LG's Engineering Mode (HiddenMenu.apk)

X

xd.bx

Senior Member

May 14, 2011

431

292

• Jul 5, 2014

• #1

This thread presents the information available within the Engineering Mode, which is a LG specific extension similar to Samsung's ServiceMode.

The thread is slip in six parts:

• How to access the Engineering Mode
• 2G (GSM/GPRS/EDGE) radio information
• 3G (WCDMA/HSDPA/HSPA+) radio information
• LTE radio information
• Network Management / NAS (Non Access Stratum)
• Understanding how the Engineering Mode works

 

• 

Reactions: dimebags420d, siggey and E:V:A

X

xd.bx

Senior Member

May 14, 2011

431

292

• Jul 5, 2014

• #2

How to access the Engineering Mode

The first thing to note is that the Engineering Mode view, provided by HiddenMenu.apk, relies on specific modifications LG added to the framework, more specifically the sending and receiving of RIL_OEM_HOOK_RAW.

Hence, contrary to the SamsungServiceMode.apk that can be install on CyanogenMod, here HiddemMenu will not work on a CyanogenMod ROM without re-implementing the functionnality LG added to the phone class.

First, to get into the application, enter 3845#*802# (that's for the international LG G2 version). Then select "WCDMA-Only", then "Modem Settings", then "Engineering Mode".

 

Attachments

• 
  Screenshot_2014-07-04-13-55-39.jpg

  147.1 KB · Views: 5,714
• 
  Screenshot_2014-07-04-13-52-41.png

  161.7 KB · Views: 5,993
• 
  Screenshot_2014-07-04-13-52-49.png

  187.7 KB · Views: 5,543
• 
  Screenshot_2014-07-04-13-53-31.png

  191.6 KB · Views: 4,657

Last edited: Jul 5, 2014

• 

Reactions: th3g1z and E:V:A

X

xd.bx

Senior Member

May 14, 2011

431

292

• Jul 5, 2014

• #3

2G (GSM/GPRS/EDGE) radio information

You will note some of these screenshots have some blurry areas: this was done on purpose by myself, to anonymize the data. This menu presents information about the current 2G cell (ARFCN, C1, C2) as well as neighbours in GSM and GPRS/EDGE modes. We also get rx quality/tx power information, and various bits and pieces about AMR and GPRS.

 

Attachments

• 
  Screenshot_2014-07-04-13-57-07.png

  150.2 KB · Views: 2,336
• 
  Screenshot_2014-07-04-13-57-20.png

  128 KB · Views: 2,246
• 
  Screenshot_2014-07-04-13-57-30.png

  126.2 KB · Views: 2,155
• 
  Screenshot_2014-07-04-13-57-39.png

  156.5 KB · Views: 1,803
• 
  Screenshot_2014-07-04-13-57-49.png

  206.8 KB · Views: 1,808

Last edited: Jul 5, 2014

• 

Reactions: E:V:A

X

xd.bx

Senior Member

May 14, 2011

431

292

• Jul 5, 2014

• #4

3G (WCDMA/HSDPA/HSPA+) radio information

There are two menus, 3G and HSDPA. Various low-level information is shown, for example the PSC (Primary Scrambling Code) the antenna uses, as well as PSC for nearby antennas.

 

Attachments

• 
  Screenshot_2014-07-04-14-04-04.png

  123.8 KB · Views: 1,168
• 
  Screenshot_2014-07-04-14-03-17.png

  110.8 KB · Views: 1,411
• 
  Screenshot_2014-07-04-14-03-09.png

  118.7 KB · Views: 1,448
• 
  Screenshot_2014-07-04-14-02-50.png

  168.8 KB · Views: 1,470
• 
  Screenshot_2014-07-04-14-04-11.png

  169.5 KB · Views: 1,111
• 
  Screenshot_2014-07-04-14-06-49.png

  203.6 KB · Views: 1,111
• 
  Screenshot_2014-07-04-14-06-56.png

  218.6 KB · Views: 1,143

Last edited: Jul 5, 2014

• 

Reactions: E:V:A

X

xd.bx

Senior Member

May 14, 2011

431

292

• Jul 5, 2014

• #5

LTE radio information

This menu provides information when connected in 4G. It seems fairly less comprehensive that the 2G and 3G menus.

