 2846579 # * # * -> ProjectMenu -> Background settings -> Usb port settings to put on the Manufacture mode google mode (or normal if you do not get up google)
* # * # 2846579 # * # * -> ProjectMenu - > Background settings -> Qualcomm backround open settings put close
Good luck..
Click to expand...
Click to collapse
This procedure did not work for me. I found it a couple of weeks ago in another thread (http://forum.xda-developers.com/showthread.php?t=1591997) and gave it a try (numerous times) without success. I was able to complete all steps up until actually writing the new IMEI. I attempted to write it a couple of dozen times without any success. It appears to work but the lMEI never actually changes.
I also found another procedure using a program called NVedit but it would give me an error stating the NV location was set to read only (I forget the actually wording). It seems that my phone has the location that contains my IMEI locked in some way that nothing can change it. So I gave up on that phone and am using a different one that I bought on eBay, brand new at a dirt cheap price ($27.00).

pastorbob62 said:
This procedure did not work for me. I found it a couple of weeks ago in another thread (http://forum.xda-developers.com/showthread.php?t=1591997) and gave it a try (numerous times) without success. I was able to complete all steps up until actually writing the new IMEI. I attempted to write it a couple of dozen times without any success. It appears to work but the lMEI never actually changes.
I also found another procedure using a program called NVedit but it would give me an error stating the NV location was set to read only (I forget the actually wording). It seems that my phone has the location that contains my IMEI locked in some way that nothing can change it. So I gave up on that phone and am using a different one that I bought on eBay, brand new at a dirt cheap price ($27.00).
Click to expand...
Click to collapse
are you rooted? i remember having these issues when i flashed 2.3 after 4.2 rom. u first need ti flash 2.2 then 2.3 and that should work

Cybergiannis said:
are you rooted? i remember having these issues when i flashed 2.3 after 4.2 rom. u first need ti flash 2.2 then 2.3 and that should work
Click to expand...
Click to collapse
Yes, I am rooted.
I started out on 2.2 way back in the beginning. Then I flashed 2.3.5. That's when I lost my IMEI and replaced the phone.
But I wanted to keep experimenting at getting it working 100% even though I had a new working, rooted, and customized phone. Using 5IromToolBox I restored a backup from the new phone to the broken phone just to see if it would work. Then I flashed Stallion-51-ICS custom ROM. It is a GB based ROM with look and feel of ICS.
When I run the procedure in this thread, everything looks as though it has worked, but the IMEI never changes. So what did 5Irom do differently that it was able to restore the backup from a different phone but I cannot use DFS or NVEditor to write to the locations? The back I made from the new phone and restored to the old one is Consumer Cellular so I suspect they have locked something out that 5Irom is able to get around but other tools don't.
On another note, just for the heck of it I tried to upgrade to ICS from GB and it fails on the first update step. Go figure.
If I could find a full-flash procedure for the pro and 51 versions of this phone I suspect I could resolve all issues. Who knows?
UPDATE: I went through the whole process again and noted a point I forgot to mention. In DFS at the bottom of the screen EQF is yellow, not green. I don't recall exactly what that means but in reading through the DFS doc, it states that writing a new IMEI is not possible as long as EQF is yellow. When I enter my IMEI and click on the WRITE command the response is "MODECHANGE OfflineD OK"

pastorbob62 said:
Yes, I am rooted.
I started out on 2.2 way back in the beginning. Then I flashed 2.3.5. That's when I lost my IMEI and replaced the phone.
But I wanted to keep experimenting at getting it working 100% even though I had a new working, rooted, and customized phone. Using 5IromToolBox I restored a backup from the new phone to the broken phone just to see if it would work. Then I flashed Stallion-51-ICS custom ROM. It is a GB based ROM with look and feel of ICS.
When I run the procedure in this thread, everything looks as though it has worked, but the IMEI never changes. So what did 5Irom do differently that it was able to restore the backup from a different phone but I cannot use DFS or NVEditor to write to the locations? The back I made from the new phone and restored to the old one is Consumer Cellular so I suspect they have locked something out that 5Irom is able to get around but other tools don't.
On another note, just for the heck of it I tried to upgrade to ICS from GB and it fails on the first update step. Go figure.
If I could find a full-flash procedure for the pro and 51 versions of this phone I suspect I could resolve all issues. Who knows?
UPDATE: I went through the whole process again and noted a point I forgot to mention. In DFS at the bottom of the screen EQF is yellow, not green. I don't recall exactly what that means but in reading through the DFS doc, it states that writing a new IMEI is not possible as long as EQF is yellow. When I enter my IMEI and click on the WRITE command the response is "MODECHANGE OfflineD OK"
Click to expand...
Click to collapse
it should be green! what i would do is to flash 2.2 then 2.3.5 and follow again the steps very carefully! maybe u ever flashed a partition and it's not the default one? i can't really help you :/ try this and if it doesn't work make a thread in the q&a section

Cybergiannis said:
it should be green! what i would do is to flash 2.2 then 2.3.5 and follow again the steps very carefully! maybe u ever flashed a partition and it's not the default one? i can't really help you :/ try this and if it doesn't work make a thread in the q&a section
Click to expand...
Click to collapse
Yeah, I knew that it should be green. The bottom line is I do not have the 2.2 image to flash. I would have done that a long time ago if I had it. All I have is the DiskImage backup that I made off of my new phone. When I flashed it onto the old phone it starts, displays the Consumer Cellular logo for about ten seconds then shuts off immediately. As far as starting a thread in Q & A, I did that weeks ago and got nowhere fast.
Any link I have found for the original 2.2 for -51 and pro is usually a broken link. or it takes me to download that stupid iLivid program that doesn't do squat to get the files I need. I did find a DiskImage file that somebody made and posted but it is almost 4 gig in size. You are supposed to use Pink Screen to load it but Pink Screen only gives me access to the image directory and it's only 256 meg.
Thank you for your time and suggestions.

I believe in the wiki section there are links to default 2.2 and 2.3.5. The ones I found a long time ago were from Blefish, although I'm not sure. Good luck!
Sent from my U8800 using xda app-developers app

Dead link.
Hi.
I try to download the "Drivers for Android 32 and 64 bit win 7 (not tested )", but its a dead link. I run win7 pro, and somehow the 32 bit driver doesn't work.
Would like to try the 64 bit driver. Could u reupload it, please?

I just did a repost cause i veen asked a lot of times I don't have the files and I don't thinks drivers are needed. You could just install huawei's suite for PC
Sent from my U8800 using xda app-developers app

WORKS!!!!
Cybergiannis said:
I just did a repost cause i veen asked a lot of times I don't have the files and I don't thinks drivers are needed. You could just install huawei's suite for PC
Sent from my U8800 using xda app-developers app
Click to expand...
Click to collapse
YEY!!!!!!! It worked!!!!
Update the first post with this info so others dont have to struggle like I did.
Thanks a bunch!!! :victory:

ευχαριστω πολυ----thanks man

Hi All,
Many thanks for this post.
Iv recently installed the Blefish CM11 rom for U8800 and its works fine. Only issue I have is IMEI=0. I can make and receive calls and even use the mobile internet.
My question is - Is there a way to edit the IMEI no on KK4.4.2 ROM through entering in the engineering mode?
or else, will have to start from the beginning (stock rom process as mentioned in the OP).
thanks for your help.

mohammad.nomaan said:
Hi All,
Many thanks for this post.
Iv recently installed the Blefish CM11 rom for U8800 and its works fine. Only issue I have is IMEI=0. I can make and receive calls and even use the mobile internet.
My question is - Is there a way to edit the IMEI no on KK4.4.2 ROM through entering in the engineering mode?
or else, will have to start from the beginning (stock rom process as mentioned in the OP).
thanks for your help.
Click to expand...
Click to collapse
i have no idea. my guess is that u should try

Cybergiannis said:
i have no idea. my guess is that u should try
Click to expand...
Click to collapse
Hi,
I haven't found out the way to fix it yet.
Only way I got to fix is to redo the stock rom, root, save the imei and the reflash the custom rom.
The reason for the imei issue was changing the partitions
thnx anyways

this guide that you have post it has been made by me and at least you should have say that is ported from me. Even the links that you have are in my acount. YOU ONLY COPY MY POST . you could ask me to repost it or just mention me. Check this link http://forum.xda-developers.com/showthread.php?t=1876501

How to force 4G only (LTE only) Mode?

Can someone help me I am trying to force my Huawei P10 Plus to use LTE/4G only mode. I have latest Firmware/Patch Level.
I have tryed many service codes in format like *#*#.....#*#* codes but I can not set the LTE Only mode.
Isn't it possible without "root"?

It is possible to force "4G only" without root. First download "Setting Database Editor" from playstore. Open it and look for "hw_networkmode_preferences". I use this value "9,3,2,1,11" on my phone. Save it and restart your phone. If you still don't get "4G only" option then you need to open the "Setting Database Editor" again and look for "hw_add_4g_only". Mine was set to "250". You need to change it according to your country mobile code. Look for your mobile country code here: https://en.wikipedia.org/wiki/Mobile_country_code. In my case I change the value to "250;502" since 502 is my country code. Save it and restart your phone.
Tested on rebranded P10 Plus 256GB.

jula182 said:
It is possible to force "4G only" without root. First download "Setting Database Editor" from playstore. Open it and look for "hw_networkmode_preferences". I use this value "9,3,2,1,11" on my phone. Save it and restart your phone. If you still don't get "4G only" option then you need to open the "Setting Database Editor" again and look for "hw_add_4g_only". Mine was set to "250". You need to change it according to your country mobile code. Look for your mobile country code here: <1. o prevent spam on the XDA forums, ALL new users prevented from posting outside links in their messages. After approximately 10 posts, you will be able to post outside links. Thank you for understanding!>. In my case I change the value to "250;502" since 502 is my country code. Save it and restart your phone.
Tested on rebranded P10 Plus 256GB.
Click to expand...
Click to collapse
Thank you very much for your Help! I already installed the DB Settings Editor and found out that hw_networkmode_preferences were already "9,3,2,1,11" so this wasn't the case. Additionally I found that I have to add "hw_add_4g_only" so I added it with the wrong Country Code because I didn't know what the hw_add_4g_only means. I was searching for it a few days now and never got an answer, so I was trying to ask here. And you made it clear now. The Wikipedia Link was very helpful and it works now for my Country. I have to set it 262 for O2 Telefonic Germany.
So again Thank you very very much!

Using Huawei P10 (VTR-L29) 8.0.0.374 (185) solution above works for me too.

jula182 said:
It is possible to force "4G only" without root. First download "Setting Database Editor" from playstore. Open it and look for "hw_networkmode_preferences". I use this value "9,3,2,1,11" on my phone. Save it and restart your phone.]
For me, It works. Huawei P10 Lite
Thanks
Click to expand...
Click to collapse

Worked on my Samsung Galaxy S9

Honor 6X is stubborn as heel... Nothing works.
Can't even find the commands... Sigh!

First Method :
1. Use SIM 1 as the default connection setting
2.
You need to install this app for FREE
at Google Play
https://play.google.com/store/apps/details?id=com.teknokia.force4glteonly
pro version : https://play.google.com/store/apps/details?id=com.teknokia.force4glteonlypro
galaxy store: https://apps.samsung.com/appquery/appDetail.as?appId=com.teknokia.force4glteonly
pro version : https://apps.samsung.com/appquery/appDetail.as?appId=com.teknokia.force4glteonlypro
3. Run the application, press the SIM 1 only or Android testing button. You will enter two LTE Switcher options and also 2 Android testing options.
4. You can try all of them which support your phone.
If the telecommunication operator you are using does not support VoLTE (Voice over LTE) and uses LTE Only Mode, so regular calls will be blocked.
Second Method :
1. DOWNLOAD Force 4G LTE Only 2020 Pro application from Google Play
2. Run the Application
3. Select SIM 1 Only menu, then Hidden Activity
4. wait to load until 100%
5. tap the search box type RadioInfo
6. In the DEvice Info app section, there is a RadioInfo activity.
7. Long Tap 3 options will appear: Create Shortcut, Launch Activity, Edit Shortcut. I recommend Select Create Shortcut to make it easier for us to enter network activity mode without having to bother opening the Force 4G LTE Only 2020 Pro application.
8. Please select Launch Activity to enter the Radio Info
9. Select LTE Only in set preferred network type

I was able to get it working on my huawei y7a sometime last year using settings database editor. Abouy 2 weeks ago i factory reset my device due to an unrelated issue and now when i try to enable it again i get an error saying my system software has rejected the edit. I tried with the version of setedit from f-droid and got the following "Unexpected failure you shouldn't not change private system settings." does anyone know what the problem could be?

K.Hatake said:
I was able to get it working on my huawei y7a sometime last year using settings database editor. Abouy 2 weeks ago i factory reset my device due to an unrelated issue and now when i try to enable it again i get an error saying my system software has rejected the edit. I tried with the version of setedit from f-droid and got the following "Unexpected failure you shouldn't not change private system settings." does anyone know what the problem could be?
Click to expand...
Click to collapse
I have the same issue with p30 pro. It seems to me that after some recent updates, they've locked those settings somehow.

alesu69 said:
I have the same issue with p30 pro. It seems to me that after some recent updates, they've locked those settings somehow.
Click to expand...
Click to collapse
did you find the solution for this problem because i have the same issue and i get the error message from setedit if you have the solution plz respond to me . thx

Make a shortcut to the activity .settings.radioInfo (phone info) of the app com.android.phone (telephone)

namous zakarya said:
did you find the solution for this problem because i have the same issue and i get the error message from setedit if you have the solution plz respond to me . thx
Click to expand...
Click to collapse
I found a solution. You would have to use "Adb shell" (usb debugging).
The code is:
adb shell settings put system hw_networkmode_preference 11

Techie0fficial said:
I found a solution. You would have to use "Adb shell" (usb debugging).
The code is:
adb shell settings put system hw_networkmode_preference 11
Click to expand...
Click to collapse
This worked for me. Thanks

LTE features / G950U rooted

Hi guys,
I have rooted G950U1. Anybody knows how to turn 4x4 MIMO and 256QAM on in this mobile phone? In the past, there was tutorial how to do it (secret menu *#2683662#). But it was working only on first 2-3 firmwares. Since the root on S8 works only on the latest version of Android 7.0, this option is not available.
Any ideas on how to do it?

pRo_lama said:
Hi guys,
I have rooted G950U1. Anybody knows how to turn 4x4 MIMO and 256QAM on in this mobile phone? In the past, there was tutorial how to do it (secret menu *#2683662#). But it was working only on first 2-3 firmwares. Since the root on S8 works only on the latest version of Android 7.0, this option is not available.
Any ideas on how to do it?
Click to expand...
Click to collapse
Do the dialer codes work on 950u1? I may be wrong but I think most of the dialers work on carrier firmware except Verizon. Again I may be wrong.
If your rooted use shortcut master and you can search for it

You have to use app for that. I'm using Shortcut Mater (Lite). I found very similar secret menu. But there is missing few options which were in old menu. I was able to turn on 4x4 MIMO and will have to test it. Very interesting was CA combination menu. There were 3 options and only in 4CA Combination was written some combination. In 2CA and 3CA were missing those combinations. I'm trying to find why is CA not working on my phone.
Odoslané z SM-N950F pomocou Tapatalku

TheMadScientist said:
Do the dialer codes work on 950u1? I may be wrong but I think most of the dialers work on carrier firmware except Verizon. Again I may be wrong.
If your rooted use shortcut master and you can search for it
Click to expand...
Click to collapse
Unfortunately starting with Android v8.x.x (Oreo), all test commands sent to the RilServiceModeApp via android_secret_code://2263 even by root are denied.
Without root, the only way to enable the band selection menu (keypad codes *#2263# or through the eng-menu *#27663368378# used to set bands and CA's), is via combination firmware or a test cable (which at this time is not yet available for USB-C, only for micro-USB).
You can also try inserting different carrier SIM cards which will reboot and reconfigure the phone on a blue screen, and if you're lucky a particular carrier's CSC will allow you to access the hidden menus via keypad codes.
If you have root, you can try the following:
1. On combination firmware edit the file /efs/carrier/HiddenMenu and /efs/FactoryApp/keystr to be "ON", which will persists even after flashing back to stock firmware.
2. Copy the <CSC>_keystrings.dat from system/etc to root/etc and set permissions to 0744.
3. You can try replacing the /system/priv-app/ModemServiceMode/ModemServiceMode.apk=com.sec.android.RilServiceModeApp from a previous Android version when it was still working, and set the permissions to 0744.
The following is only for phones with a micro-USB port, nonetheless it makes an interesting way to enable the hidden diag menus.
Without root or having to flash it with any other CSC firmware, you can actually enable most diag codes (including RIL test codes like *#2263# band change, *#2683662 lab test mode, *#2766338378# engineering diag menu, etc) on pretty much any model/firmware/region by simply plugging in a test cable into the phone (the other end doesn't have to be plugged in anywhere, it's just the built in resistor which enables diag mode/FactoryMode).
It's important to follow the next steps exactly in this order: Open the dialer, exit the dialer with the Back key (not the Home button!), reopen the dialer and now it should accept most test codes.
These cheap test cables can be found on Ebay or AliExpress, just search for "Samsung 523K uart cable" or "Samsung 619K uart cable". Some come as a combo where you can simply switch the resistor values via a switch, but you must try both values, since only one or the other will work on certain models/firmwares/regions.
I've been using this method successfully for many years (currently on my Samsung S7 with the latest 2019 firmware), unfortunately these test cables are only available for micro-USB connectors, so it won't work on the newer USB-C phones even with an adapter (because it doesn't extend the resistor lines, only the data lines). If anyone finds a solution for USB-C, please post a message here.