FORUMS
Remove All Ads from XDA
Honor 7x
Win an Honor 7X!

[REF][ServiceMode] How to make your Samsung perform dog tricks

1,451 posts
Thanks Meter: 2,174
 
By E:V:A, Recognized Developer on 28th April 2014, 02:01 PM
Post Reply Email Thread
Every time Samsung releases a new series of phones, they try to make
it just a little harder for us to find and enter the Service Mode (SM)
menus. Understandably the Service Mode menus allow you to access
functions on your phone directly related to its operation, from
selecting particular service providers, unlocking your SIM card,
changing default networks, bands and destroying your internal
non-volatile (NV) memory, that contain all your IMEI, RF, EFS
parameters, and to make a complete factory wipe and reset.

So this is not to play around with, randomly!
You have been warned.

On the other hand, it also provides extremely useful detailed
information about your mobile network, including all radio related
systems like GPS, WiFi, BlueTooth and NFC. Most of this information
is not available through the usual AOS Java API, and probably will
never be, as vendors consider this area as off-limits to users and
amateur developers.


Note:
All this info was obtained on a European
Samsung Galaxy S4-mini (GT-I9195 LTE)
But reported to work also on:
Samsung Galaxy S5 on US Cellular (SM-G900R4)


Code:
Baseband:       I9195XXUBML4            
Kernel:         3.4.0-2340422           
                se.infra@SEP-65 #1      
Build:          JDQ39.I9195XXUBML4      
SE:             SEPF_GT-I9195_4.2.2_0022
Getting into Service Mode (SM)

On this particular model, you have to do this:

Go to dial pad and enter: *#0011#

This will initially take you to Service Mode and showing you
various signal status items, by default. But it's a locked
entry. So to unlock and go to the Main Menu do this:
==> [MENU] + [Back]
==> [MENU] + [Key Input] + "Q0"
==> <wait ~5-10 seconds>
Now you can hit the thank you button below!
I have not seen this solution anywhere else, and
it required some reversing...


Understading the ServiceMode Menu

<WIP>

This will take some time to investigate, so anyone
who already knows, please post in this thread.


The ServiceMode Menu Structure (brief)

Go to Post#2 for formatted menu structure and items.

Code:
MAIN MENU
[1] UMTS        
[2] CDMA        
[3] LTE                
[4] SIM- Not Used.        --> <E>
[5] DOCOMO DEBUG SCREEN        
[6] run EFS SYNC()        
[7] DEBUG SCREEN        
Some Important Codes

9900 SysDump

This is an important hidden code is that for making a wide range
of system dumps and changing many unknown logging functions.

This will give you a list of the following functions:
Code:
Menu Item                       Setting         Description
---------------------------------------------------------------------
Run dumpstate/logcat/modem log  -               logcat -v threadtime -b radio -d -f /data/log/radio_*.log
Delete dumpstate/logcat                         
Run dumpstate/logcat                                            
Copy Kernel Log to SD card                      
Run CP based log                                
Run Forced CP crash dump                        
Copy to sdcard (include CP Ramdump)             
Debug Level Disabled/LOW        -               Change debug level [LOW/MID/HIGH]

CP Debugging Popup UI:          Disabled        
Silent Log:                     Off             dev.silentlog.on=(On,Off)
Translation Assistant:          Off             persist.translation.assistant=(0,1)
Low battery dump:               Off             
Wakelock Monitoring:            OFF             
TCP DUMP START                                  ro.product_ship=(true,false)            lucky_ril*.log
Enable SecLog (currently disabled)              persist.log.seclevel=(0,1)
MTT Logging Setting:            OFF             persist.brcm.log=(sdcard,none)          [Broadcom]
ACT data copy                                   
Exit                                            
9090 DIAG CONFIG

This is also important for changing the internal MUX used for
diagnostic debug output, to/from USB and UART.

