[BOUNTY] ($205 so far) Enable HSPA+ on 1900 MHz / 1700MHz for VZW Galaxy S3 i535

Total is shown on 2nd post.

GO TO POST #3 FOR ACHIEVEMENTS, GOALS, NOTES and QUESTIONS

To get some momentum behind this, after reading lair12's "S3 as a world GSM phone" (Link), the great replies to my thread about flashing an AT&T radio to the I535 (Link), and judging from the wealth of information gathered by and the vast knowledge of the great devs such as E.V.A, Adam Outler and Ralekdev when they were working on unlocking the bootloader, I am starting this bounty thread to get some good devs behind this much sought after ability to get full domestic 3G and HSPA+ on the I535, for enabling either 1900MHz or 1700MHz WCDMA on I535 similar to what was done for Galaxy Note i717 (Link). Please add your donations publicly (NOT by pm) to this thread, similar to the bounty thread for unlocking the bootloader. I will update the thread periodically. All regular bounty disclaimers apply. Do any work to reach this goal at your own risk, if you mess up your phone, it's not my fault or anybody else's fault, or if you choose to test any software or firmware on it. Make sure you know what you're doing and that you won't damage your phone before you do it.

Copying the following from another thread:

Requirements to Receive Bounty:​

• Be first person to create a method of enabling 1900/1700MHz 3G/HSPA+ capability on SCH-I535

• Make a post in this thread with the following:

• Proving it works with appropriate photos or screenshots

• Providing full step-by-step instructions which anyone else can follow

• Wait for another member to follow the method and confirm it works

• Claim your bounty via PM from donors

Payment will be processed between each member and the bounty collector via PM on an individual basis.

*** Please note: No hardware modification of the phone's radio chips or antennae is allowed to achieve this goal, it will be by software/firmware/coding/flashing only. If the phone turns out to be missing both the wcdma 1900 or 1700 MHz radio(s), this bounty will be void as the goal will not be achievable without hardware modifications. Even if only one of the wcdma bands is "unlocked" and HSPA+ is achieved on only one domestic carrier, the bounty can still be received. ***

I will start myself by donating $50 to the person that reaches this goal first. Please make posts below for your donations. I will update the list and the total bounty regularly.

*** BUMP ***

• Any dev with jtag willing to flash a stock or modified AT&T modem on i535 to try it, or edit the "padding" at the end of a stock i535 modem to see if it causes a brick?

• Any dev (such as Ralekdev, or with similar knowledge) willing to modify the modem.bin file from an i535 with parts from an AT&T or T-Mobile modem to keep the i535 signatures and hand-off, but operate as an AT&T radio maybe to enable wcdma modulation on 1900 MHz? The RF path for 1900 MHz is already there for gsm 1900. We can involve the help of some AT&T or T-Mobile forum members and devs if dumps from AT&T / T-Mobile modems or other files are required, that part should not be that difficult.

Hi guys,
I'm trying to do the same thing for HTC Rezound and already have results: it somewhat works on AT&T.

Take a look at this thread
Did someone already try this trick with S3?

Also I would really appreciate if you can make a RF NV dump with DFS CDMA Tool (not QPST!) from a Verizon and/or AT&T S3 (there are instructions here) and share the NVM file. It might be very helpful for the Rezound.

I am not a Dev by any means but I do have an att variant as well as verizon of this phone. I am certainly interested in getting my verizon on straight talk but I think it will need to be GSM based only i.e. converting it to mock an att variant, so I am following the progress of this thread. I will consider helping with a dump of my att phone let me know what to do.

Ok... Sorry for the double post here, but one last update before bed. Since Samsung and Qualcomm are so nice to mount their firmware in the /firmware folder, I pulled firmware from the Japanese modem (scl21) and started swapping files in. I was good till I swapped the modem.mdt file in, which brought up the non-authorized software warning immediately. So, if I can only find some way around that... Or to modify the modem.mdt file so it doesnt trigger the bootloader block, this should work for us. I need sleep, but I'm not done trying yet.

So I had another look at the i535.qcn file in QPST and QCNView.

(1) Funny thing is that under the QPST "UMTS System" tab, all "Prefered Band's" are selected as shown below. If this is true info, that means that the band must be disabled somewhere else, in some other way.




(2) Browsing the NV-data with QCNView and looking at the "Feature Mask" and "Roaming Lists" headings, I have this info. This should be compared to that of the i747 and the bitmask should be understood. (Perhaps part in that document someone posted an image from earlier?)




(3) To "dry"-load a *.qcn file into QPST (378) you need to hexedit your QCN file at 0x300 to a Qaulcomm Model number that it can handle, since that QPST version doesn't seem to have enabled the MSM8960 models, but see (4). In this case I tried with QC model 4061 and it loaded.

(4) About QPST, not sure what is the problem, it seem that the i535 QCN file is recognized (?) as Model 4069 when plugged in, which corresponds to the SURF8960, but is not present in drop down list, when file is loaded manually.
The MSM8960 is definitely present in the code...