[REF][ServiceMode] How to make your Samsung perform dog tricks

Search This thread
By:
Advanced…
A

aguaz

Senior Member
Jan 16, 2014
136
31
E:V:A said:
No, because CM dev people doesn't seem to know how the SM works and have messed up some of the standard functionality when it come to SM related items and "secret codes". Unfortunayely this is not only true for CM, but also most other AOSP based ROMs. SM is usually provided by a (java) wrapper application to send OEM commands to the baseband where the SM is actually running. So, you can try to install a copy of the Factory and Service related apps, as found on the stock rom of your device (using the same API version).
Click to expand...
Click to collapse
Is CyanogenMod/android_packages_apps_SamsungServiceMode related to this? And if not what is it?
 
  • Like
Reactions: E:V:A
E:V:A

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
vndnguyen said:
I have exactly the same problem after upgrading to 4.4.2, so don't worry, it is Samsung policy. Beside using Shortcut Master app to launch it, here is another workaround:In the Shortcut Master app, open Menu > Search and enter 'usbsettings.usbsettings' to search. Tap on the search result to launch, you can also create shortcut for it.
Click to expand...
Click to collapse
@vndnguyen : Please stop spamming my threads. I've already removed some of your annoying spam posts, trying to promote your app, and you insist re-posting the same garbage. In this particular case your answer have little to do with the quoted question/issue, and does not contribute to any further understanding. So stay away please!
 
Last edited:
  • Like
Reactions: rhetorician and kicker308
E:V:A

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
botwa2000 said:
Hi there, I got a Samsung SM-G906K Galaxy S5 model. Up until the latest stock update (4.4.2 rooted) I used to be able to run the code *#0808# no problem. Now it doesn't work anymore.
Click to expand...
Click to collapse
You may consider de-compiling the ServiceMode related apps as mentioned in OP and in my other thread. Almost all the secret codes are in there. In your case they've probably blocked direct code dialing, and you may need to enable/disable those other system properties (getprop) mentioned. Common problem is that code exists from command line via "am ... " but not from dialer. Sometimes it's just a matter of re-arranging the "*#"'s or add another.

See this thread.
 
Last edited:
  • Like
Reactions: botwa2000
E

eheilner

Senior Member
Jan 31, 2014
62
7
A easy way to get into this woth out needing to q then 0000. This works on all samsung phones and maybe others stopped working on my sgs4 after mf9 update but my s3 and note 4 and sgs5 are still able to do this method. So just go to system menu and scroll or tap till you find activate this device/ self service let it run through once it shows your plan info hit menu or three dots then pick pst and bam then your in iothiddenmenu pick test mode and your in. Do note tho that sometimes it can take a few minutes for self service to load up. If you click pst and nothing happeneds then you need to downgrade for it to work only seen on sgs4 running into this problem the non spark one.

Hit thanks of this helped anyone out.

---------- Post added at 09:19 AM ---------- Previous post was at 09:14 AM ----------
ludovicianul said:
Factory reset doesn't work. Any other ideas?
Click to expand...
Click to collapse


Try selfservice hit menu or three dots reset cell data might help.
 
K

kicker308

New member
Oct 7, 2013
3
0
Stuck on; perso sha256 off

My phone is the same as one other user, my phone doesn't have the ;perso SHA256 Off. Please any help would be great. Also what do I press to add my screen shot, nothing above sems to allow me to attach a photo..pin, photo, file nodda..One thing at a time, unlock is more important.
 
K

kicker308

New member
Oct 7, 2013
3
0
unlock sim

helen2 said:
Nice post I was wounderin why all was able to enter to service and I with my i9195 no,after reading your post I was able to unter it,unfortunately is different the service menu with the other s4 mini version so cant unlock it :crying:
But that keeps your post ok 100%
Take care
Helen
:cool:
Click to expand...
Click to collapse
You get your issue resolved with the sim unlock ? I'm having same issue, to not spam this thread can you pm me please. Thanks very much.
 
E:V:A

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
jukyO said:
Why this does not work on s4 mini eur, cm11? I mean, *#0011#?
Click to expand...
Click to collapse

Because you don't understand how SM works. SM is located in the baseband FW and the way to access it, is through a wrapper application. If this wrapper application is not present or is using other "codes", you'll not get in. Which is why I don't wanna use CM, and always try to stay close to stock.
 
  • Like
Reactions: lemalelt
A

aguaz

Senior Member
Jan 16, 2014
136
31
E:V:A said:
SM is located in the baseband FW and the way to access it, is through a wrapper application. If this wrapper application is not present or is using other "codes", you'll not get in.
Click to expand...
Click to collapse
I've now built cm-11.0 with CyanogenMod/android_packages_apps_SamsungServiceMode.
The app opens up dialing *#*#0011#*#* (yes, that's two "*#" each). However the app stays blank. Also entering Input --> "Q" and Input --> "0000" as suggested elsewhere has no effect.
Any further ideas?


Are the settings btw stored in FW and survive a reboot? Alternatively I'm thinking about a Stock/CustomROM dual boot where you tweak SM settings in stock, then reboot into CustomROM with settings (hopefully) preserved.
 
E:V:A

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
aguaz said:
I've now built cm-11.0 with CyanogenMod/android_packages_apps_SamsungServiceMode.
The app opens up dialing *#*#0011#*#* (yes, that's two "*#" each). However the app stays blank. Also entering Input --> "Q" and Input --> "0000" as suggested elsewhere has no effect. Any further ideas?
Click to expand...
Click to collapse

Very nice, but you have to tell me more what device you're using. If it is a Samsung you can download the FW, extract it and reverse the Phone and Service related apps and have a look for the correct OEM_HOOK_RAW (IPC?) sequence that navigates to that SM implementation.

Are you or that code on github by any chance?
 
E:V:A

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
One more thing. It is important to start on a freshly rebooted phone, AND you HAVE to hit the BACK button before the input sequence. I have no idea why, just that it doesn't work without hitting back button first, at least for me. Oh, I also noticed that you can combine the Q and the zeros as "Q0000".
 
Last edited:
  • Like
Reactions: meisterpido
E:V:A

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
@aguaz: Yes, that code is on GitHub HERE. You probably need to change at least some of the OEM commands in OemCommands.java. And check that the
getEnterServiceModeData() is sending the right code. The way to check is in the stock APK.
 
  • Like
Reactions: aguaz
A

aguaz

Senior Member
Jan 16, 2014
136
31
E:V:A

E:V:A

Inactive Recognized Developer
Dec 6, 2011
1,447
2,222
-∇ϕ
aguaz said:
So the cm app is more of a template for SM or was it written for a specific device only?
Click to expand...
Click to collapse
I never worked on CM or any devices with it, so I have no idea. I just know that when it comes to this kind of low level stuff, CM is rarely working and nobody know why or cares to document or inform anyone else about it.
 
You must log in or register to reply here.

Similar threads

ValenteL
[HARD BRICK ?] - I919x - Make your debrick.img and have it on extSdCard by security
Replies
150
Views
149K
I
IronRoo
cheatman
[RECOVERY][ROOT] Samsung Galaxy S4 Mini Dual SIM (GT-I9192)
Replies
480
Views
322K
G
Guiorgy
T
SIM Unlock I9195 Samsung galaxy S4 Mini
Replies
76
Views
240K
Tymmuffphii
Tymmuffphii
Aronuser
[UNBRICK Guide][for Bootloader v1 jb only][I9195]How to unbrick your device
Replies
115
Views
122K
C
ciozvarda
leripe
CyanogenMod 11 - GT-I9195 and GT-l9190 - Nightlies - Bug Reports & Discussion
Replies
5K
Views
476K
T
Tom Mix

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 63
    E:V:A
    E:V:A
    Every time Samsung releases a new series of phones, they try to make
    it just a little harder for us to find and enter the Service Mode (SM)
    menus. Understandably the Service Mode menus allow you to access
    functions on your phone directly related to its operation, from
    selecting particular service providers, unlocking your SIM card,
    changing default networks, bands and destroying your internal
    non-volatile (NV) memory, that contain all your IMEI, RF, EFS
    parameters, and to make a complete factory wipe and reset.

    So this is not to play around with, randomly!
    You have been warned.

    On the other hand, it also provides extremely useful detailed
    information about your mobile network, including all radio related
    systems like GPS, WiFi, BlueTooth and NFC. Most of this information
    is not available through the usual AOS Java API, and probably will
    never be, as vendors consider this area as off-limits to users and
    amateur developers.


    Note:
    All this info was obtained on a European
    Samsung Galaxy S4-mini (GT-I9195 LTE)
    But reported to work also on:
    Samsung Galaxy S5 on US Cellular (SM-G900R4)


    Code: 
    [SIZE=2]Baseband:       I9195XXUBML4            [/SIZE]
[SIZE=2]Kernel:         3.4.0-2340422           [/SIZE]
[SIZE=2]                se.infra@SEP-65 #1      [/SIZE]
[SIZE=2]Build:          JDQ39.I9195XXUBML4      [/SIZE]
[SIZE=2]SE:             SEPF_GT-I9195_4.2.2_0022[/SIZE]
    Getting into Service Mode (SM)

    On this particular model, you have to do this:

    Go to dial pad and enter: *#0011#

    This will initially take you to Service Mode and showing you
    various signal status items, by default. But it's a locked
    entry. So to unlock and go to the Main Menu do this:
    ==> [MENU] + [Back]
    ==> [MENU] + [Key Input] + "Q0"
    ==> <wait ~5-10 seconds>
    ​
    Now you can hit the thank you button below!
    I have not seen this solution anywhere else, and
    it required some reversing...


    Understading the ServiceMode Menu

    <WIP>

    This will take some time to investigate, so anyone
    who already knows, please post in this thread.


    The ServiceMode Menu Structure (brief)

    Go to Post#2 for formatted menu structure and items.

    Code: 
    [SIZE=2]MAIN MENU[/SIZE]
[SIZE=2][1] UMTS        [/SIZE]
[SIZE=2][2] CDMA        [/SIZE]
[SIZE=2][3] LTE                [/SIZE]
[SIZE=2][4] SIM- Not Used.        --> <E>[/SIZE]
[SIZE=2][5] DOCOMO DEBUG SCREEN        [/SIZE]
[SIZE=2][6] run EFS SYNC()        [/SIZE]
[SIZE=2][7] DEBUG SCREEN        [/SIZE]
    Some Important Codes

    9900 SysDump

    This is an important hidden code is that for making a wide range
    of system dumps and changing many unknown logging functions.

    This will give you a list of the following functions:
    Code: 
    [SIZE=2]Menu Item                       Setting         Description[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
[SIZE=2]Run dumpstate/logcat/modem log  -               logcat -v threadtime -b radio -d -f /data/log/radio_*.log[/SIZE]
[SIZE=2]Delete dumpstate/logcat                         [/SIZE]
[SIZE=2]Run dumpstate/logcat                                            [/SIZE]
[SIZE=2]Copy Kernel Log to SD card                      [/SIZE]
[SIZE=2]Run CP based log                                [/SIZE]
[SIZE=2]Run Forced CP crash dump                        [/SIZE]
[SIZE=2]Copy to sdcard (include CP Ramdump)             [/SIZE]
[SIZE=2]Debug Level Disabled/LOW        -               Change debug level [LOW/MID/HIGH][/SIZE]

[SIZE=2]CP Debugging Popup UI:          Disabled        [/SIZE]
[SIZE=2]Silent Log:                     Off             dev.silentlog.on=(On,Off)[/SIZE]
[SIZE=2]Translation Assistant:          Off             persist.translation.assistant=(0,1)[/SIZE]
[SIZE=2]Low battery dump:               Off             [/SIZE]
[SIZE=2]Wakelock Monitoring:            OFF             [/SIZE]
[SIZE=2]TCP DUMP START                                  ro.product_ship=(true,false)            lucky_ril*.log[/SIZE]
[SIZE=2]Enable SecLog (currently disabled)              persist.log.seclevel=(0,1)[/SIZE]
[SIZE=2]MTT Logging Setting:            OFF             persist.brcm.log=(sdcard,none)          [Broadcom][/SIZE]
[SIZE=2]ACT data copy                                   [/SIZE]
[SIZE=2]Exit                                            [/SIZE]
    9090 DIAG CONFIG

    This is also important for changing the internal MUX used for
    diagnostic debug output, to/from USB and UART.

    Code: 
    [SIZE=2]DIAG CONFIG[/SIZE]
[SIZE=2][1] USB  ( )[/SIZE]
[SIZE=2][2] UART (*)[/SIZE]
[SIZE=2][3] DBG MSG ON  (*)[/SIZE]
[SIZE=2][4] DBG MSG OFF ( )[/SIZE]
    Basically if you wanna use UART output, you will probably need
    to build the MyWay box or use the correct resistance between
    the USB ID and GND pins. (See my AnyWay thread.)

    0808 USB Settings

    This is by far the most important code to know, because it is used to determine,
    what drivers are enumerated when connecting your phone to PC via USB cable.
    Technically it is a multiplexer (MUX) switch which determine whether the USB
    port is directly connected to the CP (Cellular/baseband Processor/modem),
    or the AP (Application Processor). This also selects what device features will be
    enabled once connected. Such as ADB, RNDIS, and DM (Diagnostic Mode) etc.

    To change the mux settings on a Samsung S4/mini, use your dialpad
    to get to the "USBSettings" menu, like this:

    For AOS <= 4.2.2, without SELinux, use *#7284# or *#3424#.
    For AOS >= 4.2.2, with SELinux, use *#0808#.

    Code: 
    [SIZE=2]USB 
( ) CP
( ) AP

USB Settings
( ) MTP
( ) MTP + ADB
( ) PTP
(o) PTP + ADB
( ) RNDIS + DM + MODEM
( ) RMNET + DM + MODEM
( ) DM + MODEM + ADB

[OK] [Reboot]
[/SIZE]
    A few other service/secret codes

    Similarly to my GT-I9300 "Secret Codes" thread, we find many of the
    same codes present also in this phone. Do check that thread out, for
    understanding how to find more codes relevant for your phone and AOS
    version. Also note that most custom ROMs does not support all these,
    as they are usually left out or forgotten about, since they are
    vendor/modem specific.

    Here I show only the most interesting & useful ones, and I have also
    used the excellent website PhoneSpell to try to find sensible word
    combinations for some of these numbers.

    Now, many of these seem not to work at all, but they are present in
    the ServiceMode application(s) code and rely on various other
    properties being set before being available/activated. Another
    type of block is is determined by the content of the EFS files:

    /efs/FactoryApp/keystr
    /efs/carrier/HiddenMenu

    These can be set on a rooted phone by:
    Code: 
    echo -n "OFF" > /efs/FactoryApp/keystr
echo -n "ON" >/efs/carrier/HiddenMenu
echo -n "ON" >/efs/FactoryApp/factorymode
    (Somebody need to confirm the KeyString block boolean!)


    Here is list of some particularly interesting properties that often
    seem involved in blocking/enabling particular ServiceMenu
    items/features.

    Code: 
    [SIZE=2]property                                value/note[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
[SIZE=2]ril.tcpdumping=On                       [On,Off][/SIZE]
[SIZE=2]ril.OTPAuth=true                        OTP Authentication key is 6 random digits long[/SIZE]
[SIZE=2]ro.build.type=eng                       [eng, user]][/SIZE]
[SIZE=2]ro.cp_debug_level=                      [0x5500,0x55FF] [/SIZE]
[SIZE=2]ro.csc.sales_code=CHM                   [NONE, <many otehrs> ][/SIZE]
[SIZE=2]ro.csc.country_code=                    [KOREA, Unknown, ...]   KOREA allows extra menu item: "IMS"[/SIZE]
[SIZE=2]ro.product_ship=false                   [true,false][/SIZE]
[SIZE=2]ro.product.model=                       [/SIZE]
[SIZE=2]ro.factorytest=1
dev.silentlog.on=                       [0,1][/SIZE]
[SIZE=2]persist.radio.lteon=true                [true,false][/SIZE]
    And here are some of the codes:
    Code: 
    [SIZE=2]code            mnemonic        description[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
[SIZE=2]06              -               IMEI[/SIZE]

[SIZE=2]00112                   [/SIZE]
[SIZE=2]0228            0BAT            Battery status (ADC, RSSI reading)[/SIZE]
[SIZE=2]0514            -               [/SIZE]
[SIZE=2]0599            -[/SIZE]

[SIZE=2]1234            -               FW Versions for AP,CP,CSC[/SIZE]
[SIZE=2]123456          -[/SIZE]
[SIZE=2]1575            -               GPS test[/SIZE]
[SIZE=2]1111            -               FTA SW Version  [/SIZE]
[SIZE=2]2222            -               FTA FW Version[/SIZE]
[SIZE=2]8888            -               [/SIZE]
[SIZE=2]9090            -               USB/UART MUX debug switch[/SIZE]
[SIZE=2]99007788        -               [/SIZE]

[SIZE=2]197328640       -               Service Mode[/SIZE]
[SIZE=2]22558463        CALLTIME        Reset Total Call Time[/SIZE]
[SIZE=2]2263            BAND                            [/SIZE]
[SIZE=2]2580            <mid-col>       [/SIZE]
[SIZE=2]268435456       ANTIFKILO       "antenna IF kilo?? serviceModeApp_FB.apk / FTATDumpReceiver.class[/SIZE]
[SIZE=2]27663368378     CPMODEMTEST     [/SIZE]
[SIZE=2]2767*2878       APOS*CUST       Current firmware with factory default settings[/SIZE]

[SIZE=2]301279||279301  -               [/SIZE]
[SIZE=2]3214789650      -               Start Angry GPS                 Build.TYPE != "user"[/SIZE]
[SIZE=2]32489           -               Ciphering Info[/SIZE]
[SIZE=2]4238378         ICE/GCFTEST     GCF Settings?[/SIZE]
[SIZE=2]4387264636      GETRAMINFO      [/SIZE]
[SIZE=2]58366           LTEON                                           set persist.radio.lteon=true[/SIZE]
[SIZE=2]6201            -               [/SIZE]
[SIZE=2]638732          NETSEC                                          Build.TYPE != "user"[/SIZE]
[SIZE=2]66336           MODEM           CP Ram Dump (On/Off)            ro.cp_debug_level=[0x5500,0x55FF][/SIZE]
[SIZE=2]6984125*        MYTH1A5?        ?               [/SIZE]
[SIZE=2]7284            PATH            Set USB/UART path [/SIZE]

[SIZE=2]738767633       SETSOSOFF       Turn OFF SOS*[/SIZE]
[SIZE=2]73876766        SETSOSON        Turn ON SOS*[/SIZE]
[SIZE=2]7387677763      SETSOSPROF      Set SOS* profile[/SIZE]
[SIZE=2]7387678378      SETSOSTEST      Set SOS* test[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
[SIZE=2]* SOS = Sell Out SMS[/SIZE]
[SIZE=2]<> = some kind of keypad pattern[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
    In addition to these numerical codes, there are also few alphanumeric ones.
    These can be used from the command-line with the "am" command, like this:

    Code: 
    [SIZE=2]am broadcast -a android.provider.Telephony.SECRET_CODE -d android_secret_code://CP_RAMDUMP[/SIZE]
    This might also work when already in ServiceMode, by entering the string
    after selecting "Key Input" or "Select", from menu. (I have not checked.)

    Code: 
    [SIZE=2]LTE_ANT_PATH_NORMAL[/SIZE]
[SIZE=2]CP_RAMDUMP[/SIZE]
[SIZE=2]DUMP_SVCIPC[/SIZE]
[SIZE=2]DEBUG_SCR[/SIZE]
[SIZE=2]EI_DEBUG_SCR[/SIZE]
[SIZE=2]DATA_ADV[/SIZE]
[SIZE=2]NAMBASIC[/SIZE]
[SIZE=2]TESTMODE[/SIZE]
[SIZE=2]NAMSIMPLE[/SIZE]
[SIZE=2]TEST_CALL[/SIZE]
    The Samsung Diagnostics Menu

    One special secret code is that of the Samsung Dignostic
    Test Menu. This particular menu exsists on pretty much all
    Android based Samsung phones. (AFAIK) The code is simply:

    *#0*#

    It provides for testing things like the Screen, Sound, Vibrator,
    all the sensors and more. One one the cooler features for phones
    that include an IR transmitter, is that you can use it on most
    modern Samsung TV's as a remote control. Thus even easier to use
    than any of Samsung's own Remote Control Apps, which are often
    bloated and containing spyware.

    The available test items you will find on this particular model are:
    Code: 
    [SIZE=2][Red]           - screen pixel test[/SIZE]
[SIZE=2][Green]         - screen pixel test[/SIZE]
[SIZE=2][Blue]          - screen pixel test[/SIZE]
[SIZE=2][Receiver]      - (Ear) Receiver test[/SIZE]
[SIZE=2][Vibration]     -[/SIZE]
[SIZE=2][Dimming]       -[/SIZE]
[SIZE=2][Mega cam]      -[/SIZE]
[SIZE=2][Sensor]        -[/SIZE]
[SIZE=2][Touch]         -[/SIZE]
[SIZE=2][Sleep]         - sleep mode (power button) test[/SIZE]
[SIZE=2][Speaker]       - listen![/SIZE]
[SIZE=2][Sub key]       - testing keys [/SIZE]
[SIZE=2][Front cam]     -       [/SIZE]
[SIZE=2][IR LED]        - Samsung TV compatible IR remote control[/SIZE]
[SIZE=2][LOW FREQUENCY] - Listen 100/200/300 Hz[/SIZE]
[SIZE=2][Black]         - screen darkness test[/SIZE]
    For other S4 models, check this YouTube video:
    "Galaxy S4 Diagnostics Menu *#0*#"

    For the S3 GT-I9300 check out the thread:
    [REF][INFO][R&D] "Secret Codes" and other hidden features
    ​
    View
    25
    E:V:A
    E:V:A
    The ServiceMode Menu Structure

    This is really <WIP> as I don't have time to manually type in every damn menu
    item for everyone else. So if you wanna help out filling in the blanks, please post
    and I'll eventually add it here.

    Code: 
    [SIZE=2]MAIN MENU[/SIZE]
[SIZE=2] [1] UMTS                [/SIZE]
[SIZE=2] [2] CDMA                [/SIZE]
[SIZE=2] [3] LTE                         [/SIZE]
[SIZE=2] [4] SIM- Not Used.              --> <E>[/SIZE]
[SIZE=2] [5] DOCOMO DEBUG SCREEN         [/SIZE]
[SIZE=2] [6] run EFS SYNC()              [/SIZE]
[SIZE=2] [7] DEBUG SCREEN                [/SIZE]
[SIZE=2] ---------------------------------------------------------------------[/SIZE]
[SIZE=2] [1]     UMTS MAIN MENU[/SIZE]
[SIZE=2]         [1] DEBUG SCREEN[/SIZE]
[SIZE=2]         [2] VERSION INFORMATION[/SIZE]
[SIZE=2]         [3] UMTS RF NV[/SIZE]
[SIZE=2]         [4] GSM RF NV[/SIZE]
[SIZE=2]         [5] AUDIO[/SIZE]
[SIZE=2]         [6] COMMON[/SIZE]
[SIZE=2]         [7] LTE BAND CONFIG CHECK[/SIZE]

[SIZE=2]         [1]     DEBUG SCREEN[/SIZE]
[SIZE=2]                 [1] BASIC INFORMATION[/SIZE]
[SIZE=2]                 [2] NAS INFORMATION[/SIZE]
[SIZE=2]                 [3] AS INFORMATION[/SIZE]
[SIZE=2]                 [4] NEIGHBOUR CELL[/SIZE]
[SIZE=2]                 [5] GPRS INFORMATION[/SIZE]
[SIZE=2]                 [6] SIM INFORMATION[/SIZE]
[SIZE=2]                 [7] HANDOVER[/SIZE]
[SIZE=2]                 [8] PHONE CONTROL[/SIZE]
[SIZE=2]                 [9] ANTENNA/ADC[/SIZE]

[SIZE=2]         [2]     VERSION INFORMATION[/SIZE]
[SIZE=2]                 [1] SW VERSION[/SIZE]
[SIZE=2]                 [2] HW VERSION[/SIZE]

[SIZE=2]         [3]     UMTS RF[/SIZE]
[SIZE=2]                 [1] RF NV READ[/SIZE]
[SIZE=2]                 [2] RF NV WRITE[/SIZE]
[SIZE=2]                 [3] UMTS DIVERSITY CONTROL[/SIZE]
[SIZE=2]                 [4] RF CALIBRATION CHECK[/SIZE]

[SIZE=2]         [4]     GSM RF[/SIZE]
[SIZE=2]                 [1] RF NV READ[/SIZE]
[SIZE=2]                 [2] RF NV WRITE[/SIZE]

[SIZE=2]         [5]     AUDIO                           Locked! ==> See Note (a)[/SIZE]
[SIZE=2]                 ...[/SIZE]

[SIZE=2]         [6]     COMMON[/SIZE]
[SIZE=2]                 [1] FTM[/SIZE]
[SIZE=2]                 [2] DEBUG INFO[/SIZE]
[SIZE=2]                 [3] RF SCANNING[/SIZE]
[SIZE=2]                 [4] DIAG CONFIG[/SIZE]
[SIZE=2]                 [5] WCDMA SET CHANNEL[/SIZE]
[SIZE=2]                 [6] NV REBUILD[/SIZE]
[SIZE=2]                 [7] FACTORY TEST[/SIZE]
[SIZE=2]                 [8] FORCE SLEEP[/SIZE]
[SIZE=2]                 [9] GPS[/SIZE]

[SIZE=2]                 [1]     FTM : OFF               Locked! ==> See Note (b)[/SIZE]
[SIZE=2]                         [1] NOT SUPPORT [/SIZE]
[SIZE=2]                         [2] FTM : OFF[/SIZE]

[SIZE=2]                 [2]     DEBUG INFO[/SIZE]
[SIZE=2]                         [1] MM REJECT CAUSE[/SIZE]
[SIZE=2]                         [2] LOG DUMP[/SIZE]
[SIZE=2]                         [3] UI DEBUG POPUP - N/S[/SIZE]


[SIZE=2]                 [3]     RF SCANNING     [/SIZE]
[SIZE=2]                         [1] SETTING[/SIZE]
[SIZE=2]                         [2] START RF SCANNING[/SIZE]
[SIZE=2]                         [3] RESULT TO PC[/SIZE]
[SIZE=2]                         [4] RESULT TO SCREEN[/SIZE]

[SIZE=2]                 [4]     DIAG CONFIG[/SIZE]
[SIZE=2]                         [1] USB  ( )[/SIZE]
[SIZE=2]                         [2] UART (*)[/SIZE]
[SIZE=2]                         [3] DBG MSG ON  (*)[/SIZE]
[SIZE=2]                         [4] DBG MSG OFF ( )[/SIZE]

[SIZE=2]                 [5]     WCDMA SET CHANNEL       ==> "WCDMA CHANNEL SET" NOT SUPPORT[/SIZE]
[SIZE=2]                 [6]     NV REBUILD              --> Not tested![/SIZE]
[SIZE=2]                 [7]     FACTORY TEST            --> Not tested![/SIZE]
[SIZE=2]                 [8]     FORCE SLEEP             --> Not tested![/SIZE]
[SIZE=2]                 [9]     GPS[/SIZE]
[SIZE=2]                         co_gps_menu             ==> unknown![/SIZE]


[SIZE=2]         [7]     LTE BAND CONFIG CHECK           --> <E>[/SIZE]

[SIZE=2] ---------------------------------------[/SIZE]
[SIZE=2] [2]     CDMA MAIN MENU[/SIZE]
[SIZE=2]         [1] COMMON[/SIZE]
[SIZE=2]         [2] DATA[/SIZE]
[SIZE=2]         [3] RF[/SIZE]
[SIZE=2]         [4] CONTROL[/SIZE]
[SIZE=2]         [5] DEBUG SCREEN[/SIZE]
[SIZE=2]         [6] SUSPEND (001)[/SIZE]
[SIZE=2]         [7] TEST SYS(012)[/SIZE]


[SIZE=2]         [1]     COMMON MENU (1/3) [/SIZE]
[SIZE=2]                 [1] READ RAW RSSI (018)[/SIZE]
[SIZE=2]                 [2] MODEL ID (019)[/SIZE]
[SIZE=2]                 [3] SNDNAM (020)[/SIZE]
[SIZE=2]                 [4] SNDVERSION (021)[/SIZE]
[SIZE=2]                 [5] SNDESN (022)[/SIZE]
[SIZE=2]                 [6] DATASVC ON (023)[/SIZE]
[SIZE=2]                 [7] DATASVC OFF (024)[/SIZE]
[SIZE=2]                 [8] VERSION (025)[/SIZE]
[SIZE=2]                 [9] NEXT PAGE >[/SIZE]

[SIZE=2]                 COMMON MENU (2/4)[/SIZE]
[SIZE=2]                 [1] REBUILD (026)[/SIZE]
[SIZE=2]                 [2] PHONE RESET (027)[/SIZE]
[SIZE=2]                 [3] FS RESET (029)[/SIZE]
[SIZE=2]                 [4] SIO TO DM (032)[/SIZE]
[SIZE=2]                 [5] MSL KEY(245)[/SIZE]
[SIZE=2]                 [6] MSL (246)[/SIZE]
[SIZE=2]                 [7] F3 MSG (249)[/SIZE]
[SIZE=2]                 [8] CUR BAND (253)[/SIZE]
[SIZE=2]                 [9] NEXT PAGE >[/SIZE]

[SIZE=2]                 COMMON MENU (3/4)[/SIZE]
[SIZE=2]                 [1] ERR LOG CLR (252)[/SIZE]
[SIZE=2]                 [2] SIM IN OUT CHECK (89)[/SIZE]
[SIZE=2]                 [3] MEMORY CHECK (90)[/SIZE]
[SIZE=2]                 [4] ACTIVATION_DATE (99)[/SIZE]
[SIZE=2]                 [5] SIO_MODE (032)[/SIZE]
[SIZE=2]                 [6] MOB CAI REV (110)[/SIZE]
[SIZE=2]                 [7] RECONDITIONED STATUS (200)[/SIZE]
[SIZE=2]                 [8] PREF MODE SET[/SIZE]
[SIZE=2]                 [9] NEXT PAGE >[/SIZE]

[SIZE=2]                 COMMON MENU (4/4)[/SIZE]
[SIZE=2]                 [1] RTRE CONFIG[/SIZE]
[SIZE=2]                 [2] SMS FORMAT SET[/SIZE]
[SIZE=2]                 [3] (UN)BLOCK VOICE MT[/SIZE]
[SIZE=2]                 [4] CHECK FACTORY CMD[/SIZE]


[SIZE=2]         [2]     DATA[/SIZE]
[SIZE=2]                 [1] WRITE NV (031)      [/SIZE]
[SIZE=2]                 [2] MRU2 TABLE (033)[/SIZE]
[SIZE=2]                 [3] NAI SET (034)[/SIZE]
[SIZE=2]                 [4] INFORMATION[/SIZE]
[SIZE=2]                 [5] VBATT[/SIZE]
[SIZE=2]                 [6] THERMISTER[/SIZE]
[SIZE=2]                 [7] eHRPD e/disable[/SIZE]

[SIZE=2]         [3]     RF[/SIZE]
[SIZE=2]                 [1] CALIBRATION         [/SIZE]
[SIZE=2]                 [2] COMMON              [/SIZE]
[SIZE=2]                 [3] PCS                 [/SIZE]
[SIZE=2]                 [4] CDMA                --> WLAN etc[/SIZE]
[SIZE=2]                 [5] GPS                 --> Nice![/SIZE]

[SIZE=2]         [4]     CONTROL                 --> Not tested![/SIZE]
[SIZE=2]         [5]     DEBUG SCREEN            --> Not tested![/SIZE]
[SIZE=2]         [6]     SUSPEND (001)           --> Not tested![/SIZE]
[SIZE=2]         [7]     TEST SYS(012)           --> Not tested![/SIZE]

[SIZE=2] ---------------------------------------[/SIZE]
[SIZE=2] [3]     LTE MAIN MENU           [/SIZE]
[SIZE=2]         [1] DEBUG SCREEN                [/SIZE]
[SIZE=2]         [2] LTE RF                      [/SIZE]
[SIZE=2]         [3] Reserved                    --> <E>[/SIZE]
[SIZE=2]         [4] BACKOFF PLMN TIMER (T3402)  [/SIZE]

[SIZE=2] [4] SIM- Not Used.                      --> <E>[/SIZE]
[SIZE=2] [5] DOCOMO DEBUG SCREEN                 --> See Note (c)[/SIZE]
[SIZE=2] [6] run EFS SYNC()                      --> Not tested![/SIZE]
[SIZE=2] [7] DEBUG SCREEN                        --> Not tested![/SIZE]

    Special Notes for the above:
    Code: 
    [SIZE=2]//   = The end point/window where the info is displayed 
       (This usually doesn't have a title.)

<E>  = A "Dead End" that take you into an oo-loop page or back 
       to a locked *#0011# state.

(a) For accessing this sub-menu you may need to:
        1. Unblock the KeyString file with:
           echo -n "OFF" > /efs/FactoryApp/keystr
        2. Enable the carrier HiddenMenu file with:
           echo -n "ON" >/efs/carrier/HiddenMenu
        3. Set the device shipping property:  ro.product_ship=FALSE

(b) For "FTM" (Factory Test Mode) you probably need to set:
        1. Enable the FactoryMode file with:  
           echo -n "ON" >/efs/FactoryApp/factorymode
        2. Set the factory test property:  ro.factorytest=1

(c) Not available for non-DOCOMO devices, need correct property(ies).
[/SIZE]
    View
    16
    E:V:A
    E:V:A
    Some Useful Examples


    Example-1: Removing SIM network lock

    Code: 
    [SIZE=2]UMTS MAIN MENU[/SIZE]
[SIZE=2][1] DEBUG SCREEN.[/SIZE]
[SIZE=2][6] PHONE CONTROL.[/SIZE]
[SIZE=2][6] NETWORK LOCK[/SIZE]
[SIZE=2][3] PERSO SHA256 OFF[/SIZE]

[SIZE=2]Go Back to Main Menu[/SIZE]

[SIZE=2]UMTS MAIN MENU[/SIZE]
[SIZE=2][6] COMMON[/SIZE]
[SIZE=2][6] NV REBUILD.[/SIZE]
[SIZE=2][4] Restore Back-up.[/SIZE]

[SIZE=2]Reboot[/SIZE]
    This has not been tested by me, since I don't use SIM locked providers.

    So make sure you have a complete NANDroid backup of your phone in case something
    goes wrong. I do not take any responsibility for damaged phone due to this procedure.

    Please confirm if this method works for this phone.

    ​
    View
    4
    L
    ladislav.heller
    PreConfig application can be started using following command:
    Code: 
    am broadcast -a android.provider.Telephony.SECRET_CODE -d android_secret_code://83052020100812173552301071192687
    View
    3
    L
    ladislav.heller
    How to trigger the Nfc Test application?
    Package name is com.sec.android.app.nfctest.

    Decompiled NfcTestBroadcastReceiver.java file:
    Code: 
    package com.sec.android.app.nfctest;

import android.content.*;
import android.net.Uri;
import android.nfc.NfcAdapter;
import android.util.Log;

// Referenced classes of package com.sec.android.app.nfctest:
//            NfcTestMain

public class NfcTestBroadcastReceiver extends BroadcastReceiver
{

    public NfcTestBroadcastReceiver()
    {
    }

    public void onReceive(Context context, Intent intent)
    {
        String s = intent.getAction();
        if(!s.equals("android.provider.Telephony.SECRET_CODE")) goto _L2; else goto _L1
_L1:
        Intent intent1 = new Intent("android.intent.action.MAIN");
        if(intent.getData().getHost().equals("[COLOR="Red"]6328378[/COLOR]"))
            intent1.setClass(context, com/sec/android/app/nfctest/NfcTestMain);
        intent1.setFlags(0x10000000);
        context.startActivity(intent1);
_L4:
        return;
_L2:
        if("android.intent.action.BCS_REQUEST".equals(s))
        {
            Log.i("NfcTestBroadcastReceiver", "BCS_REQUEST receive");
            if("AT+NFCVALUE".equalsIgnoreCase(intent.getStringExtra("command")))
            {
                NfcAdapter nfcadapter = NfcAdapter.getDefaultAdapter(context);
                Log.i("NfcTestBroadcastReceiver", "AT+NFCVALUE!!!");
                if(nfcadapter.isEnabled())
                {
                    Log.i("NfcTestBroadcastReceiver", "NFC STATE ON!!!");
                    context.sendBroadcast((new Intent("android.intent.action.BCS_RESPONSE")).putExtra("response", "ON"));
                } else
                {
                    Log.i("NfcTestBroadcastReceiver", "NFC STATE OFF!!!");
                    context.sendBroadcast((new Intent("android.intent.action.BCS_RESPONSE")).putExtra("response", "OFF"));
                }
            }
        }
        if(true) goto _L4; else goto _L3
_L3:
    }
}

    Tried the secret code *#6328378# in phone dialer but nothing happened.

    Update:
    But it works from commandline:
    Code: 
    am broadcast -a android.provider.Telephony.SECRET_CODE -d android_secret_code://6328378
    View

New posts