Welcome to XDA

Search to go directly to your device's forum

Register an account

Unlock full posting privileges

Ask a question

No registration required
Post Reply

LG's Engineering Mode (HiddenMenu.apk)

OP xd.bx

5th July 2014, 12:34 PM   |  #1  
OP Senior Member
Flag Copenhague
Thanks Meter: 284
 
411 posts
Join Date:Joined: May 2011
More
This thread presents the information available within the Engineering Mode, which is a LG specific extension similar to Samsung's ServiceMode.

The thread is slip in six parts:
  • How to access the Engineering Mode
  • 2G (GSM/GPRS/EDGE) radio information
  • 3G (WCDMA/HSDPA/HSPA+) radio information
  • LTE radio information
  • Network Management / NAS (Non Access Stratum)
  • Understanding how the Engineering Mode works
The Following 2 Users Say Thank You to xd.bx For This Useful Post: [ View ]
5th July 2014, 12:34 PM   |  #2  
OP Senior Member
Flag Copenhague
Thanks Meter: 284
 
411 posts
Join Date:Joined: May 2011
More
How to access the Engineering Mode
The first thing to note is that the Engineering Mode view, provided by HiddenMenu.apk, relies on specific modifications LG added to the framework, more specifically the sending and receiving of RIL_OEM_HOOK_RAW.

Hence, contrary to the SamsungServiceMode.apk that can be install on CyanogenMod, here HiddemMenu will not work on a CyanogenMod ROM without re-implementing the functionnality LG added to the phone class.

First, to get into the application, enter 3845#*802# (that's for the international LG G2 version). Then select "WCDMA-Only", then "Modem Settings", then "Engineering Mode".
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-13-55-39.jpg
Views:	442
Size:	147.1 KB
ID:	2833852   Click image for larger version

Name:	Screenshot_2014-07-04-13-52-41.png
Views:	471
Size:	161.7 KB
ID:	2833855   Click image for larger version

Name:	Screenshot_2014-07-04-13-52-49.png
Views:	424
Size:	187.7 KB
ID:	2833856   Click image for larger version

Name:	Screenshot_2014-07-04-13-53-31.png
Views:	417
Size:	191.6 KB
ID:	2833857  
Last edited by xd.bx; 5th July 2014 at 12:43 PM.
The Following 2 Users Say Thank You to xd.bx For This Useful Post: [ View ]
5th July 2014, 12:34 PM   |  #3  
OP Senior Member
Flag Copenhague
Thanks Meter: 284
 
411 posts
Join Date:Joined: May 2011
More
2G (GSM/GPRS/EDGE) radio information
You will note some of these screenshots have some blurry areas: this was done on purpose by myself, to anonymize the data. This menu presents information about the current 2G cell (ARFCN, C1, C2) as well as neighbours in GSM and GPRS/EDGE modes. We also get rx quality/tx power information, and various bits and pieces about AMR and GPRS.
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-13-57-07.png
Views:	354
Size:	150.2 KB
ID:	2833862   Click image for larger version

Name:	Screenshot_2014-07-04-13-57-20.png
Views:	337
Size:	128.0 KB
ID:	2833863   Click image for larger version

Name:	Screenshot_2014-07-04-13-57-30.png
Views:	330
Size:	126.2 KB
ID:	2833864   Click image for larger version

Name:	Screenshot_2014-07-04-13-57-39.png
Views:	316
Size:	156.5 KB
ID:	2833865   Click image for larger version

Name:	Screenshot_2014-07-04-13-57-49.png
Views:	311
Size:	206.8 KB
ID:	2833866  
Last edited by xd.bx; 5th July 2014 at 12:48 PM.
The Following User Says Thank You to xd.bx For This Useful Post: [ View ]
5th July 2014, 12:35 PM   |  #4  
OP Senior Member
Flag Copenhague
Thanks Meter: 284
 
411 posts
Join Date:Joined: May 2011
More
3G (WCDMA/HSDPA/HSPA+) radio information
There are two menus, 3G and HSDPA. Various low-level information is shown, for example the PSC (Primary Scrambling Code) the antenna uses, as well as PSC for nearby antennas.
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-14-02-50.png
Views:	289
Size:	168.8 KB
ID:	2833871   Click image for larger version

Name:	Screenshot_2014-07-04-14-03-09.png
Views:	283
Size:	118.7 KB
ID:	2833872   Click image for larger version

Name:	Screenshot_2014-07-04-14-03-17.png
Views:	274
Size:	110.8 KB
ID:	2833873   Click image for larger version

Name:	Screenshot_2014-07-04-14-04-04.png
Views:	278
Size:	123.8 KB
ID:	2833874   Click image for larger version

Name:	Screenshot_2014-07-04-14-04-11.png
Views:	276
Size:	169.5 KB
ID:	2833875   Click image for larger version

Name:	Screenshot_2014-07-04-14-06-49.png
Views:	273
Size:	203.6 KB
ID:	2833876   Click image for larger version

Name:	Screenshot_2014-07-04-14-06-56.png
Views:	279
Size:	218.6 KB
ID:	2833877  
Last edited by xd.bx; 5th July 2014 at 12:51 PM.
The Following User Says Thank You to xd.bx For This Useful Post: [ View ]
5th July 2014, 12:35 PM   |  #5  
OP Senior Member
Flag Copenhague
Thanks Meter: 284
 
411 posts
Join Date:Joined: May 2011
More
LTE radio information
This menu provides information when connected in 4G. It seems fairly less comprehensive that the 2G and 3G menus.
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-14-08-28.png
Views:	264
Size:	175.6 KB
ID:	2833881   Click image for larger version

Name:	Screenshot_2014-07-04-14-08-34.png
Views:	257
Size:	168.6 KB
ID:	2833882  
Last edited by xd.bx; 5th July 2014 at 12:53 PM.
The Following User Says Thank You to xd.bx For This Useful Post: [ View ]
5th July 2014, 12:36 PM   |  #6  
OP Senior Member
Flag Copenhague
Thanks Meter: 284
 
411 posts
Join Date:Joined: May 2011
More
Network Management / NAS (Non Access Stratum)
This mode is fairly interesting, mostly due to its reporting of the current ciphering algorithm in use. However in packed switched mode (PS) this indicator seems limited to GPRS/EDGE (below, it appears the network uses GEA/3). In circuit switched mode it correctly reports the ciphering status as soon as a call is made or received; below, you can see the network uses A5/1 for GSM and UEA1 (Kasumi) for 3G calls. (for some reason in 3G the baseband only informs the "UEA" field. the "ciphering" field is unused).

Please note the NM menu seems limited to 2G/3G, when the phone is on LTE the fields have their default value.
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-13-58-41.png
Views:	241
Size:	150.8 KB
ID:	2833889   Click image for larger version

Name:	Screenshot_2014-07-04-13-58-49.png
Views:	237
Size:	204.2 KB
ID:	2833890   Click image for larger version

Name:	Screenshot_2014-07-04-13-59-31.png
Views:	236
Size:	154.2 KB
ID:	2833891   Click image for larger version

Name:	Screenshot_2014-07-04-13-59-56.png
Views:	231
Size:	155.4 KB
ID:	2833892   Click image for larger version

Name:	Screenshot_2014-07-04-14-00-03.png
Views:	230
Size:	121.3 KB
ID:	2833894   Click image for larger version

Name:	Screenshot_2014-07-04-14-00-12.png
Views:	221
Size:	157.5 KB
ID:	2833895   Click image for larger version

Name:	Screenshot_2014-07-04-14-06-05.png
Views:	219
Size:	154.5 KB
ID:	2833896  
Last edited by xd.bx; 5th July 2014 at 01:04 PM.
The Following User Says Thank You to xd.bx For This Useful Post: [ View ]
5th July 2014, 12:36 PM   |  #7  
OP Senior Member
Flag Copenhague
Thanks Meter: 284
 
411 posts
Join Date:Joined: May 2011
More
Understanding how the Engineering Mode works
TBD - I might add information at some point here on how to use strace to peek at the QMI requests rild makes.

It's worth noting this application could be ported to the Nexus 4/5, since it appears from looking at the strings in the baseband LG also included these specific extensions.
Last edited by xd.bx; 5th July 2014 at 01:08 PM.
The Following User Says Thank You to xd.bx For This Useful Post: [ View ]
5th July 2014, 04:01 PM   |  #8  
E:V:A's Avatar
Recognized Developer
Flag -∇ϕ
Thanks Meter: 1,868
 
1,378 posts
Join Date:Joined: Dec 2011
Fantastic! Great Job. Can you also say something in OP what BP that phone is using? And if the APK relies on some specific libraries. Then perhaps we could pack up the APK with the libraries, to look at.

To everyone: Hey! Don't just do this blindly. You will ruin some essential functionality if you accidentally overwrite these files/libraries.
5th July 2014, 04:53 PM   |  #9  
OP Senior Member
Flag Copenhague
Thanks Meter: 284
 
411 posts
Join Date:Joined: May 2011
More
Quote:
Originally Posted by E:V:A

Fantastic! Great Job. Can you also say something in OP what BP that phone is using? And if the APK relies on some specific libraries. Then perhaps we could pack up the APK with the libraries, to look at.

To everyone: Hey! Don't just do this blindly. You will ruin some essential functionality if you accidentally overwrite these files/libraries.

Hi E:V:A,

AFAIK it is a MDM9x25.

Unfortunately LG Terms of use, which I agreed to, prohibit me from redistributing, disassembling or decompiling their binaries.

However there are two points to note:
  • HiddenMenu can be found in some stock ROM that have been made available on this site by various xda developers. Thanks guys!
  • Reverse-engineering is not a strict requirement. Instead I examine the side effects eg using strace. The samsung-ril developers used the same technique

Post Reply Subscribe to Thread
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes