[GUIDE] [AT&T Z999] Unlock hidden GSM & LTE bands for international use

Drakosha

Senior Member
Mar 14, 2007
134
87
28
Tbilisi
www.drakia.com
Hello.

AT&T has disabled all the international GSM\LTE bands on Z999, making it unusable outside of USA (at least in countries with GSM 900\1800, UMTS 2100 & LTE B3 & B20, like the one I live in). In order to change that, we need to turn on the Qualcomm USB Diag port, and for this, the phone has to be rooted.
I've been trying to root my AT&T Z999 for some time now, without any success, unfortunately. However, searching forums after forums, sites after sites, I've discovered the surprisingly easy method of turning on the Diag port without root.
It appears, that Axon M shares a lot with Axon 7, at least the secret key combination to enter Factory Test Mode:
  1. Turn off the phone
  2. Press and hold Power + Vol DOWN buttons until you see the screen "FTM" (see attached screenshot)
You have to press both buttons for the long time, do not release them when the phone starts - just wait until you see the screen. And that's it - you are now in Factory Test Mode and PC sees your phone as "ZTE Handset Diagnostic Interface (COMxx)"

Now, in order to change the bands, you have to follow these guides one after one:
  1. Backup IMEI and NVRAM (ignore all the steps to turn Diag port on, you've done that already)
  2. Unlock LTE bands
  3. Mod edit: Link removed! (this guide in in Russian, but all screenshots are in English & every step is pretty clear)
  4. You would need this tool also.
Please remember, these things are complex, and require considerable experience with Android & Windows. DO NOT START unless you feel confident that you know, what you're doing. I'm serious. Do not try this, if you're not experienced.​


WBR,
Draco.
 

Attachments

Last edited by a moderator:
  • Like
Reactions: vijay555 and ugynok

hene193

Senior Member
Aug 21, 2011
128
19
0
hene193.com
Why mods deleted the link? Google translate exists.

Edit:
I've managed to get the data from the phone using QXDM.
lte_bc_config contained the value of "2251800618993690" now I'm parsing the info how to edit this. Seems like the tutorials don't really match this device. Now I wonder if the chipset can handle invalid data and just input all 1's. Unsupported frequencies just won't work.

Edit2: Writing all 1's didn't work.

Edit3: I wrote this value: "2251802901219551" Calculated with CDMATool. But it seems like the AT&T firmware only finds edge network. I've double checked the bands to be correct ones. So now I will switch to the chinese firmware.

Edit4: Final edit. Turns out you cannot flash chinese firmware on AT&T device. Sigh so my unit is stuck to EDGE/wifi only.
 
Last edited:
  • Like
Reactions: ugynok

wangiles

Senior Member
Feb 17, 2008
189
20
0
Hello.

AT&T has disabled all the international GSM\LTE bands on Z999, making it unusable outside of USA (at least in countries with GSM 900\1800, UMTS 2100 & LTE B3 & B20, like the one I live in). In order to change that, we need to turn on the Qualcomm USB Diag port, and for this, the phone has to be rooted.
I've been trying to root my AT&T Z999 for some time now, without any success, unfortunately. However, searching forums after forums, sites after sites, I've discovered the surprisingly easy method of turning on the Diag port without root.
It appears, that Axon M shares a lot with Axon 7, at least the secret key combination to enter Factory Test Mode:
  1. Turn off the phone
  2. Press and hold Power + Vol DOWN buttons until you see the screen "FTM" (see attached screenshot)
You have to press both buttons for the long time, do not release them when the phone starts - just wait until you see the screen. And that's it - you are now in Factory Test Mode and PC sees your phone as "ZTE Handset Diagnostic Interface (COMxx)"

Now, in order to change the bands, you have to follow these guides one after one:
  1. Backup IMEI and NVRAM (ignore all the steps to turn Diag port on, you've done that already)
  2. Unlock LTE bands
  3. Mod edit: Link removed! (this guide in in Russian, but all screenshots are in English & every step is pretty clear)
  4. You would need this tool also.
Please remember, these things are complex, and require considerable experience with Android & Windows. DO NOT START unless you feel confident that you know, what you're doing. I'm serious. Do not try this, if you're not experienced.​


WBR,
Draco.
Does this really work? Anyone else tried?

Sent from my SM-N950F using Tapatalk
 

Drakosha

Senior Member
Mar 14, 2007
134
87
28
Tbilisi
www.drakia.com
I can't "repost" the 3rd link, but I can suggest you to open the well-known (and the best) Russian web-site with the name starting with "4" (and having something like "...pda" also), and then add this to the address: /forum/index.php?showtopic=546814&st=4640#entry35702698
 

hene193

Senior Member
Aug 21, 2011
128
19
0
hene193.com
Well that russian site has pretty good instructions on how to do it. I tried with one program and it didn't work on AT&T ZTE. I'll try with that qualcomm app again this weekend but if I remember right the last time it had trouble writing because it had no correct service mode code \o/
 

gaosilver1000

New member
Jan 3, 2011
3
0
0
I can't "repost" the 3rd link, but I can suggest you to open the well-known (and the best) Russian web-site with the name starting with "4" (and having something like "...pda" also), and then add this to the address: /forum/index.php?showtopic=546814&st=4640#entry35702698
that website's address ends with ".RU", doesnt it?
i accessed that website as your given link, but i cannot see any related threads about ZTE on that, seems all they disscussed about is Lenovo K910SS. was something wrong with my searching?
 

Drakosha

Senior Member
Mar 14, 2007
134
87
28
Tbilisi
www.drakia.com
that website's address ends with ".RU", doesnt it?
i accessed that website as your given link, but i cannot see any related threads about ZTE on that, seems all they disscussed about is Lenovo K910SS. was something wrong with my searching?
Every Quallcomm device has almost the same NVram configuration rules, the difference is usually on how to enable diagnostic port, but for Z999 I have figured that out already. So, for the configuration process, every Quallcomm guide should work.
I've successfully enabled Z999 to work with 2G & Edge in my country using these guides. 3G & LTE don't work yet, but I'm sure they will eventually. I don't believe Z999 lacks the hardware ability to use LTE B3 & B20 (and other bands), it has to be something wrong with NVram parameters.
 
Last edited:
  • Like
Reactions: ugynok

gaosilver1000

New member
Jan 3, 2011
3
0
0
Every Quallcomm device has almost the same NVram configuration rules, the difference is usually on how to enable diagnostic port, but for Z999 I have figured that out already. So, for the configuration process, every Quallcomm guide should work.
I've successfully enabled Z999 to work with 2G & Edge in my country using these guides. 3G & LTE don't work yet, but I'm sure they will eventually. I don't believe Z999 lacks the hardware ability to use LTE B3 & B20 (and other bands), it has to be something wrong with NVram parameters.
It means success unlock 2G/EDGE, not yet with 3G and LTE? When buy the device, it can use other carrer to call and 2G.
When you finger out the way to unlock LTE, please share me.
by the way, do you have the way to enter fastboot mode? I tried the "volunm + &power button" but it just do a normal restart into android.
 

loopdeer

New member
Dec 3, 2017
3
3
0
Fair warning to everyone trying this, make sure you actually do a backup of your IMEI. I didn't and after screwing something up my SIM is no longer detected, and my IMEI is no longer available.
 
  • Like
Reactions: ugynok

ugynok

Senior Member
Apr 2, 2012
87
17
0
Hello folks!

I have an AT&T phone. I cannot connect to ANY (even EDGE) network!
I modified the configuration several times:

---
I have EDGE with this config:
00441: 0 and 0xFFFF
00946: 0 and 0x06A8
01877: 1677472
02954: 0
06828: 524356
06829: 524356
I got no LTE
---


test2:
06828: 524485
06829: 524485
I got no LTE

----
00441: 0xffff (but 0x380 is recommended)
00946: 0xff8
02954: 0 and 805765120
01877: 3460734838925427584
06828: 1904863
06829: 1904863
I got no LTE, just continous dropping network, useless config.


----
00441: 896
00946: 0 and 0x140
02954: 0 and 131072
01877: 562949974393728
Only edge network, error while searching for networks.

----
06828: 524485
06829: 524485
I have EDGE with this config, but no LTE.

----


Anyone has a good and working LTE mode?!

edit: "The bands on the AT&T z999 are: 2, 4, 5, 12, 29, 30, and 66. "
So, there won't be any Band 1,3,20 for us?! :(

Thanks!
 
Last edited:
  • Like
Reactions: baize

Mario15gl

New member
Dec 3, 2019
1
0
0
Every Quallcomm device has almost the same NVram configuration rules, the difference is usually on how to enable diagnostic port, but for Z999 I have figured that out already. So, for the configuration process, every Quallcomm guide should work.
I've successfully enabled Z999 to work with 2G & Edge in my country using these guides. 3G & LTE don't work yet, but I'm sure they will eventually. I don't believe Z999 lacks the hardware ability to use LTE B3 & B20 (and other bands), it has to be something wrong with NVram parameters.
Have you been able to make 3G & LTE work? I just got my ZTE AXON M from ebay and since I can't use data or make calls/unlock the phone I was thinking of trying this.
 

classicbank

New member
Nov 1, 2008
1
0
0
Every Quallcomm device has almost the same NVram configuration rules, the difference is usually on how to enable diagnostic port, but for Z999 I have figured that out already. So, for the configuration process, every Quallcomm guide should work.
I've successfully enabled Z999 to work with 2G & Edge in my country using these guides. 3G & LTE don't work yet, but I'm sure they will eventually. I don't believe Z999 lacks the hardware ability to use LTE B3 & B20 (and other bands), it has to be something wrong with NVram parameters.
Can I describe in detail how to enable 2G?
Thanks !
 

baize

New member
Dec 14, 2008
4
1
0
Hello guys. I've tried all configs mentioned by @ugynok and some of my own - the result is still the same, no 2G network and all options in mobile connections are disabled not clickable. Can you please advice which config worked for you to enable 2G network?
 
Last edited:
  • Like
Reactions: Agsmex16