[TUTORIAL] How to unlock more LTE frequency bands on Mi Note Pro

Search This thread

XICO2KX

Member
Oct 20, 2012
41
9
Just a thought but...

This is a list of other devices with Qualcomm Snapdragon 810 aka MSM8994:
  • BenQ F52
  • Coolpad Fengshang C+
  • Doogee F3 Ltd
  • Fujitsu Arrows F-04G
  • Sony Xperia Z3+/Z4
  • HTC Butterfly 3
  • HTC One M9 LeTV Le Max
  • LG G Flex 2
  • LeTV Le One Pro
  • Microsoft Lumia 950 XL
  • Motorola Droid Turbo 2
  • Nexus 6P
  • OnePlus 2
  • Qiku Prime
  • Qualcomm Snapdragon MDP
  • Sharp Aquos Pad SH-05G
  • Sharp Aquos Xx
  • Sharp Aquos Zeta SH-03G
  • Sony Xperia Z4 Tablet
  • Sony Xperia Z5 (-/Compact/Premium)
  • Vertu Signature Touch
  • Xiaomi Mi Note Pro
  • ZTE Nubia Axon (-/Elite/Pro/Lux)
  • ZTE Nubia Z9 (-/Elite/Exclusive)
  • ZTE Nubia Z9 Max (-/Elite)
  • Does anyone know of any other devices with the same MSM8994 SoC not on the list? (The list is from a Wikipedia article.)
  • Does anyone know if any of those devices supports more LTE bands than the Note Pro?
The reason I am asking is that once the bands are enabled in the NVRAM settings, whether they work or not is up to, in particular, the power amplifier chip and modem firmware (radio). The firmware is contained within the file NON-HLOS.bin, which is typically included with any OTA update ZIP but can also be easily flashed independently with:
Code:
fastboot flash modem NON-HLOS.bin
I haven't tried it but I guess it's likely that this file is interchangeable between at least some of the devices sharing the same SoC, unless there's a signature check involved. There is some anecdotal evidence that this could work, and if not, flashing back the original modem firmware should resolve any issues. Thus we could:
  1. Locate another MSM8994 device that supports more bands than the Note Pro.
  2. Obtain the NON-HLOS.bin file for it
  3. Flash it onto the Note Pro to, hopefully, enable more bands.
Comments welcome.
That's a pretty nice idea! :good:
Have you tried checking those manufacturer's websites to see if they have the ROM available for downloading, and then extracting that NON-HLOS.bin file?:fingers-crossed:
 

youngtodie

Member
Nov 27, 2013
5
1
sam in redmi note 4

Hey,

Newbie here, but i can tech a little :D
I was wondering if this would work on my redmi note 4 india version or just redmi note 4 in general.
 

msssm

Senior Member
Mar 4, 2014
158
8
First of all download this package. I have zipped it up into seperate folders.
https://drive.google.com/file/d/0B-0Lr302nDVcbXhsSWxWdktOZGM/view?usp=sharing
Hi, I would like to try that on a Mi Max 2. However I can see the file listing on Google Drive but can't download. You you please re-share?
I found the latest QPST on https://www.qpstflash.com/ . But where did you get the QXDM from, I just find a PDF on the qualcomm website.

That QPST_2.7.460.zip was not possible to install on Windows 7. The QPST*.exe fails with "QPSTserver.png is missing" and the setup.exe looks like installing but is interrupted at the end without an installed application.
 
Last edited:

Nikogamboa

New member
Apr 23, 2019
3
0
Does anyone knows how to install 28 (700) frequency in mi a1?

Does anyone knows how to install 28 (700) frequency in mi a1?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 14
    This tutorial was not made by me, all credits go to ethan2k he posted a thread on miui forum.

    Hi All,

    After 3 days of researching and semi bricking my phone, I have now worked out how to properly unlock most bands of LTE for international use!

    NOTE: This guide is for Xiaomi Note Pro 64gb China version only.
    ***** THIS GUIDE WILL UNLOCK THE FOLLOWING BANDS: 4G bands: LTE band 1(2100), 2(1900), 3(1800), 4(1700/2100), 5(850), 7(2600), 8(900), 17(700), 20(800), 28(700) *****

    First of all download this package. I have zipped it up into seperate folders.

    https://drive.google.com/file/d/0B-0Lr302nDVcbXhsSWxWdktOZGM/view?usp=sharing

    This driver pack only works on Windows 7!! Win 8 and 10 are not working!

    Here goes:

    1. Unzip the package into anyplace on your PC
    2. On your phone type in: *#*#717717#*#* This will enable Diag USB mode for your phone
    3. Before you plug your phone in, enable USB Debugging
    4. Plug in USB cable into your phone, then go to Device Manager -
    * Update the driver for Device Manager --> Ports (Com & LPT) --> Qualcomm HS-USB Diagnostics 9025 from the Zip folder: "1. Xiaomi Diag Driver"
    A2uYs7L.png
    It should now look like this, remember what Com Port the Diagnostic 9025 is using, in my case its on COM11.

    5. Install "2. QPST v2.7 Build 4.11" from zip package
    6. Install "3. QXDM-3.12.714" from zip package
    7. Open up QPST Configuration
    8. Go to Ports tab - By default it should have found the phone and auto added the port.
    xf8CDOv.png

    9. Leave QPST running in background
    10. Open up QXDM Professional
    11. Go into Options --> Communications --> Enable the Com Port your phone is running on.
    12. Back to QXDM main window, in the "View" drop-down menu, select NV Browser
    CqEfzeE.png

    13. Now the fun part begin

    Inside the NV Browser window, scroll down and click on line 01877 (rf_bc_config)(1); click the Read button(2), save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 3460734838925427584(3) and click on Write button(4).
    HjNh2cr.png

    14. Inside the NV Browser window, scroll down and click on line 00946 (band_pref_16_31); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x0FF8 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button.


    15. Inside the NV Browser window, scroll down and click on line 02954 (band_pref_32_63); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 805765120 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button.


    16. 10. Inside the NV Browser window, scroll down and click on line 00441 (band_pref); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x380 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button.


    17. Inside the NV Browser window, scroll down and click on line 06828 (lte_bc_config); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 2061853925599 (please don't be an idiot and don't edit the empty one with "ext" in the name) and click on Write button.


    18. On your phone type in: *#*#717717#*#* This will now disable Diag USB mode


    19. Reboot your phone and its all complete!!!

    If you are having troubles with the values I suggest using the NV Calculator app https://play.google.com/store/apps/details?id=org.vndnguyen.nvcalc
    4
    If i get the chinese version and unlock the bands so i can use it on my network, can i still install the stock rom and receive OTA updates and not be rooted? I cannot have root installed for some secure apps for work/banking?
    Qualcomm NVRAM settings are independent of the ROM and you don't need root access to change them. Just enable the diagnostics mode by typing *#*#717717#*#* on the keypad.

    The "Chinese version" (of the ROM) is the only one you can get though. There's no other version because so far this device was only sold in China. The choice you have is between "stable" and "developer," and the unofficial ROMs (such as Xiaomi.eu) that are generally based off the latter.

    Changing the ROM as such will not affect those NVRAM settings but it is still possible reflashing the ROM will overwrite them because of the update script also flashing newer versions of the file NON-HLOS.bin (LTE modem) or modem.bin (2G/3G modem), which might include different defaults.

    Conclusion: flash the ROM you want to use first, and make any changes to Qualcomm NVRAM settings afterwards.
    2
    If anyone manages to unlock bands with this tuto PLEASE state it clearly!
    Nobody has yet succeeded for sure as far as I know.
    TL;DR Warning: Scroll to the bottom if you just want the conclusions.

    The original author, ethan2k on the MIUI English forum, claimed to have unlocked band 8 on Telstra in Sydney:
    ethan2k at en.miui.com said:
    I forgot to mention of what worked for me.

    I have dual sim in Australia, on Vodafone and Telstra. This unlocked Band 8 for me, Telstra takes major advantage of Band 8 in Sydney! I believe band 5 is unlocked as well, previously for Vodafone, I only had 3g in certain areas, now I have LTE.

    However, gadgetwhisperer, another user on that forum, pointed out to him:
    gadgetwhisperer at en.miui.com said:
    I think your Telstra n Voda is on band 3 (1800Mhz) - which is supported from the beginning.

    850mhz and 900mhz is only used to broaden their network scope. I dont think it used as the main freq... [...]

    I would suggest you to try to revert the value back to the original and go to the place where you only can get 3G with voda, then only you chanhe the value to the "unlocked one" and see whether you can get LTE or not.

    Until now (up to post #86 in that thread) there was no follow up on the above suggestion.

    According to the website OzTowers.com, which has a list of mobile bands by provider in Australia, the majority of Telstra's network is on band 3, while in the New South Wales (NSW) area, of which Sydney is the capital, they only have 2 (two) base stations on band 8. To quote the relevant part of the table at this link as of January 2016:
    Code:
    Gen  Spectrum  Band  ...  NSW   ...
    ...  ...       ...   ...  ...   ...
    4G    700 MHz    28  ...   320  ...
    4G    900 MHz     8  ...     2  ... <
    4G   1800 MHz     3  ...   985  ...
    4G   2100 MHz     1  ...     4  ...
    4G   2600 MHz     7  ...    30  ...
                                 ^

    The reason? Already in September 2014, Telstra announced they were cancelling their 900 MHz (band 8) services:
    TeleGeography.com said:
    Australian mobile network operator Telstra is reportedly planning to halt development of its LTE-Advanced (LTE-A) network using its 900MHz and 1800MHz spectrum holdings, with it instead looking to pair the latter with its recently acquired 700MHz frequencies.
    According to iTnews, although Telstra’s first round trials of LTE carrier aggregation – carried out in July 2013 – combined 900MHz and 1800MHz spectrum, the operator has opted not to extend this first implementation of the technology. Instead, it will reportedly focus on coupling the two 20MHz blocks of 700MHz spectrum it secured via auction in May 2013. The 900MHz and 1800MHz service is still operational in a number of locations, including the Sunshine Coast, but will not be expanded as we focus on the use of 700MHz and 1800MHz,’ an unnamed Telstra spokesperson confirmed, adding: ‘Our intention for carrier aggregation was always to focus on 1800MHz and 700MHz – hence the purchase of the additional 700 MHz spectrum.’

    Moving on, in the original post the author states:
    ethan2k on en.miui.com said:
    ***** THIS GUIDE WILL UNLOCK THE FOLLOWING BANDS: 4G bands: LTE band 1(2100), 2(1900), 3(1800), 4(1700/2100), 5(850), 7(2600), 8(900), 17(700), 20(800), 28(700) *****

    First of all, the bands 1, 3 and 7, underlined in the quote above, are enabled by default, so they don't need to be unlocked. That leaves the following bands supposedly unlocked by the author: 2, 4, 5, 8, 17, 20, 28.

    The author suggests the required change to the settings to enable those bands:
    ethan2k on en.miui.com said:
    17. Inside the NV Browser window [...] click on line 06828 (lte_bc_config); [...] replace Input value with 2061853925599 [...] and click on Write button.

    Converting the suggested decimal value to binary, for example using Google's "2061853925599 to binary", we can see which bits are set:
    Code:
    11110000000010000000100100010000011011111  < Value
     4         3         2         1        0  ^ Bands
    10987654321098765432109876543210987654321  (vertical)
    You can see this setting then enables the following bands:
    • 38-41: TDD LTE
    • 1, 3, 7: already enabled by default
    • 2 ,4, 5, 8: this part is OK, does what it claims to do
    • 14, 18, 21, 29 - ?
    As for the last line, bands 18 and 21 are only used in Japan, each of them by a single network. Of these, band 18 is obsolete and is supposed to be replaced by band 26, of which it is a subset. Bands 14 and 29 are not used by any commercial networks anywhere in the world at all. You can check this for yourself in Wikipedia.

    In short, enabling those four bands is most certainly useless. So, what happened? Most likely whoever was doing the calculation wanted to enable bands 13, 17, 20 and 28 but shifted a part of the number one bit too much to the left. Anyone can make a mistake like this but with so many people following this guide it could be reasonably expected that someone would spot it before.

    I am skipping the discussion of the changes to the other values, which concern 2G and 3G settings, but in my view the suggested values are even more off (particularly so if you have the All-Network version of the Note Pro, it'll actually disable some of the originally enabled bands).

    To wrap it all up:

    I appreciate ethan2k's posting of the whole tutorial complete with the necessary software links but it appears he has been misled into thinking that he was connected on band 8 while in fact his phone was using band 3, which worked by default without any changes.

    The value calculated by ethan2k was OK for attempting to enable bands 5 and 8, which is what he wanted to try, but a mistake in the calculation means it does not really enable all the bands it claims.


    So far no-one has had any results with the changes but it seems most people tried the values that were not correct either. If you want to try changing those settings, do it properly. That is:
    • Start with the values read from your phone (not some magical, mysterious number found on the Internet)
    • Convert them to binary
    • See if the bits set to 1's match with the bands that should be enabled by default
    • Change the bits that enable the bands you want and double-check
    • Convert back to the original base the number was in (decimal or hexadecimal)
    • Write the number into the phone
    • Report back the results with all the relevant details: Phone model, Baseband & ROM versions, Bands you tried to enable, Original values, Replaced values, Network you tried it on, Whether it worked or not. Don't just say "it worked" because the phone didn't explode the moment you changed the values to some garbage.
    This way we might actually get somewhere with all this one day.


    To find out which bits in the settings correspond to which bands you can see my post here (particularly for 2G and 3G, as for 4G LTE it's simpler and already explained above). I can't vouch that what I wrote is all correct but at least this way you have a chance to check my reasoning for yourself because everything is described step-by-step and referenced. I encourage everyone not to take anything about the band settings at face value and reproduce all the steps on their own. Also, if you find some better sources of information or spot a mistake, please share it so that we can all learn from it.

    Let me reiterate that with my post I didn't mean to criticize ethan2k or anyone else but I just want to clear up some confusion that built up, and propose some more rigorous way that will hopefully lead us to a definite conclusion on whether more bands can be enabled and if so, which ones.
     
    2
    Seems like I'll have to always manually update myself all the time (No OTA?) will flashing an incremental newer release delete all my data/setting and revert the modem file?
    An update is a ZIP archive. In it, there is the file META-INF/com/google/android/updater-script, which has all the instructions what to do during an update. In particular, inside this file there will be a line saying something like:

    package_extract_file("firmware-update/NON-HLOS.bin", "/dev/block/bootdevice/by-name/modem");

    If you want to stop the modem firmware from being updated, you need to comment out this line by putting the pound sign (#) in front of it, or delete it altogether.

    The problem is that updates have a signature which, once you do the above, will become invalid, which means it probably cannot be flashed through the official Updater app. But you will still be able flash the same file though from the TWRP recovery for example, with exactly the same result.

    Note that I didn't say that flashing a different version of the file NON-HLOS.bin, which is what the updates generally do, will override the changes you made because I don't know that: whether it does so might even depend on the particular version of the file. What can be said with near certainty though is that anything else other than this done by an update is unlikely to change these NVRAM settings.

    The above is for the sake of explanation. I wouldn't worry about this too much now though. If you manage to enable some LTE bands and after an update they stop working, at most you'll need to redo the changes. Only if you noticed that they become disabled with every update, then the file above would be the likely culprit, in which case you can disable it in the script before flashing any further updates.

    Two things of note though:
    1. So far I've seen little evidence that bands can actually be unlocked on the Note Pro. (I've done the change myself but in the place where I am there are no networks using the supposedly unlocked bands.) It's harmless to try as long as you make a note of any values you replace so that they can be restored later but if you're considering getting the phone on the assumption that some other bands can be enabled on it, then I'd say the evidence for this is scarce so far: don't be disappointed if it doesn't work out (it's still a nice phone though).
    2. Xiaomi has locked the bootloader starting from their 6.1.14 ROM update, and unlocking it seems to be a tedious process. If I were you I'd stay away from this and any newer updates for the moment, so as not to limit your options.
    2
    @edmondt
    @burimii
    Can you capture some screenshoot of below apps or LTE log to let us know your band and operator info? Apps for your options:
    https://play.google.com/store/apps/details?id=net.simplyadvanced.ltediscovery
    https://play.google.com/store/apps/details?id=cellmapper.net.cellmapper
    https://play.google.com/store/apps/details?id=com.blueline.signalcheck

    ---------- Post added at 02:01 PM ---------- Previous post was at 01:42 PM ----------

    2db40d301907ccbc50309763fac1bdfe.jpg

    It worked guys after many restarts the other day it just started working !

    Sent from my MI NOTE Pro using Tapatalk


    ---------- Post added at 02:32 PM ---------- Previous post was at 02:21 PM ----------

    I've just checked the OnePlus 2. According to the official specs there are three versions of it: China, Europe/Asia and North America:
    • The China (A2001) version supports exactly the same LTE bands as the Note Pro.
    • The Europe/Asia (A2003) version adds 4G LTE bands 5, 8, 20 (and drops TDD-LTE band 39).
    • The North America (A2005) version adds 3G UMTS band 4 and 4G UMTS bands 2, 4, 5, 8, 12, 17 (drops LTE band 3 and TDD-LTE support).
    More on this from the official forum: OnePlus 2 Regional Versions Explained.

    Mirrored official flashable ROM images are available from this thread. The latest one at the moment is OnePlus2Oxygen_14_OTA_011_all_1512111634.zip, and inside it there's firmware-update/NON-HLOS.bin. Of interest there's also the file RADIO/static_nvbk.bin, which appears to be an NVRAM backup that is flashed to the partition /dev/block/bootdevice/by-name/oem_stanvbk: this looks like some OnePlus-specific extension but maybe it could be opened with QXDM?
    • Has anyone tried flashing this or another modem on the Note Pro?
    • The question also remains, since there is only one modem firmware but at least two hardware versions (the China version uses different images), when is the distinction made between them?
    • I've been also trying to find out if there is a known way to decompile the NON-HLOS.bin file but a casual search yields no results. Any thoughts?
    @Aqq123
    really good thought to dig into NON-HLOS.bin , in other model, I know NON-HLOS.bin can rename ti NON-HLOS.img/iso and use WinImage to view it; but inside, you will not found much crackable thing;
    I have another approch like my NEXUS5 successed story, add more RFNV into EFS to make more bands.
    STEP1 collect qcn files from other devices with simular RF frontend design
    STEP2 filter out want is lack in MI NOTE Pro nv items, need tools only on me
    STEP3 trail some filtered small qcn to adding more missed RFNV on MI NOTE Pro EFS in right network location
    in fact I have manage to make 2 set of 6 filtered files attached
    , asking help here to B2,B4,B8 coverage users with MI NOTE Pro 2015022 to test them.