[GUIDE] [HOW TO] Enable unlock edit add GSM LTE bands to Samsung Galaxy S5 QualComm

[botwa2000]

I'm going to try and summarise the steps to play around with 3G and 4G bands on Samsung Galaxy S5 devices.

I didn't come to it on my own, all thanks and contributors are listed below.

Happy to close any gaps in the guide - just shout.

The process might help add extra 3G or 4G/LTE bands if the hardware of your device allows it.
So far there have been found a lot of limitations on Sammy devices so the success is by no means guaranteed.

Use everything at your own risk, I'm not going to be responsible for any damage to your phone as a result of you trying to follow the steps.

The steps worked for me, I was able to disable and then enable some GSM bands.
So if nothing else the guide should be useful for those who accidentally delete default bands on their phones.

Additional LTE bands have been successfully unlocked on some brands already.

Thanks for providing inspiration, guidance and working assumptions to following threads and folks:

http://xdaforums.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059
http://xdaforums.com/crossdevice-dev/sony/thread-progress-please-leave-im-updating-t2871269

@fffft
@olokos
@BlackSoulxxx
@Isriam
@dl12345

Original Quick Guide as compiled by @fffft quoted here:

The Mod:

Step by step guide

1. You need a phone with a Qualcomm processor that has been rooted.
2. If you need to root your phone, click on the button below for guidance. Otherwise skip to step 3.

3. If you are running a custom ROM and kernel that were compiled from source code, well done. Skip to Step 4.
Otherwise click on the button below for more information.

4. Download and install QPST. We will use this program to edit your phone settings. This runs best on Windows XP. But you can use Windows 7 (and probably Win 8, if you must). Right click on setup.exe (not the .msi file) and choose run as adminstrator.

5. Download and install QXDM. We will use this program to "write enable" your phone settings. QXDM won't work unless QPST is also installed, so you need both programs. Right click on setup.exe and choose run as administrator to install.
6. Open the USB settings screen on your phone. Change USB from AP to CP. And USB settings from MTP + ADB to RNDIS + DM + Modem mode (after you have finished making edits in your phone's memory, remember to revert the original settings in this screen).

This is the hardest part of this mod as the USB setting menu is usually hidden and the method to access it is slightly different on some brands. For the S5, you can open it by dialing *#0808# . Other phones may use *#7284# , *#8778# , *#*#8778#*#* , ##3424# or something else entirely. If those codes don't work on your phone, try a Google search for keywords like those below to find out how to open the USB settings menu for your phone:

Google: USB settings xda
Google: how to use QPST xda

6a. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
For Sony, the following CLI commands have been reported to work. These may or may not work for other brands.
You can enter these using a terminal emulator app or from an adb shell.

From terminal emulator:
Code:
su
setprop persist.usb.eng 1
setprop usb.rndis.enable 1
echo 1 > /sys/class/usb_composite/modem/enable

Or using adb:
Code:
adb start-server
adb shell
su
setprop persist.usb.eng 1
setprop usb.rndis.enable 1
echo 1 > /sys/class/usb_composite/modem/enable
exit

If you use either of these, remember to revert the USB settings after you finish your phone edits. e.g.
Code:
su
setprop persist.usb.eng 0
setprop usb.rndis.enable 0
echo 0 > /sys/class/usb_composite/modem/enable

6b. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an LGE phone, try the dialer codes here and change the USB mode from AP to CP (Modem mode). If that doesn't work, then it has been reported that the following commands will also enable diagnostic mode for you:
Code:
su
echo 1 > /sys/devices/platform/lg_diag_cmd/diag_enable
setprop sys.usb.config acm,diag,mtp,adb

6c. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an HTC phone, this diagnostic driver may work for your phone.

6d. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have an Opo phone, it been reported that the following commands will enable diagnostic mode for your phone.

Code:
su
setprop sys.usb.config diag,adb

6e. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you have a custom kernel installed (which has permissive permissions) then you can probably enable diagnostic USB mode from the EFS Professional program menu.

6f. If you have enabled RNDIS + DM + Modem mode already, skip to step 7.
If you cannot find out how to access the USB settings on your phone anywhere, you may be able to force diagnostic mode by installing the Windows USB drivers for your phone in advance. You can download Motorola /Sony/ LG/ HTC/ ASUS/ Huawei /Google, etc drivers here. Otherwise do a Google /XDA search to find USB drivers for your phone. Install the USB driver.

7. Enable USB debugging on your phone. This is a hidden menu. Look for Settings menu > System > About Device > Developer. If you don't see a Developer option, then tap on the firmware build number about ten times to unhide it.
8. Connect your phone to your phone to an USB port on your PC. Do not use an USB hub, connect directly to your computer. Windows will install a diagnostic driver.
9. Open the Windows (Control panel) Device Manager and confirm that you see something like "Samsung Mobile USB Serial Port" listed there. If you see a yellow triangle there > right click and update the driver.

10. Open the "QPST Configuration" program > Ports > Add new port > choose the port labeled diagnostic > OK.
If you do not see a diagnostic port listed and you were not able to explictly able to set USB diagnostic mode earlier, then right click on the driver that Windows has assigned to your phone in the Windows (Control panel) Device Manager > Update Driver Software > Browse. Choose the folder where you extracted the USB driver that you downloaded for your phone. This forces Windows to use the downloaded driver.
11. Now select the QPST Start Clients > Software download > Backup > Start. This saves a backup copy of your phone's stock NV memory to your computer in case you need it later.
12. Navigate to the C:/Program Files/Qualcomm/QPST/bin folder.
13. Right click on ServiceProg.exe > run as administrator.
14. Choose Phone > Read from phone > UMTS System. This will show which 3G bands are currently enabled. Add checkmarks to the additional 3G bands that you would like to add. Resist the temptation to check everything unless you are prepared to troubleshoot possible issues with non-existant bands, slow boot times and other issues. Just add specific bands that you need for another carrier or are missing in the areas you travel. If you aren't sure what to add, then don't check any extra bands for now - you can always come back later after you find out which 3G bands you can actually make use of.

Either way, do not click write to phone yet. And do not close the Service Programming window either.

15. Before we write anything to your phone, we need to write enable the locations we are going to edit. Navigate to the C:/Program Files/Qualcomm/QXDM/bin folder.
16. Right click on QXDM.exe > run as administrator. If you are not adding any new 3G bands at this time, skip to step 21.
17. In the NV Browser window, scroll down to ID 01877 (aka NV 1877) > Read.
Then write "0" to NV 01877 with QXDM. This initializes (write enables) the item for QPST. We need to do the same for several more NV items.
18. Select ID 00441 > Read. > Write "0" to NV 00441 with QXDM. This initializes (write enables) the item for QPST.
19. Select ID 00946 > Read. > Write "0" to NV 00946 with QXDM. This initializes (write enables) the item for QPST.

20. Select ID 02954 > Read. > Write "0" to NV 02954 with QXDM. This initializes (write enables) the item for QPST.
21. If you do not intend to add any new LTE bands, skip to step 24. Otherwise,
Select ID 06828 > Read. > Write "0" to NV 06828 with QXDM. This initializes (write enables) the item for QPST.
22. Select ID 06829 > Read. > Write "0" to NV 06829 with QXDM. This initializes (write enables) the item for QPST.
23. If you wish to add LTE bands and have already calculated a custom value from the instructions in the thread, then use QXDM to write that value to both ID 06829 and ID 06829, writing one item at a time.
Otherwise, write (decimal) "17592185995263" to both ID 06828 and ID 06829, writing one item at a time. This will enable all LTE bands.
Note that LTE edits will only work if your firmware has an LTE modem. If you already have at least one LTE band active, then you are OK. If your current firmware is from a carrier that does not use LTE at all, then you'll also need to update your modem to an LTE capable version as well.
24. Now go back to the Service Programming window that you left open. If you added any new 3G bands, click on write to phone to write the current selection of 3G bands to your phone. Otherwise do not click write, simply continue on to the next step.

25. You are now finished editing the NV values in your phone.
26. Reboot your phone.
27 In the Service Programming screen, choose Phone > Read from phone > UMTS System to confirm that your new 3G band selection are persistent. If they revert and you don't have a custom kernel installed, this confirms that you will need a custom kernel for this mod to work.
28. In the QXDM NV Browser screen, scroll down to ID 06828 > Read. Note the value.
29. In the QXDM NV Browser screen, scroll down to ID 06829 > Read. Note the value.
ID 06828 and ID 06829 should both show the custom value that you wrote. i.e. "17592185995263" (or hex "0xFFFFFFF3FFF") or the custom value, if you had used one.

30. Remember to change your USB settings back to normal mode, e.g. on the S5, dial *#0808# again and choose USB = AP and USB Settings = MTP + ADB > Click OK.
31. Celebrate! And let us know about your success (or sticking points).
32. You can test your results by checking whether your phone uses the new bands when you roam onto other systems that use them. Or if you have a SIM card for an alternate carrier. To tell if your phone is using the new bands, you can look at the current band being used in the Service menu or with various apps, e.g. LTE Discovery.

Your device should be rooted.

1. Enter into diag mode from *#0808# dial pad command. If a direct dial doesn't get you to the menu then use any Secret Code explorer app from Google Market, e.g. Phone Info Samsung by @vndnguyen.

AP
RMDIS + DM + MODEM

2. Enter into USB debug mode,
3. In Terminal Emulator ran
su
setenforce 0

4. Connect to PC
5. In device manager enable hidden devices.
You should see your Sammy in ports like COMxx

6. Run QPST
7. In QPST, add the COM port where you see your device. If one port won't work, try the next one.

Now you should be able to run NV manager or QXDM.

NV values responsible for GSM are 00441, 00946, 02954 and 01877

NV values responsible for LTE bands are 06828 and 06829.

The correct values that you would write in these NV can be derived by using Qualcomm NV Calculator app by @vndnguyen.
Further details on the values are in this thread http://xdaforums.com/andr...lcomm-t2950491 courtesy of @yakapa40

---------------
Another important aspect of controlling the phone network behaviour is through the hidden menu.
Use with extreme care & do this at your own risk.

Here's how you can check you existing LTE bands:

Open the dial pad
Type: *#0011# to enter Service Mode (Be very careful with what you do here)
Note: You need to be rooted for this to work
Once in Service Mode, do the following:
Tap the menu button and tap Back
Tap the menu button again and select "Key Input" and enter an upper case Q and press OK
Tap the menu button again and select "Key Input" and enter 4 zeroes (0000) and press OK
Wait 5 - 15 seconds. You'll see the Main Menu
Choose option [2]: UE SETTING & INFO
Choose option [1]: SETTING
Choose option [1]: PROTOCOL
Choose option [2]: NAS
Choose option [1]: NETWORK CONTROL
Choose option [4]: BAND SELECTION
Choose option [4]: LTE Band Preference
Choose option [7]: LTE ALL (Or you can choose any band instead)
If you want to go back then tap the menu button and choose Back (Don't press the back key)

Press the back key to exit

 

[Isriam]

seems most have lost interest because its not capabile with the basic instructions provided previously. good luck though, let me know if you ever need a g900f nv list.

 

[botwa2000]

seems most have lost interest because its not capabile with the basic instructions provided previously. good luck though, let me know if you ever need a g900f nv list.

True. Just hoping one day someone with specific knowledge will be able to move it forward.

My motivation for reviving the topic was as someone destroyed their LTE bands through service menu and I believe our method can help restore it.

 

[juDGEY2k10]

3rd time lucky for this topic

Just dont let ffff spoil it again.

 

[botwa2000]

3rd time lucky for this topic

Just dont let ffff spoil it again.

Far from that. Need to get it in motion first

 

[botwa2000]

@Hongdae since the latest samsung rom update I also reach *#0808# through hidden menu app only, not via dial pad.

I'll update the OP accordingly.

I had the issue of QPST connection dropping but was able to reestablishe after several attempts.

Try to launch nv manager, you should be able to select the 3g bands from the check boxes without the need of edit nv values manually.

Also check if your phone shows a valid IMEI number that also equals the one printed on the back of your device.

 

[Hongdae]

@Hongdae since the latest samsung rom update I also reach *#0808# through hidden menu app only, not via dial pad.

I'll update the OP accordingly.

I had the issue of QPST connection dropping but was able to reestablishe after several attempts.

Try to launch nv manager, you should be able to select the 3g bands from the check boxes without the need of edit nv values manually.

Also check if your phone shows a valid IMEI number that also equals the one printed on the back of your device.

Okay. Yeah the IMEI is the same as the one printed on the back, so I guess it is valid. By now I'm trying to fix the QPST connection but it is not working yet.

Maybe KIES recovery could fix my phone, but I think this problem comes from EFS folder and I don't know if KIES reinstalls that content.

 

[botwa2000]

Okay. Yeah the IMEI is the same as the one printed on the back, so I guess it is valid. By now I'm trying to fix the QPST connection but it is not working yet.

Maybe KIES recovery could fix my phone, but I think this problem comes from EFS folder and I don't know if KIES reinstalls that content.

Yeah maybe a good idea to do a full format and then use kies recovery.

I can upload my EFS folder backup for you if you want to check against your existing folder and see if there're any major differences.

Though mine is a G906K model if it makes any difference.

 

[botwa2000]

....

 

[Hongdae]

Yeah maybe a good idea to do a full format and then use kies recovery.

I can upload my EFS folder backup for you if you want to check against your existing folder and see if there're any major differences.

Though mine is a G906K model if it makes any difference.

That would be awesome, thanks! I made a backup of my NV values with QPST but the restore is not working, so I have no backup of mine.

Actually, what I modified are these values, following the procedure on:

http://xdaforums.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059

17. In the NV Browser window, scroll down to ID 01877 (aka NV 1877) > Read.
Then write "0" to NV 01877 with QXDM. This initializes (write enables) the item for QPST. We need to do the same for several more NV items.
18. Select ID 00441 > Read. > Write "0" to NV 00441 with QXDM. This initializes (write enables) the item for QPST.
19. Select ID 00946 > Read. > Write "0" to NV 00946 with QXDM. This initializes (write enables) the item for QPST.

20. Select ID 02954 > Read. > Write "0" to NV 02954 with QXDM. This initializes (write enables) the item for QPST.
21. If you do not intend to add any new LTE bands, skip to step 24. Otherwise,
Select ID 06828 > Read. > Write "0" to NV 06828 with QXDM. This initializes (write enables) the item for QPST.
22. Select ID 06829 > Read. > Write "0" to NV 06829 with QXDM. This initializes (write enables) the item for QPST.
23. If you wish to add LTE bands and have already calculated a custom value from the instructions in the thread, then use QXDM to write that value to both ID 06829 and ID 06829, writing one item at a time.
Otherwise, write (decimal) "17592185995263" to both ID 06828 and ID 06829, writing one item at a time. This will enable all LTE bands.

Maybe I made a mistake when changing them.

 

[botwa2000]

That would be awesome, thanks! I made a backup of my NV values with QPST but the restore is not working, so I have no backup of mine.

Actually, what I modified are these values, following the procedure on:

http://xdaforums.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059

17. In the NV Browser window, scroll down to ID 01877 (aka NV 1877) > Read.
Then write "0" to NV 01877 with QXDM. This initializes (write enables) the item for QPST. We need to do the same for several more NV items.
18. Select ID 00441 > Read. > Write "0" to NV 00441 with QXDM. This initializes (write enables) the item for QPST.
19. Select ID 00946 > Read. > Write "0" to NV 00946 with QXDM. This initializes (write enables) the item for QPST.

20. Select ID 02954 > Read. > Write "0" to NV 02954 with QXDM. This initializes (write enables) the item for QPST.
21. If you do not intend to add any new LTE bands, skip to step 24. Otherwise,
Select ID 06828 > Read. > Write "0" to NV 06828 with QXDM. This initializes (write enables) the item for QPST.
22. Select ID 06829 > Read. > Write "0" to NV 06829 with QXDM. This initializes (write enables) the item for QPST.
23. If you wish to add LTE bands and have already calculated a custom value from the instructions in the thread, then use QXDM to write that value to both ID 06829 and ID 06829, writing one item at a time.
Otherwise, write (decimal) "17592185995263" to both ID 06828 and ID 06829, writing one item at a time. This will enable all LTE bands.

Maybe I made a mistake when changing them.

Yep same happened to me! I guess editing values other than 1877, 6828 and 6829 is what killed GSM for me. That's why I haven't even quoted these steps in my guide.

I guess editing the three NV values above is safe as you can change them any time.

In terms of deriving the right decimal value you should use QualComm NV Calculator app by @vndnguyen from Google Market - it proved to be accurate.

PM me your details I'll send you my EFS backup.

 

[Hongdae]

Yep same happened to me! I guess editing values other than 1877, 6828 and 6829 is what killed GSM for me. That's why I haven't even quoted these steps in my guide.

I guess editing the three NV values above is safe as you can change them any time.

In terms of deriving the right decimal value you should use QualComm NV Calculator app by @vndnguyen from Google Market - it proved to be accurate.

PM me your details I'll send you my EFS backup.

Sent! How did you manage to fix the QPST connection? Still dropping

 

[botwa2000]

Sent! How did you manage to fix the QPST connection? Still dropping

I did a clean install of the stock firmware.

My QPST connection wasn't completely dead but dropped every few seconds or so.

I was able to open NV Manager, select all GSM bands and write to the phone within a couple of seconds. The connection dropped before the write operation was finished but I managed to get the network back.

Afterwards I got QPST connection back normally.

 

[Hongdae]

I did a clean install of the stock firmware.

My QPST connection wasn't completely dead but dropped every few seconds or so.

I was able to open NV Manager, select all GSM bands and write to the phone within a couple of seconds. The connection dropped before the write operation was finished but I managed to get the network back.

Afterwards I got QPST connection back normally.

Okay. The same happened and now connection is working fine. Just one more question, in order to edit the NV values I have opened QXDM, then NV Browser. Now I have the following values from the calculator:

NV 1877: 844, 425, 062, 777, 216

How do I input this?

 

[botwa2000]

Okay. The same happened and now connection is working fine. Just one more question, in order to edit the NV values I have opened QXDM, then NV Browser. Now I have the following values from the calculator:

NV 1877: 844, 425, 062, 777, 216

How do I input this?

I'm not sure I understand how you got to these values...

For starters I suggest you check all your phone's default bands and calculate the decimal value. You should use it without commas.

In my first post in this thread I included the original guide on how to edit the NV values with QXDM.

Read the current value from 1877, what does it say?

BTW if you find any of my posts useful feel free to hit 'Thanks' button

 

[Hongdae]

I'm not sure I understand how you got to these values...

For starters I suggest you check all your phone's default bands and calculate the decimal value. You should use it without commas.

In my first post in this thread I included the original guide on how to edit the NV values with QXDM.

Read the current value from 1877, what does it say?

BTW if you find any of my posts useful feel free to hit 'Thanks' button

Yeah you are right, I am a total rookie here. If I read 1877 it it shows 0, but now I have written 422212531388608. I have selected "Use QXDM Notation" on the NV calculator, I guess that should be correct.

However, the calculator gives 192 for NV 0441 and when I write it it says: Parameter Bad. I have 0 on nam and 0xFFFF on band when I read it

 

[botwa2000]

Yeah you are right, I am a total rookie here. If I read 1877 it it shows 0, but now I have written 422212531388608. I have selected "Use QXDM Notation" on the NV calculator, I guess that should be correct.

However, the calculator gives 192 for NV 0441 and when I write it it says: Parameter Bad. I have 0 on nam and 0xFFFF on band when I read it

Looks like by now you should have your 3G connection back I hope

Do you also have your LTE back?

I believe only NV 6828 and 6829 are relevant for LTE.
What values do you read in those?

 

[Hongdae]

Looks like by now you should have your 3G connection back I hope

Do you also have your LTE back?

I believe only NV 6828 and 6829 are relevant for LTE.
What values do you read in those?

I have nothing back, still no signal. No GSM, 3G or LTE. I can't write on NV 0441, 0946, 2954 values...

 

[botwa2000]

I have nothing back, still no signal. No GSM, 3G or LTE. I can't write on NV 0441, 0946, 2954 values...

Hmm. At this point I had my connection back after reboot.

As I said I haven't touched 0441, 0946 or 2954 lines.

Here is my entire NV dump shortly - you can have a look vs. your values
http://xdaforums.com/showthread.php?p=56215728

So just brainstorming now.

Did you activate all possible gsm bands in NV manager and was able to write to your phone?

Are your APN settings intakt?

 

[Hongdae]

Hmm. At this point I had my connection back after reboot.

As I said I haven't touched 0441, 0946 or 2954 lines.

Here is my entire NV dump shortly - you can have a look vs. your values
http://xdaforums.com/showthread.php?p=56215728

So just brainstorming now.

Did you activate all possible gsm bands in NV manager and was able to write to your phone?

Are your APN settings intakt?

My APN is fine yeah.

All 0441, 0946 and 2954 show 0 when I read from phone. If I write the values from the NV calculator on QXDM it says error, parameter bad.

By NV manager do you mean QPST Service Programming / UMTS System?

This is what I have when I click on Read from phone: