Attend XDA's Second Annual Developer Conference, XDA:DevCon 2014!
5,808,657 Members 43,517 Now Online
XDA Developers Android and Mobile Development Forum

LG's Engineering Mode (HiddenMenu.apk)

Tip us?
 
xd.bx
Old
#1  
Senior Member - OP
Thanks Meter 284
Posts: 408
Join Date: May 2011
Location: Copenhague
Default LG's Engineering Mode (HiddenMenu.apk)

This thread presents the information available within the Engineering Mode, which is a LG specific extension similar to Samsung's ServiceMode.

The thread is slip in six parts:
  • How to access the Engineering Mode
  • 2G (GSM/GPRS/EDGE) radio information
  • 3G (WCDMA/HSDPA/HSPA+) radio information
  • LTE radio information
  • Network Management / NAS (Non Access Stratum)
  • Understanding how the Engineering Mode works
Away for a short while
The Following 2 Users Say Thank You to xd.bx For This Useful Post: [ Click to Expand ]
 
xd.bx
Old
(Last edited by xd.bx; 5th July 2014 at 11:43 AM.)
#2  
Senior Member - OP
Thanks Meter 284
Posts: 408
Join Date: May 2011
Location: Copenhague
Default How to access the Engineering Mode

The first thing to note is that the Engineering Mode view, provided by HiddenMenu.apk, relies on specific modifications LG added to the framework, more specifically the sending and receiving of RIL_OEM_HOOK_RAW.

Hence, contrary to the SamsungServiceMode.apk that can be install on CyanogenMod, here HiddemMenu will not work on a CyanogenMod ROM without re-implementing the functionnality LG added to the phone class.

First, to get into the application, enter 3845#*802# (that's for the international LG G2 version). Then select "WCDMA-Only", then "Modem Settings", then "Engineering Mode".
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-13-55-39.jpg
Views:	424
Size:	147.1 KB
ID:	2833852   Click image for larger version

Name:	Screenshot_2014-07-04-13-52-41.png
Views:	448
Size:	161.7 KB
ID:	2833855   Click image for larger version

Name:	Screenshot_2014-07-04-13-52-49.png
Views:	409
Size:	187.7 KB
ID:	2833856   Click image for larger version

Name:	Screenshot_2014-07-04-13-53-31.png
Views:	401
Size:	191.6 KB
ID:	2833857  
Away for a short while
The Following 2 Users Say Thank You to xd.bx For This Useful Post: [ Click to Expand ]
 
xd.bx
Old
(Last edited by xd.bx; 5th July 2014 at 11:48 AM.)
#3  
Senior Member - OP
Thanks Meter 284
Posts: 408
Join Date: May 2011
Location: Copenhague
Default 2G (GSM/GPRS/EDGE) radio information

You will note some of these screenshots have some blurry areas: this was done on purpose by myself, to anonymize the data. This menu presents information about the current 2G cell (ARFCN, C1, C2) as well as neighbours in GSM and GPRS/EDGE modes. We also get rx quality/tx power information, and various bits and pieces about AMR and GPRS.
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-13-57-07.png
Views:	342
Size:	150.2 KB
ID:	2833862   Click image for larger version

Name:	Screenshot_2014-07-04-13-57-20.png
Views:	326
Size:	128.0 KB
ID:	2833863   Click image for larger version

Name:	Screenshot_2014-07-04-13-57-30.png
Views:	319
Size:	126.2 KB
ID:	2833864   Click image for larger version

Name:	Screenshot_2014-07-04-13-57-39.png
Views:	309
Size:	156.5 KB
ID:	2833865   Click image for larger version

Name:	Screenshot_2014-07-04-13-57-49.png
Views:	305
Size:	206.8 KB
ID:	2833866  

Away for a short while
The Following User Says Thank You to xd.bx For This Useful Post: [ Click to Expand ]
 
xd.bx
Old
(Last edited by xd.bx; 5th July 2014 at 11:51 AM.)
#4  
Senior Member - OP
Thanks Meter 284
Posts: 408
Join Date: May 2011
Location: Copenhague
Default 3G (WCDMA/HSDPA/HSPA+) radio information

There are two menus, 3G and HSDPA. Various low-level information is shown, for example the PSC (Primary Scrambling Code) the antenna uses, as well as PSC for nearby antennas.
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-14-02-50.png
Views:	280
Size:	168.8 KB
ID:	2833871   Click image for larger version

Name:	Screenshot_2014-07-04-14-03-09.png
Views:	275
Size:	118.7 KB
ID:	2833872   Click image for larger version

Name:	Screenshot_2014-07-04-14-03-17.png
Views:	268
Size:	110.8 KB
ID:	2833873   Click image for larger version

Name:	Screenshot_2014-07-04-14-04-04.png
Views:	271
Size:	123.8 KB
ID:	2833874   Click image for larger version

Name:	Screenshot_2014-07-04-14-04-11.png
Views:	269
Size:	169.5 KB
ID:	2833875  

Click image for larger version

Name:	Screenshot_2014-07-04-14-06-49.png
Views:	266
Size:	203.6 KB
ID:	2833876   Click image for larger version

Name:	Screenshot_2014-07-04-14-06-56.png
Views:	272
Size:	218.6 KB
ID:	2833877  
Away for a short while
The Following User Says Thank You to xd.bx For This Useful Post: [ Click to Expand ]
 
xd.bx
Old
(Last edited by xd.bx; 5th July 2014 at 11:53 AM.)
#5  
Senior Member - OP
Thanks Meter 284
Posts: 408
Join Date: May 2011
Location: Copenhague
Default LTE radio information

This menu provides information when connected in 4G. It seems fairly less comprehensive that the 2G and 3G menus.
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-14-08-28.png
Views:	258
Size:	175.6 KB
ID:	2833881   Click image for larger version

Name:	Screenshot_2014-07-04-14-08-34.png
Views:	252
Size:	168.6 KB
ID:	2833882  
Away for a short while
The Following User Says Thank You to xd.bx For This Useful Post: [ Click to Expand ]
 
xd.bx
Old
(Last edited by xd.bx; 5th July 2014 at 12:04 PM.)
#6  
Senior Member - OP
Thanks Meter 284
Posts: 408
Join Date: May 2011
Location: Copenhague
Default Network Management / NAS (Non Access Stratum)

This mode is fairly interesting, mostly due to its reporting of the current ciphering algorithm in use. However in packed switched mode (PS) this indicator seems limited to GPRS/EDGE (below, it appears the network uses GEA/3). In circuit switched mode it correctly reports the ciphering status as soon as a call is made or received; below, you can see the network uses A5/1 for GSM and UEA1 (Kasumi) for 3G calls. (for some reason in 3G the baseband only informs the "UEA" field. the "ciphering" field is unused).

Please note the NM menu seems limited to 2G/3G, when the phone is on LTE the fields have their default value.
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-07-04-13-58-41.png
Views:	234
Size:	150.8 KB
ID:	2833889   Click image for larger version

Name:	Screenshot_2014-07-04-13-58-49.png
Views:	230
Size:	204.2 KB
ID:	2833890   Click image for larger version

Name:	Screenshot_2014-07-04-13-59-31.png
Views:	228
Size:	154.2 KB
ID:	2833891   Click image for larger version

Name:	Screenshot_2014-07-04-13-59-56.png
Views:	227
Size:	155.4 KB
ID:	2833892   Click image for larger version

Name:	Screenshot_2014-07-04-14-00-03.png
Views:	226
Size:	121.3 KB
ID:	2833894  

Click image for larger version

Name:	Screenshot_2014-07-04-14-00-12.png
Views:	219
Size:	157.5 KB
ID:	2833895   Click image for larger version

Name:	Screenshot_2014-07-04-14-06-05.png
Views:	219
Size:	154.5 KB
ID:	2833896  
Away for a short while
The Following User Says Thank You to xd.bx For This Useful Post: [ Click to Expand ]
 
xd.bx
Old
(Last edited by xd.bx; 5th July 2014 at 12:08 PM.)
#7  
Senior Member - OP
Thanks Meter 284
Posts: 408
Join Date: May 2011
Location: Copenhague
Default Understanding how the Engineering Mode works

TBD - I might add information at some point here on how to use strace to peek at the QMI requests rild makes.

It's worth noting this application could be ported to the Nexus 4/5, since it appears from looking at the strings in the baseband LG also included these specific extensions.
Away for a short while
The Following User Says Thank You to xd.bx For This Useful Post: [ Click to Expand ]
 
E:V:A
Old
#8  
E:V:A's Avatar
Recognized Developer
Thanks Meter 1,790
Posts: 1,341
Join Date: Dec 2011
Location: -∇ϕ
Fantastic! Great Job. Can you also say something in OP what BP that phone is using? And if the APK relies on some specific libraries. Then perhaps we could pack up the APK with the libraries, to look at.

To everyone: Hey! Don't just do this blindly. You will ruin some essential functionality if you accidentally overwrite these files/libraries.
MSM8960 Info, Architecture and Bootloader(s)
El Grande Partition Table Reference
How to talk to the Modem with AT commands

[REF][ServiceMode] How to make your Samsung perform dog tricks
[REF|R&D|RF] RF/Radio properties of Samsung ServiceMode

Want to know when your phone is getting tracked or tapped?

Help us develop the IMSI Catcher / Spy Detector!
(To be part of the EFF & The Guardian Project toolsets.)
_______________________________
If you like what I do, just click THANKS!
Everything I do is free, altruism is the way!
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
I do not answer support related PM's.

 
xd.bx
Old
#9  
Senior Member - OP
Thanks Meter 284
Posts: 408
Join Date: May 2011
Location: Copenhague
Quote:
Originally Posted by E:V:A View Post
Fantastic! Great Job. Can you also say something in OP what BP that phone is using? And if the APK relies on some specific libraries. Then perhaps we could pack up the APK with the libraries, to look at.

To everyone: Hey! Don't just do this blindly. You will ruin some essential functionality if you accidentally overwrite these files/libraries.
Hi E:V:A,

AFAIK it is a MDM9x25.

Unfortunately LG Terms of use, which I agreed to, prohibit me from redistributing, disassembling or decompiling their binaries.

However there are two points to note:
  • HiddenMenu can be found in some stock ROM that have been made available on this site by various xda developers. Thanks guys!
  • Reverse-engineering is not a strict requirement. Instead I examine the side effects eg using strace. The samsung-ril developers used the same technique
Away for a short while

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes