[GUIDE][PARTIAL] Unlock Additional LTE bands on Chinese & US variants of OnePlus 3

[otonieru]

[GUIDE][PARTIAL] Unlock Additional LTE bands on Chinese & US variants of OnePlus 3

[GUIDE] [How To] Unlock Additional LTE bands on Chinese & US variants of OnePlus 3 (Band 5 confirmed WORK)

UPDATE 9 : Please use this static nvbk patch for oreo instead, it give more stable results. Credit to : @qhsusb_bulk

UPDATE 8 : : PATCH for OREO is now available https://yadi.sk/d/bQhvMaY23REaXZ]here - credit to BlackzAfiqz

UPDATE 7 :

i gonna try to clean up this thread a bit and give a better instruction, since there are lot of changes since the initial post was created - all previous method and steps now moved to second post

So basically with latest situation, there r few steps you can try to unlock your band.

but before doing so, please READ few sidenotes/conclusion that we manage to gather so far :
1. This step was MADE for and TESTED on MARSHMALLOW, and MARSHMALLOW ONLY
2. The Rmt Storage Patch will still working up to an official N ROM version of 4.0.3
3. This step/trick WONT WORK on OB12 or 4.1.0 - doing so will result in UNUSABLE RADIO or BOOTLOOP - Updated, PATCH for 4.1.x is NOW AVAILABLE in courtesy of @SnowWolf75
4. We only able to (partially) unlock bands THAT ARE AVAILABLE in one or another OP3/OP3T models. If the band is NEVER APPEAR on any of the available models, then currently it's NOT DOABLE. Example : Band 13 is nowhere to be found on any model of OP3, so there will be no support for B13, since there's not enough resources to do so
5. Up to today, there are some SUCCESS STORIES while using the method. Some of them are :

Myself, & @baskaflyfer of course - CN MODEL - B5 B8 UNLOCKED - B3+B7 CA UNLOCKED

@allluke - US MODEL - B3 UNLOCKED post #640

B3 working IMEI intact. Thank you so much

@dapsyra - US MODEL - B3 UNLOCKED post #558

After following the guide, I was able to unlock band 3 in my US model OnePlus3 A3000. See attached images
I did all the steps. My IMEI is intact.
It takes some time for the signal to show up in Network Guru, so be patient.
In Network Guru->Band Locking->LTE, uncheck all the other LTE bands leaving only band 3 checked
Then go to RAT Locking and select LTE. Wait for the signal to show up.
If Network Guru goes to WCDMA, repeat last step.

@band3pls - US MODEL - B3 UNLOCKED post #846

I can confirm my LTE band 3 is working after flashing the new QCN, BUT after flashing the QCN you must reboot and then open QXDM and write 225 to NV item 1878, or else it won't work.

Here are my steps:

First I flashed this: (other/older QCN files posted by @otonieru will probably work too)
https://yadi.sk/d/dKAKorWd3FGTXB

Then I rebooted, and flashed this: (Baskaflyfer's QCN)
https://drive.google.com/file/d/0B1R...ew?usp=sharing

Then I rebooted again, and flashed this: (Baskflyfer's fbrx file)
https://drive.google.com/file/d/0B1R...ew?usp=sharing

Then I rebooted, wrote 225 in NV item 1878 in QXDM, and finally got LTE signal on band 3 working here in Pakistan on my A3000US.

@kaiserreich - US MODEL - B3 UNLOCKED post #921

I managed to get it to work.
Now I have EU bands on my A3000CN

1. flash rmt_storage via twrp. (first page)
2. restore europe qcn. (first page)
3.restore A3003_eu from post #334 (third step)
4.run qxdm -> nv browser -> find id 1878 and change it to 237 (write).
5.reboot your phone.

Thanks

So here's what you gonna need :

1. Qualcomm USB DIAG Driver - Find it from post#2
2. QPST & QXDM - sorry but i can't redistribute it here, please look for it yourself
3. Main QCN for base, here : https://yadi.sk/d/E0y_4Ka63GNUdt
4. Extra QCN for fbrx_cal :

• A3000_cn
• A3000_us
• A3003_eu
• A3010_cn_3T

5. Rmt Storage Patch - find it from post #2 - For OOS 4.1.x download it from Here
6. Network Signal Guru App from PlayStore

Additional file for OP3T users :
1. OP3T EU QCN - Here
2. OP3T fbrx - Here

Now do the PRE-STEP,
1. Boot into TWRP
2. Flash the RMT Storage Patch according to your OS version, 4.1.x use Snowwolf version, bellow that, use Baskaflyfer version

Next, step is :

1. Opening DIAG - Assuming you got your phone rooted, run this command from ADB

adb shell
su
setprop sys.usb.config diag,adb​

2. Now your devices wil either detected as unknown device (or Qualcomm Diag Port/USB Modem if you already have the diag driver) on Device Manager
3. Install the driver from requirement list number one, and you will have "HTC USB Modem" listed in your device manager (skip this step, if you already have your own qualcomm usb diag driver installed)-(remember to disable signature enforcement if you use WIN8/10)
4. Now fire up QPST and go to "Port" tab, and choose "Add New Port" ,
5. On "Serial/USB Port" tab, unchecked the option of "Show Serial & USB...bl bla bla" option, you will see your phone listed there as a "COM#" (# is a number depending on your PC) choose it, and click "OK"
6. Now choose "Start Clients" from the Menu tab above, and choose "Software Download"
7. Airplane Mode your Phone
8. Choose "Restore" Tab, and click browse for QCN file, and look for the QCN you have downloaded from requirement list Number 3 (if you need B3 on your US, use CN QCN, if you need B5 or B8 on your CN Model, use EU QCN. US QCN is still experimental)
9. Check "Allow phone/ESN mismatch"
10. Click "Start" and wait for the process to complete
11. After complete, wait 30 Seconds (for curing time), close QPST and reboot your phone
12. Once it fully boot, open back your CMD and re-run command from step number 1 to re-open your DIAG port
13. Use the "Software Download" function again, and restore the supporting QCN from requirement list Number 4 (choose one according to your needs)
14. Click "Start" and wait for the process to complete
15. After complete, wait 30 Seconds (for curing time), and reboot your phone
16. Once it fully boot, open back your CMD and re-run command from step number 1 to re-open your DIAG port, and make sure it detected on QPST
17. Now Open your "QXDM", choose options tab - "Communications", and choose the port according to your DIAG Port, and hit OK
18. Now choose "View" - "New" - "Common" - "NV Browser"
19. Go to NV ID 1878, and click "Read"
20. According to your needs, change the value. (If you need B3, B5, B8 on CN Model, use 237. If you need B3 on US Model, use 231 or 225)
21. Click "Write"
22. After complete, wait 30 Seconds (for curing time), close QXDM and reboot your phone
23. Run Network Signal Guru, choose "Clear Forcing" from the Tri-dot menu on top right
23. Continue with choosing "Band Locking" and choose only your new unlocked LTE Band. Hit OK, if warning about powercycle appear, just hit OK as well
24. Wait for a while until your phone picking up signal. To make it faster, you might want to lock your network mode to LTE ONLY through *#*#4636#*#* or through Network Signal Guru

That's it, if everything is well, you should have your new LTE BAND working now.

 

[otonieru]

I gonna try to clean up the first post,

so i move all previous update to 2nd post :

[GUIDE] [How To] Unlock Additional LTE bands on Chinese & US variants of OnePlus 3 (Band 5 confirmed WORK)

UPDATE 6 : Based on guidance from Baska, i re-tweak the QCN for more proper IMEI removal, please try again accordingly based on your needs :

WARNING : NOT COMPATIBLE WITH 4.1.0

Based on guidance from @baskaflyfer few posts back

here i upload the new version set of modified QCNs : https://yadi.sk/d/E0y_4Ka63GNUdt

you guys can try again to flash it on your OP3 (still no OP3T at the moment)

Step required would be :

1. Have your Rmt Storage Patched - if havent, flash the storage patch
2. Flash One of the QCN from the zip file, depending on your need, If you are loking for B3, u can try CN or EU model. If you need B5, then use US or EU model, and if you need B4, try to use US model
3. Use QXDM to edit the NV Value of NV item 1878 based on your needs, in my case, to be able to use B3, B5 and B40 i need to use EU QCN and set the id to 237, if you look for B3 on your US Model, u might want to try 225, 231 or 237. Meanwhile if you need B4, you might want to try 232
4. Open Network Signal Guru, and lock the LTE band to the only band you want to test, and wait. It takes quite sometime to get reception. Also make sure you are in area where the band you look for has strong reception.

UPDATE 5 : I managed to create EASY WAY to unlock necessary Bands, - you can skip all the steps in this post, except for the flashing RMT Storage Patch step. Thats the MAIN REQUIREMENT

for the one who need band 3 on the US Model, flash this QCN : https://yadi.sk/d/4Y2lpk5Y3EqYZn
for the one who need band 4, 12, 17 & 30 on CN/EU model, flash this : https://yadi.sk/d/5c8r8Xle3Eqmo8
for the one who need band 5, 8 & 20 on CN/US model, flash this : https://yadi.sk/d/lGURsV523EqqM5

UPDATE 4 : Thx to Baskaflyfer for his work in separating QCN, now we managed to Unlock Band 5 & 8 and Keep Our IMEI Intact - New QCN for Band 5 & 8 ADDED to Download Section

Update 1 : I reupload the QCN with safety precaution so that you can input your own IMEI to prevent accidental IMEI overwritten
- this solution is no longer working for OnePlus
Update 2 : I found that in order to use Band 3, we need to use A3000CN QCN as base. Meanwhile, if we want to use band 5, 8 and possibly 20, we need to use A3003 base. So please download according to your needs

Update 3 :

Ok,

It seems that Oneplus is using an encryption when storing the IMEI in QCN,

Thus the normal editing method for qualcomm chipset wont work,

This is means that we cant use a full QCN as based,

because even when it successfully unlocked the band, the IMEI mashup will become a problem in a long term use

Instead, we need to take only several parts of the QCN itself to be written later

For now, i will take down the DL link for the QCN first, as it may exposed my or others IMEI accidentally.

Sorry for this, but we gonna need to find a better solution

Good things we can learned is : at least we know that its not entirely impossible

Salam from Indonesia

I had confirmed Band 3, 5, 8 and 40 are all workings in my A3000

Another GOOD NEWS is :
@allluke & @koko21341 confirmed that Band 3 is UNLOCKED and USABLE in their US variants

So after trying so many ways (Thx to @baskaflyfer who manage to bring back my courage to tinker on this), simple and hard one to unlock additional LTE Bands on our beloved A3000 to match the one from A3003

also credit to @devilsshadow & @Albirew who bring the initial & original way of unlocking extra bands for us all

and extra thanks to :

Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software and for the modified OnePlus Drivers
Thanks to @olokos for his original tutorial
Thanks to @fards for finding the diagnostics command that made all this possible

also thanks to this japanese guy here : https://logicalmemo.net/2016/10/19/post-300/ that enlighten all of us regarding the static_nvbk.bin modification so that we can begin to tinker with the NV value on our OP3

I finally (kinda) found a way to unlock more bands

WARNING : Do THIS WITH YOUR OWN RISK, I am not responsible for any harm that can happen during the process of unlocking the LTE BANDS, ALWAYS MAKE BACKUP FIRST

First, what you gonna need to have are :

1. Qualcomm Diag Driver - Here - i mod the HTC driver, you can use your own driver if you have one
2. Marshmallow ROM with DIAG capability (example : mine done on @arter97 CM13, but OOS is perfectly fine)
3. QPST - please find it yourself, i got mine from company, and i wont share link to cracked version here
4. DFS Tool - Here
5. PC (Win 7 64 preferable) with ADB n fastboot driver installed - Minimal ADB Download Here
6. Dedicated QCN for Each Needed Band, Currently we only managed to Get Working QCN for Band 5 & 8 -

• Band 5 & 8 QCN - Download Here

7. HEX Editor to insert your own IMEI - Here
8. Unlocked BL & Rooted device with TWRP Recovery Installed - I assume every of OP3 users know how to do this, or kind enough to find the way by themself
9. Network Signal Guru App from PlayStore
10. Rmt Storage Patch Zip (credit to @baskaflyfer) - Here *for Nougat Users & Op3T users, use this one instead : Rmt Storage Patch 4.x --> This (probably) wont work on firmware newer than OB9, latest tested is on 4.0.3

Ok, here we Go !

1. First, copy the rmt storage patch zip from list number 9 above to your internal storage of OP3
2. Boot into TWRP, do BACKUP for your EFS partition, then continue with flashing that zip
3. Reboot into system, and you should get warning about EFS Partition mismatch, ignore or closed that warning (i choose to ignore it forever, so it wont annoy me upon reboot)
4. Now open up your CMD and run this ADB command :

adb devices
adb shell
su (you will get pop up on your phone to give root authorization for ADB, authorize it)
setprop sys.usb.config diag,adb (this will open your OP3 diagnostic port)

5. Now your devices wil either detected as unknown device (or Qualcomm Diag Port/USB Modem if you already have the diag driver) on Device Manager
6. Install the driver from requirement list number one, and you will have "HTC USB Modem" listed in your device manager (skip this step, if you already have your own qualcomm usb diag driver instaled)
7. Now fire up QPST and go to "Port" tab, and choose "Add New Port" ,
8. On "Serial/USB Port" tab, unchecked the option of "Show Serial & USB...bl bla bla" option, you will see your phone listed there as a "COM#" (# is a number depending on your PC) choose it, and click "OK"
9. Now choose "Start Clients" from the Menu tab above, and choose "Software Download"
10. Airplane Mode your Phone

11. Now open the HEX Editor, and open either the A3003 or A3000CN QCN file (depends on which bands you want to unlock) you have downloaded, and find this entry AA AA AA AA AA AA AA AA and replace it with your own 16 digit of IMEI in a HEX format (use online IMEI to HEX converter if you don't know how to do so or use this App : https://drive.google.com/file/d/0B09fj-nvjJeodlVaZHdVb29RaHc/view?usp=sharing ) and SAVE AS the file somewhere you can easily find. - this info is obsolete now

For the 2nd IMEI number you can search for 88 00 01 00 26 02 00 00 then the hex after is the IMEI, so you can just replace that with your 2nd IMEI number - Thx to @DarkN3ss61 for the findings

WARNING : WHEN INPUTTING YOUR IMEI, PLEASE MAKE SURE YOU INPUT THE HEX VALUE OF YOUR IMEI, NOT THE IMEI NUMBER ITSELF, ELSE YOU MIGHT INJECTING A RANDOM IMEI TO YOUR DEVICES

12. Choose "Restore" Tab, and click browse for QCN file, and look for the QCN you have downloaded from requirement list Number 6
13. Check "Allow phone/ESN mismatch"
14. Click "Start" and wait for the process to complete

15. After complete, wait 30 Seconds (for curing time), close QPST and reboot your phone
16. Once it fully boot, open back your CMD and re-run command from step number 4 to re-open your DIAG port

17. After the port opened and detected, open your DFS Tool (downloaded from requirement list number 4)
18 . If it ask for login just close the window
19. You will see your device listed in "Port" tab, double click it to trigger connection
20. Once you see "Device in diagnostic Mode" in DFS log windows, go to "Bands" tab

21. Choose "LTE" Tab
22. Choose "LTE BC Config" on the right side
23. Click "Read" and see, confirm first that u have all the A3003 LTE bands activated, IF NOT, REPEAT STEP 1 to 14
24. If you can confirm that the default Band of A3003 already Opened/activated, now add more bands as you desired - by put a checkmark on it (remember that even if it enabled, your phone need hardware capability to connect - i only managed to try on band 5 & 8, my country has no others band, so please try it yourself and tell us here the result)
25. Once you done, click "WRITE"
26. Wait for the countdown process done, and check the log whether "Operation Completed" or not
27. Once everything is done. Wait again for 30 Seconds, and reboot your phone
28. After it fully booted, turn OFF the AIRPLANE Mode, and wait for the reception - it can take up to few minutes for the radio to get reception
29. Now, open up "Network Signal Guru" that you have downloaded from PlayStore, if it ask for Root Access, Grant it
30. Click the "Magic Wand" at the top bar, and choose "Band Locking"
31. Choose "LTE"
32. Now see, whether Bands you added is there or not. If NOT, CLICK AGAIN on the "Magic Wands" icon, and click "Clear All" and confirm the dialog that appear
33. After step 32, you should see that all Bands were added now !

NOW! Go out and try yourself whether you can manage to get a reception using your new bands.

TIPS : If you are sure that your area has certain bands, you can use "Network Signal Guru" Band Locking menu to disable some bands and only enable the one you want to test to check whether you can get reception or not. I used to disable all except band 5 & 26 to confirm whether the UNLOCK process is WORK or not. And IT WORK (see screenshot on 2nd post)


Screenshot :

 

[Crahzee]

Thanks for your work!

Any chance of adding band 66?

Sent from my ONEPLUS A3000 using Tapatalk

 

[otonieru]

Thanks for your work!

Any chance of adding band 66?

Sent from my ONEPLUS A3000 using Tapatalk

Logically speaking, step above only can opened up to band 44 on our phone

Rest of the bands would need latest QXDM from Qualcomm, which unfortunately i dont have in my belonging (license is expensive, as u know)

 

[DarkN3ss61]

Can anyone confirm this worked for unlocking band 3 on the US model?

 

[otonieru]

Can anyone confirm this worked for unlocking band 3 on the US model?

I think if moderator can bring this up, more US model users can try to see whether it can open the band 3 or not.

i have one friend who bought OP3 from US and brought it here to my country (which using band 3 as major LTE bands), i'll try to persuade him to try

 

[meqwerty]

Will this method work for adding bands 2 and 4 for A3003?

 

[otonieru]

Well this method work for adding bands 2 and 4 for A3003?

Please try and help us to builds more results databases

 

[baskaflyfer]

Please try and help us to builds more results databases

Good job,
but
What can I say, I began my work from this by adding LTE Bands. Here will not work B3 and B20, but will work LTE CA B7+B7 ( hw id are different ). At the moment I stopped on this.
Now I don't have time to explain everything.

 

[otonieru]

Good job,
but
What can I say, I began my work from this by adding LTE Bands. Here will not work B3 and B20, but will work LTE CA B7+B7 ( hw id are different ). At the moment I stopped on this.
Now I don't have time to explain everything.

I think the key is in flashing clean the QCN of 3003 so we can get the proper config for LTE band,

And using DFS Tool,

Because somehow QXDM cant "bruteforce write" some NV,

Engineer guy from my company said its due to older version of QXDM (we need to buy new one - my company, i mean)

You might want to try again using DFS

After all, its your persistence that encourage me to keep trying

 

[baskaflyfer]

I think the key is in flashing clean the QCN of 3003 so we can get the proper config for LTE band,

And using DFS Tool,

Because somehow QXDM cant "bruteforce write" some NV,

Engineer guy from my company said its due to older version of QXDM (we need to buy new one - my company, i mean)

You might want to try again using DFS

After all, its your persistence that encourage me to keep trying

Okay, i'll try it

And you are right about QXDM, I noticed that it didn't always writes the some NV

 

[meqwerty]

Please try and help us to builds more results databases

i would, but the place i live has no band 2/4 to test it with. it'd be nice if we can find a generic way to unlock all bands for all models.

 

[otonieru]

i would, but the place i live has no band 2/4 to test it with. it'd be nice if we can find a generic way to unlock all bands for all models.

Basically you can tick all the bands available in DFS Tool to unlock all band,

It might not work though, since not every band is preconfigured in the radio of the phone,

Thats why i only unlock bands which avail in A3003 model, so that i can get the radio config for that band using the QCN dump.

Theoritically, the one that should work well after unlocked is band 3, 5, 8, 20 and 40

 

[gillim74]

Can anyone confirm it gives you a option to unlock band 13 before i do this

 

[otonieru]

Can anyone confirm it gives you a option to unlock band 13 before i do this

Unlock Option is available for Band 1 - 44

 

[gillim74]

Unlock Option is available for Band 1 - 44

Ok thanks for your response

 

[Stupifier]

Yes! If I can get Band 20 in USA, We can get these phones working on Verizon! Right?

 

[otonieru]

Yes! If I can get Band 20 in USA, We can get these phones working on Verizon! Right?

Theoritically, as long as the config for antenna is also there,

Baska used to be able to find band 20 during his experience, so i can say that its achieveable,

Thing i notice is, the phone wont pick up the unlocked band, if you also playing around with the GSM and WCDMA band,

Before, i already managed to unlocked the band, but it wont pick up reception, that is when i still combine it with the NV value mod for GSM and WCDMA

I decided to revert everything back and using A3003 NV value as a base, and then do the unlocking from there,

And, voila, we got lucky !

 

[gillim74]

Yes! If I can get Band 20 in USA, We can get these phones working on Verizon! Right?

Verizon is band 13 isnt it

---------- Post added at 09:44 PM ---------- Previous post was at 09:43 PM ----------

https://www.frequencycheck.com/carriers/verizon-wireless-united-states

 

[Stupifier]

Verizon is band 13 isnt it

---------- Post added at 09:44 PM ---------- Previous post was at 09:43 PM ----------

https://www.frequencycheck.com/carriers/verizon-wireless-united-states

Crap....yes! you are correct! I dunno why I had Band 20 floating around in my head this whole time. Yes, Band 13 is for USA Verizon (not Band 20).