 

Attachments

• 
  Screenshot_2014-07-04-14-08-28.png

  175.6 KB · Views: 1,310
• 
  Screenshot_2014-07-04-14-08-34.png

  168.6 KB · Views: 1,275

Last edited: Jul 5, 2014

• 

Reactions: E:V:A

X

xd.bx

Senior Member

May 14, 2011

431

292

• Jul 5, 2014

• #6

Network Management / NAS (Non Access Stratum)

This mode is fairly interesting, mostly due to its reporting of the current ciphering algorithm in use. However in packed switched mode (PS) this indicator seems limited to GPRS/EDGE (below, it appears the network uses GEA/3). In circuit switched mode it correctly reports the ciphering status as soon as a call is made or received; below, you can see the network uses A5/1 for GSM and UEA1 (Kasumi) for 3G calls. (for some reason in 3G the baseband only informs the "UEA" field. the "ciphering" field is unused).

Please note the NM menu seems limited to 2G/3G, when the phone is on LTE the fields have their default value.

 

Attachments

• 
  Screenshot_2014-07-04-13-58-41.png

  150.8 KB · Views: 1,156
• 
  Screenshot_2014-07-04-13-58-49.png

  204.2 KB · Views: 1,126
• 
  Screenshot_2014-07-04-13-59-31.png

  154.2 KB · Views: 1,103
• 
  Screenshot_2014-07-04-13-59-56.png

  155.4 KB · Views: 959
• 
  Screenshot_2014-07-04-14-00-03.png

  121.3 KB · Views: 940
• 
  Screenshot_2014-07-04-14-00-12.png

  157.5 KB · Views: 915
• 
  Screenshot_2014-07-04-14-06-05.png

  154.5 KB · Views: 906

Last edited: Jul 5, 2014

• 

Reactions: E:V:A

X

xd.bx

Senior Member

May 14, 2011

431

292

• Jul 5, 2014

• #7

Understanding how the Engineering Mode works

TBD - I might add information at some point here on how to use strace to peek at the QMI requests rild makes.

It's worth noting this application could be ported to the Nexus 4/5, since it appears from looking at the strings in the baseband LG also included these specific extensions.

 

Last edited: Jul 5, 2014

• 

Reactions: E:V:A

E:V:A

Inactive Recognized Developer

Dec 6, 2011

1,447

2,222

-∇ϕ

• Jul 5, 2014

• #8

Fantastic! Great Job. Can you also say something in OP what BP that phone is using? And if the APK relies on some specific libraries. Then perhaps we could pack up the APK with the libraries, to look at.

To everyone: Hey! Don't just do this blindly. You will ruin some essential functionality if you accidentally overwrite these files/libraries.

 

X

xd.bx

Senior Member

May 14, 2011

431

292

• Jul 5, 2014

• #9

E:V:A said:

Fantastic! Great Job. Can you also say something in OP what BP that phone is using? And if the APK relies on some specific libraries. Then perhaps we could pack up the APK with the libraries, to look at.

To everyone: Hey! Don't just do this blindly. You will ruin some essential functionality if you accidentally overwrite these files/libraries.

Click to expand...

Click to collapse

Hi E:V:A,

AFAIK it is a MDM9x25.

Unfortunately LG Terms of use, which I agreed to, prohibit me from redistributing, disassembling or decompiling their binaries.

However there are two points to note:

• HiddenMenu can be found in some stock ROM that have been made available on this site by various xda developers. Thanks guys!
• Reverse-engineering is not a strict requirement. Instead I examine the side effects eg using strace. The samsung-ril developers used the same technique

 

Q

qassimto

New member

May 30, 2016

1

0

• May 30, 2016

• #10

please how to repiar my IMEI on lg g2 by useing engineering mode

 

R

rajbsn

Senior Member

Jun 15, 2007

225

13

• Mar 26, 2017

• #11

Can this be used to sim unlock the sprint variant to work on ATT?

 

R

revized

Senior Member

May 30, 2009

557

58

united sins of america

• May 28, 2017

• #12

I think so although because the commitments make to the powers that be at LG strictly prohibit any type of such activities to be discussed lest the lg ivory towers no longer shield us from destruction

 

H

hjroh0315

Member

Jun 9, 2015

28

5

Samsung Galaxy Tab 4

• Jun 6, 2017

• #13

I finally got to the hidden menu, but I could not find the WCDMA only button.

Sent from my LG Optimus G Pro