These are the logs generated by QXDM and are not on the phone at all. You cant see the diagnostic interfaces from the radio in those logs, just the RIL.
They are .isf files (Item Store Files) and are generated by QXDM Logging View(F1) and saved by default in the Program Files/QXDM/Bin directory.
You setup which message types are monitored in Logging View Config(F5).
If, like me in most cases, you don't know what you are looking for then you set a very broad set of message types and the logs are extremely large and verbose.
The one I generated last night for about 2 hours of logging is 225MB.
These files can be opened and "replayed" with the Item View(F11)function so you can search them and parse the messages, events and strings or raw item hex data in a split pane view.
It is definitely a huge step to have found the specific mechanism, but still does not necessarily mean there is a boolean switch as has been found before for other models. It may mean that the Forbidden PLMN list and Preferred PLMN list or acquisition databases need to be edited directly.
The phone is connected to the QC Diagnostic Port and not the QC BP Modem as it is for AT mode.
I crashed at 6:00 AM and need to go back and re examine the logs for more info.
There are many NV items that refer to the PLMN(Public Land Mobile Network) in various forms and the items referenced by igwtapc are non existent AFAIK.
I believe he maybe misreading the item IDs because they are expressed in Little Endian (Least Significant Byte First) format in the raw item hex output from QXDM.
In any event, there is a lot to look at now to find the specific means of undoing the block.
EDIT: added screenshots of logs
EDIT 2: I found the same sequence in the Bionic logs and it also checks the Forbidden PLMN List with 4 items but all the items are 000- 00 so it doesn't block anything!
So it seems clear that editing the Forbidden PLMN List should work as desired assuming we can locate it in the NVM.
Edit 3: I have found several items labeled Acquisition List 1, 2,3 and 4 that contain PLMN designations for various bands and have the ATT MCC/MNC pairs in them.
I have not yet found an item that contains values structured like I am anticipating for this list of 4 items.
These items also contain entry codes for each entry and I am not certain how they need to be properly edited even if they are the right items.
Learning lots from moment to moment here though and I wanted to let you in on some of the progress!
Edit 4: I found the item that controls the forbidden PLMN list and sets all values to 000- 00 for the 4 entries like the Bionic, but it was not enough by itself and it still gets flagged as invalid country code despite being able to successfully pass the NAS REG sequence with the cleared PLMN list.
The item is 6844 first byte changed to 00 from default 02 zeros the entries in the forbidden PLMN list.
I won't have much time to work on this further for a couple days but we are definitely closing in on this now!