Xperia Z C6602 LTE band IV AWS possibility

Search This thread

ozaki86

Member
Apr 13, 2011
25
10
The pic shows already found telecom with LTE from Taiwan(the bottom one)
But I'm not the telecom user,so can not choice to test:crying:
pAUwvUr.png
 

SquallATF

Member
Nov 25, 2011
32
45
You have C6602?

What tutorial did you use, what settings you changed?
my device is L36h chinese version c6602
New discovery modify ta can change default band config
when I read /nvta_log/log.txt in efs I fond this
Code:
0010346 Selecting band configuration file
0010346 Selected band configuration file '/nvpreload/[COLOR="Red"]nv_W12458.bin[/COLOR]'.
0010348 /nvpreload/nv_W12458.bin removed successfully.
0010348 /nvpreload/nv_default_band.bin removed successfully.
0010699 Baseband version 9x15A-ACEFWMAZQ-30110098-75
the I fond many band configuration bin file in m9kefs3 partition same as amss_fs_3 such as nv_L1357_20W1358.bin
next I dump ta use DumpXperiaTA
I fond
Code:
Offset: 0x000009C0
Token 0x000009F7, Len = 0x00000007, Magic1 = 0x3BF8E9C1, Magic2 = 0xFFFFFFFF
Hex value:
57313234353800
ASCII value:
[COLOR="Red"]W12458[/COLOR].
and
Code:
Offset: 0x0004E7E0
Token 0x0000EA62, Len = 0x00000040, Magic1 = 0x3BF8E9C1, Magic2 = 0xFFFFFFFF
Hex value:
797567615F726F777774725F57313234353800000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000
ASCII value:
[COLOR="Red"]yuga_rowwtr_W12458[/COLOR]..............................................
next I try to change ta setting using flashtool then success switch band config to nv_L1357_20W1358 but rfnv file
and get a full log
Code:
0007769 === NV/TA-log start ===
0007769 taks: Received 1559 units
0007769 TA_QMI_SVC: TA QMI Service started and ready...
0007883 EFS2 free: 627 kB
0007883 nvpreload/nv_L1245_17W12458.bin removed successfully.
0007883 nvpreload/nv_L1245_17W12458_cal_true.bin removed successfully.
0007884 nvpreload/nv_L1245_17W12458_ets.bin removed successfully.
0007884 nvpreload/nv_L1_19_21W156_19.bin removed successfully.
0007884 nvpreload/nv_L1_19_21W156_19_cal_true.bin removed successfully.
0007884 nvpreload/nv_L1_19_21W156_19_ets.bin removed successfully.
0007884 nvpreload/nv_W12458.bin removed successfully.
0007884 nvpreload/nv_W12458_cal_true.bin removed successfully.
0007884 nvpreload/nv_W12458_ets.bin removed successfully.
0007885 nvpreload/nv_W1358.bin removed successfully.
0007885 nvpreload/nv_W1358_cal_true.bin removed successfully.
0007885 nvpreload/nv_W1358_ets.bin removed successfully.
0007886 Selecting band configuration file
0007886 Selected band configuration file '/nvpreload/nv_L1357_20W1358_cal_true.bin'.
0007887 /nvpreload/nv_L1357_20W1358_cal_true.bin removed successfully.
0007887 /nvpreload/nv_default_band_cal_true.bin removed successfully.
0007887 Selecting band configuration file
0007887 Selected band configuration file '/nvpreload/nv_L1357_20W1358_ets.bin'.
0007888 /nvpreload/nv_L1357_20W1358_ets.bin removed successfully.
0007888 /nvpreload/nv_default_band_ets.bin removed successfully.
0007933 Loading trim area to NV (<unit> [<size>]):
...................
...................
0009792 Trim area load completed. 1475 items copied, took 1859 ms.
0009792 IMEI: sony_imei_smem: 1073761248
0009792 IMEI: sony_imei_size: 16
0009792 IMEI: 
0009792 IMEI: 
0009793 Selecting band configuration file
0009793 Selected band configuration file '/nvpreload/[COLOR="Red"]nv_L1357_20W1358.bin[/COLOR]'.
0009795 /nvpreload/nv_L1357_20W1358.bin removed successfully.
0009795 /nvpreload/nv_default_band.bin removed successfully.
0010160 Baseband version 9x15A-ACEFWMAZQ-30110098-75

Warning the following changes might cause your phone is unavailable at your own risk, and backup your ta partition first.
I post a ftf file can change band config to yuga_gltewtr_L1357_20W1358(the c6603 default band config), but also need replace rfnv by you self

I noticed all default rfnv files are read from ta partition, is there any way to delete ta value? so that we can fully switch band by flashtool
 

Attachments

  • C6603_10.5.1.A.0.292_bandbase_v1.zip
    130.1 KB · Views: 371
Last edited:

Androxyde

Recognized Developer
Aug 3, 2010
1,099
2,836
50
Paris
www.flashtool.net
my device is L36h chinese version c6602
New discovery modify ta can change default band config
when I read /nvta_log/log.txt in efs I fond this
Code:
0010346 Selecting band configuration file
0010346 Selected band configuration file '/nvpreload/[COLOR="Red"]nv_W12458.bin[/COLOR]'.
0010348 /nvpreload/nv_W12458.bin removed successfully.
0010348 /nvpreload/nv_default_band.bin removed successfully.
0010699 Baseband version 9x15A-ACEFWMAZQ-30110098-75
the I fond many band configuration bin file in m9kefs3 partition same as amss_fs_3 such as nv_L1357_20W1358.bin
next I dump ta use DumpXperiaTA
I fond
Code:
Offset: 0x000009C0
Token 0x000009F7, Len = 0x00000007, Magic1 = 0x3BF8E9C1, Magic2 = 0xFFFFFFFF
Hex value:
57313234353800
ASCII value:
[COLOR="Red"]W12458[/COLOR].
and
Code:
Offset: 0x0004E7E0
Token 0x0000EA62, Len = 0x00000040, Magic1 = 0x3BF8E9C1, Magic2 = 0xFFFFFFFF
Hex value:
797567615F726F777774725F57313234353800000000000000000000000000000000000000000000
000000000000000000000000000000000000000000000000
ASCII value:
[COLOR="Red"]yuga_rowwtr_W12458[/COLOR]..............................................
next I try to change ta setting using flashtool then success switch band config to nv_L1357_20W1358 but rfnv file
and get a full log
Code:
0007769 === NV/TA-log start ===
0007769 taks: Received 1559 units
0007769 TA_QMI_SVC: TA QMI Service started and ready...
0007883 EFS2 free: 627 kB
0007883 nvpreload/nv_L1245_17W12458.bin removed successfully.
0007883 nvpreload/nv_L1245_17W12458_cal_true.bin removed successfully.
0007884 nvpreload/nv_L1245_17W12458_ets.bin removed successfully.
0007884 nvpreload/nv_L1_19_21W156_19.bin removed successfully.
0007884 nvpreload/nv_L1_19_21W156_19_cal_true.bin removed successfully.
0007884 nvpreload/nv_L1_19_21W156_19_ets.bin removed successfully.
0007884 nvpreload/nv_W12458.bin removed successfully.
0007884 nvpreload/nv_W12458_cal_true.bin removed successfully.
0007884 nvpreload/nv_W12458_ets.bin removed successfully.
0007885 nvpreload/nv_W1358.bin removed successfully.
0007885 nvpreload/nv_W1358_cal_true.bin removed successfully.
0007885 nvpreload/nv_W1358_ets.bin removed successfully.
0007886 Selecting band configuration file
0007886 Selected band configuration file '/nvpreload/nv_L1357_20W1358_cal_true.bin'.
0007887 /nvpreload/nv_L1357_20W1358_cal_true.bin removed successfully.
0007887 /nvpreload/nv_default_band_cal_true.bin removed successfully.
0007887 Selecting band configuration file
0007887 Selected band configuration file '/nvpreload/nv_L1357_20W1358_ets.bin'.
0007888 /nvpreload/nv_L1357_20W1358_ets.bin removed successfully.
0007888 /nvpreload/nv_default_band_ets.bin removed successfully.
0007933 Loading trim area to NV (<unit> [<size>]):
...................
...................
0009792 Trim area load completed. 1475 items copied, took 1859 ms.
0009792 IMEI: sony_imei_smem: 1073761248
0009792 IMEI: sony_imei_size: 16
0009792 IMEI: 
0009792 IMEI: 
0009793 Selecting band configuration file
0009793 Selected band configuration file '/nvpreload/[COLOR="Red"]nv_L1357_20W1358.bin[/COLOR]'.
0009795 /nvpreload/nv_L1357_20W1358.bin removed successfully.
0009795 /nvpreload/nv_default_band.bin removed successfully.
0010160 Baseband version 9x15A-ACEFWMAZQ-30110098-75

Warning the following changes might cause your phone is unavailable at your own risk, and backup your ta partition first.
I post a ftf file can change band config to yuga_gltewtr_L1357_20W1358(the c6603 default band config), but also need replace rfnv by you self

I noticed all default rfnv files are read from ta partition, is there any way to delete ta value? so that we can fully switch band by flashtool

Hi :)

To erase a unit, you have a write a 0 length value to that unit.
That's what I do to erase bootloader unlock code from TA (https://github.com/Androxyde/Flashtool/blob/master/src/gui/BLUWizard.java line 181)
 

ozaki86

Member
Apr 13, 2011
25
10
Found my LTE signal of telecom ,But can not register(login?)
 

Attachments

  • Screenshot_2015-04-03-15-55-14.png
    Screenshot_2015-04-03-15-55-14.png
    202.1 KB · Views: 360
  • Screenshot_2015-04-03-15-55-24.png
    Screenshot_2015-04-03-15-55-24.png
    140.3 KB · Views: 353
  • Screenshot_2015-04-03-15-57-25.png
    Screenshot_2015-04-03-15-57-25.png
    209.4 KB · Views: 362
Last edited:

sipe1

Senior Member
Jul 31, 2011
276
71
Hello all, I got in touch with @SquallATF, sent him my TA, got from him custom baseband that I flashed and success!

I can see two LTE networks in Croatia, bands are 3 and 20. I will get LTE sim card and try to connect, will post here if success.

Thank you @SquallATF!
 

Attachments

  • Screenshot_2015-04-05-14-53-23.jpg
    Screenshot_2015-04-05-14-53-23.jpg
    91.6 KB · Views: 288
  • Like
Reactions: RyomaEchizen

ozaki86

Member
Apr 13, 2011
25
10
Hello all, I got in touch with @SquallATF, sent him my TA, got from him custom baseband that I flashed and success!

I can see two LTE networks in Croatia, bands are 3 and 20. I will get LTE sim card and try to connect, will post here if success.

Thank you @SquallATF!
You will success,because many people flash SquallATF's baseband and got LTE already.
But it seems only Band 8 in Taiwan.(looks no band 3 in Taiwan)
Actually,Its a little different with C6602&03 chip ,So..may some bands can not support.
SquallATF guess support 1、5、8 only,its need more testing to prove.
In China & Taiwan, Our main band is 3!
 

Attachments

  • Screenshot_2015-04-05-20-17-13.jpg
    Screenshot_2015-04-05-20-17-13.jpg
    163.2 KB · Views: 298
  • Screenshot_2015-04-04-11-56-14.jpg
    Screenshot_2015-04-04-11-56-14.jpg
    90.2 KB · Views: 297

Hexchain

Senior Member
Oct 8, 2010
118
25
You will success,because many people flash SquallATF's baseband and got LTE already.
But it seems only Band 8 in Taiwan.(looks no band 3 in Taiwan)
Actually,Its a little different with C6602&03 chip ,So..may some bands can not support.
SquallATF guess support 1、5、8 only,its need more testing to prove.
In China & Taiwan, Our main band is 3!

It's sad to know there's no "Free upgrade to a 4G phone" for L36h but still big thanks to @SquallATF ! Amazing work.

EDIT: band 3 works for me, and band 5 maybe too (because another carrier uses band 5 here, and when my carrier has no signal coverage it will fallback to their network and provide emergency call service)

Anyway the only thing to find these days is that our carrier's 4G coverage still has a long way to go...
 
Last edited:
  • Like
Reactions: sipe1

mamumba

New member
Apr 21, 2015
4
1
Is there a chance to port this method to other sony devices? Would you be so kind to post a full manual step by step, including software you use!
Tnx!
 

Xtian2.Xtian2

Member
Jul 24, 2008
11
3
paris
guild same as http://xdaforums.com/crossdevice-dev/sony/thread-progress-please-leave-im-updating-t2871269
ignore setp 3
setp 12 use device MI_05 replace MI_04
also should change driver inf file USB\VID_0FCE&PID_5146&MI_04 to USB\VID_0FCE&PID_B146&MI_05

ps lte doesn't work

I try to write m9kefs1 m9kefs2 m9kefs3 partition dump from c6603 then switch to lte the device not reboot now, but I did not have 4g sim card can not do more tests
I compared the rfnv files are different from before, try to replace it, may get lte work

Could you indicate how you write m9kefs1 m9kefs2 m9kefs3 partition dump from c6603?
 

Xtian2.Xtian2

Member
Jul 24, 2008
11
3
paris
Thanks for your indication but "dd" stands for what?
in post "98 you have added a zip file containing rfnv files.
Could you explain how you have replaced orignal rfnv with the one you provided?
Have you succeed to change TA partition? Should it be the case how have you done it?:D
Thanks in advance for your assistance and great job.
 

SquallATF

Member
Nov 25, 2011
32
45
Thanks for your indication but "dd" stands for what?
in post "98 you have added a zip file containing rfnv files.
Could you explain how you have replaced orignal rfnv with the one you provided?
Have you succeed to change TA partition? Should it be the case how have you done it?:D
Thanks in advance for your assistance and great job.
Sorry I can't help you, because my main hard disk broken and all data lost.
My friend send me the c6603 n9kefs1-3 dump, and I use dd write theme to my phone, but this is not the best way and have some problem.
You can see my post, I build a ftf can change baseband config
If you want flash to 5.0 device, you should replace amss_fs_1.sin, amss_fs_2.sin and amss_fs_3.sin from 5.0 firmware.
 

Alpmann

New member
Jul 23, 2016
2
0
Hi,
I have z c 6602.
Because of resolving a problem about internal speaker of phone, a mobile fitter opened it and changed the speaker, but there was no software reapir.
And
Then, When i was searching for service provider, i checked the preferred network type, and i saw LTE.
I selected it, it's now active!!!
I
 

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    guild same as http://xdaforums.com/crossdevice-dev/sony/thread-progress-please-leave-im-updating-t2871269
    ignore setp 3
    setp 12 use device MI_05 replace MI_04
    also should change driver inf file USB\VID_0FCE&PID_5146&MI_04 to USB\VID_0FCE&PID_B146&MI_05

    ps lte doesn't work

    I try to write m9kefs1 m9kefs2 m9kefs3 partition dump from c6603 then switch to lte the device not reboot now, but I did not have 4g sim card can not do more tests
    I compared the rfnv files are different from before, try to replace it, may get lte work
    4
    We know that the C6603 has LTE, while C6602 doesn't

    http://www.gsmarena.com/sony_xperia_z-5204.php



    Take a look at the FCC website.



    -- evidence that FCC website shows a C6602

    From the External Photos.pdf, first page, bottom photo, the photo says "C6602"



    From the Label.pdf, it says "C6602"



    -- evidence that LTE could be possible

    From the Internal Photos.pdf, page 4, bottom photo, the Qualcomm chip says "MDM9215M", which supports LTE FDD/TDD CAT3, SVLTE-DB and it is the same modem that the Nexus 4 had. Nexus 4 had that LTE hack for band 4 AWS

    On page 3, bottom pic, on the chip near the bottom right, there is an Avago A5004, which is a power amplifier supporting part of LTE band IV(1700mhz portion)

    Above the A5004 chip, there is the Qualcomm WTR1605L transceiver(also present in Nexus 4), which supports all LTE frequencies in the world right now





    Recap, chips listed supports LTE band IV:
    Modem: Qualcomm MDM9215M
    Power Amplifier: Avago A5004 (only 1700mhz, not 2100mhz for LTE band IV downlink)
    Frequency Transceiver: Qualcomm WTR1605L
    Antenna:? can't tell from FCC photo

    Now, we don't know if the above chips have their full functionality and active, or whether there is a power amplifier for the 2100mhz downlink, or whether the antenna supports it, or whether we can find a software mod to enable LTE Band IV signal. Can't find a full Xperia Z teardown, and the FCC pictures aren't detailed enough
    3
    The pic shows already found telecom with LTE from Taiwan(the bottom one)
    But I'm not the telecom user,so can not choice to test:crying:
    pAUwvUr.png
    3
    may get lte work, my card does not enable 4g so can not connect to lte network, but my phone success found lte network single
    3
    You have C6602?

    What tutorial did you use, what settings you changed?
    my device is L36h chinese version c6602
    New discovery modify ta can change default band config
    when I read /nvta_log/log.txt in efs I fond this
    Code:
    0010346 Selecting band configuration file
    0010346 Selected band configuration file '/nvpreload/[COLOR="Red"]nv_W12458.bin[/COLOR]'.
    0010348 /nvpreload/nv_W12458.bin removed successfully.
    0010348 /nvpreload/nv_default_band.bin removed successfully.
    0010699 Baseband version 9x15A-ACEFWMAZQ-30110098-75
    the I fond many band configuration bin file in m9kefs3 partition same as amss_fs_3 such as nv_L1357_20W1358.bin
    next I dump ta use DumpXperiaTA
    I fond
    Code:
    Offset: 0x000009C0
    Token 0x000009F7, Len = 0x00000007, Magic1 = 0x3BF8E9C1, Magic2 = 0xFFFFFFFF
    Hex value:
    57313234353800
    ASCII value:
    [COLOR="Red"]W12458[/COLOR].
    and
    Code:
    Offset: 0x0004E7E0
    Token 0x0000EA62, Len = 0x00000040, Magic1 = 0x3BF8E9C1, Magic2 = 0xFFFFFFFF
    Hex value:
    797567615F726F777774725F57313234353800000000000000000000000000000000000000000000
    000000000000000000000000000000000000000000000000
    ASCII value:
    [COLOR="Red"]yuga_rowwtr_W12458[/COLOR]..............................................
    next I try to change ta setting using flashtool then success switch band config to nv_L1357_20W1358 but rfnv file
    and get a full log
    Code:
    0007769 === NV/TA-log start ===
    0007769 taks: Received 1559 units
    0007769 TA_QMI_SVC: TA QMI Service started and ready...
    0007883 EFS2 free: 627 kB
    0007883 nvpreload/nv_L1245_17W12458.bin removed successfully.
    0007883 nvpreload/nv_L1245_17W12458_cal_true.bin removed successfully.
    0007884 nvpreload/nv_L1245_17W12458_ets.bin removed successfully.
    0007884 nvpreload/nv_L1_19_21W156_19.bin removed successfully.
    0007884 nvpreload/nv_L1_19_21W156_19_cal_true.bin removed successfully.
    0007884 nvpreload/nv_L1_19_21W156_19_ets.bin removed successfully.
    0007884 nvpreload/nv_W12458.bin removed successfully.
    0007884 nvpreload/nv_W12458_cal_true.bin removed successfully.
    0007884 nvpreload/nv_W12458_ets.bin removed successfully.
    0007885 nvpreload/nv_W1358.bin removed successfully.
    0007885 nvpreload/nv_W1358_cal_true.bin removed successfully.
    0007885 nvpreload/nv_W1358_ets.bin removed successfully.
    0007886 Selecting band configuration file
    0007886 Selected band configuration file '/nvpreload/nv_L1357_20W1358_cal_true.bin'.
    0007887 /nvpreload/nv_L1357_20W1358_cal_true.bin removed successfully.
    0007887 /nvpreload/nv_default_band_cal_true.bin removed successfully.
    0007887 Selecting band configuration file
    0007887 Selected band configuration file '/nvpreload/nv_L1357_20W1358_ets.bin'.
    0007888 /nvpreload/nv_L1357_20W1358_ets.bin removed successfully.
    0007888 /nvpreload/nv_default_band_ets.bin removed successfully.
    0007933 Loading trim area to NV (<unit> [<size>]):
    ...................
    ...................
    0009792 Trim area load completed. 1475 items copied, took 1859 ms.
    0009792 IMEI: sony_imei_smem: 1073761248
    0009792 IMEI: sony_imei_size: 16
    0009792 IMEI: 
    0009792 IMEI: 
    0009793 Selecting band configuration file
    0009793 Selected band configuration file '/nvpreload/[COLOR="Red"]nv_L1357_20W1358.bin[/COLOR]'.
    0009795 /nvpreload/nv_L1357_20W1358.bin removed successfully.
    0009795 /nvpreload/nv_default_band.bin removed successfully.
    0010160 Baseband version 9x15A-ACEFWMAZQ-30110098-75

    Warning the following changes might cause your phone is unavailable at your own risk, and backup your ta partition first.
    I post a ftf file can change band config to yuga_gltewtr_L1357_20W1358(the c6603 default band config), but also need replace rfnv by you self

    I noticed all default rfnv files are read from ta partition, is there any way to delete ta value? so that we can fully switch band by flashtool