Code:
DIAG CONFIG
[1] USB  ( )
[2] UART (*)
[3] DBG MSG ON  (*)
[4] DBG MSG OFF ( )
Basically if you wanna use UART output, you will probably need
to build the MyWay box or use the correct resistance between
the USB ID and GND pins. (See my AnyWay thread.)

0808 USB Settings

This is by far the most important code to know, because it is used to determine,
what drivers are enumerated when connecting your phone to PC via USB cable.
Technically it is a multiplexer (MUX) switch which determine whether the USB
port is directly connected to the CP (Cellular/baseband Processor/modem),
or the AP (Application Processor). This also selects what device features will be
enabled once connected. Such as ADB, RNDIS, and DM (Diagnostic Mode) etc.

To change the mux settings on a Samsung S4/mini, use your dialpad
to get to the "USBSettings" menu, like this:

For AOS <= 4.2.2, without SELinux, use *#7284# or *#3424#.
For AOS >= 4.2.2, with SELinux, use *#0808#.

Code:
USB 
( ) CP
( ) AP

USB Settings
( ) MTP
( ) MTP + ADB
( ) PTP
(o) PTP + ADB
( ) RNDIS + DM + MODEM
( ) RMNET + DM + MODEM
( ) DM + MODEM + ADB

[OK] [Reboot]
A few other service/secret codes

Similarly to my GT-I9300 "Secret Codes" thread, we find many of the
same codes present also in this phone. Do check that thread out, for
understanding how to find more codes relevant for your phone and AOS
version. Also note that most custom ROMs does not support all these,
as they are usually left out or forgotten about, since they are
vendor/modem specific.

Here I show only the most interesting & useful ones, and I have also
used the excellent website PhoneSpell to try to find sensible word
combinations for some of these numbers.

Now, many of these seem not to work at all, but they are present in
the ServiceMode application(s) code and rely on various other
properties being set before being available/activated. Another
type of block is is determined by the content of the EFS files:

/efs/FactoryApp/keystr
/efs/carrier/HiddenMenu

These can be set on a rooted phone by:
Code:
echo -n "OFF" > /efs/FactoryApp/keystr
echo -n "ON" >/efs/carrier/HiddenMenu
echo -n "ON" >/efs/FactoryApp/factorymode
(Somebody need to confirm the KeyString block boolean!)


Here is list of some particularly interesting properties that often
seem involved in blocking/enabling particular ServiceMenu
items/features.

Code:
property                                value/note
---------------------------------------------------------------------
ril.tcpdumping=On                       [On,Off]
ril.OTPAuth=true                        OTP Authentication key is 6 random digits long
ro.build.type=eng                       [eng, user]]
ro.cp_debug_level=                      [0x5500,0x55FF] 
ro.csc.sales_code=CHM                   [NONE, <many otehrs> ]
ro.csc.country_code=                    [KOREA, Unknown, ...]   KOREA allows extra menu item: "IMS"
ro.product_ship=false                   [true,false]
ro.product.model=                       
ro.factorytest=1
dev.silentlog.on=                       [0,1]
persist.radio.lteon=true                [true,false]
And here are some of the codes:
Code:
code            mnemonic        description
---------------------------------------------------------------------
06              -               IMEI

00112                   
0228            0BAT            Battery status (ADC, RSSI reading)
0514            -               
0599            -

1234            -               FW Versions for AP,CP,CSC
123456          -
1575            -               GPS test
1111            -               FTA SW Version  
2222            -               FTA FW Version
8888            -               
9090            -               USB/UART MUX debug switch
99007788        -               

197328640       -               Service Mode
22558463        CALLTIME        Reset Total Call Time
2263            BAND                            
2580            <mid-col>       
268435456       ANTIFKILO       "antenna IF kilo?? serviceModeApp_FB.apk / FTATDumpReceiver.class
27663368378     CPMODEMTEST     
2767*2878       APOS*CUST       Current firmware with factory default settings

301279||279301  -               
3214789650      -               Start Angry GPS                 Build.TYPE != "user"
32489           -               Ciphering Info
4238378         ICE/GCFTEST     GCF Settings?
4387264636      GETRAMINFO      
58366           LTEON                                           set persist.radio.lteon=true
6201            -               
638732          NETSEC                                          Build.TYPE != "user"
66336           MODEM           CP Ram Dump (On/Off)            ro.cp_debug_level=[0x5500,0x55FF]
6984125*        MYTH1A5?        ?               
7284            PATH            Set USB/UART path 

738767633       SETSOSOFF       Turn OFF SOS*
73876766        SETSOSON        Turn ON SOS*
7387677763      SETSOSPROF      Set SOS* profile
7387678378      SETSOSTEST      Set SOS* test
---------------------------------------------------------------------
* SOS = Sell Out SMS
<> = some kind of keypad pattern
---------------------------------------------------------------------
In addition to these numerical codes, there are also few alphanumeric ones.
These can be used from the command-line with the "am" command, like this:

Code:
am broadcast -a android.provider.Telephony.SECRET_CODE -d android_secret_code://CP_RAMDUMP
This might also work when already in ServiceMode, by entering the string
after selecting "Key Input" or "Select", from menu. (I have not checked.)

Code:
LTE_ANT_PATH_NORMAL
CP_RAMDUMP
DUMP_SVCIPC
DEBUG_SCR
EI_DEBUG_SCR
DATA_ADV
NAMBASIC
TESTMODE
NAMSIMPLE
TEST_CALL
The Samsung Diagnostics Menu

One special secret code is that of the Samsung Dignostic
Test Menu. This particular menu exsists on pretty much all
Android based Samsung phones. (AFAIK) The code is simply:

*#0*#

It provides for testing things like the Screen, Sound, Vibrator,
all the sensors and more. One one the cooler features for phones
that include an IR transmitter, is that you can use it on most
modern Samsung TV's as a remote control. Thus even easier to use
than any of Samsung's own Remote Control Apps, which are often
bloated and containing spyware.

The available test items you will find on this particular model are:
Code:
[Red]           - screen pixel test
[Green]         - screen pixel test
[Blue]          - screen pixel test
[Receiver]      - (Ear) Receiver test
[Vibration]     -
[Dimming]       -
[Mega cam]      -
[Sensor]        -
[Touch]         -
[Sleep]         - sleep mode (power button) test
[Speaker]       - listen!
[Sub key]       - testing keys 
[Front cam]     -       
[IR LED]        - Samsung TV compatible IR remote control
[LOW FREQUENCY] - Listen 100/200/300 Hz
[Black]         - screen darkness test
For other S4 models, check this YouTube video:
"Galaxy S4 Diagnostics Menu *#0*#"

For the S3 GT-I9300 check out the thread:
[REF][INFO][R&D] "Secret Codes" and other hidden features
The Following 57 Users Say Thank You to E:V:A For This Useful Post: [ View ]
 
 
28th April 2014, 02:02 PM |#2  
E:V:A's Avatar
OP Recognized Developer
Flag -∇ϕ
Thanks Meter: 2,174
 
More
The ServiceMode Menu Structure

This is really <WIP> as I don't have time to manually type in every damn menu
item for everyone else. So if you wanna help out filling in the blanks, please post
and I'll eventually add it here.

Code:
MAIN MENU
 [1] UMTS                
 [2] CDMA                
 [3] LTE                         
 [4] SIM- Not Used.              --> <E>
 [5] DOCOMO DEBUG SCREEN         
 [6] run EFS SYNC()              
 [7] DEBUG SCREEN                
 ---------------------------------------------------------------------
 [1]     UMTS MAIN MENU
         [1] DEBUG SCREEN
         [2] VERSION INFORMATION
         [3] UMTS RF NV
         [4] GSM RF NV
         [5] AUDIO
         [6] COMMON
         [7] LTE BAND CONFIG CHECK

         [1]     DEBUG SCREEN
                 [1] BASIC INFORMATION
                 [2] NAS INFORMATION
                 [3] AS INFORMATION
                 [4] NEIGHBOUR CELL
                 [5] GPRS INFORMATION
                 [6] SIM INFORMATION
                 [7] HANDOVER
                 [8] PHONE CONTROL
                 [9] ANTENNA/ADC

         [2]     VERSION INFORMATION
                 [1] SW VERSION
                 [2] HW VERSION

         [3]     UMTS RF
                 [1] RF NV READ
                 [2] RF NV WRITE
                 [3] UMTS DIVERSITY CONTROL
                 [4] RF CALIBRATION CHECK

         [4]     GSM RF
                 [1] RF NV READ
                 [2] RF NV WRITE

         [5]     AUDIO                           Locked! ==> See Note (a)
                 ...

         [6]     COMMON
                 [1] FTM
                 [2] DEBUG INFO
                 [3] RF SCANNING
                 [4] DIAG CONFIG
                 [5] WCDMA SET CHANNEL
                 [6] NV REBUILD
                 [7] FACTORY TEST
                 [8] FORCE SLEEP
                 [9] GPS

                 [1]     FTM : OFF               Locked! ==> See Note (b)
                         [1] NOT SUPPORT 
                         [2] FTM : OFF

                 [2]     DEBUG INFO
                         [1] MM REJECT CAUSE
                         [2] LOG DUMP
                         [3] UI DEBUG POPUP - N/S


                 [3]     RF SCANNING     
                         [1] SETTING
                         [2] START RF SCANNING
                         [3] RESULT TO PC
                         [4] RESULT TO SCREEN

                 [4]     DIAG CONFIG
                         [1] USB  ( )
                         [2] UART (*)
                         [3] DBG MSG ON  (*)
                         [4] DBG MSG OFF ( )

                 [5]     WCDMA SET CHANNEL       ==> "WCDMA CHANNEL SET" NOT SUPPORT
                 [6]     NV REBUILD              --> Not tested!
                 [7]     FACTORY TEST            --> Not tested!
                 [8]     FORCE SLEEP             --> Not tested!
                 [9]     GPS
                         co_gps_menu             ==> unknown!


         [7]     LTE BAND CONFIG CHECK           --> <E>

 ---------------------------------------
 [2]     CDMA MAIN MENU
         [1] COMMON
         [2] DATA
         [3] RF
         [4] CONTROL
         [5] DEBUG SCREEN
         [6] SUSPEND (001)
         [7] TEST SYS(012)


         [1]     COMMON MENU (1/3) 
                 [1] READ RAW RSSI (018)
                 [2] MODEL ID (019)
                 [3] SNDNAM (020)
                 [4] SNDVERSION (021)
                 [5] SNDESN (022)
                 [6] DATASVC ON (023)
                 [7] DATASVC OFF (024)
                 [8] VERSION (025)
                 [9] NEXT PAGE >

                 COMMON MENU (2/4)
                 [1] REBUILD (026)
                 [2] PHONE RESET (027)
                 [3] FS RESET (029)
                 [4] SIO TO DM (032)
                 [5] MSL KEY(245)
                 [6] MSL (246)
                 [7] F3 MSG (249)
                 [8] CUR BAND (253)
                 [9] NEXT PAGE >

                 COMMON MENU (3/4)
                 [1] ERR LOG CLR (252)
                 [2] SIM IN OUT CHECK (89)
                 [3] MEMORY CHECK (90)
                 [4] ACTIVATION_DATE (99)
                 [5] SIO_MODE (032)
                 [6] MOB CAI REV (110)
                 [7] RECONDITIONED STATUS (200)
                 [8] PREF MODE SET
                 [9] NEXT PAGE >

                 COMMON MENU (4/4)
                 [1] RTRE CONFIG
                 [2] SMS FORMAT SET
                 [3] (UN)BLOCK VOICE MT
                 [4] CHECK FACTORY CMD


         [2]     DATA
                 [1] WRITE NV (031)      
                 [2] MRU2 TABLE (033)
                 [3] NAI SET (034)
                 [4] INFORMATION
                 [5] VBATT
                 [6] THERMISTER
                 [7] eHRPD e/disable

         [3]     RF
                 [1] CALIBRATION         
                 [2] COMMON              
                 [3] PCS                 
                 [4] CDMA                --> WLAN etc
                 [5] GPS                 --> Nice!

         [4]     CONTROL                 --> Not tested!
         [5]     DEBUG SCREEN            --> Not tested!
         [6]     SUSPEND (001)           --> Not tested!
         [7]     TEST SYS(012)           --> Not tested!

 ---------------------------------------
 [3]     LTE MAIN MENU           
         [1] DEBUG SCREEN                
         [2] LTE RF                      
         [3] Reserved                    --> <E>
         [4] BACKOFF PLMN TIMER (T3402)  

 [4] SIM- Not Used.                      --> <E>
 [5] DOCOMO DEBUG SCREEN                 --> See Note (c)
 [6] run EFS SYNC()                      --> Not tested!
 [7] DEBUG SCREEN                        --> Not tested!
Special Notes for the above:
Code:
//   = The end point/window where the info is displayed 
       (This usually doesn't have a title.)

<E>  = A "Dead End" that take you into an oo-loop page or back 
       to a locked *#0011# state.

(a) For accessing this sub-menu you may need to:
        1. Unblock the KeyString file with:
           echo -n "OFF" > /efs/FactoryApp/keystr
        2. Enable the carrier HiddenMenu file with:
           echo -n "ON" >/efs/carrier/HiddenMenu
        3. Set the device shipping property:  ro.product_ship=FALSE

(b) For "FTM" (Factory Test Mode) you probably need to set:
        1. Enable the FactoryMode file with:  
           echo -n "ON" >/efs/FactoryApp/factorymode
        2. Set the factory test property:  ro.factorytest=1

(c) Not available for non-DOCOMO devices, need correct property(ies).
The Following 24 Users Say Thank You to E:V:A For This Useful Post: [ View ]
28th April 2014, 02:03 PM |#3  
E:V:A's Avatar
OP Recognized Developer
Flag -∇ϕ
Thanks Meter: 2,174
 
More
Some Useful Examples


Example-1: Removing SIM network lock

Code:
UMTS MAIN MENU
[1] DEBUG SCREEN.
[6] PHONE CONTROL.
[6] NETWORK LOCK
[3] PERSO SHA256 OFF

Go Back to Main Menu

UMTS MAIN MENU
[6] COMMON
[6] NV REBUILD.
[4] Restore Back-up.

Reboot
This has not been tested by me, since I don't use SIM locked providers.

So make sure you have a complete NANDroid backup of your phone in case something
goes wrong. I do not take any responsibility for damaged phone due to this procedure.


Please confirm if this method works for this phone.

The Following 14 Users Say Thank You to E:V:A For This Useful Post: [ View ]
29th April 2014, 05:57 PM |#4  
luisbraz's Avatar
Senior Member
Flag Faro
Thanks Meter: 109
 
More
This is bul****!


I don't see the possibility to do a simple "Boby, sit!"
The Following User Says Thank You to luisbraz For This Useful Post: [ View ] Gift luisbraz Ad-Free
29th April 2014, 10:49 PM |#5  
Junior Member
Thanks Meter: 7
 
More
You should be able to get into service mode directly by using the code *#27663368378#

Sent from my SCH-I435 using XDA Free mobile app
30th April 2014, 07:24 AM |#6  
Junior Member
Thanks Meter: 1
 
More
LTE BAND CONFIG CHECK don't work
[7] LTE BAND CONFIG CHECK

it still doesn't work after I -------------------------------------------------------
<E> = A "Dead End" that take you into an oo-loop page or back
to a locked *#0011# state.

(a) For accessing this sub-menu you need two things:
1. KeyString file unblocked: /efs/FactoryApp/keystr: "OFF"
2. Property: ro.product_ship=FALSE
--------------------------------------------------------------------------------------------

Actually I want to check if it support bands change. In China, CMCC seems to only support band41.
The Following User Says Thank You to jmzwcn For This Useful Post: [ View ] Gift jmzwcn Ad-Free
30th April 2014, 09:48 AM |#7  
Senior Member
Flag Bratislava
Thanks Meter: 510
 
Donate to Me
More
Quote:
Originally Posted by wiisixtyfour

You should be able to get into service mode directly by using the code *#27663368378#

Sent from my SCH-I435 using XDA Free mobile app

Doesn't work on GT-I9195
The Following User Says Thank You to ladislav.heller For This Useful Post: [ View ] Gift ladislav.heller Ad-Free
30th April 2014, 11:46 AM |#8  
Junior Member
Thanks Meter: 7
 
More
Quote:
Originally Posted by ladislav.heller

Doesn't work on GT-I9195

It works for me on the Verizon version. Make sure you set /efs/carrier/HiddenMenu to 'ON'.

Sent from my SCH-I435 using XDA Free mobile app
The Following User Says Thank You to wiisixtyfour For This Useful Post: [ View ] Gift wiisixtyfour Ad-Free
30th April 2014, 02:00 PM |#9  
Senior Member
Flag Bratislava
Thanks Meter: 510
 
Donate to Me
More
Thumbs up
How to trigger the Nfc Test application?
Package name is com.sec.android.app.nfctest.

Decompiled NfcTestBroadcastReceiver.java file:
Code:
package com.sec.android.app.nfctest;

import android.content.*;
import android.net.Uri;
import android.nfc.NfcAdapter;
import android.util.Log;

// Referenced classes of package com.sec.android.app.nfctest:
//            NfcTestMain

public class NfcTestBroadcastReceiver extends BroadcastReceiver
{

    public NfcTestBroadcastReceiver()
    {
    }

    public void onReceive(Context context, Intent intent)
    {
        String s = intent.getAction();
        if(!s.equals("android.provider.Telephony.SECRET_CODE")) goto _L2; else goto _L1
_L1:
        Intent intent1 = new Intent("android.intent.action.MAIN");
        if(intent.getData().getHost().equals("6328378"))
            intent1.setClass(context, com/sec/android/app/nfctest/NfcTestMain);
        intent1.setFlags(0x10000000);
        context.startActivity(intent1);
_L4:
        return;
_L2:
        if("android.intent.action.BCS_REQUEST".equals(s))
        {
            Log.i("NfcTestBroadcastReceiver", "BCS_REQUEST receive");
            if("AT+NFCVALUE".equalsIgnoreCase(intent.getStringExtra("command")))
            {
                NfcAdapter nfcadapter = NfcAdapter.getDefaultAdapter(context);
                Log.i("NfcTestBroadcastReceiver", "AT+NFCVALUE!!!");
                if(nfcadapter.isEnabled())
                {
                    Log.i("NfcTestBroadcastReceiver", "NFC STATE ON!!!");
                    context.sendBroadcast((new Intent("android.intent.action.BCS_RESPONSE")).putExtra("response", "ON"));
                } else
                {
                    Log.i("NfcTestBroadcastReceiver", "NFC STATE OFF!!!");
                    context.sendBroadcast((new Intent("android.intent.action.BCS_RESPONSE")).putExtra("response", "OFF"));
                }
            }
        }
        if(true) goto _L4; else goto _L3
_L3:
    }
}
Tried the secret code *#6328378# in phone dialer but nothing happened.

Update:
But it works from commandline:
Code:
am broadcast -a android.provider.Telephony.SECRET_CODE -d android_secret_code://6328378
Attached Thumbnails
Click image for larger version

Name:	Screenshot_2014-04-30-18-48-41.png
Views:	9257
Size:	35.6 KB
ID:	2717903  
The Following 3 Users Say Thank You to ladislav.heller For This Useful Post: [ View ] Gift ladislav.heller Ad-Free
1st May 2014, 07:28 PM |#10  
E:V:A's Avatar
OP Recognized Developer
Flag -∇ϕ
Thanks Meter: 2,174
 
More
Quote:
Originally Posted by jmzwcn

[7] LTE BAND CONFIG CHECK
it still doesn't work after I ...Actually I want to check if it support bands change. In China, CMCC seems to only support band41.

Does you phone actually support LTE?
What model?

Quote:
Originally Posted by wiisixtyfour

It works for me on the Verizon version. Make sure you set /efs/carrier/HiddenMenu to 'ON'.

Thank you! Can you find out if there are there other files we should look out for. Can you post the output of "busybox ls -alR" for the /efs directory?

Quote:
Originally Posted by ladislav.heller

How to trigger the Nfc Test application?
Package name is com.sec.android.app.nfctest.
Decompiled NfcTestBroadcastReceiver.java file:
Tried the secret code *#6328378# in phone dialer but nothing happened.

Great Job! Thanks. BTW. "6328378" = "NFCTEST".
also see if there are some other related files in /efs/ that need to be "enabled".

Make sure to backup you EFS folder, and don't try to add delete files in there, it doesn't work as a normal directory... EFS is more like a solid part of memory. You can change values, but not the number of values (size).
The Following 2 Users Say Thank You to E:V:A For This Useful Post: [ View ]
1st May 2014, 08:22 PM |#11  
Junior Member
Thanks Meter: 7
 
More
Quote:
Originally Posted by E:V:A

Thank you! Can you find out if there are there other files we should look out for. Can you post the output of "busybox ls -alR" for the /efs directory?

Here is the output from that command on my SCH-I435:
Code:
.:
drwxrwxr-x root     root              1969-12-31 15:00 .files
drwxrwxr-x system   system            2013-11-09 01:57 FactoryApp
drwx------ system   system            2012-12-31 16:00 U0BwJo4kmkmm-BgyzUZgoEY7pn8_
-rw------- radio    radio         212 2013-12-01 16:25 apn-changes.xml
drwxr-xr-x radio    radio             2013-11-09 01:49 bluetooth
drwxr-xr-x system   system            2012-12-31 16:02 carrier
drwx------ system   system            2012-12-31 16:00 drm
-rw------- system   system         12 2013-11-09 01:58 gyro_cal_data
-rw-r--r-- root     root           16 2012-12-31 16:00 h2k.dat
drwxrwxr-x radio    radio             2013-11-09 01:49 imei
-rw------- root     root            0 2014-05-01 11:17 log
drwx------ root     root              1969-12-31 15:00 lost+found
drwxrwx--- radio    system            2013-11-09 01:49 prov
drwx------ system   system            2012-12-31 16:00 prov_data
drwxrwxr-x system   system            2013-11-09 01:49 wifi

./.files:
drwxrwxr-x media    system            1969-12-31 15:00 .dm33
drwxrwxr-x media    system            1969-12-31 15:00 .dx1
drwxrwxr-x media    system            1969-12-31 15:00 .mp301

./.files/.dm33:

./.files/.dx1:

./.files/.mp301:

./FactoryApp:
-rwxr--r-- system   system          1 1970-01-01 15:00 baro_delta
-rw------- system   system          5 2014-05-01 06:18 batt_cable_count
-rwxrwxr-x media    system          2 2014-04-26 21:12 earjack_count
-rwxr--r-- system   system          2 2013-11-09 01:49 factorymode
-rwxrwxr-x system   radio           4 1969-12-31 15:00 fdata
-rwxrwxr-x system   radio           0 2012-12-31 08:00 hist_nv
-rwxr--r-- system   system         10 1970-01-01 15:00 hw_ver
-rwxr--r-- system   system          2 2013-11-09 01:49 keystr
-rwxr--r-- system   system          5 1970-01-01 15:00 prepay
-rwxr--r-- system   system         11 1970-01-01 15:00 serial_no
-rwxrwxr-x system   radio         270 2012-12-31 08:00 test_nv

./U0BwJo4kmkmm-BgyzUZgoEY7pn8_:
-rwx------ system   system       1072 2012-12-31 16:00 qen2gEqW2A+OTDT0KpoESJiYnrk_
-rwx------ system   system       1072 2012-12-31 16:00 zm0WY4lY7rpx3kcVTTDWeh8VFRU_

./bluetooth:
-rw-r--r-- radio    radio          17 2013-11-09 01:49 bt_addr

./carrier:
-rwxr--r-- system   system          2 2014-04-29 12:42 HiddenMenu

./drm:
drwx------ system   system            2012-12-31 16:00 h2k

./drm/h2k:
drwx------ system   system            2012-12-31 16:00 8tjfX-7nJB21LtUUWIMbdlUfZTU_

./drm/h2k/8tjfX-7nJB21LtUUWIMbdlUfZTU_:
-rwx------ system   system       1072 2012-12-31 16:00 HAv-sOqL1pMh2jiAzRoeKCzAmhE_
-rwx------ system   system       1072 2012-12-31 16:00 SNbX8rtYWzaqdrnXa79HbAt5OFM_

./imei:
-rwxrwxr-x radio    radio           3 2013-12-23 03:38 mps_code.dat

./lost+found:

./prov:
-rw-rw---- radio    system          0 2013-11-09 01:49 libdevkm.lock

./prov_data:
drwx------ system   system            2013-11-09 01:49 G+8IRqTrHDIvQWyDjPjJkVB5u6o_
drwx------ system   system            2012-12-31 16:00 bG5QQZ77nDjI2757PvvQ3rPPrVg_

./prov_data/G+8IRqTrHDIvQWyDjPjJkVB5u6o_:
-rwx------ system   system       1072 2013-11-09 01:49 3mvhJJQ5lPk1G+yj67Y71hI3inI_
-rwx------ system   system       1072 2013-11-09 01:49 I0jYBKhtBZN0Rru2UXWB+UZ7Vc0_
-rwx------ system   system       1072 2013-11-09 01:49 MHkfmzQg-bRYZzQ4Dc1M+rgodfA_
-rwx------ system   system       1072 2013-11-09 01:49 iaBl+cROT4fwHRANIx6tIUgBqSA_
-rwx------ system   system       1072 2013-11-09 01:49 qOk21RBBYMeZqVYofK+oU09QG2o_

./prov_data/bG5QQZ77nDjI2757PvvQ3rPPrVg_:
-rwx------ system   system       1072 2012-12-31 16:00 4OV1KOT1hf21qdU1tnH6b8mOYLI_
-rwx------ system   system       1072 2012-12-31 16:00 CuWlydrYrNFsWwuO0IaVlUQVxEg_
-rwx------ system   system       1072 2012-12-31 16:00 gh8lZ2gd7MCgXAgHEgG7apFzmR0_
-rwx------ system   system       1072 2012-12-31 16:00 pYEZlsu8egNLf3z5mqguGPyhE2Q_
-rwx------ system   system       1072 2012-12-31 16:00 z-yiAOMWDX7wyfLCg5VIl-fyXus_

./wifi:
-rw------- system   system         17 2013-11-09 01:49 .mac.cob
-rw-rw-r-- system   system         17 2013-11-09 01:49 .mac.info
Quote:
Originally Posted by E:V:A

Great Job! Thanks. BTW. "6328378" = "NFCTEST".
also see if there are some other related files in /efs/ that need to be "enabled".

Make sure to backup you EFS folder, and don't try to add delete files in there, it doesn't work as a normal directory... EFS is more like a solid part of memory. You can change values, but not the number of values (size).

The NFC test did not work for me either but I am not sure if anything else in EFS should be changed.

Sent from my SCH-I435 using XDA Free mobile app
The Following User Says Thank You to wiisixtyfour For This Useful Post: [ View ] Gift wiisixtyfour Ad-Free
Post Reply Subscribe to Thread

Tags
code, diagnostic, mode, secret, service

Guest Quick Reply (no urls or BBcode)
Message:
Previous Thread Next Thread
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes