[GUIDE] Add all GSM and LTE bands to your phone

Status
Not open for further replies.
Search This thread

fffft

Senior Member
Jul 16, 2013
1,973
802
.
[size=+1]Use your phone anywhere[/size]


[size=+1]Have you ever wondered why your phone doesn't work nearly as well when you travel?[/size]
Or tried to change carriers only to be told that you'd need to buy a different version of your high end phone for it to work properly?
It's happened to a lot of us and there is no good reason for it. Other than greedy carriers that is.


Most phones should work on a lot more bands. And have good reception when roaming. The S5 in particular is one of the first phones that is fully capable of working on every GSM and LTE frequency in the world. So.. why doesn't it actually do that? Well because your carrier doesn't want to make it easy for you to leave. And because Samsung and other manufacturers want to force you to buy a new phone everytime you change telephone companies. So they put restrictions in your phone to limit how many bands you can use. Wouldn't you rather have your phone work on all carriers?

This guide will show you how to do that.


Okay okay, I'm convinced already.
I don't want to read any more. I'm a power user (or reckless).. just show me how to do the hack!





[size=+1]The lawyers made us do it[/size]

We have to post an obligatory warning

We don't think that this mod will cause you any problems. But we can't guarantee that.
You assume all risks if you proceed, including the risk that your phone might object, meltdown, brick or void your warranty.





[size=+1]Quick Start Guide[/size]


This mod makes a night and day difference when you travel, roam or change carriers. It's a dramatic improvement.
But it's not an easy, one click process. There are a lot of steps to add this to your phone.

And due to minor differences between brands (finding the hidden USB settings menu), it may take a little experimenting to succeed. So this mod won't be for everyone. But if you have some patience, you can add a lot of bands to your phone. Just post in the thread and we'll figure it out as we go. This Quick Start guide will show you how to add bands to a Samsung S5. It can also be used on dozens of other Samsung, Sony, LG, HTC, Nexus, etc phones with minor differences in the steps here. I'll add comments for other brands when I have them. If you get stuck anywhere, post in the thread for guidance.



[size=+1]The Mod:[/size]

Step by step guide

1. You need a phone with a Qualcomm processor that has been rooted.
2. If you need to root your phone, click on the button below for guidance. Otherwise skip to step 3.

How to root your phone

There are a lot of XDA threads explaining how to root your phone. Towel root will work with almost all phones (and doesn't increment the Samsung Knox flag, if you care about that). You need a pre June 6, 2014 firmware build for the original Towel Root method to work. Otherwise, downgrade to an older firmware first (Use Odin software for Samsung), then root with Towel root. Or you can look for the modified Towel root that is said to work with newer firmware (unconfirmed by me). Another excellent root method is CF-Autoroot which works with most popular phones.

3. If you are running a custom ROM and kernel that were compiled from source code, well done. Skip to Step 4.
Otherwise click on the button below for more information.

Custom ROM & kernel

Qualcomm apparently reads XDA too and appears to have added some anti-tamper code to keep this hack or similiar mods from working. Drat! Until we figure out exactly what they added, you will need a custom ROM & kernel for this mod to work. This works because a kernel made from scratch won't have the anti-tamper code in it. Probably you only need the custom kernel and not the full custom ROM (unconfirmed). Configurations known to work include CM11 + Ark kernel. And Phoenix V3 ROM + kernel. But any custom ROM + kernel that is made from source, rather than modified stock will probably work fine. If anyone is still running Jelly Bean (firmware versions 4.2.2. and below), you probably don't have the anti-tamper code and won't need a custom ROM or kernel.

You can go ahead and try adding bands without a custom kernel. It probably won't work, but you can leave the custom kernel as the very last step if you want to and see if adding bands without a custom kernel succeeds. Note that installing a custom kernel on a Samsung phone will increment the Knox flag if you care about that (the Knox flag might affect a warranty claim).

If you have a Verizon or ATT phone, you should know that these two carriers do something that almost no other carrier does. These two carriers lock the bootloader which prevents installing a custom kernel in the normal manner. The Safestrap program can emulate another ROM, but we won't know if that is sufficient or not for this mod. If you are with Verizon or ATT, let us know if you were able to add bands or not.

Follow this link for details about the Phoenix ROM + kernel for the S5.
You can find CM11 downloads here for various phones. Then look for an XDA support thread for your phone.
Ark kernel

4. Download and install QPST. We will use this program to edit your phone settings. This runs best on Windows XP. But you can use Windows 7 (and probably Win 8, if you must). Right click on setup.exe (not the .msi file) and choose run as adminstrator.

5. Download and install QXDM. We will use this program to "write enable" your phone settings. QXDM won't work unless QPST is also installed, so you need both programs. Right click on setup.exe and choose run as administrator to install.
6. Open the USB settings screen on your phone. Change USB from AP to CP. And USB settings from MTP + ADB to RNDIS + DM + Modem mode (after you have finished making edits in your phone's memory, remember to revert the original settings in this screen).

This is the hardest part of this mod as the USB setting menu is usually hidden and the method to access it is slightly different on some brands. For the S5, you can open it by dialing *#0808# . Other phones may use *#7284# , *#8778# , *#*#8778#*#* , ##3424# or something else entirely. If those codes don't work on your phone, try a Google search for keywords like those below to find out how to open the USB settings menu for your phone:

Google: USB settings <brand> xda
Google: how to use QPST <brand> xda

6a. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
For Sony, the following CLI commands have been reported to work. These may or may not work for other brands.
You can enter these using a terminal emulator app or from an adb shell.

From terminal emulator:
Code:
su
setprop persist.usb.eng 1
setprop usb.rndis.enable 1
echo 1 > /sys/class/usb_composite/modem/enable


Or using adb:
Code:
adb start-server
adb shell
su
setprop persist.usb.eng 1
setprop usb.rndis.enable 1
echo 1 > /sys/class/usb_composite/modem/enable
exit


If you use either of these, remember to revert the USB settings after you finish your phone edits. e.g.
Code:
su
setprop persist.usb.eng 0
setprop usb.rndis.enable 0
echo 0 > /sys/class/usb_composite/modem/enable


6b. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an LGE phone, try the dialer codes here and change the USB mode from AP to CP (Modem mode). If that doesn't work, then it has been reported that the following commands will also enable diagnostic mode for you:
Code:
su
echo 1 > /sys/devices/platform/lg_diag_cmd/diag_enable
setprop sys.usb.config acm,diag,mtp,adb


6c. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an HTC phone, this diagnostic driver may work for your phone.

6d. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an Opo phone, it been reported that the following commands will enable diagnostic mode for your phone.

Code:
su
setprop sys.usb.config diag,adb


6e. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have a custom kernel installed (which has permissive permissions) then you can probably enable diagnostic USB mode from the EFS Professional program menu.

6f. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you cannot find out how to access the USB settings on your phone anywhere, you may be able to force diagnostic mode by installing the Windows USB drivers for your phone in advance. You can download Motorola /Sony/ LG/ HTC/ ASUS/ Huawei /Google, etc drivers here. Otherwise do a Google /XDA search to find USB drivers for your phone. Install the USB driver.

7. Enable USB debugging on your phone. This is a hidden menu. Look for Settings menu > System > About Device > Developer. If you don't see a Developer option, then tap on the firmware build number about ten times to unhide it.
8. Connect your phone to your phone to an USB port on your PC. Do not use an USB hub, connect directly to your computer. Windows will install a diagnostic driver.
9. Open the Windows (Control panel) Device Manager and confirm that you see something like "Samsung Mobile USB Serial Port" listed there. If you see a yellow triangle there > right click and update the driver.

10. Open the "QPST Configuration" program > Ports > Add new port > choose the port labeled diagnostic > OK.
If you do not see a diagnostic port listed and you were not able to explictly able to set USB diagnostic mode earlier, then right click on the driver that Windows has assigned to your phone in the Windows (Control panel) Device Manager > Update Driver Software > Browse. Choose the folder where you extracted the USB driver that you downloaded for your phone. This forces Windows to use the downloaded driver.
11. Now select the QPST Start Clients > Software download > Backup > Start. This saves a backup copy of your phone's stock NV memory to your computer in case you need it later.
12. Navigate to the C:/Program Files/Qualcomm/QPST/bin folder.
13. Right click on ServiceProg.exe > run as administrator.
14. Choose Phone > Read from phone > UMTS System. This will show which 3G bands are currently enabled. Add checkmarks to the additional 3G bands that you would like to add. Resist the temptation to check everything unless you are prepared to troubleshoot possible issues with non-existant bands, slow boot times and other issues. Just add specific bands that you need for another carrier or are missing in the areas you travel. If you aren't sure what to add, then don't check any extra bands for now - you can always come back later after you find out which 3G bands you can actually make use of.

Either way, do not click write to phone yet. And do not close the Service Programming window either.

15. Before we write anything to your phone, we need to write enable the locations we are going to edit. Navigate to the C:/Program Files/Qualcomm/QXDM/bin folder.
16. Right click on QXDM.exe > run as administrator. If you are not adding any new 3G bands at this time, skip to step 21.
17. In the NV Browser window, scroll down to ID 01877 (aka NV 1877) > Read.
Then write "0" to NV 01877 with QXDM. This initializes (write enables) the item for QPST. We need to do the same for several more NV items.
18. Select ID 00441 > Read. > Write "0" to NV 00441 with QXDM. This initializes (write enables) the item for QPST.
19. Select ID 00946 > Read. > Write "0" to NV 00946 with QXDM. This initializes (write enables) the item for QPST.

20. Select ID 02954 > Read. > Write "0" to NV 02954 with QXDM. This initializes (write enables) the item for QPST.
21. If you do not intend to add any new LTE bands, skip to step 24. Otherwise,
Select ID 06828 > Read. > Write "0" to NV 06828 with QXDM. This initializes (write enables) the item for QPST.
22. Select ID 06829 > Read. > Write "0" to NV 06829 with QXDM. This initializes (write enables) the item for QPST.
23. If you wish to add LTE bands and have already calculated a custom value from the instructions in the thread, then use QXDM to write that value to both ID 06829 and ID 06829, writing one item at a time.
Otherwise, write (decimal) "17592185995263" to both ID 06828 and ID 06829, writing one item at a time. This will enable all LTE bands.
Note that LTE edits will only work if your firmware has an LTE modem. If you already have at least one LTE band active, then you are OK. If your current firmware is from a carrier that does not use LTE at all, then you'll also need to update your modem to an LTE capable version as well.
24. Now go back to the Service Programming window that you left open. If you added any new 3G bands, click on write to phone to write the current selection of 3G bands to your phone. Otherwise do not click write, simply continue on to the next step.

25. You are now finished editing the NV values in your phone.
26. Reboot your phone.
27 In the Service Programming screen, choose Phone > Read from phone > UMTS System to confirm that your new 3G band selection are persistent. If they revert and you don't have a custom kernel installed, this confirms that you will need a custom kernel for this mod to work.
28. In the QXDM NV Browser screen, scroll down to ID 06828 > Read. Note the value.
29. In the QXDM NV Browser screen, scroll down to ID 06829 > Read. Note the value.
ID 06828 and ID 06829 should both show the custom value that you wrote. i.e. "17592185995263" (or hex "0xFFFFFFF3FFF") or the custom value, if you had used one.

30. Remember to change your USB settings back to normal mode, e.g. on the S5, dial *#0808# again and choose USB = AP and USB Settings = MTP + ADB > Click OK.
31. Celebrate! And let us know about your success (or sticking points).
32. You can test your results by checking whether your phone uses the new bands when you roam onto other systems that use them. Or if you have a SIM card for an alternate carrier. To tell if your phone is using the new bands, you can look at the current band being used in the Service menu or with various apps, e.g. LTE Discovery.

.
hand_65.png


[size=+1]So now what?[/size]

Well, if you decided to jump in and follow the Quick Start Guide.. that's it. The Quick Start Guide has everything that you need to add new bands to your phone. Unless you run into difficulties, you don't need anything else. The guide is a bit terse as I don't have a lot of spare time to rewrite or polish it. But all of the important information is there.

If something doesn't make sense or you get stuck somewhere, you can (and should) try a quick search for details. If that doesn't resolve your issue, then post in this thread for help. If you want to learn more about how this works, why more bands is a good thing. Or how to make custom edits that choose particular frequency bands, then keep reading this post and the rest of the thread.

This is a proven working method, despite a few trolls claiming otherwise. It's also new territory and there are model specific quirks.
If you run into problems, most likely you missed a step somewhere. Less likely, you may have discovered something new that needs to be unraveled.

The purpose of this thread is to discuss new findings and suggest ways to improve this method.
This is not a support thread, although if you make an effort to provide enough detail about your situation, someone will probably try to help you.





[size=+1]Is this mod hard to do?[/size]

No. There really isn't anything hard about it. But it's not a one click kind of mod either. These are recent discoveries and there are a lot of steps needed to make these changes. Samsung doesn't want to make it easy for you - they'd rather sell you another phone. In particular, there is one hidden menu (USB settings) that is hard to find because it's in a different place on almost every brand of phone. So we have to Google around for details and experiment a bit to find the hidden menu for some brands. But the mod works. If you have a little patience and don't get frustrated at temporary obstacles, then you can add bands to your phone!

One surprising finding was that people with older phones were having better results. Why? It seems that Qualcomm quietly added some anti-tamper code into recent Android versions to keep us from doing this. It's almost like they read our forum and know what we're trying to mod. But they wouldn't spy on us like that, would they?

We don't know where the anti tamper code was added yet but we found that we can avoid it on newer phones by installing a custom kernel & ROM. So until we discover where they added the anti tamper stuff, you also need a custom kernel & ROM (probably the custom kernel is the essential part) to make this mod work. Unless you happen to have an older phone that is still running Jelly bean (4.2.2) firmware. So that's it in a nutshell.



[size=+1]Okay. So give me a quick overview again[/size]

Our phones have artificial restrictions in them so that they only work properly on the original carrier. If you travel (roam) or change phone companies, your phone won't work 100% because it will have gaps in coverage. It will be missing some of the frequency bands that the other carrier uses. This isn't a technological limitation. It's just your wireless carrier siphoning more money out of your pocket by forcing you to buy a new phone when you change carriers.

This mod has a lot of steps in it, so it won't be for everyone. But if you have some patience or enjoy a challenge then it's a great way to really improve how well your phone works when you roam onto another carrier. There are three parts to this mod. You need:


1. A phone with a Qualcomm processor, that is rooted.
2. (For now) Install a custom ROM & kernel to get rid of the anti-tamper code
3. Edit six values in your phone's non volatile (NV) memory to enable a lot of additional frequency bands​



That's it. It takes about thirty steps to do those three things but nothing really good ever turns out to be easy, right?



.
 
Last edited:

fffft

Senior Member
Jul 16, 2013
1,973
802
[size=+1]Success stories[/size]
Some documented successes - various models


Congrats @BlackSoulxxx
Samsung S5 Int. version (SM-G900F) (added LTE bands) - details CM11 + Ark, custom ROM & kernel.
Added 35 LTE bands i.e. all LTE bands (not all bands confirmed as operational).

Congrats @regspy
Verizon HTC One M8 (added LTE bands 3,7) - details

Congrats @bpear96
Moto G (added AWS RF band 25) - details

Congrats @drnizeguy
Opo OnePlus One (added LTE band 20) - details here, here & here

Congrats @OP
Samsung S3/S4/S5
S3 - added AWS (RF band 25) to SGH-I747M
S4 - added AWS (RF band 25) to SGH-I337M
S5 - added LTE band 13 to SM-G900T - details custom Phoenix kernel and ROM
XXU1ANG2, NV 6828, 6829: decimal 139710 i.e. LTE bands 1/2/3/4/5/7/8/13/17
Currently testing 47 added bands. It's frankly difficult to confirm that most of the additions are operational as no local carriers
use most of the newly enabled bands. So far, 7 new LTE & 3 new 3G bands confirmed as actually in use.


Congrats @ JustLiveIt - details here
LG G3 D855 - Added LTE bands 2/4.

Congrats @ kroukes2000 - details here
LG G3 - Added LTE bands 3/7.

According to this Japanese site (Google translation), there have been successes with a variety of models
e.g. Nexus 5, Nexus 7 LG G2, Moto G, Sony Xperia Z, Z1, ZL, ZR & HTC J.

Samsung SM-G900F - added LTE band 4. Confirmed operation on new band
Samsung SM-G900P - added LTE band 4/14
Samsung SM-G906L - added LTE band 4

Congrats @ Guiper - details here
Nexus 5 (LG D820) - Added LTE band 3

Congrats @ Trak-X - details here
Samsung SM-G900V - Added LTE band 3



.
 
Last edited:

fffft

Senior Member
Jul 16, 2013
1,973
802
.
[size=+1]The Gory details[/size]

If you are following the Quick Start guide, you can probably skip this section for now. This is a detailed explanation of how to calculate values for custom configurations. And other gory details.

This is an S5 forum, but you're welcome to post here if you own a different brand of Qualcomm based phone.
This mod should work for almost any Qualcomm based phone which is a lot of Samsung, Sony, LG, Opo, Nexus, and other models.

If you own a Samsung phone, you should know that installing a custom kernel will increment something called the Knox flag. Most of us don't care about Knox, but some people do because it might affect your phone's warranty. Samsung threatens to void your warranty if the Knox flag changes. That still doesn't affect most warranties because most people make warranty claims through their carrier, rather than directly with Samsung. And most carriers don't care about Knox. It's also illegal for Samsung to void warranties this way in the E.U. Anyway, what you need to know is that if you install a custom kernel it will increment your Knox flag. And that might afffect you if your phone is still under warranty.

The actual information in your phone's non-volatile (NV) memory is formatted in byte swapped, little endian hex. Huh? Just something that programmers did to confuse the rest of us. If you're really curious, you can read about it here. We start off with a binary number because it's easy to represent what bands we want that way. Then we use a calculator to convert that number to decimal or hex, depending on which NV editor program we use. Windows has a built in calculator that you can use, just set it to scientific mode. Or there are a plethora of online calculators.

Note that some NV editors use a non-standard binary format as well.
e.g. if we want to represent an NV edit for bands 1/4/5/6/15, we can write it in binary as follows

1000000001110010

15 <------------------ 0
bands 1/4/5/6/15 (standard notation)

We write the bands we want as "1", meaning that they are enabled. We start with a placeholder for zero on the right side. Then construct or read the number, right to left. So band 1 is the second position from the right. This is the standard way of doing things and what most of your NV editors will use (newer tools may take decimal numbers instead).

Just to complicate things though, QXDM lops off the zero placeholder just to be different.

100000000111001

15 <------------------ 1
bands 1/4/5/6/15 (QXDM notation)

It's all arbritrary, so the editor still works fine. It just creates unnecessary confusion because calculations will now be different from a standard editor than the renegade. So double check your writes to see that the expected value was written. And of course the best test of all is finding that the new band works properly!



[size=+1]What bands do you want?[/size]

We need to make a list of 2G/3G bands. And a second list for LTE bands. Your list should probably include the bands that your phone already has, plus the ones that you want to add. You can find out what bands your phone already supports with a search. Be sure to use your actual S5 model, e.g. sm-g900t for TMobile, sm-g900v for Verizon, etc.
Google: sm-g900a specs site:samsung.com


S5 models (variants)

Asia sm-g900i
ATT sm-g900a
BMC sm-g900w8
Canadian S5's sm-g900w8
China sm-g9006v
China ZM sm-g9008v
China CTC sm-g9008d
Claro PR sm-g900w8
Europe sm-g900f
Japan DCM sm-g900d
Japan KDI sm-g900j
Korea KTC sm-g900k
Korea STC sm-g900s
Sprint sm-g900p
TMobile sm-g900t
US Cellular sm-g900r4
Verizon sm-g900v
Vodafone sm-g900m

Note that the sm-g900h is not supported
because it uses a different processor




[size=+1]NV editors[/size]


QPST v. 2.7.411 download . (QPST v. 2.7.323)
QXDM v. 3.12.714 download
EFS Professional v. 2.1.73

CDMA Workshop (Demo)
Caution, some antivirus programs flag this as a generic trojan. Appears to be a false alarm, they've categorized it as a "hacker tool" and lumped it in with trojans! Political Correctness /FUD to the rescue. Yes Virginia, we do want to hack our phone. No apparent evidence of actual malware, but use at your own risk

DFS Tool (Demo)
QRCT
QDART



Untested downloads. Download the following links at your own risk!
These are Google search hits that I haven't found time to check out yet. Be sure to scan these for malware and viruses.




These QXDM 3.14.x builds are not usable unless you have already have a license.

QXDM v. 3.14.514, unlicensed
QXDM v. 3.14.594, expired license



NV writes don't succeed? You may need to enable the NV parameter first (write enable it) - details

NV changes revert? - This may mean that the NV wasn't write enabled (see above).Or that you need a custom ROM and kernel to avoid the apparent anti-tamper code added to Kitkat. e.g. CM11 & Ark kernel or Phoenix v3 ROM & kernel.




[size=+1]An example[/size]

Say that you want to use an ATT phone on TMobile?
The ATT version S5 is missing the AWS band (RF band 25) that TMobile uses.
So we will want to add the AWS band to the ATT version S5 i.e. the sm-g900a.


Determine what bands you want

In this case, the bands that TMobile uses.
Google: specs sm-g900t site:samsung.com


samsung.com said:
Network
LTE bands 1/2/3/5/7/8/4/17
HSPA+/UMTS: 850/AWS/1900/2100MHz
GSM: 850/900/1800/1900MHz


Using our table of bands (post No. 3), we can cross reference that to:
LTE (4G) bands 1/2/3/5/7/8/4/17
RF (UMTS /3G) bands 26/25/23/22
RF (GSM /2G) bands 19/8/7/21

So we end up with a total of these bands:
RF Bands 7,8,19,21,22,23,25,26
LTE Bands 1,2,3,4,5,7,8,17


Now that we know which bands we need to change six settings in the phone's non volatile (NV) memory. Some NV editors may let you choose the desired bands from a menu. Try the QPST service programming menu for that. If your editor doesn't have let you do this, then you need to calculate the six raw numbers and write them to your phone.


Calculate the required NV values

We write the two band lists as binary numbers, with "1"s representing the bands that we want. And "0"s for non-selected bands. Then we use a calculator to convert the binary number to decimal or hex number that your NV editor will need (see note about hex conversion, here).

#1 NV 1877
RF Bands 7,8,19,21,22,23,25,26

Now just to confuse you.. I know from looking at the stock Tmobile sm-g900t that it also includes RF band 9. This is a subset of band 8. As band 8 incorporates band 9 it might seem redundant to list both. It's done to ensure compatibility with roaming networks that are not band 8 aware.

So we'll revise our list to include band 9
RF Bands 7,8,9,19,21,22,23,25,26


binary 110111010000000001110000000
Remove any leading zeros = 110111010000000001110000000
decimal 115868544 = hex 6E803280
hex 6E80380 = byte swapped hex 80 03 E8 06


As a check, we find that this value is the same as the stock Tmobile NV (yea!)

#2 NV 6828
LTE Bands 1,2,3,4,5,7,8,17
binary 100000000110111110
Remove any leading zeros = 100000000110111110
decimal 131518
hex 201BE = byte swapped hex BE 01 02


#3 NV 441
Copy bits 0 - 15 from NV 1877 = 0000001110000000
Remove any leading zeros = 1110000000
decimal 896
hex 380 = byte swapped hex 80 03


#4 NV 946
Copy bits 16 - 31 from NV 1877 = 11011101000
Remove any leading zeros = 11011101000
decimal 1768
hex 6E8 = byte swapped hex E8 06


#5 NV 2954
Copy bits 32 - 63 from NV 1877 = N/A
Remove any leading zeros = N/A
We don't have any bits in this range, so write 0
decimal 0
hex 0


#6 NV 6829
Copy bits 0 - 63 from NV 6828 = 100000000110111110
Remove any leading zeros = 100000000110111110
decimal 131518
hex 201BE = byte swapped hex BE 01 02




Write the edits to your phone

Now you need to write (save) the changes to your phone:
Back up your phone, including your IMEI and EFS just in case
Open your NV editor

Enable USB debugging enabled in the Settings menu.
Put your phone into diagnostic mode.
Then use the dialer code *#0808# to enter the USB settings menu.
Set USB = CP (Modem) and USB settings to RNDIS + DM + Modem (USB mode)

Use QXDM to write enable a NV parameter by reading it. Then writing "0" to it.
Then write your intended NV edit with QXDM or other NV editor. The leaked versions of QPST are too old to write enable a field directly.
You can only write one NV parameter at a time, unless you found a copy of the more capable QRCT software.
Do the same for the remaining five NV parameters.
Return your phone to normal USB mode AP (CPU) and MTP + ADB USB mode.
Reboot your phone


Confirm that it worked by viewing what band is in actual use in the Service menu or with a monitor app e.g. LTE Discovery.
Celebrate! And tell us about your success.



[size=+1]Reference[/size]

Some existing threads





[size=+2]Caution: If using the NV calculator app advertised in the next post[/size]
[size=+1]The app is producing erroneous results
[/size]


The app author was made aware of the errors earlier in this thread but refuses to address the errors. He is convinced that no errors exist. And being dogmatically certain, he won't actually take a little time to confirm that his app works with the various popular NV editors. He posted that he will rely upon people using his app to report if there are any issues. Since you are being set up as an unwitting guinea pig, you should know that the app may work fine for you or cause much frustration, depending on what NV editor you use. If you decide to use his app, ensure that you check the results and confirm that it is compatible with the particular NV editor you are using.

The app appears to work correctly with some NV editors. And clearly does not with others. This is logical as various editors require different input formats. The author hasn't provided for this, making his app incompatible with some popular NV editors. If you use this app, you need to be diligent in checking that it is producing accurate results for you. A lot of people have been asking me whether this app works as the app author is actively promoting it in this thread. And has even deleted some of his posts where he asked me how to use this method and how to make calculations (replacing his questions with ads for his new app) and quoted my instructions out of context to assure users that his app works correctly.



.
 
Last edited:

vndnguyen

Senior Member
Sep 11, 2009
4,252
1,920
Vinnitsa

Attachments

  • 1.png
    1.png
    214.9 KB · Views: 40,102
  • 2.png
    2.png
    185.5 KB · Views: 37,961
  • 3.png
    3.png
    185.9 KB · Views: 36,761
  • 4.png
    4.png
    186.2 KB · Views: 29,356
  • 5.png
    5.png
    250.7 KB · Views: 27,813
  • 6.png
    6.png
    205 KB · Views: 27,068
  • 7.png
    7.png
    208 KB · Views: 26,035
  • 8.png
    8.png
    208.9 KB · Views: 24,818
Last edited:

jinosong

Senior Member
Jan 22, 2011
1,075
544
Seoul
This thread has finally been created! Thanks for posting this. I've been looking for someone to solve this.
 

fffft

Senior Member
Jul 16, 2013
1,973
802
Thanks for the guide. Very informative and comprehensive guide :)

May I ask the question, why don't we enable all the bands, instead of only some bands?
This way we just need to put all '1' into the number, i.e 1111111111111111.....11111111111111

I think that will be simpler for the users.


There is no reason why someone couldn't try enabling every possible band.

But two possible issues come to mind. If literally everything is enabled, even non-existant bands we may get undefined or out of bounds errors. And possibly it might bog the system down if too many bands are enabled. We won't know until someone tries and finds out.


.
 
  • Like
Reactions: AlBaraa98

fffft

Senior Member
Jul 16, 2013
1,973
802
My phone alreay has activated the LTE band..You can read on the original box. ;)


You didn't say what phone you have.

Regardless, I'm not aware of any stock phone that has all LTE bands enabled. I think that you'll find it only supports a subset of LTE bands 1,2,3,4,5,6,7,8,9,10,11,12,13,14,17,18,19,10,21,22,23,24,25,26,27,28,29,30,31.32,33,34,35,36,37,38,39,40,41,42,43, & 44.

.
 
Last edited:
  • Like
Reactions: AlBaraa98

fffft

Senior Member
Jul 16, 2013
1,973
802
FYI of any early birds who are already testing.

There was a typo saying write NV 6929 with the same value as NV 6828.
That should have read NV 6829, not 6929.

.
 
Last edited:

fffft

Senior Member
Jul 16, 2013
1,973
802
This guide only applies to Qualcomm based phones.

That is a lot of phone models, including most Samsung S5's. However the SM-G900H S5 used in some parts of the Middle east and Latin America uses a different processor, Exynos instead of Qualcomm.

This will not help 900H owners.

.
 
Last edited:

ionutmaruta

Senior Member
Sep 19, 2014
598
185

Not all, of course. But who need to enable all LTE bands, because this is no implemented in all countries.
In my country is implemented 4G, but I never see the download speed more than 10 MB/s :(
Only H+ and 3G :)
OK, your turorial is fine, but like I said, there are no many peoples which want to enable all LTE bands. Our infrastructure is down !
 
Last edited:

fffft

Senior Member
Jul 16, 2013
1,973
802
I think that is a narrow view. There are a lot of people that would benefit from a greatly expanded set of bands. Some people travel extensively and have mediocre roaming experiences due to many inaccessible bands.

Another situation would be changing carriers. Having a richer palette of service bands could obviate the need to buy a new phone to get full coverage under a new carrier's spectrum allocation.

.
 

BlackSoulxxx

Senior Member
Feb 19, 2014
1,395
2,314
Loading...
Sorry but I already tried in S5 and it keep reset nv 1877 because in the kernel and ROM has "safety" procedure (actually it's vary from Kernel to kernel and rom to rom...) so I have to decompile everythings and disable it. Hope it can help....
 
  • Like
Reactions: oksagi and fffft

fffft

Senior Member
Jul 16, 2013
1,973
802
Sorry but I already tried in S5 and it keep reset nv 1877 because in the kernel and ROM has "safety" procedure (actually it's vary from Kernel to kernel and rom to rom...) so I have to decompile everythings and disable it. Hope it can help....


Interesting. Which S5 variant did you try?

It works with the S5 (Phoenix custom) ROM /kernel, which was compiled from source.
It'll be interesting to hear if it works with other S5 (stock) variants or not.

.
 

botwa2000

Senior Member
Sep 6, 2014
794
238
This guide only applies to Qualcomm based phones.

That is a lot of phone models, including most Samsung S5's. However the SM-G900H S5 used in some parts of the Middle east and Latin America uses a different processor, Exynos instead of Qualcomm.

This will not help 900H owners.

.

Hi fffft,

Fantastic, I absolutely am going to test it.

Well the guide suit the Korean version of SGS5 namely SM-G906K running on QC805 you think?
 

fffft

Senior Member
Jul 16, 2013
1,973
802
Fantastic, I absolutely am going to test it.

Well the guide suit the Korean version of SGS5 namely SM-G906K running on QC805 you think?


I don't have a G906K to test. And Qualcomm doesn't believe in sharing their technical documentation.
So we won't know until someone tries it.

You have a derivative of the original S5, usually referred to as the S5 LTE-A aka the infamous S5 Prime. It's Qualcomm based and running Kitkat so it will probably work on your phone as it does on a dozen other brands of Qualcomm based phones.

However, we may need to develop ROM or kernel mods before you'll succeed with your phone as post No. 14 above suggests that Samsung may be trying to thwart us on recent models.

.
 
Last edited:

-PiLoT-

Retired Senior Moderator
Jan 17, 2008
3,351
1,332
38
Jefferson, SD
I don't have a G906K to test. And Qualcomm doesn't believe in sharing their technical documentation.
So we won't know until someone tries it.

You have a derivative of the original S5, usually referred to as the S5 LTE-A aka the infamous S5 Prime. It's Qualcomm based and running Kitkat so it will probably work on your phone as it does on a dozen other brands of Qualcomm based phones.

However, we may need to develop ROM or kernel mods before you'll succeed with your phone as post No. 14 above suggests that Samsung may be trying to thwart us on recent models.

.

If im reading this right would this allow me to add verizon 4g bands to my g900f so i can get phone working fine once im there
 

botwa2000

Senior Member
Sep 6, 2014
794
238
I don't have a G906K to test. And Qualcomm doesn't believe in sharing their technical documentation.
So we won't know until someone tries it.

You have a derivative of the original S5, usually referred to as the S5 LTE-A aka the infamous S5 Prime. It's Qualcomm based and running Kitkat so it will probably work on your phone as it does on a dozen other brands of Qualcomm based phones.

However, we may need to develop ROM or kernel mods before you'll succeed with your phone as post No. 14 above suggests that Samsung may be trying to thwart us on recent models.

.

Thanks. I'm fairly new in the field, do you mind posting a guide on how to backup/restore the current settings should the procedure go wrong.

Or point me to a direction where such a guide is already available.:thumbup:
 
Status
Not open for further replies.

Top Liked Posts

  • There are no posts matching your filters.
  • 124
    .
    [size=+1]Use your phone anywhere[/size]


    [size=+1]Have you ever wondered why your phone doesn't work nearly as well when you travel?[/size]
    Or tried to change carriers only to be told that you'd need to buy a different version of your high end phone for it to work properly?
    It's happened to a lot of us and there is no good reason for it. Other than greedy carriers that is.


    Most phones should work on a lot more bands. And have good reception when roaming. The S5 in particular is one of the first phones that is fully capable of working on every GSM and LTE frequency in the world. So.. why doesn't it actually do that? Well because your carrier doesn't want to make it easy for you to leave. And because Samsung and other manufacturers want to force you to buy a new phone everytime you change telephone companies. So they put restrictions in your phone to limit how many bands you can use. Wouldn't you rather have your phone work on all carriers?

    This guide will show you how to do that.


    Okay okay, I'm convinced already.
    I don't want to read any more. I'm a power user (or reckless).. just show me how to do the hack!





    [size=+1]The lawyers made us do it[/size]

    We have to post an obligatory warning

    We don't think that this mod will cause you any problems. But we can't guarantee that.
    You assume all risks if you proceed, including the risk that your phone might object, meltdown, brick or void your warranty.





    [size=+1]Quick Start Guide[/size]


    This mod makes a night and day difference when you travel, roam or change carriers. It's a dramatic improvement.
    But it's not an easy, one click process. There are a lot of steps to add this to your phone.

    And due to minor differences between brands (finding the hidden USB settings menu), it may take a little experimenting to succeed. So this mod won't be for everyone. But if you have some patience, you can add a lot of bands to your phone. Just post in the thread and we'll figure it out as we go. This Quick Start guide will show you how to add bands to a Samsung S5. It can also be used on dozens of other Samsung, Sony, LG, HTC, Nexus, etc phones with minor differences in the steps here. I'll add comments for other brands when I have them. If you get stuck anywhere, post in the thread for guidance.



    [size=+1]The Mod:[/size]

    Step by step guide

    1. You need a phone with a Qualcomm processor that has been rooted.
    2. If you need to root your phone, click on the button below for guidance. Otherwise skip to step 3.

    How to root your phone

    There are a lot of XDA threads explaining how to root your phone. Towel root will work with almost all phones (and doesn't increment the Samsung Knox flag, if you care about that). You need a pre June 6, 2014 firmware build for the original Towel Root method to work. Otherwise, downgrade to an older firmware first (Use Odin software for Samsung), then root with Towel root. Or you can look for the modified Towel root that is said to work with newer firmware (unconfirmed by me). Another excellent root method is CF-Autoroot which works with most popular phones.

    3. If you are running a custom ROM and kernel that were compiled from source code, well done. Skip to Step 4.
    Otherwise click on the button below for more information.

    Custom ROM & kernel

    Qualcomm apparently reads XDA too and appears to have added some anti-tamper code to keep this hack or similiar mods from working. Drat! Until we figure out exactly what they added, you will need a custom ROM & kernel for this mod to work. This works because a kernel made from scratch won't have the anti-tamper code in it. Probably you only need the custom kernel and not the full custom ROM (unconfirmed). Configurations known to work include CM11 + Ark kernel. And Phoenix V3 ROM + kernel. But any custom ROM + kernel that is made from source, rather than modified stock will probably work fine. If anyone is still running Jelly Bean (firmware versions 4.2.2. and below), you probably don't have the anti-tamper code and won't need a custom ROM or kernel.

    You can go ahead and try adding bands without a custom kernel. It probably won't work, but you can leave the custom kernel as the very last step if you want to and see if adding bands without a custom kernel succeeds. Note that installing a custom kernel on a Samsung phone will increment the Knox flag if you care about that (the Knox flag might affect a warranty claim).

    If you have a Verizon or ATT phone, you should know that these two carriers do something that almost no other carrier does. These two carriers lock the bootloader which prevents installing a custom kernel in the normal manner. The Safestrap program can emulate another ROM, but we won't know if that is sufficient or not for this mod. If you are with Verizon or ATT, let us know if you were able to add bands or not.

    Follow this link for details about the Phoenix ROM + kernel for the S5.
    You can find CM11 downloads here for various phones. Then look for an XDA support thread for your phone.
    Ark kernel

    4. Download and install QPST. We will use this program to edit your phone settings. This runs best on Windows XP. But you can use Windows 7 (and probably Win 8, if you must). Right click on setup.exe (not the .msi file) and choose run as adminstrator.

    5. Download and install QXDM. We will use this program to "write enable" your phone settings. QXDM won't work unless QPST is also installed, so you need both programs. Right click on setup.exe and choose run as administrator to install.
    6. Open the USB settings screen on your phone. Change USB from AP to CP. And USB settings from MTP + ADB to RNDIS + DM + Modem mode (after you have finished making edits in your phone's memory, remember to revert the original settings in this screen).

    This is the hardest part of this mod as the USB setting menu is usually hidden and the method to access it is slightly different on some brands. For the S5, you can open it by dialing *#0808# . Other phones may use *#7284# , *#8778# , *#*#8778#*#* , ##3424# or something else entirely. If those codes don't work on your phone, try a Google search for keywords like those below to find out how to open the USB settings menu for your phone:

    Google: USB settings <brand> xda
    Google: how to use QPST <brand> xda

    6a. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
    For Sony, the following CLI commands have been reported to work. These may or may not work for other brands.
    You can enter these using a terminal emulator app or from an adb shell.

    From terminal emulator:
    Code:
    su
    setprop persist.usb.eng 1
    setprop usb.rndis.enable 1
    echo 1 > /sys/class/usb_composite/modem/enable


    Or using adb:
    Code:
    adb start-server
    adb shell
    su
    setprop persist.usb.eng 1
    setprop usb.rndis.enable 1
    echo 1 > /sys/class/usb_composite/modem/enable
    exit


    If you use either of these, remember to revert the USB settings after you finish your phone edits. e.g.
    Code:
    su
    setprop persist.usb.eng 0
    setprop usb.rndis.enable 0
    echo 0 > /sys/class/usb_composite/modem/enable


    6b. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
    If you have an LGE phone, try the dialer codes here and change the USB mode from AP to CP (Modem mode). If that doesn't work, then it has been reported that the following commands will also enable diagnostic mode for you:
    Code:
    su
    echo 1 > /sys/devices/platform/lg_diag_cmd/diag_enable
    setprop sys.usb.config acm,diag,mtp,adb


    6c. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
    If you have an HTC phone, this diagnostic driver may work for your phone.

    6d. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
    If you have an Opo phone, it been reported that the following commands will enable diagnostic mode for your phone.

    Code:
    su
    setprop sys.usb.config diag,adb


    6e. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
    If you have a custom kernel installed (which has permissive permissions) then you can probably enable diagnostic USB mode from the EFS Professional program menu.

    6f. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
    If you cannot find out how to access the USB settings on your phone anywhere, you may be able to force diagnostic mode by installing the Windows USB drivers for your phone in advance. You can download Motorola /Sony/ LG/ HTC/ ASUS/ Huawei /Google, etc drivers here. Otherwise do a Google /XDA search to find USB drivers for your phone. Install the USB driver.

    7. Enable USB debugging on your phone. This is a hidden menu. Look for Settings menu > System > About Device > Developer. If you don't see a Developer option, then tap on the firmware build number about ten times to unhide it.
    8. Connect your phone to your phone to an USB port on your PC. Do not use an USB hub, connect directly to your computer. Windows will install a diagnostic driver.
    9. Open the Windows (Control panel) Device Manager and confirm that you see something like "Samsung Mobile USB Serial Port" listed there. If you see a yellow triangle there > right click and update the driver.

    10. Open the "QPST Configuration" program > Ports > Add new port > choose the port labeled diagnostic > OK.
    If you do not see a diagnostic port listed and you were not able to explictly able to set USB diagnostic mode earlier, then right click on the driver that Windows has assigned to your phone in the Windows (Control panel) Device Manager > Update Driver Software > Browse. Choose the folder where you extracted the USB driver that you downloaded for your phone. This forces Windows to use the downloaded driver.
    11. Now select the QPST Start Clients > Software download > Backup > Start. This saves a backup copy of your phone's stock NV memory to your computer in case you need it later.
    12. Navigate to the C:/Program Files/Qualcomm/QPST/bin folder.
    13. Right click on ServiceProg.exe > run as administrator.
    14. Choose Phone > Read from phone > UMTS System. This will show which 3G bands are currently enabled. Add checkmarks to the additional 3G bands that you would like to add. Resist the temptation to check everything unless you are prepared to troubleshoot possible issues with non-existant bands, slow boot times and other issues. Just add specific bands that you need for another carrier or are missing in the areas you travel. If you aren't sure what to add, then don't check any extra bands for now - you can always come back later after you find out which 3G bands you can actually make use of.

    Either way, do not click write to phone yet. And do not close the Service Programming window either.

    15. Before we write anything to your phone, we need to write enable the locations we are going to edit. Navigate to the C:/Program Files/Qualcomm/QXDM/bin folder.
    16. Right click on QXDM.exe > run as administrator. If you are not adding any new 3G bands at this time, skip to step 21.
    17. In the NV Browser window, scroll down to ID 01877 (aka NV 1877) > Read.
    Then write "0" to NV 01877 with QXDM. This initializes (write enables) the item for QPST. We need to do the same for several more NV items.
    18. Select ID 00441 > Read. > Write "0" to NV 00441 with QXDM. This initializes (write enables) the item for QPST.
    19. Select ID 00946 > Read. > Write "0" to NV 00946 with QXDM. This initializes (write enables) the item for QPST.

    20. Select ID 02954 > Read. > Write "0" to NV 02954 with QXDM. This initializes (write enables) the item for QPST.
    21. If you do not intend to add any new LTE bands, skip to step 24. Otherwise,
    Select ID 06828 > Read. > Write "0" to NV 06828 with QXDM. This initializes (write enables) the item for QPST.
    22. Select ID 06829 > Read. > Write "0" to NV 06829 with QXDM. This initializes (write enables) the item for QPST.
    23. If you wish to add LTE bands and have already calculated a custom value from the instructions in the thread, then use QXDM to write that value to both ID 06829 and ID 06829, writing one item at a time.
    Otherwise, write (decimal) "17592185995263" to both ID 06828 and ID 06829, writing one item at a time. This will enable all LTE bands.
    Note that LTE edits will only work if your firmware has an LTE modem. If you already have at least one LTE band active, then you are OK. If your current firmware is from a carrier that does not use LTE at all, then you'll also need to update your modem to an LTE capable version as well.
    24. Now go back to the Service Programming window that you left open. If you added any new 3G bands, click on write to phone to write the current selection of 3G bands to your phone. Otherwise do not click write, simply continue on to the next step.

    25. You are now finished editing the NV values in your phone.
    26. Reboot your phone.
    27 In the Service Programming screen, choose Phone > Read from phone > UMTS System to confirm that your new 3G band selection are persistent. If they revert and you don't have a custom kernel installed, this confirms that you will need a custom kernel for this mod to work.
    28. In the QXDM NV Browser screen, scroll down to ID 06828 > Read. Note the value.
    29. In the QXDM NV Browser screen, scroll down to ID 06829 > Read. Note the value.
    ID 06828 and ID 06829 should both show the custom value that you wrote. i.e. "17592185995263" (or hex "0xFFFFFFF3FFF") or the custom value, if you had used one.

    30. Remember to change your USB settings back to normal mode, e.g. on the S5, dial *#0808# again and choose USB = AP and USB Settings = MTP + ADB > Click OK.
    31. Celebrate! And let us know about your success (or sticking points).
    32. You can test your results by checking whether your phone uses the new bands when you roam onto other systems that use them. Or if you have a SIM card for an alternate carrier. To tell if your phone is using the new bands, you can look at the current band being used in the Service menu or with various apps, e.g. LTE Discovery.

    .
    hand_65.png


    [size=+1]So now what?[/size]

    Well, if you decided to jump in and follow the Quick Start Guide.. that's it. The Quick Start Guide has everything that you need to add new bands to your phone. Unless you run into difficulties, you don't need anything else. The guide is a bit terse as I don't have a lot of spare time to rewrite or polish it. But all of the important information is there.

    If something doesn't make sense or you get stuck somewhere, you can (and should) try a quick search for details. If that doesn't resolve your issue, then post in this thread for help. If you want to learn more about how this works, why more bands is a good thing. Or how to make custom edits that choose particular frequency bands, then keep reading this post and the rest of the thread.

    This is a proven working method, despite a few trolls claiming otherwise. It's also new territory and there are model specific quirks.
    If you run into problems, most likely you missed a step somewhere. Less likely, you may have discovered something new that needs to be unraveled.

    The purpose of this thread is to discuss new findings and suggest ways to improve this method.
    This is not a support thread, although if you make an effort to provide enough detail about your situation, someone will probably try to help you.





    [size=+1]Is this mod hard to do?[/size]

    No. There really isn't anything hard about it. But it's not a one click kind of mod either. These are recent discoveries and there are a lot of steps needed to make these changes. Samsung doesn't want to make it easy for you - they'd rather sell you another phone. In particular, there is one hidden menu (USB settings) that is hard to find because it's in a different place on almost every brand of phone. So we have to Google around for details and experiment a bit to find the hidden menu for some brands. But the mod works. If you have a little patience and don't get frustrated at temporary obstacles, then you can add bands to your phone!

    One surprising finding was that people with older phones were having better results. Why? It seems that Qualcomm quietly added some anti-tamper code into recent Android versions to keep us from doing this. It's almost like they read our forum and know what we're trying to mod. But they wouldn't spy on us like that, would they?

    We don't know where the anti tamper code was added yet but we found that we can avoid it on newer phones by installing a custom kernel & ROM. So until we discover where they added the anti tamper stuff, you also need a custom kernel & ROM (probably the custom kernel is the essential part) to make this mod work. Unless you happen to have an older phone that is still running Jelly bean (4.2.2) firmware. So that's it in a nutshell.



    [size=+1]Okay. So give me a quick overview again[/size]

    Our phones have artificial restrictions in them so that they only work properly on the original carrier. If you travel (roam) or change phone companies, your phone won't work 100% because it will have gaps in coverage. It will be missing some of the frequency bands that the other carrier uses. This isn't a technological limitation. It's just your wireless carrier siphoning more money out of your pocket by forcing you to buy a new phone when you change carriers.

    This mod has a lot of steps in it, so it won't be for everyone. But if you have some patience or enjoy a challenge then it's a great way to really improve how well your phone works when you roam onto another carrier. There are three parts to this mod. You need:


    1. A phone with a Qualcomm processor, that is rooted.
    2. (For now) Install a custom ROM & kernel to get rid of the anti-tamper code
    3. Edit six values in your phone's non volatile (NV) memory to enable a lot of additional frequency bands​



    That's it. It takes about thirty steps to do those three things but nothing really good ever turns out to be easy, right?



    .
    38
    .
    [size=+1]The Gory details[/size]

    If you are following the Quick Start guide, you can probably skip this section for now. This is a detailed explanation of how to calculate values for custom configurations. And other gory details.

    This is an S5 forum, but you're welcome to post here if you own a different brand of Qualcomm based phone.
    This mod should work for almost any Qualcomm based phone which is a lot of Samsung, Sony, LG, Opo, Nexus, and other models.

    If you own a Samsung phone, you should know that installing a custom kernel will increment something called the Knox flag. Most of us don't care about Knox, but some people do because it might affect your phone's warranty. Samsung threatens to void your warranty if the Knox flag changes. That still doesn't affect most warranties because most people make warranty claims through their carrier, rather than directly with Samsung. And most carriers don't care about Knox. It's also illegal for Samsung to void warranties this way in the E.U. Anyway, what you need to know is that if you install a custom kernel it will increment your Knox flag. And that might afffect you if your phone is still under warranty.

    The actual information in your phone's non-volatile (NV) memory is formatted in byte swapped, little endian hex. Huh? Just something that programmers did to confuse the rest of us. If you're really curious, you can read about it here. We start off with a binary number because it's easy to represent what bands we want that way. Then we use a calculator to convert that number to decimal or hex, depending on which NV editor program we use. Windows has a built in calculator that you can use, just set it to scientific mode. Or there are a plethora of online calculators.

    Note that some NV editors use a non-standard binary format as well.
    e.g. if we want to represent an NV edit for bands 1/4/5/6/15, we can write it in binary as follows

    1000000001110010

    15 <------------------ 0
    bands 1/4/5/6/15 (standard notation)

    We write the bands we want as "1", meaning that they are enabled. We start with a placeholder for zero on the right side. Then construct or read the number, right to left. So band 1 is the second position from the right. This is the standard way of doing things and what most of your NV editors will use (newer tools may take decimal numbers instead).

    Just to complicate things though, QXDM lops off the zero placeholder just to be different.

    100000000111001

    15 <------------------ 1
    bands 1/4/5/6/15 (QXDM notation)

    It's all arbritrary, so the editor still works fine. It just creates unnecessary confusion because calculations will now be different from a standard editor than the renegade. So double check your writes to see that the expected value was written. And of course the best test of all is finding that the new band works properly!



    [size=+1]What bands do you want?[/size]

    We need to make a list of 2G/3G bands. And a second list for LTE bands. Your list should probably include the bands that your phone already has, plus the ones that you want to add. You can find out what bands your phone already supports with a search. Be sure to use your actual S5 model, e.g. sm-g900t for TMobile, sm-g900v for Verizon, etc.
    Google: sm-g900a specs site:samsung.com


    S5 models (variants)

    Asia sm-g900i
    ATT sm-g900a
    BMC sm-g900w8
    Canadian S5's sm-g900w8
    China sm-g9006v
    China ZM sm-g9008v
    China CTC sm-g9008d
    Claro PR sm-g900w8
    Europe sm-g900f
    Japan DCM sm-g900d
    Japan KDI sm-g900j
    Korea KTC sm-g900k
    Korea STC sm-g900s
    Sprint sm-g900p
    TMobile sm-g900t
    US Cellular sm-g900r4
    Verizon sm-g900v
    Vodafone sm-g900m

    Note that the sm-g900h is not supported
    because it uses a different processor




    [size=+1]NV editors[/size]


    QPST v. 2.7.411 download . (QPST v. 2.7.323)
    QXDM v. 3.12.714 download
    EFS Professional v. 2.1.73

    CDMA Workshop (Demo)
    Caution, some antivirus programs flag this as a generic trojan. Appears to be a false alarm, they've categorized it as a "hacker tool" and lumped it in with trojans! Political Correctness /FUD to the rescue. Yes Virginia, we do want to hack our phone. No apparent evidence of actual malware, but use at your own risk

    DFS Tool (Demo)
    QRCT
    QDART



    Untested downloads. Download the following links at your own risk!
    These are Google search hits that I haven't found time to check out yet. Be sure to scan these for malware and viruses.




    These QXDM 3.14.x builds are not usable unless you have already have a license.

    QXDM v. 3.14.514, unlicensed
    QXDM v. 3.14.594, expired license



    NV writes don't succeed? You may need to enable the NV parameter first (write enable it) - details

    NV changes revert? - This may mean that the NV wasn't write enabled (see above).Or that you need a custom ROM and kernel to avoid the apparent anti-tamper code added to Kitkat. e.g. CM11 & Ark kernel or Phoenix v3 ROM & kernel.




    [size=+1]An example[/size]

    Say that you want to use an ATT phone on TMobile?
    The ATT version S5 is missing the AWS band (RF band 25) that TMobile uses.
    So we will want to add the AWS band to the ATT version S5 i.e. the sm-g900a.


    Determine what bands you want

    In this case, the bands that TMobile uses.
    Google: specs sm-g900t site:samsung.com


    samsung.com said:
    Network
    LTE bands 1/2/3/5/7/8/4/17
    HSPA+/UMTS: 850/AWS/1900/2100MHz
    GSM: 850/900/1800/1900MHz


    Using our table of bands (post No. 3), we can cross reference that to:
    LTE (4G) bands 1/2/3/5/7/8/4/17
    RF (UMTS /3G) bands 26/25/23/22
    RF (GSM /2G) bands 19/8/7/21

    So we end up with a total of these bands:
    RF Bands 7,8,19,21,22,23,25,26
    LTE Bands 1,2,3,4,5,7,8,17


    Now that we know which bands we need to change six settings in the phone's non volatile (NV) memory. Some NV editors may let you choose the desired bands from a menu. Try the QPST service programming menu for that. If your editor doesn't have let you do this, then you need to calculate the six raw numbers and write them to your phone.


    Calculate the required NV values

    We write the two band lists as binary numbers, with "1"s representing the bands that we want. And "0"s for non-selected bands. Then we use a calculator to convert the binary number to decimal or hex number that your NV editor will need (see note about hex conversion, here).

    #1 NV 1877
    RF Bands 7,8,19,21,22,23,25,26

    Now just to confuse you.. I know from looking at the stock Tmobile sm-g900t that it also includes RF band 9. This is a subset of band 8. As band 8 incorporates band 9 it might seem redundant to list both. It's done to ensure compatibility with roaming networks that are not band 8 aware.

    So we'll revise our list to include band 9
    RF Bands 7,8,9,19,21,22,23,25,26


    binary 110111010000000001110000000
    Remove any leading zeros = 110111010000000001110000000
    decimal 115868544 = hex 6E803280
    hex 6E80380 = byte swapped hex 80 03 E8 06


    As a check, we find that this value is the same as the stock Tmobile NV (yea!)

    #2 NV 6828
    LTE Bands 1,2,3,4,5,7,8,17
    binary 100000000110111110
    Remove any leading zeros = 100000000110111110
    decimal 131518
    hex 201BE = byte swapped hex BE 01 02


    #3 NV 441
    Copy bits 0 - 15 from NV 1877 = 0000001110000000
    Remove any leading zeros = 1110000000
    decimal 896
    hex 380 = byte swapped hex 80 03


    #4 NV 946
    Copy bits 16 - 31 from NV 1877 = 11011101000
    Remove any leading zeros = 11011101000
    decimal 1768
    hex 6E8 = byte swapped hex E8 06


    #5 NV 2954
    Copy bits 32 - 63 from NV 1877 = N/A
    Remove any leading zeros = N/A
    We don't have any bits in this range, so write 0
    decimal 0
    hex 0


    #6 NV 6829
    Copy bits 0 - 63 from NV 6828 = 100000000110111110
    Remove any leading zeros = 100000000110111110
    decimal 131518
    hex 201BE = byte swapped hex BE 01 02




    Write the edits to your phone

    Now you need to write (save) the changes to your phone:
    Back up your phone, including your IMEI and EFS just in case
    Open your NV editor

    Enable USB debugging enabled in the Settings menu.
    Put your phone into diagnostic mode.
    Then use the dialer code *#0808# to enter the USB settings menu.
    Set USB = CP (Modem) and USB settings to RNDIS + DM + Modem (USB mode)

    Use QXDM to write enable a NV parameter by reading it. Then writing "0" to it.
    Then write your intended NV edit with QXDM or other NV editor. The leaked versions of QPST are too old to write enable a field directly.
    You can only write one NV parameter at a time, unless you found a copy of the more capable QRCT software.
    Do the same for the remaining five NV parameters.
    Return your phone to normal USB mode AP (CPU) and MTP + ADB USB mode.
    Reboot your phone


    Confirm that it worked by viewing what band is in actual use in the Service menu or with a monitor app e.g. LTE Discovery.
    Celebrate! And tell us about your success.



    [size=+1]Reference[/size]

    Some existing threads





    [size=+2]Caution: If using the NV calculator app advertised in the next post[/size]
    [size=+1]The app is producing erroneous results
    [/size]


    The app author was made aware of the errors earlier in this thread but refuses to address the errors. He is convinced that no errors exist. And being dogmatically certain, he won't actually take a little time to confirm that his app works with the various popular NV editors. He posted that he will rely upon people using his app to report if there are any issues. Since you are being set up as an unwitting guinea pig, you should know that the app may work fine for you or cause much frustration, depending on what NV editor you use. If you decide to use his app, ensure that you check the results and confirm that it is compatible with the particular NV editor you are using.

    The app appears to work correctly with some NV editors. And clearly does not with others. This is logical as various editors require different input formats. The author hasn't provided for this, making his app incompatible with some popular NV editors. If you use this app, you need to be diligent in checking that it is producing accurate results for you. A lot of people have been asking me whether this app works as the app author is actively promoting it in this thread. And has even deleted some of his posts where he asked me how to use this method and how to make calculations (replacing his questions with ads for his new app) and quoted my instructions out of context to assure users that his app works correctly.



    .
    37
    [size=+1]Success stories[/size]
    Some documented successes - various models


    Congrats @BlackSoulxxx
    Samsung S5 Int. version (SM-G900F) (added LTE bands) - details CM11 + Ark, custom ROM & kernel.
    Added 35 LTE bands i.e. all LTE bands (not all bands confirmed as operational).

    Congrats @regspy
    Verizon HTC One M8 (added LTE bands 3,7) - details

    Congrats @bpear96
    Moto G (added AWS RF band 25) - details

    Congrats @drnizeguy
    Opo OnePlus One (added LTE band 20) - details here, here & here

    Congrats @OP
    Samsung S3/S4/S5
    S3 - added AWS (RF band 25) to SGH-I747M
    S4 - added AWS (RF band 25) to SGH-I337M
    S5 - added LTE band 13 to SM-G900T - details custom Phoenix kernel and ROM
    XXU1ANG2, NV 6828, 6829: decimal 139710 i.e. LTE bands 1/2/3/4/5/7/8/13/17
    Currently testing 47 added bands. It's frankly difficult to confirm that most of the additions are operational as no local carriers
    use most of the newly enabled bands. So far, 7 new LTE & 3 new 3G bands confirmed as actually in use.


    Congrats @ JustLiveIt - details here
    LG G3 D855 - Added LTE bands 2/4.

    Congrats @ kroukes2000 - details here
    LG G3 - Added LTE bands 3/7.

    According to this Japanese site (Google translation), there have been successes with a variety of models
    e.g. Nexus 5, Nexus 7 LG G2, Moto G, Sony Xperia Z, Z1, ZL, ZR & HTC J.

    Samsung SM-G900F - added LTE band 4. Confirmed operation on new band
    Samsung SM-G900P - added LTE band 4/14
    Samsung SM-G906L - added LTE band 4

    Congrats @ Guiper - details here
    Nexus 5 (LG D820) - Added LTE band 3

    Congrats @ Trak-X - details here
    Samsung SM-G900V - Added LTE band 3



    .
    23
    I have made this app for your convenience in calculation of NV items: Qualcomm NV Calculator

    This app can show the calculation result in 3 formatS: Decimal, Hexadecimal and Byte-swapped Hex.

    DOWNLOAD: https://play.google.com/store/apps/details?id=org.vndnguyen.nvcalc

    Some screenshots:
    16
    Mod Edit

    XDA should be a place for research,development , and joint ventures and collaborations to make phones better

    It seems that there are too many egos here, unwilling to make progress amicably.

    Warnings have gone unheeded , and we have once more reduced a thread to petty bickering.

    Thread closed

    malybru
    Forum Moderator