[BOUNTY] ($205 so far) Enable HSPA+ on 1900 MHz / 1700MHz for VZW Galaxy S3 i535

Search This thread

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
What's new? Any new insights? [I haven't followed, TLDR.]

We have a lot of new Qualcomm docs now... Have a look there.
Looking there, I saw some comments regarding the possibility of having certain accessibility lists for data access (from the Network side). But I could have misunderstood and be wrong...and it might not be applicable to this.

Also have look at what this guys says: http://xdaforums.com/showthread.php?t=1880781

From what i have been informed there are 2 partitions one is on the modem and the other is somewhere fixed which is not accessible... once the changes are done on the 1877 item it comapres it to the fixed partition values (modem nv items with fixed parition values) and restores it back to original settings....I was told 1877 is not an editable item...however i was given hope it can be edited but its hard to do it....

If there is a partition check of some kind, please post the exact partition info for the two different (carriers) devices.
 

mybook4

Senior Member
Apr 3, 2011
445
267
What's new? Any new insights? [I haven't followed, TLDR.]

Nothing much. We couldn't get item 1877 to keep our changes on reboot. I ended up getting really busy at work and don't have much time at all to work on this. If someone wants to take the reins, don't be shy.

Sent from my SCH-I535 using xda premium
 

jnc8651

Senior Member
Feb 9, 2007
104
12
San Antonio
Hey guys i have a galaxy s3 that needs to be warrantied out as i accidentally cracked the front screen. Im down to try anything that *could* result in a bricked s3. only problem is i do not have an att account. i currently am running cm 10.1 nightlys if that matters.
 

preusstang

Senior Member
Jan 13, 2011
276
97
Hey guys i have a galaxy s3 that needs to be warrantied out as i accidentally cracked the front screen. Im down to try anything that *could* result in a bricked s3. only problem is i do not have an att account. i currently am running cm 10.1 nightlys if that matters.

You're in the wrong thread dude. Plus they aren't going to replace your phone under warranty when you done smashed the screen.
That's like wrecking your car and trying to get it replaced under warranty by sabotaging the starter. Sorry man but that's just dumb.
 

mybook4

Senior Member
Apr 3, 2011
445
267
You're in the wrong thread dude. Plus they aren't going to replace your phone under warranty when you done smashed the screen.
That's like wrecking your car and trying to get it replaced under warranty by sabotaging the starter. Sorry man but that's just dumb.

I think he was offering to try something potentially risky on his phone (since he is getting it replaced anyway). There's a little bit of history to that in this thread. At one point we were entertaining the idea of flashing an i747 modem to the i535. We were hesitant to try it because we have a boot chain that is partially secured with secureboot. Later in the thread, Marcustaz had an i535 with a damaged screen. We ended up being able to flash the i747 LG1 modem to the i535. Long story short, we didn't hard brick the i535 by flashing the modem.

Sent from my SCH-I535 using xda premium
 
Last edited:
  • Like
Reactions: preusstang

jnc8651

Senior Member
Feb 9, 2007
104
12
San Antonio
I think he was offering to try something potentially risky on his phone (since he is getting it replaced anyway). There's a little bit of history to that in this thread. At one point we were entertaining the idea of flashing an i747 modem to the i535. We were hesitant to try it because we have a boot chain that is partially secured with secureboot. Later in the thread, Marcustaz had an i535 with a damaged screen. We ended up being able to flash the i747 LG1 modem to the i535. Long story short, we didn't hard brick the i535 by flashing the modem.

Sent from my SCH-I535 using xda premium

^^ This,

I have to pay a deductible as the screen is cracked so if it bricks the phone i dont care.

Let me know if yall have any risky stuff that needs to be done :)
 
Nov 12, 2007
19
1
Hey guys quick question,

Is the radio hardware really that different from Verizon galaxy note 2 to the s3? I was asking because since the note 2 come unlocked to support 3G on national carriers would it be possible to flash a radio from the note 2 to the s3 and be unlocked?
 

iamone007

Member
Jan 9, 2012
5
1
i747m from Bell Canada - getting HSPA+ 1700mhz from Wind

Hey Guys, I am pretty new to the community and I do not know much about hacking and cracking stuff.... but I tried to read many posts and experimented with my S3 i747m by changing a few NV parameters and I can make it work with Wind (Canadian Carrier who uses 1700mhz freq.) I am not taking any credit for anything and giving full credit to who ever has worked or tried to work on it.

I am just trying to help a few people out who are working towards it.
here are my findings and what I did.

- I have not touched any NV flag items, just item 01877 and changed 04 to 06.
- Initially it does not work, but after I restart my phone. I go to network operators and manually select my carrier and it connects.(I am getting HSPA+ connection)
- If I restart my phone second time, it does not work anymore and I need to change item 01877 to 06 again.

Possible reasons why it is getting changed to 04 again may be because of check sum, as we are just changing just 1 value. If any checksum is attached with it than we need to update checksum as well. so upon restart checksum of NV parameters is not matched and it is reloading all defaults. Expert may think on this as well.

It is good enough for me rite now, it is just like tethered jail break for Iphone. I am taking care that my phone always remain ON.

I dont know if all are experts here, and can understand all instructions, but I found it very difficult to follow instructions given in this forum and other forums. If someone who want to enable it on their phone and do not know how to do it, I would like to help them out by making a simple DIV. believe me, it is very easy, easier than rooting, anyone will be able to do it on their own. just put message below and I would help them out.

Again, thanks for help everyone
 

Tracerlx

Senior Member
Feb 9, 2010
101
11
I am interested in lending my G3 as a test. I have t-mobile now in my G3 and would love to receive the other signals. Anyone want to help?
 
  • Like
Reactions: newuser134

preusstang

Senior Member
Jan 13, 2011
276
97
So what do you think the scope of the checksum may be? All NV items? A specific subset? Calculate checksums and CRCs - 8 bit /16 bit / 32 bit and any other possibilities for the scopes defined above. Look at a raw NV dump and parse for those values, possibly towards the ending bound of your scopes.

That's my guess-and-check approach.
 
Last edited:
Jan 13, 2013
5
0
hidden menus on verizon gs3

Hey i'm not sure if guys are aware of this but doing the steps below will enable the hidden menus in the verizon gs3

Go to Phone Dialer and type *#22745927
Enable Hidden Menu
Go to Phone Dialer and type *#7284#

I tried to use this to enable the 3g/4g band like the att note 2 on tmobile but it didnt work. qpst didn't detect the phone.

There is a post on here to enable the ATT Samsung galaxy Note 2 on Tmobile with 3g/4g band. I had tried to see if I could use the same steps

Well i just hopes this information helps
 

flipos12

New member
Mar 20, 2013
4
0
re: Help me with a tutorial please.

Can you please tell me how you do this. i woul love to ge it working like you have. thank you.

Hey Guys, I am pretty new to the community and I do not know much about hacking and cracking stuff.... but I :Dtried to read many posts and experimented with my S3 i747m by changing a few NV parameters and I can make it work with Wind (Canadian Carrier who uses 1700mhz freq.) I am not taking any credit for anything and giving full credit to who ever has worked or tried to work on it.

I am just trying to help a few people out who are working towards it.
here are my findings and what I did.

- I have not touched any NV flag items, just item 01877 and changed 04 to 06.
- Initially it does not work, but after I restart my phone. I go to network operators and manually select my carrier and it connects.(I am getting HSPA+ connection)
- If I restart my phone second time, it does not work anymore and I need to change item 01877 to 06 again.

Possible reasons why it is getting changed to 04 again may be because of check sum, as we are just changing just 1 value. If any checksum is attached with it than we need to update checksum as well. so upon restart checksum of NV parameters is not matched and it is reloading all defaults. Expert may think on this as well.

It is good enough for me rite now, it is just like tethered jail break for Iphone. I am taking care that my phone always remain ON.

I dont know if all are experts here, and can understand all instructions, but I found it very difficult to follow instructions given in this forum and other forums. If someone who want to enable it on their phone and do not know how to do it, I would like to help them out by making a simple DIV. believe me, it is very easy, easier than rooting, anyone will be able to do it on their own. just put message below and I would help them out.

Again, thanks for help everyone
 

ihadacatonce

Member
Oct 10, 2012
15
3
Redmi Note 10 Pro
SCH-I747 successfully flashed to d2att without error

I know this is slightly off topic, as I'm assuming all this fancy dev-speak is focused on enabling data on a post-paid plan, but I'm on ATT prepaid and accidentally found an ATT stock-like ROM that made my VZW SGS3 capable of incoming/outgoing calls and text. gapps are functioning, and everything appears fine. I've turned it on/off and flashed between 2 ROMs including ParanoidAndroid 2.1 multiple times without ever losing my ATT connectivity.

WanamLite 1.3, available through ROM Toolbox Pro.

Can I get it back to stock VZW? no idea. don't care. If your only goal is staying on ATT without needing to reflash every few days, this is the golden ticket.
 

Israelleite

Senior Member
The question is, are you able to get UMTS-2 ?

http://en.wikipedia.org/wiki/UMTS_frequency_bands

I know this is slightly off topic, as I'm assuming all this fancy dev-speak is focused on enabling data on a post-paid plan, but I'm on ATT prepaid and accidentally found an ATT stock-like ROM that made my VZW SGS3 capable of incoming/outgoing calls and text. gapps are functioning, and everything appears fine. I've turned it on/off and flashed between 2 ROMs including ParanoidAndroid 2.1 multiple times without ever losing my ATT connectivity.

WanamLite 1.3, available through ROM Toolbox Pro.

Can I get it back to stock VZW? no idea. don't care. If your only goal is staying on ATT without needing to reflash every few days, this is the golden ticket.
 

foil

Senior Member
Jan 9, 2008
195
211
0x000000FF
From somewhere there should also be a QXDM 3.14.304... (which we will never see.)

I wouldn't be so sure about that ;)
ps: Yes, this picture is Photoshopped; how else was I going to fit all of that **** into one screen and also on this forum? haha

qualcomm.jpg
 
Last edited:
  • Like
Reactions: autoprime

LLStarks

Senior Member
Jun 1, 2012
2,258
1,676
Why can't we just use a modified QCN file? The AT&T Note 2 can have AWS enabled using one.
 

bedwa

Inactive Recognized Developer
Oct 5, 2008
1,152
718
Springfield IL
I modified my backup by hex, but was not able to restore it for some reason. Therefore I'm not sure we can in that fashion. I wonder where the system keeps the nvbackup when you use the phone itself to backup the NV for imei purposes. The other thing I was trying with the sch-I535 I have was flashing the kddi modem, but it came up with the unapproved software screen and wouldn't boot, but it is a similar baseband.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 8
    Total is shown on 2nd post.

    GO TO POST #3 FOR ACHIEVEMENTS, GOALS, NOTES and QUESTIONS

    To get some momentum behind this, after reading lair12's "S3 as a world GSM phone" (Link), the great replies to my thread about flashing an AT&T radio to the I535 (Link), and judging from the wealth of information gathered by and the vast knowledge of the great devs such as E.V.A, Adam Outler and Ralekdev when they were working on unlocking the bootloader, I am starting this bounty thread to get some good devs behind this much sought after ability to get full domestic 3G and HSPA+ on the I535, for enabling either 1900MHz or 1700MHz WCDMA on I535 similar to what was done for Galaxy Note i717 (Link). Please add your donations publicly (NOT by pm) to this thread, similar to the bounty thread for unlocking the bootloader. I will update the thread periodically. All regular bounty disclaimers apply. Do any work to reach this goal at your own risk, if you mess up your phone, it's not my fault or anybody else's fault, or if you choose to test any software or firmware on it. Make sure you know what you're doing and that you won't damage your phone before you do it.

    Copying the following from another thread:

    Requirements to Receive Bounty:

    • Be first person to create a method of enabling 1900/1700MHz 3G/HSPA+ capability on SCH-I535
    • Make a post in this thread with the following:
    • Proving it works with appropriate photos or screenshots
    • Providing full step-by-step instructions which anyone else can follow
    • Wait for another member to follow the method and confirm it works
    • Claim your bounty via PM from donors

    Payment will be processed between each member and the bounty collector via PM on an individual basis.


    *** Please note: No hardware modification of the phone's radio chips or antennae is allowed to achieve this goal, it will be by software/firmware/coding/flashing only. If the phone turns out to be missing both the wcdma 1900 or 1700 MHz radio(s), this bounty will be void as the goal will not be achievable without hardware modifications. Even if only one of the wcdma bands is "unlocked" and HSPA+ is achieved on only one domestic carrier, the bounty can still be received. ***

    I will start myself by donating $50 to the person that reaches this goal first. Please make posts below for your donations. I will update the list and the total bounty regularly.

    *** BUMP ***
    • Any dev with jtag willing to flash a stock or modified AT&T modem on i535 to try it, or edit the "padding" at the end of a stock i535 modem to see if it causes a brick?
    • Any dev (such as Ralekdev, or with similar knowledge) willing to modify the modem.bin file from an i535 with parts from an AT&T or T-Mobile modem to keep the i535 signatures and hand-off, but operate as an AT&T radio maybe to enable wcdma modulation on 1900 MHz? The RF path for 1900 MHz is already there for gsm 1900. We can involve the help of some AT&T or T-Mobile forum members and devs if dumps from AT&T / T-Mobile modems or other files are required, that part should not be that difficult.
    6
    Hi guys,
    I'm trying to do the same thing for HTC Rezound and already have results: it somewhat works on AT&T.

    Take a look at this thread
    Did someone already try this trick with S3?

    Also I would really appreciate if you can make a RF NV dump with DFS CDMA Tool (not QPST!) from a Verizon and/or AT&T S3 (there are instructions here) and share the NVM file. It might be very helpful for the Rezound.
    6
    I am not a Dev by any means but I do have an att variant as well as verizon of this phone. I am certainly interested in getting my verizon on straight talk but I think it will need to be GSM based only i.e. converting it to mock an att variant, so I am following the progress of this thread. I will consider helping with a dump of my att phone let me know what to do.
    6
    Ok... Sorry for the double post here, but one last update before bed. Since Samsung and Qualcomm are so nice to mount their firmware in the /firmware folder, I pulled firmware from the Japanese modem (scl21) and started swapping files in. I was good till I swapped the modem.mdt file in, which brought up the non-authorized software warning immediately. So, if I can only find some way around that... Or to modify the modem.mdt file so it doesnt trigger the bootloader block, this should work for us. I need sleep, but I'm not done trying yet.
    5
    So I had another look at the i535.qcn file in QPST and QCNView.

    (1) Funny thing is that under the QPST "UMTS System" tab, all "Prefered Band's" are selected as shown below. If this is true info, that means that the band must be disabled somewhere else, in some other way.

    attachment.php



    (2) Browsing the NV-data with QCNView and looking at the "Feature Mask" and "Roaming Lists" headings, I have this info. This should be compared to that of the i747 and the bitmask should be understood. (Perhaps part in that document someone posted an image from earlier?)

    attachment.php



    (3) To "dry"-load a *.qcn file into QPST (378) you need to hexedit your QCN file at 0x300 to a Qaulcomm Model number that it can handle, since that QPST version doesn't seem to have enabled the MSM8960 models, but see (4). In this case I tried with QC model 4061 and it loaded.
    Code:
    00000300  30 00 30 00 30 00 30 00  [B]34 [/B]00 [B]30 [/B]00 [B]36 [/B]00 [B]39 [/B]00  |0.0.0.0.[B]4[/B].[B]0[/B].[B]6[/B].[B]9[/B].|
    change to:
    00000300  30 00 30 00 30 00 30 00  34 00 30 00 36 00 [B][COLOR=Red]31 [/COLOR][/B]00  |0.0.0.0.4.0.6.[B][COLOR=Red]1[/COLOR][/B].|

    (4) About QPST, not sure what is the problem, it seem that the i535 QCN file is recognized (?) as Model 4069 when plugged in, which corresponds to the SURF8960, but is not present in drop down list, when file is loaded manually.
    The MSM8960 is definitely present in the code...
    Code:
    ServiceProg.exe:  302244 MSM8960*
    ServiceProg.exe:  302256 MSM8960*
    
    QPSTServer.exe:  602f78 AO-8960 SURF7225A
    QPSTServer.exe:  602fe0 SURF8960