*UPDATED* 6/26/2012 Motorola Razr/Maxx, Droid 4,HTC Rezound Will work on any GSM

TBH Band Config Unlock zip Install for Razr

It's not "Magic code".

It is just a zip installation of the NVM edit using the updater-binary from an official OTA update.zip to write the 8 byte string for the band config to NV Item 1877.

The NVM is updated every time you get an OTA in order to increment the version numbers and dates. We just used the binary for our own needs.

So far, we have not had complete success with this on the D4 or Razr on stock hardware with T Mobile or ATT in the US. There appears to be a different form of lock in effect for domestic GSM carriers, because there are many reports of it working with international carriers, at least on D4.

There is a Chinese engineering ICS build that P3droid has running on his eng Razr and everything works out of the box with that radio image. It cannot be loaded on stock hardware unfortunately.
We dumped the entire NVM from it and I have been going through it to find a potential solution. There are many differences in the NVM and it will take some time to work through them to determine their impact.

Edit: I have included the Razr version of the TBH band config zip files for those interested in testing this.

These files MUST be run from Razr bootstrap recovery and NOT Safestrap.
The unlock zip writes the GSM band config string and the relock zip writes the stock string to revert if you need to for any reason.

They do no other modifications to the device and any build.prop edits or additional apns-conf.xml or system libs must be done manually if desired.

Please post back with any information regarding success or failure using these files, thanks!
The files did not upload from my dropbox properly, sorry. I will have to reattach them from PC later.

Edit 2: I reuploaded the files. These have been tested on mine and P3droid's Razrs and should work fine.
As people quickly discovered, the D4 files work on the Razr too, so you can use either. The binaries are compatible and the string is the same. The Chinese ICS build has a slightly altered string that you can also try in RadioComm if desired.
The first 2 bytes are different: 8001E80400000200

***UPDATE 6/26/2012***

Ok, not all the info that I got before was 100% correct. It looks like RAZR / MAXX is unlocked only for Global(GSM) use which is outside of USA. The Tmobile and ATT sims are not fully working as of right now.

We have couple amazing Devs which are working to resolve this issue.

Please PM me if you want me to update the OP.

-----------------------------------------------------------------------------

On the Bionic forum people found a way to activate disabled feature of couple 4g verizon phones to be able to use it on GSM networks.

Can someone test it please?

http://xdaforums.com/showthread.php?t=1297714

***UPDATE***

Follow this steps to make it work: http://xdaforums.com/showpost.php?p=25967009&postcount=118

munchy_cool said:

how did you do it , as in the steps and the carrier you used, att or tmo.
assuming it's att as you are on 850 3g, also can you please post a pic for us.
we will be so happy

Click to expand...

Click to collapse

Actually its pretty easy , no need of Radio Comm

I have a Moto CDMA XT912

Steps :

[optional] Flash this : ICS ROM > http://bit.ly/JW8j8w
[optional] Flash this : GAPPS > http://bit.ly/JW7vAG

Flash this : GSM PATCH > http://bit.ly/JW7Hjd
FLash this : "MAGIC code" lol > http://xdaforums.com/attachment.php?attachmentid=1048524&d=1336485537

Reboot , and done ! , you'll have GSM enabled [ all bands ]

I am not giving up anyone. Right now still working on unlock for xt912 for my wife since she hates changing phones. Can't ask for anything better then a phone that can do both CDMA and gsm. We are planning a trip to Asia after the baby is born.

Sent from my DROID RAZR HD using xda app-developers app

The first thing I did after completing the edit on my RAZR M and testing it was to check the NVM of my D4 for the same item. It is not present on any of the MDM6600 chipset devices, unfortunately.

There are a number of other items that contain single byte boolean switches(01 on 00 off) in the 8000-8400 range, which is the main section of Motorola proprietary NVM area and I have tried all of them and none of them enables US GSM carriers.

I have also tried logging with QXDM in order to try to replicate the method used to isolate the 8322 item in the MSM8960 chipset based devices but without any results so far.

This was deliberately setup on those devices as a boolean switch by the Moto engineers and there is not necessarily a corollary item or switch on the MDM6600 based devices.
I have dumped the NVM from all of my devices including Bionic, D4, RAZR and Xoom many times and logged QXDM for hours monitoring the radio searching for clues to the nature and location of the MCC block and have tried many varied combinations of NV edits.

I have spent hundreds of hours doing this over the past year since their release over many firmware revisions and configurations and have NVM dumps from other users devices and engineering models with the unlocked Chinese radio and everything working as it should and still have not found the solution.

I am not saying I haven't missed anything nor thought through all of the possibilities, but I have amassed a considerable amount of information and studied it at length.
We have tools and techniques for access and analysis of the radios and the images and haven't found the answer yet.

I just wanted to make clear that much of this ground has been covered and there is a lot of work that has been done thus far.