Database Users

[HowTo] [VZW XT907/926 RAZR M/HD] Unlock US GSM Carriers Using RadioComm

Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!

<Reserved>

Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?

Yehudah said:
Thanks man.. gonna try this when I get home tonight. I was actually just thinking about switching vendors from VZW to someone else and didn't really want to buy a new phone.
Maybe now I don't have to. Proof is in the pudding though, maybe I'll by a cheap month of Straight Talk to see if it works?
Click to expand...
Click to collapse
Running RAZR M in US on straight talk now. Works wonderful!!!

Thanks a lot! im a total noob when it comes to most of this, but it worked perfect for me!!

Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?

Skrilax_CZ said:
Hmm, MDM6x00? Won't that work on the OG RAZR XT912 / Droid 4 as well?
Click to expand...
Click to collapse
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.

Remember to install the latest Motorola drivers and *especially* highlight the entire 01 and type 00. I was backspacing only the 1 and it did not "stick" when writing. So HIGHLIGHT, don't backspace. Works perfectly.

is it possible to write the NV item to the Droid 4 then edit ? ?
cellzealot said:
The MA used in RadioComm is the same chip set base as the RAZR/D4 because it's the closest to the MSM8960 available in this version, which is more than 18 months old now.
What we really need is an updated version of RadioComm with full support for the newer chip sets.
This specific NV Item 8322 does not exist on the MDM6600 chip set devices and I have not been able to find a similar boolean switch item for those phones, unfortunately.
I have been logging with QXDM extensively searching for a way to disable the MCC/MNC block on MDM6600 without success so far.
I have dumps of all of the readable NV items from 0000-12000 from many devices running various builds and even a dump from Chinese engineering build on P3Droid's Dev model where everything is working as it should with open GSM on US carriers.
I would love some help from someone with a better understanding of the radio and diagnostic mode access than myself.
Very few people know how to use the software to even start analyzing the problem.
Click to expand...
Click to collapse

Can I use a similar way to unlock XT902(Japanese Razr M)? I can't find 8322 in XT902.......

Followed instructions and worked perfectly. The key for me was the latest Motorola drivers AND the Motorola USB cable that came with the phone. I tried other cables that both charged and synced but the only that worked for this was the Moto cable. Using Win XP SP3 ( 12 year old OS on brand new work laptop. WTF!)

i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.

AKG0214 said:
i was wondering if this works on other networks such as boost mobile,net10, criket etc...? i honestly dont have enough money to buy a new phone and whatnot. the whole reason why i did this is because i lost my job and now i cant pay my phone bill and it keeps getting higher and higher.
Click to expand...
Click to collapse
Boost - No
Cricket - No
They're both cdma. This is to allow the GSM side (SIM CARD based) of the phone to work on other carriers. With that said, your best options are
Net10, Straight Talk, ATT, T-Mobile, Simple Mobile, H20, Orange, and there's a plethora of others out there. Post paid and pre-paid.
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.

after boot, it is set back to 01 again @ address 8322
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
cellzealot said:
Introduction:
This post is a guide to show how to perform the NV edit required to unlock US GSM carriers(AT&T and T-Mobile etc.) on the VZW XT907/926 RAZR M/HD stock modem using a Motorola serviceware tool called RadioComm.
This is simply a different method to perform the same hack that was discovered by Arnold Snarb in the main thread about ATT/T-Mobile here.
http://forum.xda-developers.com/showpost.php?p=37123644&postcount=158
Despite the fact that he thanked me for leading the way in that post, he did some really brilliant analysis of the logs in QXDM to isolate this NV Item and saw something in the them that I had missed as well as guessing correctly about it's significance, and deserves all of the credit for this hack.
Everyone should please go and thank him in that post for the outstanding work.
He used a tool called DFS to access and edit NV Item 8322 and change the value of the first byte from 01 to 00 which disables the checking of the MCC/MNC against a list of banned networks and flags MCC 310 as Invalid Country Code.
That method requires booting into BP Tools mode from the boot menu and loading the Qualcomm diagnostic device interfaces.
The problem is that there are no signed 64bit drivers available and you must force load the drivers on Win7/8 64 bit for the diagnostic port in order to see the device properly and have NV read/write access.
This has been a stumbling block for many users and makes the NV editing unnecessarily difficult.
This method uses Factory boot mode and allows RadioComm to have full diagnostic mode access via the Motorola USB Networking driver that loads normally with the standard USB driver set. I will demonstrate 2 different ways to perform the edit, one manual and one using a preconfigured SEEM table file that writes the value in a single operation.
Neither of these methods is as easy as an update.zip install from custom recovery would be, but we don't have a binary that supports the motorola.update_nv function that we used for prior MDM6600 based devices available to us for the MSM8960 devices.
Given that some form of diagnostic mode software and a PC is required, I feel that RadioComm is probably an easier option for most users as it avoids the driver problems and has a clearer and simpler interface for NV read/write access than DFS.
Once you have the latest Motorola drivers installed and RadioComm loaded, this guide should make it very easy and safe to perform what is generally a complicated and potentially dangerous task of editing the radio NVM(Non Volatile Memory).
RadioComm itself is a terrifyingly complex piece of software with a GUI that can bring even the most seasoned and experienced phone hacker to their knees wondering what all the various windows, modules and buttons do.
It is the premier Motorola serviceware application and is designed by and intended for use by top level radio engineers and technicians.
It is an extremely powerful application that can access all models and chipsets of Motorola devices and perform a vast array of diagnostic testing and configuration operations and can be fully automated via multiple scripting languages.
It's just plain scary and confusing and very dangerous if not taken seriously.
Warning and disclaimer:
DO NOT PLAY AROUND WITH ANY FEATURES OR RANDOMLY HIT ANY BUTTONS IN RADIOCOMM!!!
YOU CAN RENDER YOUR PHONE DYSFUNCTIONAL OR UNBOOTABLE IN SECONDS!!!
This cannot be emphasized strongly enough!
Follow the instructions exactly as they are written and shown in the screenshots and you will find it very simple to use have no trouble doing the edit with either method.
You, the user, are the only person responsible for your actions and performing this hack will absolutely void your warranty the same way rooting or any other modifications to your device's software does!
That said, this hack will be undetectable and have no outward visible signs of having been performed other than the fact that any GSM SIM should work afterward.
Root is NOT required and this can be safely done and undone at will without making any other changes on the device and all normal services function properly on VZW's network with the edit in place. It appears to only affect the US GSM network block and nothing else.
Prerequisites:
You need to have a recent set of Motorola USB drivers v. 5.9.0 or greater installed on your PC with a full USB 2.0 compatible port.
You need a standard Motorola micro USB cable.
RadioComm 11.12.xx I have included a link to 11.12.2 below.
https://dl.dropbox.com/u/7632904/RadioComm_v11.12.2_Install.zip
This has been tested on Win7 64bit and WinXP SP3 32bit with .NET Framework 4.0 installed.
Method:
This guide assumes you already have RadioComm and the drivers properly installed and have rebooted both PC and the phone afterward.
The first instructions and screenshots describe the initial setup and manual method using the FTM Common 1 tab and the NV Access window in RadioComm.
When you first open RadioComm you will get a popup stating that the version is more than 2 months old. Just close it and continue.
Now go to the top left corner and hit the Main button and select the MA: Common/MDM6x00 as shown in the first screenshot.
Next, go to Settings/USB and select PST USB Driver as shown in the second screenshot.
Test Command Format should default to P2K05 lower in Setings menu.
Leave all other options default.
Now we are ready to connect the phone and perform the edit.
Make sure you have Connect as Media Device in USB settings and USB Debugging enabled in Developer Options.
Power off the phone and then hold both Vol Up and Down + Power to enter the boot menu.
Use the Vol Down key to scroll down in the menu to Factory and then Vol Up key to select and the phone will boot.
Connect the USB cable and RadioComm will enumerate the phone and the radio button in the top right will change colors.
It will cycle sever times red to yellow and eventually go green when the device is fully enumerated and shows as XT907 in the status bar
at the bottom of the screen. You can read the Software Version and MEID/ESN/pESN buttons to make sure everything is working properly.
Each successful read the GUI will flash green and the Command buffer will turn green and any selected button will be green.
Any unsuccessful attempt will turn red.
If not, then restart everything and check over all settings again before proceeding.
Now go to the tabs bar across the top middle of the GUI and select FTM Common 1 tab and go to the NV access window in the center right of that tab and select the top menu Item "FFFF Manual Entry" as shown in the third screenshot.
Now hit the Read button and you will get 2 popup windows.
In the first window you will enter the Decimal NV Item ID 8322 and in the second you will enter the byte length to be read 1 as shown in the fourth screenshot.
When you hit ok it will read the NV Item and flash green and display the data in the hex output buffer below and you will see 01 for the value as shown in the fifth screen shot.
Now highlight the 01 and change it to 00 and hit the write button and this time it will only popup once asking for the Decimal NV Item ID 8322. When you hit OK the item will be written and the GUI will again flash green for a successful write as shown in the sixth screenshot.
You are now finished and can either use the restart button at top right of RadioComm to reboot or manually restart the phone.
The last screen shot is edited to show the steps to use the NV/SEEM feature with a SEEM table file I have provided below to do all of the steps as a single operation. Some users may find this easier than manually editing in the NV Access window but it's really almost the same number of steps.
Go to the top left and hit Features and select NV/SEEM and another window will open and the radio button will cycle again a couple time as it re enumerates the device again it will go green finally. Follow the instructions in the seventh screenshot and be sure to use the Restart button in the main window after you close NV/SEEM because its suspends the phone and it will be black screen and unresponsive and require holding Vol keys and Power for 10 secs to reset it otherwise.
Congrats! All done now and the rest is just putting in a SIM and selecting GSM/UMTS in Network Settings and everything should just work!
Below is the link for the .NVM SEEM table file.
https://dl.dropbox.com/u/7632904/TBH_RAZR_M_GSM_Unlock.NVM
Please use this thread to discuss issues relating to this method and RadioComm and keep general discussion of the phone on US carriers in the other thread, thank you!
Click to expand...
Click to collapse
---------- Post added at 11:14 PM ---------- Previous post was at 10:48 PM ----------
tried again for couple of times, this time it actually works.
maybe last time I reboot the phone too early?
sipida said:
my phone version is Bsmq_vzw-user 4.1.1 9.8.1Q_27-2 4 release-keysSM_BP_1139.000.32.62P
after write to 8322 with zeros, I read it again the confirm it is written, but after rebooting the phone, the value is back to 01 again.
I guess the verizon driver may override this value during rebooting?
any help?
should I root the phone?
==
thanks
Click to expand...
Click to collapse

Glad you got it working. There is no VZW software on the phone capable of writing to the radio NV, so it's not being reverted by anything.
If anyone else has similar issues I would suggest trying the NV/SEEM method as that will definitely write the item properly.

queberican351 said:
@DSDD
I beleive your XT902 is GSM by default. So if what your asking is will this bypass the network lock, no, the device needs to be unlocked by code. Then you can use it outside of the current carrier/country.
Click to expand...
Click to collapse
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.

Does this tutorial unlock mobile data usage on other carriers. I cannot seem to get data working on my XT907 in Australia. GSM and MMS work fine, so why doesnt Data?

I don't know for certain because I only have experience with domestic US GSM carriers, but I tend to doubt it.
You can try it and see and revert it easily if it doesn't work. You can also try flashing the Telstra XT905 NON-HLOS.bin(modem) and fsg.mbn(carrierEFS/NVM config).
This was the method used to get US GSM service on XT907 before the method shown here was discovered.
It works but is limited to GSM/EDGE data services here in the US.
I am inclined to think it is some other problem with the device because it should work as a global capable phone by default.

dsdd said:
XT902 has sim lock, and there is no way to key in unlock code. So I think it maybe unlocked by modifying another NV item.
Click to expand...
Click to collapse
If it has a sim lock and you can acquire the code open your dialer and press #073887* (#0SETUP*) and it'll prompt you for the code.

Several people have PMd me questions about this method and I would much prefer that they be posted here in the thread so that everyone may benefit from the information.
Please include as much information about your PC and driver versions and be as thorough as possible in explaining your problems.

Unlock all bands of your Qualcomm device! Use your phone globally! No bs!

You do everything here at your own risk. I take no responsibility for any broken devices/sdcards/your house going down on fire and everything else.
PLEASE DO NOT MIRROR THESE FILES!
Requirements:
root
ability to use mouse and keyboard
terminal emulator on your phone
What do you get for doing this?
Propably you'll be able to use a lot more bands than before. Most likely your phone will work on every place in the world now.
Check the third post for a link to OPO guide
C6903
before
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
after
1. Download this zip Google it as it's banned from xda for the ability of imei change
2. Extract it and install QPST from that zip
3. Open the caller app and type in *#*#8778#*#* (it should go off the screen after you type in the last symbol "*"
3.5 Those on custom roms (tested on cyanogen 11 with s4 mini) can use the efs professional toolkit to change the mode to enable the diag port.(Thanks @blackburn !)
4. Connect your phone to your PC
5. Open ADB console
6. Type in these commands:
Code:
adb shell
su
setprop persist.usb.eng 1
7. Turn off USB Debugging, Disconnect your phone from the PC
8. Wait about 10 seconds (don't have to be exact, just let it all disconnect in the PC) and turn USB Debugging back on
10. Connect it back to the PC. It should try to install drivers. Wait until it fails to install all of them.
11. Open device manager - you will see your device model a few times. Go to details tab. Scroll down a single time on that tab. You will see MI_0x there.
12. Go through those devices until you find MI_04 under the second drop down position.
13. Select "update driver" for this device and install the htc driver from the zip.
14. Press start button and navigate to QPST -> QPST Configuration
15. Go back to device manager -> modems -> HTC
16. Find "COM*" in my case it was "COM3". It might be different for you.
17. In QPST Configuration click on "Add new port" and in "Port" type in your "COM*". In my case It's "COM3" in there. In Port label it could be anyting u want. In my case I used a Z1 so I typed IN "Z1".
18. It should look like this now.
19. Navigate to QPST/bin and open RV_NV_Manager.exe
20. press on settings -> Comport and choose your COM port.
21. Press on file -> read from phone
22. Wait patiently until it is finished. Now pay attention!
23. Go to line 1877, click it and copy the decimal number on the right side of a programme. right click - copy
24. Go to the place where you extracted the zip from the first step and start mzTool
25. On the left side you will see "Input radix" - press decimal there.
26. On the right side you will see "RF BC CONFIG" paste your previously copied number from the RV_NV_Manager.exe there.
27. You will see now what bands are you able to use on the bottom of the app in "Bit information"
28. Switch tab to "Band Preference (NV Value)"
29. In there select all GSM bands and WCDMA bands. This place is really a field of testing. In my case (C6903 LTE) I selected all of GSM and WCDMA. I wouldn't suggest you to do anyting else in here unless you know what your'e doing. Let me know if you got something interesting in there.
30. After you're done choosing what bands do you want - copy decimal number from the bottom right
31. Remove all commas from that number ( "," ) so it would be just a bunch of numbers without anything else.
32. Open RV_NV_Manager.exe from the point you left it (step 23) and paste your new number without commas "," there.
33. Press on write NV and then press on file ->write changed NV to the phone.
34. Open up the terminal emulator on your phone and write there this:
Code:
su
setprop persist.usb.eng 0
35. Reboot the device and hope you'll have the reception. If you do, hooray!
36. Type in *#*#SERVICE#*#* (*#*#7378423#*#*) to see your new bands that your phone can use!
If your phone can't boot then flash stock FTF to your device and you should have your reception back!
Enjoy!
I wanted to mention that I'm just the guy that was interested in this and the person that actually made it possible is @BlackSoulxxx all thanks go to him! He's the guy that did it! Please thank him in the second post!
PLEASE DO NOT ASK ME IF IT WORKS ON YOUR DEVICE! I DON'T KNOW. YOU HAVE TO TRY IT YOURSELF.
If you have any problems or issues here's some help from other users http://forum.xda-developers.com/showpost.php?p=55321344&postcount=3
Tested on: ZU, Z1,SP,Xperia TL,Sharp-DOCOMO Aquos Zeta SH-04F

Dangerous stuff to experiment with. Already lost 2 phone (2 expensive paper-weight with OmniBalance design -_- )
But ENJOY!
And remember to check out *#*#4636*#*# to select band (I dont advice to do that, because to revert it you will have to reflash baseband)
And the setting
@olokos

BlackSoulxxx said:
Hey, for everyone with error "execptionthrow" error pls use QXDM and search for nv 1877 and change it
Click to expand...
Click to collapse
Nexus connection
1. Remove all installed drivers.
2. Install LG United Mobile Driver
3. Enable debugging and install adb driver if it's not automatically installed.
4. Using adb issue the following commands on a separate line
Code:
adb shell
su
setprop sys.usb.config diag, adb
5. Your phone should start installing drivers, once installed under Ports in device manager there should be (* indicates a number):
LGE AndroidNet for Diagnostics Port (COM*)
LGE AndroidNet USB Serial Port (COM*)
Thanks for that @CHAMAVELI !
kevin3688 said:
For GSM HTC Phones.
Use "setprop sys.usb.diag.config diagon" instead of "setprop persist.usb.eng 1"
Click to expand...
Click to collapse
One Plus One guide
Moto Droid RAZR Guide
XIAOMI MI2 Guide
LG G3 D852 Guide

Device-specific drivers and Z2 LTE unlock here:
http://forum.xda-developers.com/showthread.php?p=55394190
LTE Unlock guide based on OPO
http://forum.xda-developers.com/showpost.php?p=56577252&postcount=455

olokos said:
Massive stuff. I'm writing it down right now. wait for it.
Click to expand...
Click to collapse
Haha ok, we all waiting ^^
Send from my XZ With My Own Personal Modified MoonWalker SuperB !

What about this thread,I don't understand. You will open a port or an app thread,right?

Mazellat said:
What about this thread,I don't understand. You will open a port or an app thread,right?
Click to expand...
Click to collapse
Much bigger than that. Look at @BlackSoulxxx signature. I'm almost done writing it all down. Hang tight

Finally did it

olokos said:
Much bigger than that. Look at @BlackSoulxxx signature. I'm almost done writing it all down. Hang tight
Click to expand...
Click to collapse
I don't see anything his sign. and waiting for you

Mazellat said:
I don't see anything his sign. and waiting for you
Click to expand...
Click to collapse
Already did it! Try it by yourself!

I forget to tell you that this can works with UB and LB If you want to unlock for non-Xperia device that power by SD PM me....

Is it also supposed to work on the LTE bands, or just GSM and WCDMA? For instance, would it reveal any 'hidden' LTE bands on LT30AT?

ArtDC said:
Is it also supposed to work on the LTE bands, or just GSM and WCDMA? For instance, would it reveal any 'hidden' LTE bands on LT30AT?
Click to expand...
Click to collapse
Yes, works with GSM/WCDMA/LTE, even with CDMA if you phone supporting them. About hidden band, just give it a try
But if your phone is 3G variant, it will unlock wcdma/gsm band only. Using LTE version, result like OP screenshot

Tempted to try this out but what happens if we mess up something? Just do a nandroid and everything is fine?

Ahki767 said:
Tempted to try this out but what happens if we mess up something? Just do a nandroid and everything is fine?
Click to expand...
Click to collapse
Reflash baseband from full ftf

BlackSoulxxx said:
Reflash baseband from full ftf
Click to expand...
Click to collapse
When i disconnect and reconnect, it just worked normally without trying to install drivers

Ahki767 said:
When i disconnect and reconnect, it just worked normally without trying to install drivers
Click to expand...
Click to collapse
Repeat the step
1. Dial *#*#8778#*#*
2. open adb
adb shell
su
setprop persist.usb.eng 1
Click to expand...
Click to collapse
3. turnoff usb debugging and unplug the phone
4. wait 10s, turn on usb debug and connect it again to pc

1. Dial *#*#8778#*#* ---> I try several times and will not turn off

erick_shadow said:
1. Dial *#*#8778#*#* ---> I try several times and will not turn off
Click to expand...
Click to collapse
When you dial it, it will dissappear right? If so, that's ok. Stay on the guide and olokos guide have some place wrong, I have correct it in #2 post

the mark is left on the keyboard and does nothing

[TUTORIAL][Radio] Enable NEXUS6 XT1103 4G LTE B1/B8/B9/B19 and also XT1100 B2/B4

As I brought Band3 for NEXUS5, here, we are bringing 4G LTE band1 IMT 2100MHz for users such as, but
not limited to:
China Telecom,
Japan AU/NTT Docomo/Softbank,
Korea LG U+ /SK Telecom,
Philippines Smart,
Thailand DTAC/TrueMove-H
according http://en.wikipedia.org/wiki/List_of_LTE_networks#Asia and more:
Czech Republic Vodafone
Poland Play/P4
according http://en.wikipedia.org/wiki/List_of_LTE_networks#Europe
20150412 UPDATE: we are in Trial of more bands,as attachment names at POST#33:
Band 2 and band 4 for XT1100 View attachment 3257101
and Band 1 and band 8 or Band 1/9/19 or Band 1/8/9/19 for XT1103 View attachment 3257100
I am sorry below English language is not good, it is come from Google Translation^_^ from my Chinese post.
attachment docx is more clear since more detail images can are attched inside:
EN:View attachment 3187257
CN:View attachment 3187214
NEXUS 6 US MOTO XT1103 Band1 Enablement Tutorials
Foreword:
With the US version NEXUS6 XT1103 Chinese users, most of them come for China Telecom
, but is there such a telecommunications in many indoor shopping centers and car parks, do 4G LTE band1 2100MHz coverage, but also greater bandwidth than band3 15MHz with 20MHz bandwidth with China Telecom license.
What is a pity, XT1103 band1 RF front-end is shipped out without factory calibration, so only official usage is [email protected] only for China Telecom.In fact, as NEXUS5 band3 enablement, NEXUS6 RF front-end hardware also left a tiny space to enable it. The following tutorial is the first edition, With more extensive testing,It will needs correction on your demands.
I am sorry I do not have English version computer to reworks the Chinese screen captures,
I believe you have some way to understand around.​
STEP1: using TWRP backup EFS
you can nexus6 of TWRP-Backup-EFS. More insurance after the phone Root, you canalso EFS Professional to backup your original EFS.
Thus, When need to restore the original state , Just use TWRP-Restore- to select the original EFS and slide the button to restore any changed below. ​
STEP2: Install the driver Moto BP Tools Driver
Mobile side: the phone off, then press the power button + volume down key, enter fastboot mode, use the volume keys to select BP Tools, and then turn the power button to confirm. Open usb diag device port.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
View attachment 3187207 View attachment 3187208
1. Connect your phone to your computer, then prompted to install "diag_mdm" drive (or right-click "My Computer" and select "Properties" - "Device Manager" to install "diag_mdm" drive)
2. Right-click on the "diag_mdm", select "Update Driver Software" and then select "Browse my computer for driver software."
3. Select "choose from a list of device drivers in your computer."
4. Select "Show all devices", the "Next" button.
5. select "Disk"
6. Click "Browse"
7. Select the folder where you drive, point to open after selecting "momdm", then OK.
8. Select the "Motorola USB Diagnostic Port", click "Next."
9, warning, Click "Yes"
10, in the Device Manager port as shown below to show that the installation was successful (Note: The port number com93 vary)
​
STEP3: Write qcn
Phone side: the phone off, then press the power button + volume button, enter fastboot mode, use the volume keys to select BP Tools, and then turn the power button to confirm, so you can open the usb diag device port.
1.the installation QPST. Do not use lower version 2.7 build 422, otherwise it will not recognize the device. please find such installation by yourself.
2. open QPST configuration, the first point of Ports tab, select the device displayed, the first point below "remove", Prompt window popuped, and then point "Yes".
3, Chick "Add New Port".
4. Select the port of your device com port, and then "OK" button.
5, open the folder points QPST Software Download, click on "Restore" tab, click Browse to select the desired brush into qcn file:
View attachment XT1100_LTE_B1_To_XT1103_24226_6735_6736_RxAdded_TxOverrided.qcn.zip
(Here, the only difference vs nexus5 enabled band3 ,XT1103 purchased from Google Play, MOTO did not change default SPC, 000000),
Check Allow phone / file ESN mismatch, the final blow: Point Start, Errors box appears Could not Reset the Phone error normal, qcn has finished writing, after using the Power button off, then boot directly out LTE signal, the restart, do not use QuickBoot like Reboot, to ensure safety.
​
FINALLY: Check Whether Band1 Enablement successful methods
Method 1: Insert China telecom USIM cards, confirming a place where band1 with LTE Cell ID can be found with the end of HEX is 00,01,02,03,04,05 of LTE base stations (in the dial-up interface, enter * # * # 4636 # * # *, open "mobile phone information ", the" Set preferred network type "to LET ONLY, and then find the" Location: LAC = 7101 CID = 1924c01 "in this column, the CELL ID is inside this CID.
Method 2: Use the LTE Discovery watch band states.
NOTE: These two methods are there GCI (CID) guessing band, is only applicable to some of operators such as China Telecom, the absence of good planning China Unicom 4G CellID, and also China Mobile is not applicable for this .
[email protected]， we have LTE Discovery update to 3.19， support NEXUS6 display the real MODEM LTE Band!! thanks for Danial and his great team!!
​While you want to Check real band PC tool QXDM may help if you have such tool, menu path is View-LTE- RRC layer-RRC/NAS Status Screen- Frequency band, wait for 10mintues for update or use airplane mode on/off to Tigger update.
In case you are not in LTE covered area, but just want to check the qcn is applied or not, reset your phone in boot loader mode, select BP TOOLS again,them use QXDM-view-NV Browser-Item 06828- read to get the value, it should be 1099830466655 for add band1 while stock default is 1099830466654,
Other qcn XT1103 add:
B1/8 1099830466783
B1/9/19 1099830729055
B1/8/9/19 1099830729183
XT1100 add:
B2/4 1099646632415, @default 1099646632405
Here we must thank:
Q39705630 enthusiastic and efficient testing and Draft this tutorial V0.1 version;
Q562552826 provide XT1103 of qcn file, doing preliminary analysis;
Q386499038 provide XT1100 qcn file, do the final release qcn file parameter reference;​
Other Reference Tutorial IN Chinese:
1. CN version band1 enablement:
http://bbs.gfan.com/android-7863761-1-1.html
2.NEXUS6 RF parameters such as PC-side backup method qcn
http://bbs.gfan.com/android-7741730-1-1.html
3. Some tools on LTE band1 signal monitoring
http://bbs.gfan.com/android-7684876-1-1.html​

。chinese here hei
Sent from my SPH-L720 using XDA Premium 4 mobile app

Could you send the xt1100'qcn to me? Q2954103426 . If I retore xt1100's qcn to xt1103, it only can make xt1103 support band same as xt1100?

Hi, I messed up my NV values and I can't get signal anymore. Can you please post original XT1103 QCN file so we can restore the backup? Thanks.

Done! Working here in philippines smart user here! Thanks OP!

MrDreamSky said:
。chinese here hei
Click to expand...
Click to collapse
Yes. I can not Choose where I was born, But I can choose whether I can contribute.
While American Dream is on the Sky, Chinese Dream is running on the ground even we are weak, I am expecting to contribute for the global. haha

MaxChuang said:
Could you send the xt1100'qcn to me? Q2954103426 . If I retore xt1100's qcn to xt1103, it only can make xt1103 support band same as xt1100?
Click to expand...
Click to collapse
No, you can not enable all the band but some, and it need some technical filtering job,
RF front end hardware is arm and body of RF driver software soul.
I will try to bring band8, but need more weeks to find time gap during my work.

messedupqcn said:
Hi, I messed up my NV values and I can't get signal anymore. Can you please post original XT1103 QCN file so we can restore the backup? Thanks.
Click to expand...
Click to collapse
Please note the normal QPST-Software Download backup qcn will not works for restoring,
and older QPST-RF NV Item manager backuped Qcn can not cover all RF nv now, so it is also not good choice for you to restore Solutions for your issue,
Soution1. In case you only lost your signal after you use 4636-Phone Info-Select UMTS band- US band, Try to set NV00441 to 0xFFFF with this qcn, by QPST-Software Download, an old post is here:
http://forum.xda-developers.com/nexus-6/help/help-locked-nexus-to-usa-band-t2975290/page2
Solution2. for others failture reason, To NEXUS6 reflash the factory images will help to reset all your nv from backup eMMC partition,
How to is here: http://forum.xda-developers.com/nexus-6/general/guide-flash-factory-images-nexus-6shamu-t2954008

Just wondering though, the com should be com93? Ir it could be any digit? Because i got com25 and i still insist it im flashing..it worked but it cannot tell the band im using that should be band 1.

Azlun said:
No, you can not enable all the band but some, and it need some technical filtering job,
RF front end hardware is arm and body of RF driver software soul.
I will try to bring band8, but need more weeks to find time gap during my work.
Click to expand...
Click to collapse
Thanks for your contribution !
I am curious if carrier aggregation can be configured ,too.

Yeah, I would like to know if carrier aggregation can be configured

Azlun said:
Please note the normal QPST-Software Download backup qcn will not works for restoring,
and older QPST-RF NV Item manager backuped Qcn can not cover all RF nv now, so it is also not good choice for you to restore Solutions for your issue,
Soution1. In case you only lost your signal after you use 4636-Phone Info-Select UMTS band- US band, Try to set NV00441 to 0xFFFF with this qcn, by QPST-Software Download, an old post is here:
http://forum.xda-developers.com/nexus-6/help/help-locked-nexus-to-usa-band-t2975290/page2
Solution2. for others failture reason, To NEXUS6 reflash the factory images will help to reset all your nv from backup eMMC partition,
How to is here: http://forum.xda-developers.com/nexus-6/general/guide-flash-factory-images-nexus-6shamu-t2954008
Click to expand...
Click to collapse
Thanks! Is fastboot flash radio enough to restore everything to normal? :laugh:
edit: looks like you have to reflash everything. Oh well.
---------- Post added at 06:28 AM ---------- Previous post was at 06:14 AM ----------
I restored the factory image and it's fine. There's a bug with the current factory image where it doesn't flash system and userdata when you run flash-all.sh, but it seems to have flashed the nv value backup without that. I didn't reflash system and userdata manually so I get to keep my phone without wiping.
Any idea why line 6828 in NV browser says 268501086 in my XT1103? According to LTE band calculator, this means the phone supports band 2/3/4/5/7/17/29. But Google Play says the phone supports 2/3/4/5/7/12/13/17/25/26/29/41. Any idea why this supports seemingly less bands?
Looks like some Moto X have this band configuration, but my Nexus 6 shouldn't. Can someone confirm their stock line 6828?

Will this change stick even after a firmware upgrade, say, after upgrading to Lollipop 5.1?
Is this technique applicable to a D820 Nexus 5 as well?

mimsiroll said:
Just wondering though, the com should be com93? Ir it could be any digit? Because i got com25 and i still insist it im flashing..it worked but it cannot tell the band im using that should be band 1.
Click to expand...
Click to collapse
COMxx is depand on PC, it can be any number.

messedupqcn said:
Thanks! Is fastboot flash radio enough to restore everything to normal? :laugh:
edit: looks like you have to reflash everything. Oh well.
---------- Post added at 06:28 AM ---------- Previous post was at 06:14 AM ----------
I restored the factory image and it's fine. There's a bug with the current factory image where it doesn't flash system and userdata when you run flash-all.sh, but it seems to have flashed the nv value backup without that. I didn't reflash system and userdata manually so I get to keep my phone without wiping.
Any idea why line 6828 in NV browser says 268501086 in my XT1103? According to LTE band calculator, this means the phone supports band 2/3/4/5/7/17/29. But Google Play says the phone supports 2/3/4/5/7/12/13/17/25/26/29/41. Any idea why this supports seemingly less bands?
Looks like some Moto X have this band configuration, but my Nexus 6 shouldn't. Can someone confirm their stock line 6828?
Click to expand...
Click to collapse
1: Is fastboot flash radio enough to restore everything to normal?
Az:I never try, may be you can try when you have enough partition backuped.
2. for nv6828, the stock default is 1099830466654
and after my qcn written, it should be changed to 1099830466655 (add band1)
in fact there is many other nv added and overrided, so a EFS backup before qcn write in is suggested.
I can not understand why your value become an unknow one.
<!-- Add Band1 in LTE bands over XT1103
default 1099830466654 decially = binary:
00000000 00000000 00000001 00000000 00010011 00000001 00011000 01011110B
(band 41 29/26/25 17 13/12 7/5/4/3/2 )
= 1099830466655 decially = binary:
00000000 00000000 00000001 00000000 00010011 00000001 00011000 01011111B
(band 41 29/26/25 17 13/12 7/5/4/3/2/!1!)
** other referenece,
ONLY Band8 = 128
-->
<NvItem id="6828" subscriptionid="0" name="NV_LTE_BC_CONFIG_I" mapping="direct" encoding="dec" index="0">1099830466655,0</NvItem>

Biggster said:
Will this change stick even after a firmware upgrade, say, after upgrading to Lollipop 5.1?
Is this technique applicable to a D820 Nexus 5 as well?
Click to expand...
Click to collapse
1 my NV items will be kept in EFS until a factory restore including erase EFS partition to trigger factory EFS restoring.
so OTA upgrade will be fine, but next factory image whole reflashing will erase nv items in this qcn.
That is MOTO design while LG NEXUS5 have not such issue.
2. NEXUS5 D820 can enabled band3 band8 in the same way if you are in track of http://forum.xda-developers.com/google-nexus-5/general/radio-enable-lte-band-3-nexus-5-d820-t2928561
but qcn in that post will NOT bring CDMA+LTE 1xSRLTE dual-stanby working, it is still in LTE only mode.
why NEXUS6 support 1xSRLTE is come from facotry by default, DI4.0 new modem firmware and trigger by right carrier_policy.xml from m_bing.

Hmm, I seem to remember my line 6828 was the same unknown value before I changed anything. Stock. Then when I flashed your qcn, it became the 1099830466655. I have no idea why my phone came with less bands stock. it is XT1103 Bought from moto US store. no way to test it either, until I am out of the US

Solved.
Anyone know how to get the SPC/MSL code if it's not all zeros? My N6 is Amazon sprint version but I'm using it out of US.
Sent from my Nexus ⑥

XT1100 to XT1103?
Is it possible to convert an XT1100 to an XT1103? Is it a hardware thing?
I would like to enable band 2 and 4 in the XT1100, is that at all possible?
I have both an XT1103 (borrowed) and my own, an XT1100. Could I copy the NV values from the 1103 onto the 1100? Would it cause any damage to try?
I dont mind formatting, but I also don't want a brick.
Thanks,
Sam.

How could I enable LTE band 4? Really thats the only one I need to enable. Any help is much appreciated. I am more than willing to test as well.

(5.0.2+5.1) (UPDATED 08/27/2016) How to: Use Verizon Moto E (2015) on ANY GSM network

Please follow the updated directions provided by Bendrexl below before attempting any other methods.
bendrexl said:
Here's a roundup of essential steps from this thread that worked for me...
:good: HUGE THANKS to: Whoareyou, docna, caspar347, Dishe
Prepare for battle:
Ensure your Verizon Moto E 2015 is configured for USB debugging.
Ensure your Verizon Moto E 2015 has airplane mode enabled.
Ensure your PC/Mac has the Android SDK Platform Tools installed & accessible via your terminal / command line (added to $PATH var).
Download 5.0.2 factory image: http://forum.xda-developers.com/moto-e-2015/general/stocks-firmwares-moto-e-t3113235/page2?nocache=1 (Thanks to caspar347!)
Unzip / expand this .zip archive.
Open a terminal session in the directory you just unzipped (containing NON-HLOS.bin & fsg.mbn)
Execute!
In your terminal with phone plugged in:
$ adb reboot bootloader (your phone should now reboot into bootloader, wait for this)
$ fastboot flash modem NON-HLOS.bin
$ fastboot erase modemst1
$ fastboot erase modemst2
$ fastboot flash fsg fsg.mbn
$ fastboot reboot (WAIT for phone to fully boot before continuing)
$ adb shell (your command prompt will change to something like [email protected]_cdma:/ $. If you get kicked out of the session while entering the next commands, just type adb shell again and pick up where you left off)
[email protected]_cdma:/ $ pm clear com.android.providers.telephony
[email protected]_cdma:/ $ settings put global preferred_network_mode 9
[email protected]_cdma:/ $ settings put global preferred_network_mode1 9
[email protected]_cdma:/ $ settings put global preferred_network_mode2 9
[email protected]_cdma:/ $ pm hide com.motorola.setupwizard.phoneservice (optional)
[email protected]_cdma:/ $ exit (or just unplug & reboot phone)
$ adb reboot (or just unplug & reboot phone)
On the phone:
Turn off Airplane mode
Open Settings app > More > Cellular Networks
Ensure Preferred network type selected is "4G (recommended)"
Under Access Point Names, add the appropriate APNs for your specific carrier. (for Fi data, I only needed "h2g2").
Disable all Verizon apps through settings or Titanium Backup. (Optional)
CREDITS: Whoareyou, docna, caspar347, Dishe
Click to expand...
Click to collapse
IF YOUR DEVICE IS RUNNING 5.1, FOLLOW THE GREEN INSTRUCTIONS!
In order to attempt to get Verizon/Motorola to push out a new update with a fix for the removal of the option to switch to GSM, please sign this petition on Change.org and share it to anyone who you know will sign it! https://www.change.org/p/verizon-daniel-s-mead-stop-carrier-locking-motorola-moto-e-lte-xt1528
Background Info: I work at Walmart in the Connection Center, and today I had a customer wanting to switch to Family Mobile from AT&T, so I showed them our Family Mobile devices and T-Mobile Devices, they didnt seem interested in them and said they wanted somthing that had Android 5.0 Lollipop, I thought about it for a minute and remembered that the Moto E (2015) shipped with Lollipop installed, I also knew that Verizon phones come unlocked, so I showed them the device and they decided to go with it, they bought the Family Mobile Micro SIM starter kit, and the Moto E, but once I powered it on, I couldn't get it to connect to Family Mobile, so I tried to access the advanced radio menu (*#*#4636#*#*) to no avail, but I eventually got it working, with full LTE support, heres how:
POSSIBLE SIM SWAP WORKAROUND (Reported by wogeboy):
Disable vzwAPNpermissions.apk and vzwAPNservice.apk using this program: http://bit.ly/1HHyVao
I have not tested this as I dont have a VZW Moto E to test it on.
5.1 Updated Instrcutions:
With the SIM you want to use the the phone :
1. Put the phone into Airplane mode (I'm not sure this is needed, but it doesn't hurt)
2. Go to Settings -> About Phone and tap on "Build Number" until it says you are in Developer Mode (~10 times)
3. Go back one menu, and right above About Phone there should now be an option for Developer Options, go into that.
4. Turn on USB Debugging
5. Connect the phone to your computer and type "adb shell" in your CMD window
6. Run the following commands in adb shell :
pm clear com.android.providers.telephony
settings put global preferred_network_mode 9
settings put global preferred_network_mode1 9
settings put global preferred_network_mode2 9
7. Turn off Airplane mode
8. Power off and Restart the phone
9. Open up the settings app, go to the mobile networks panel, select "Prefered Network Mode" and change it to "4G"
10. Input the appropriate APNs for your specific carrier
11. (Optional). Disable all Verizon apps through settings or Titanium Backup.
CREDIT: docna
.
5.0.2 Instructions:
1. Power on the device with the GSM SIM card in the SIM card slot
2. Connect to WiFi and complete Google Sign-In
3. Go to the Play Store and search "Network" download the first app (A white circle with a black phone in it) (This will allow us access to the advance radio options)
4. Open the "Network" shortcut
5. Change the radio mode from "CDMA/LTE PRL" to "GSM/LTE Auto"
6. Open up the settings app, go to the mobile networks panel, select "Prefered Network Mode" and change it to "4G"
7. Input the appropriate APNs for your specific carrier
8 (Optional). Disable all Verizon apps through settings or Titanium Backup.
The only thing I couldnt solve was how to remove the "SIM Card is not from Verizon Wireless" error in the status bar permanently, but thats just an annoyance, and causes no usability decrease.

This Works!
Thanks a lot, had been trying to get the GSM working. The "Network" app in the Play Store give access to the hidden radio selection menu. Verizon was able to disable all other way to enter the radio selection menu but this one did it. I think there is a apk file somewhere which disables the annoying "NOT verizon SIM" message. I will post here if I find that works.

That's a lot easier than poking around in NVram! Thanks, OP. And yeah, there's a Setup app or something you need to freeze for then sim error. I'll have to get mine out and find it.

Here are screen snaps. The VZ phone is actually picking up LTE for Ting (T-Mobile).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Nice. This is definitely some progress. Still waiting for the sprint version to be unlocked.

Whoareyou said:
Background Info: I work at Walmart in the Connection Center, and today I had a customer wanting to switch to Family Mobile from AT&T, so I showed them our Family Mobile devices and T-Mobile Devices, they didnt seem interested in them and said they wanted somthing that had Android 5.0 Lollipop, I thought about it for a minute and remembered that the Moto E (2015) shipped with Lollipop installed, I also knew that Verizon phones come unlocked, so I showed them the device and they decided to go with it, they bought the Family Mobile Micro SIM starter kit, and the Moto E, but once I powered it on, I couldn't get it to connect to Family Mobile, so I tried to access the advanced radio menu (*#*#4636#*#*) to no avail, but I eventually got it working, with full LTE support, heres how:
1. Power on the device with the GSM SIM card in the SIM card slot
2. Connect to WiFi and complete Google Sign-In
3. Go to the Play Store and search "Network" download the first app (A white circle with a black phone in it) (This will allow us access to the advance radio options)
4. Open the "Network" shortcut
5. Change the radio mode from "CDMA/LTE PRL" to "GSM/LTE Auto"
6. Open up the settings app, go to the mobile networks panel, select "Prefered Network Mode" and change it to "4G"
7. Input the appropriate APNs for your specific carrier
8 (Optional). Disable all Verizon apps through settings or Titanium Backup.
The only thing I couldnt solve was how to remove the "SIM Card is not from Verizon Wireless" error in the status bar permanently, but thats just an annoyance, and causes no usability decrease.
Click to expand...
Click to collapse
Thanks a ton for this! Do you know what the APN setting should be for T-Mobile? That's my current challenge. Every site has a different opinion. Including T-Mobile.

APN: fast.t-mobile.com
MMSC: http://mms.msg.eng.t-mobile.com/mms/wapenc
that should be all you have to set

Method Works on SPRINT AND BOOST too
Thanks
This method works on Boost and Sprint too.
Tested in INDIA working fine with indian GSM carriers.

Whoareyou said:
Background Info: I work at Walmart in the Connection Center, and today I had a customer wanting to switch to Family Mobile from AT&T, so I showed them our Family Mobile devices and T-Mobile Devices, they didnt seem interested in them and said they wanted somthing that had Android 5.0 Lollipop, I thought about it for a minute and remembered that the Moto E (2015) shipped with Lollipop installed, I also knew that Verizon phones come unlocked, so I showed them the device and they decided to go with it, they bought the Family Mobile Micro SIM starter kit, and the Moto E, but once I powered it on, I couldn't get it to connect to Family Mobile, so I tried to access the advanced radio menu (*#*#4636#*#*) to no avail, but I eventually got it working, with full LTE support, heres how:
1. Power on the device with the GSM SIM card in the SIM card slot
2. Connect to WiFi and complete Google Sign-In
3. Go to the Play Store and search "Network" download the first app (A white circle with a black phone in it) (This will allow us access to the advance radio options)
4. Open the "Network" shortcut
5. Change the radio mode from "CDMA/LTE PRL" to "GSM/LTE Auto"
6. Open up the settings app, go to the mobile networks panel, select "Prefered Network Mode" and change it to "4G"
7. Input the appropriate APNs for your specific carrier
8 (Optional). Disable all Verizon apps through settings or Titanium Backup.
The only thing I couldnt solve was how to remove the "SIM Card is not from Verizon Wireless" error in the status bar permanently, but thats just an annoyance, and causes no usability decrease.
Click to expand...
Click to collapse
Hello. It does not work in Ukraine. Tried many operators. Line GSM only emergency calls and all.I choose the network settings and 2G and 3G. Prompt what to do please.

_Z_x_Z_ said:
Hello. It does not work in Ukraine. Tried many operators. Line GSM only emergency calls and all.I choose the network settings and 2G and 3G. Prompt what to do please.
Click to expand...
Click to collapse
The device may not support Ukrainian bands, check with your carrier to see what band they use for HSPA/LTE

I'll have to get mine out and find it.

This only kinda works with T-Mobile. No LTE or 3G, just edge - and that keeps disconnecting and reconnecting about once every minute or so. I'll have to look into the return/exchange policy if I can't get data working.

brotherswing said:
This only kinda works with T-Mobile. No LTE or 3G, just edge - and that keeps disconnecting and reconnecting about once every minute or so. I'll have to look into the return/exchange policy if I can't get data working.
Click to expand...
Click to collapse
You must be in a non-refarmed area, in Shawnee, KS i was able to get Edge/3G/HSPA+/LTE

Whoareyou said:
You must be in a non-refarmed area, in Shawnee, KS i was able to get Edge/3G/HSPA+/LTE
Click to expand...
Click to collapse
Yep. See my snapshot above for Ting GSM (T-Mobile) in Florida. 4G LTE indicated.

I figured it out. With WiFi on my cell signal strength fluctuates wildly, but as soon as I turn off the WiFi the signal settles down, and I get a solid LTE connection averaging about 32Mbps. Strange, but I've seen crazier things.
Side note, the XT1528 is not eligible for the Motorola unlock program, and cannot be rooted by any method currently available. Several "one click root" tools claim to support it, but don't actually work.
Sent from my XT1528 using Tapatalk

Will the boost variant work on net10
Sent from my N800 using XDA Free mobile app

syrkles said:
Will the boost variant work on net10
Sent from my N800 using XDA Free mobile app
Click to expand...
Click to collapse
I personally haven't had any luck with the Sprint variants (Virgin Mobile, Boost) but I also didn't get to try using an activated Sim card, you could try, but I'm not sure

brotherswing said:
I figured it out. With WiFi on my cell signal strength fluctuates wildly, but as soon as I turn off the WiFi the signal settles down, and I get a solid LTE connection averaging about 32Mbps. Strange, but I've seen crazier things.
Side note, the XT1528 is not eligible for the Motorola unlock program, and cannot be rooted by any method currently available. Several "one click root" tools claim to support it, but don't actually work.
Sent from my XT1528 using Tapatalk
Click to expand...
Click to collapse
That root thread won't root the XT1528?

Root must be flashed with a custom recovery, which in turn requires that the boot loader be unlocked. Since the boot loader on the XT1528 can't be unlocked, we can't use that root technique.

brotherswing said:
Root must be flashed with a custom recovery, which in turn requires that the boot loader be unlocked. Since the boot loader on the XT1528 can't be unlocked, we can't use that root technique.
Click to expand...
Click to collapse
Ahh that's for clearing that up for me!

Programming modem with QPST/QXDM on Boost Desire 626S

Hello everyone. It's been heavily requested that I create a guide on how to program the values I provided in one of the posts on my previous boot image thread into the Boost Desire 626S modem so I decided to take the job into my own hands for your convenience.
First you will need QPST, QXDM, and the modem diag usb driver if it is not already installed on your computer. Here are the links:
QPST:
https://www.sendspace.com/filegroup/XynIcslf8H6Qm2TsJ5z4ZEocT85CdvbS
QXDM:
https://www.sendspace.com/filegroup/XynIcslf8H6Qm2TsJ5z4ZEocT85CdvbS
DIAG DRIVER:
https://www.sendspace.com/filegroup/XynIcslf8H6Qm2TsJ5z4ZEocT85CdvbS
1 --- INSTALLING SOFTWARE / DRIVERS
Run QPST.2.7.425 from the QPST folder in the QPST.zip archive and install it by clicking next through the dialog box at each step.
Run QXDMInstaller from the QXDM folder in the QXDM.zip archive and install it by clicking next at each step as well.
Run HTC CDMA LTE DIAG Modem Driver v3.0.2.0 from the inside the DIAGDRIVER.zip archive and you've got everything you need to now program the Boost Desire 626S modem.
2 --- SETTING UP USB DEBUGGING
---First you will need to enable usb debugging.
---Connect your Desire 626S to a usb port on your computer.
---Open the settings app and scroll to about and select it.
---Next, select software information then select more and tap on build number 7 times.
---This will enable access to Developer Options in the settings app.
---Tap back three times and you will now see developers options as selectable in the settings app.
---Tap on developer options and scroll down a bit to USB debugging option.
---Make sure it has a blue checkmark next to it so it is enabled.
3 --- SETTING UP DIAG USB ACCESS
---Now we will enable usb diag access to allow communications with QPST/QXDM.
---On your computer with the phone still connected, open a command prompt as administrator and type adb shell then hit enter.
---Or if you are using minimal adb and fastboot installation, open the shortcut for it as administrator and type adb shell then hit enter.
---On your phone, tick the box next to always allow and tap ok.
---You might have to type in adb shell again and hit enter.
---Do so and you will see [email protected]_a32ewhl:/ $ at the prompt which means you have shell access.
---Now we need root shell access.
---With the shell access, type in su and hit enter.
---Allow the root access for adb shell in the supersu prompt that pops up on your phone.
---You will now see [email protected]_a32ewhl:/ # in the command prompt window.
---Congrats you now have root access.
---With root shell access type this in and hit enter in the command prompt window:
echo 1 > /sys/devices/virtual/android_usb/android0/f_diag/func_en
---You might hear a ding and you have now enabled diag access to use QPST/QXDM in order to program the modem.
4 --- SETTING UP MODEM DIAG COMMUNICATION
---To open QXDM, click the orb in the bottom left hand corner to open the start menu and then click all programs.
---Scroll to QXDM Professional and click it and then click the next QXDM Professional shortcut under it.
---QXDM will now open so now it's time to access the diag port to the modem.
---Click on options in the bar towards the top of the window and then click on communications.
---Under target port, click on the box that says disconnect and click on the available COM port whether it might be COM1-5 then click ok.
5 --- PROGRAMMING MODEM NV ITEM VALUES
---Now we are down to the nitty gritty, actually programming the values for the bands in the modem. It is actually quite easy to do if you figure out what needs to be done.
---Click on the box next to view on the second bar down and click on the NV browser option to open it.
---In the NV browser window you will see some of the first typical NV items that might be included in a modem firmware but we are looking for the certain ones we want to edit to change bands and functionality.
---Left click the up and down arrows on the scroll bar and hold the left mouse button to slowly scroll from item value to item value if you need to, and slowly drag the knob on the scroll bar up and down if you require quicker navigation through the NV items.
---Once you reach an NV item you want to change, for instance, item 1877, click it and in the box under fields section you will see the input field used to change the following value field are both 0, followed by the respective nv items true name.
---To retrieve the content of each field for item 1877 or any nv item, click the read button in the bottom right hand side of the nv browser window, and you will be presented with the fields contents.
---For example NV item 1877 has a default value field content of 78135687 on my Boost Desire 626S so input field is also the same but this input field is what we change.
---Click the value under input once to select it then click it again and it will be editable with the caret blinking and 78135687 highlighted.
---Type in or copy and paste the value you wish to use for the value field in this input field once it is highlighted then hit enter on the keyboard and click write in the bottom right hand side of the window to make the new value stick.
---Congrats you have changed the value for an NV item.
---After writing new values, click offline in the bottom right hand side of the nv browser and wait 5 seconds.
---You will see the signal bar on your phone go blank.
---Click reset and the signal on your phone will be restored.
---Follow these last few steps when writing new values to ensure they stick.
---Reboot your phone and the values will stick.
6 --- GETTING MSL/SPC CODE FOR YOUR PHONE
---Scroll to item ID 00085 with description security code and click it to select it then click read in the bottom right hand side of the NV browser window
---In the input and value fields you will be presented with the MSL/SPC for your phone.
---Use this MSL/SPC code to program/edit the modem nv item values in EPST menus accessed by using ##3282# in the dialer.
---Also type in spc ****** in the text field in the command bar below the view bar in the QXDM window and hit enter, the six stars being the six digits of your MSL/SPC.
---Enter the MSL/SPC in the latter manner before writing new values to the modem for safe measure to ensure they stick.
---Quick note, enter *#*#4636#*#* in the dialer to open the testing menu, and tap phone information then scroll down to set preferred network type, and tap the down arrow to the right then scroll to and tap the network type you would like to use.
7 --- HERE ARE SOME RELEVANT NV ITEMS AND THE VALUES TO WRITE TO THEM....
----------------
Items 6828 and 6829
35184372088830
all lte
----------------
Item 65633
0x00001FFFFFFFFFFE
all LTE Bands
----------------
Item 441
32767
all 3G
----------------
Item 946
65535
all 3G
----------------
Item 1878
32
max HW band
----------------
Item 2954
4294967295
all 3G
----------------
Item 1877
18446744073709551615
all 3G
----------------
Item 4548
18446744073709551615
all 3G
----------------
Item 11
B only
Channel 384 and 777
----------------
Item 12
B only
Channel 384 and 777
----------------
Item 441
0x2
Channel B
----------------
Item 442
0xFFFF
All Roam
----------------
Item 10
LTE Only
Band Pref
----------------
Item 5
0x0
Slot Cycle Index
-------------------
Item 4
0x9A
Station Class Mark
----------------
Item 179
0
Voice Privacy
----------------

What next?
---------- Post added at 11:36 AM ---------- Previous post was at 11:19 AM ----------
I meant how do I use d softwares to edit LTE bands

Thanks a lot man. I've successfully programmed the values and although I have a Sprint version and the LTE bands are different in my country, I was able to get the values from NV calculator on play store. I've not had time to check if they work albeit I programmed 3g bands a while back and band 2100 which works in my country failed to work, I hope the LTE works. Thanks once again

You're Welcome
doyin116 said:
Thanks a lot man. I've successfully programmed the values and although I have a Sprint version and the LTE bands are different in my country, I was able to get the values from NV calculator on play store. I've not had time to check if they work albeit I programmed 3g bands a while back and band 2100 which works in my country failed to work, I hope the LTE works. Thanks once again
Click to expand...
Click to collapse
You're Welcome. Glad it worked for you.

@anthonykb
---With root shell access type this in and hit enter in the command prompt window:
echo 1 > /sys/devices/virtual/android_usb/android0/f_diag/func_en
---You might hear a ding and you have now enabled diag access to use QPST/QXDM in order to program the modem.
Click to expand...
Click to collapse
Great work !!
Do you have any reference to other commands for switching the download / service modes?
To flash boot-loaders and such !!
I have the board support package for the msm8909 chipset and I am working on building the required programmers.
Just need to write my partition.xml ( I have the GPT info. )
My plan is to make a Qfil flashable Service Rom.

Update: Bands were successfully programmed as I stated earlier but sadly, they don't work. I just hope and pray someone somewhere is making a from scratch custom kernel for this device

@doyin116
Did that for Lollipop ( Completed ) For Marshmallow they didn't release the source yet.
I don't think it will be a problem to use the CAF source. ( Will Find out soon. )
Here is my kernel.
http://forum.xda-developers.com/desire-626/development/kernel-wip-port-lollipop-5-1-source-t3470476
Here's my source.
https://github.com/Bigcountry907/kernel_htc_a32eul
I just synced the CAF Android 7.0 source.
It's gonna be a wile cause I been developing this by my self but it is in the works.
I have built the UBERTC cortex a9 toolchains and compiled the kernel inline with the recovery both in omnirom 6.0 and omnirom7.0.
Omnirom 7.0 uses Ninja for building. https://ninja-build.org/
I didn't know if this would cause a problem but it didn't. None I couldn't fix anyway.
So I have used the 5.1 kernel source and built it successfully in newer android versions.
It could be the combination of ninja and the UBERTC toolchain that make it work. IDK.
What do you need in the kernel? I might have it built.

BigCountry907 said:
@doyin116
Did that for Lollipop ( Completed ) For Marshmallow they didn't release the source yet.
I don't think it will be a problem to use the CAF source. ( Will Find out soon. )
Here is my kernel.
http://forum.xda-developers.com/desire-626/development/kernel-wip-port-lollipop-5-1-source-t3470476
Here's my source.
https://github.com/Bigcountry907/kernel_htc_a32eul
I just synced the CAF Android 7.0 source.
It's gonna be a wile cause I been developing this by my self but it is in the works.
I have built the UBERTC cortex a9 toolchains and compiled the kernel inline with the recovery both in omnirom 6.0 and omnirom7.0.
Omnirom 7.0 uses Ninja for building. https://ninja-build.org/
I didn't know if this would cause a problem but it didn't. None I couldn't fix anyway.
So I have used the 5.1 kernel source and built it successfully in newer android versions.
It could be the combination of ninja and the UBERTC toolchain that make it work. IDK.
What do you need in the kernel? I might have it built.[/QUOTE
Came across your kernel but from my understanding, it was meant for the METRO PCs version of 626s while mine is the Sprint version. I also tried to downgrade from marshmallow to lollipop but wasn't successful because it seemed the tutorial again was for METRO PCs. As to what I need in the kernel, I heard Qualcomm has an anti-tamper settings or so that prevents flashed bands from working but can be by passed by a built from scratch kernel.
My questions now are: can I flash your kernel on my 626s albeit the Sprint version and if yes, how do I downgrade to 5.1 on my Sprint version. If no, could you please create a custom kernel for the Sprint version? Thanks
Click to expand...
Click to collapse

Maybe I can get you a ruu of lolipop.
Let me go see.
Most likly I need to build you a kernel.

BigCountry907 said:
@doyin116
Did that for Lollipop ( Completed ) For Marshmallow they didn't release the source yet.
I don't think it will be a problem to use the CAF source. ( Will Find out soon. )
Here is my kernel.
http://forum.xda-developers.com/desire-626/development/kernel-wip-port-lollipop-5-1-source-t3470476
Here's my source.
https://github.com/Bigcountry907/kernel_htc_a32eul
I just synced the CAF Android 7.0 source.
It's gonna be a wile cause I been developing this by my self but it is in the works.
I have built the UBERTC cortex a9 toolchains and compiled the kernel inline with the recovery both in omnirom 6.0 and omnirom7.0.
Omnirom 7.0 uses Ninja for building. https://ninja-build.org/
I didn't know if this would cause a problem but it didn't. None I couldn't fix anyway.
So I have used the 5.1 kernel source and built it successfully in newer android versions.
It could be the combination of ninja and the UBERTC toolchain that make it work. IDK.
What do you need in the kernel? I might have it built.
Click to expand...
Click to collapse
BigCountry907 said:
Maybe I can get you a ruu of lolipop.
Let me go see.
Most likly I need to build you a kernel.
Click to expand...
Click to collapse
Would really appreciate you building me a kernel. Thanks in advance

@doyin116
I got my hands on a RUU for sprint lolipop.
I will upload when I get a chance.
Right now i'm in kernel mode so you might get lucky.
Hopefully I can add the sprint config to my tree and build it.
I'm trying that with the vzw 526. So if all goes well........
After I make recovery for 526 I will compile you a kernel.

BigCountry907 said:
@doyin116
I got my hands on a RUU for sprint lolipop.
I will upload when I get a chance.
Right now i'm in kernel mode so you might get lucky.
Hopefully I can add the sprint config to my tree and build it.
I'm trying that with the vzw 526. So if all goes well........
After I make recovery for 526 I will compile you a kernel.
Click to expand...
Click to collapse
I'm glad. Is there a time frame for all of this to be done?

I will upload this ruu tonight. Over the weekend I will put together the kernel over the weekend.
You will have to test it. I don't think I can flash sprint to my device. It's metro. But I am s-off.

BigCountry907 said:
@doyin116
I got my hands on a RUU for sprint lolipop.
I will upload when I get a chance.
Right now i'm in kernel mode so you might get lucky.
Hopefully I can add the sprint config to my tree and build it.
I'm trying that with the vzw 526. So if all goes well........
After I make recovery for 526 I will compile you a kernel.
Click to expand...
Click to collapse
BigCountry907 said:
I will upload this ruu tonight. Over the weekend I will put together the kernel over the weekend.
You will have to test it. I don't think I can flash sprint to my device. It's metro. But I am s-off.
Click to expand...
Click to collapse
No problem. I'm up for it

@doyin116n116
Here is the 5.1 ruu for sprint.
https://drive.google.com/open?id=0B8jitdIyh2NtUHQ2YWd5T2RCUFk
Download it and rename the file 0PM9IMG.zip.
See the downgrade post for metro pcs and edit the mainver in the misc partition as shown there.
You can just flash the misc.img that is posted on that thread.
Copy the 0PM9IMG.zip to your sdcard.
Boot the phone into download mode.
It will ask you if you want to install the ruu.
Hit the vol up key to install it.
If it reboots the first time back to download mode then hit vol up again.
It will flash for sure.
And don't worry.....it is easier to go back to MM than it is to go to LP.

BigCountry907 said:
@doyin116n116
Here is the 5.1 ruu for sprint.
https://drive.google.com/open?id=0B8jitdIyh2NtUHQ2YWd5T2RCUFk
Download it and rename the file 0PM9IMG.zip.
See the downgrade post for metro pcs and edit the mainver in the misc partition as shown there.
You can just flash the misc.img that is posted on that thread.
Copy the 0PM9IMG.zip to your sdcard.
Boot the phone into download mode.
It will ask you if you want to install the ruu.
Hit the vol up key to install it.
If it reboots the first time back to download mode then hit vol up again.
It will flash for sure.
And don't worry.....it is easier to go back to MM than it is to go to LP.
Click to expand...
Click to collapse
@BigCountry907 I'm having issues flashing the misc.img. I flashed through adb fastboot flash misc.img and it said unknown partition 'misc.img' error: cannot determine image file name for 'misc.img'. I flashed through twrp and it said could not find meta-inf/com/Google/Android/update-binary in the zip file. Through adb I did adb push misc.img /sdcard/".
"adb shell"
"su"
"dd if=/sdcard/misc.img of=/dev/block/bootdevice/by-name/misc" and it succeeded but when I flashed the 5.1 ruu it said ru_zip_error.
Could it be that the downgrading process is for metro PCs/ do I have to be unrooted or can I get detailed process of flashing it if I did it wrong. Alternatively, is there a tool I can use to access the misc.img partition and edit it myself?

@doyin116
I am creating a new how to thread.
We have got this thread way off topic.
The new thread is here.
http://forum.xda-developers.com/desire-626/general/how-to-downgrade-sprint-desire-626s-to-t3498653
Give me a little wile to write it up.
If a Moderator would like to move post #7 through post #17 to there that would be good.
How do we request a moderator to do that?

Old thread on old phone, I realize... but hoping someone might catch this & assist me. Having issues with gather SPC using QXDM 03.14.594 on 626s 0PM92 - Sprint MM ROM running on I-Wireless [T-Mobile].
While attempting READ on 00085, response is: "No DIAG response received".
Concerned about programming NV values in EPST w/o it. Any thoughts?
Update: After upgrading both qxdm/qpst, I'm getting a return on read from phone. Has it possibly been set as: 000000?