[GUIDE] UNLOCK ADITIONAL BANDS FOR QUALCOMM DEVICES <OnePlus One EDITION>

Search This thread

devilsshadow

Senior Member
Sep 15, 2011
672
337
Bucharest
STOP!

By following this guide, you acknowledge that you and you alone are responsible for the proper-functioning state of your device.

I am not responsible for any harm that may come to your device.

In an attempt to make this guide short and comprehensive and also to prevent the completely uninitiated from doing something stupid, I'm going to skip babysteps like <power on your coputer> or <browse to x folder and doubleclick on y>
I start this assuming anyone following it has a basic understanding of what they're doing, what ADB is and also of the risks that come with messing with their device.


Introduction:


This guide will show you how to alter the default baseband frequencies of your qualcomm-based device, augmenting them so that (theoretically) it should work more like a global phone.

Those with an international version of the OPO can still follow this guide, if only to check your unlocked bands against those of your fellow chinese OPO owners. I'm of the opinion that even the international version lacks a few GSM/WCDMA bands, so no harm in trying to unlock some aditional ones.

This guide will, however, NOT UNLOCK ADITIONAL LTE BANDS. At least not for now. It will be updated if and when someone discovers a way to tamper with the LTE bands.

The Guide:

1. Download this archive containing all the necessary files and extract it wherever you please.

2. Enable Android Debugging on your phone and connect it to your computer, making sure MTP and PTP are not enabled in Storage > USB computer connection

3. Open up ADB and type the following:
Code:
adb shell
Code:
su
Code:
setprop sys.usb.config diag,adb

4. Launch Device Manager and look for the Other Devices expandable menu.

5. Right click on the first device listed under that menu (the first of the two A0001 devices listed there) and choose Update Driver Software, Browse my computer for driver software, Let me pick from a list of device drivers on my computer, Show All Drivers, Have Disk and Browse

6. Browse to where you extracted OPO SPECIFIC QUALCOMM BAND UNLOCKER and locate the OPO Diagnostics Driver folder; Inside you will find 32bit and 64bit versions, pick the one relevant to you and inside you will find an .inf file that you will Open. Accept any warning messages that might pop up and let the installation of the driver complete.

7. Once everything is done installing, under Modems in Device Manager you will find HTC USB Modem. Rightclick and select Properties; In the Modem tab in the top left corner you will see Port: COM<number>. Remember that COM<number> or write it down or simply leave the window open for future reference.

8. Open the OPO SPECIFIC QUALCOMM BAND UNLOCKER folder, locate and install QPST 2.7.411 inside QPST > QPST v2.7 Build 4.11

9. Open QPST Configuration, go to the Ports tab, Add New Port (right bottom corner); In the Port field type in the COM<number> you wrote down/remembered from step 7 and in Port Label type OPO and finally click OK (left bottom corner). If you've followed all the steps correctly until here, you should be able to see this in the Active Phones tab:

byEQa.png


10. Locate and launch RF_NV_Manager.exe in the bin folder of the QPST installation directory (normally C:\Program Files (x86)\Qualcomm\QPST\bin)

11. Once you have RF_NV_Manager.exe open, click on Setting > Comport and select COM<number> from the dropdown menu and click OK; Go to File (top right corner) and select Read from Phone and let it finish.

12. Scroll down and click on line 1877 (NV_RF_BC_CONFIG_I); Copy the number displayed on the right-hand side field (the one next to < unsigned 8 bytes > Band Class(s) Supported >)

13. Locate and open mzTool_1.2.1a.exe inside OPO SPECIFIC QUALCOMM BAND UNLOCKER; select Decimal under Input Radix (top left side); Paste the number you copied in step 12 into the Decimal field under RF BC Config. You should now see your currently available bands in the Bit Information field underneath. It should look similar to this:

bxJoA.png


14. Go to Band Performance (NV Value) tab and check all the GSM and WCDMA bands; Copy the number in the Decimal field under RF BC Config (2,307,813,334,319,039,360); Copy it into a text editor and remove the ","

15. Go back to RF NV Manager and paste the clean number (2307813334319039360) into the number field next to < unsigned 8 bytes > Band Class(s) > --- if you paste the number with commas or brackets instead of just the number, you're an idiot.

16. Press WRITE NV then go to File and select Write Changed NV Items To Phone; Wait 23 seconds (because I like arbitrary waiting times), disable Android Debugging on your phone, unplug it and reboot your device; Once it comes back on, it might take a few seconds for it to acquire signal so don't panic.

ADDENDUM:

NEW LTE UNLOCKING GUIDE
Courtesy of @Albirew

Conclusion:

The only real way to know if the whole thing got applied is to do steps 1 through 13 again (obviously skipping installations) or if you are in an area where you previously had bad or no reception.

I've tested this on my 64GB Chinese OPO running stock rooted CM11S. Everything seems to work properly radio-wise, no worse than before. I'll have to travel a bit around to see if i get better or worse reception.

I'll edit this thread with any relevant information if any becomes available in the future or if anyone feels something is missing.

Thanks:

Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software and for the modified OPO Drivers
Thanks to @olokos for his original tutorial
Thanks to @Glatzi for bringing the original thread to my attention
Thanks to @fards for finding the diagnostics command that made all this possible
Thanks to @Albirew for writing an extensive LTE tutorial
 
Last edited:

-Nx-

Senior Member
Jan 11, 2013
52
15
Thank you for your help I was stucked because MTP in debugging mode was checked, and also I because I did not get the right command (setprop sys.usb.config diag,adb instead of setprop persist.usb.eng 1 in the terminal.

Cheers

PS : Love your comment "if you paste the number with commas or brackets instead of just the number, you're an idiot." ^^
 
Last edited by a moderator:

devilsshadow

Senior Member
Sep 15, 2011
672
337
Bucharest
As Galaxy S5 can use the European LTE 800mhz band, could we check the bits from S5 and try to use them in our OPO to enable 800mhz LTE band?
The S5 is an Exynos powered device, cant really do much for our Qualcomm based handsets. Besides, as far as I know, no OPO version has the 800MHz band availabe. Check out the band chart below with the available OPO bands:
bzflr.jpg

So for now you don't know how to unlock some LTE bands for the OPO?

Sent from my One A0001 using XDA Premium 4 mobile app
Not as of right now, no. I'd need confirmation from someone with a chinese OPO in the US to test if flashing the latest CM11 does anything to unlock the additional LTE bands that the Chinese OPO lacks. Otherwise, like I said in the OP, this tutorial is only for unlocking aditional GSM/WCDMA bands.

I'm sure someone smarter than me will find a way to get to the LTE bands as well. Just give it time.
 

skydayzer

Senior Member
Jul 11, 2014
272
90
Vicenza,Italy
The S5 is an Exynos powered device, cant really do much for our Qualcomm based handsets. Besides, as far as I know, no OPO version has the 800MHz band availabe. Check out the band chart below with the available OPO bands:
bzflr.jpg


Not as of right now, no. I'd need confirmation from someone with a chinese OPO in the US to test if flashing the latest CM11 does anything to unlock the additional LTE bands that the Chinese OPO lacks. Otherwise, like I said in the OP, this tutorial is only for unlocking aditional GSM/WCDMA bands.

I'm sure someone smarter than me will find a way to get to the LTE bands as well. Just give it time.

Noob question will i have to do this anytime i flash a new rom or update??
 

devilsshadow

Senior Member
Sep 15, 2011
672
337
Bucharest
OK thx! I really appreciate your work! Btw the EU GS5 has the Snapdragon 801 ;)

Sent from my A0001 using XDA Premium 4 mobile app
Oh yes, my mistake, although, to my knowledge it uses an 805 and not an 801. Feel free to correct me on that!
Noob question will i have to do this anytime i flash a new rom or update??
I'm not 100% sure but I think think so. Flashing a new rom also flashes whatever radios come with the rom so that might overwrite everything. Need someone to test this.
Got manically busy week ahead, so not sure I can get to my pc to look at the lte.
If you can do some screen shots of the codes in nv manager (like the 1187) there might be something that shows up.

Sent from my A0001 using Tapatalk
As this is still a work in progress, any further studies into the matter (from different devices owners as well) will only help us further our goal of unlocking full LTE.
 
Last edited:

skydayzer

Senior Member
Jul 11, 2014
272
90
Vicenza,Italy
Oh yes, my mistake, although, to my knowledge it uses an 805 and not an 801. Feel free to correct me on that!

I'm not 100% sure but I think think so. Flashing a new rom also flashes whatever radios come with the rom so that might overwrite everything. Need someone to test this.

Then i guess this wont affect me since am using Multirom and the custom rom does not flash any radio...
 
  • Like
Reactions: adiktivedrumz

frog3000

Member
Jul 29, 2014
18
1
@devilsshadow

Could you list what base band available after the hack? That will be very helpful if you could post a screen capture for the step 13 after the modification.

I am particular interested on 1700MHz (AWS or WCDMA-4) at 3G. Thanks a lot
 

valexi

Senior Member
Sep 19, 2010
219
42
Kuopio
Oh yes, my mistake, although, to my knowledge it uses an 805 and not an 801. Feel free to correct me on that!
http://en.m.wikipedia.org/wiki/Samsung_Galaxy_S5

European version has the Snapdragon 801. In Korea they announced a LTE-A version which has the 805 processor. They also said that they will not sell the LTE-A version outside if the Korea.

Since we have the same SoC as the Galaxy S5 European version and S5 can do the 800mhz LTE, technically OPO should be able to use that band alao.

Because radio chip is inside of the Snapdragon 801 SoC, I don't believe that there is any hardware limitations.
 
  • Like
Reactions: devilsshadow

dlhxr

Senior Member
May 26, 2011
516
500
New York City
About FDD-LTE and WCDMA restriction in China.

It may not be related to Baseband.

What I found is that Color OS could modify modemst1 or modemst2 partition to unlock the restriction in China. It has nothing to do with NON-HLOS.bin.

But here's another possibility that we could modify NON-HLOS.bin directly to get FDD-LTE and WCDMA in China supported. But it is not what color os crack does.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 82
    LTE Tutorial (yet another addendum for OP)

    Here I tried to make a step by step compilation of all you need to unlock LTE bands in OP style.

    Working only on kitkat and below
    ONLY FOR 1+1


    Introduction:

    Since OP, we got bads and goods, all NV write ability are belong to CM, for great justice, dlhxr took off every lock, etc. but since I'm lazy and all, I'm going to stop introduction there.
    It will theoretically unlock:
    GSM: DCS-1800/P-GSM/E-GSM/GSM-850/Railways-900/PCS-1900
    WCDMA: Band I to XI
    LTE: Band 1, 2, 3, 4, 5, 7, 8, 12, 13, 17, 19, 20, 21
    PS: Even if they're theoretically enabled, some band cannot be used because of hardware limitation...

    The Guide:

    1. Download the rmt_storage patch and put it in your phone storage's root.

    2. reboot your phone in recovery mode, install the rmt_storage patch then reboot in system mode aka normal mode. (when phone start, you won't have any signal for a min or two so don't panic)

    3. Follow OP's steps from 1 to 9 (we need QPST configuration's server configured and active)

    4. Download and install QXDM.

    5. Open QXDM Pro, go to Options menu, Communications and set Target port to your phone.

    1-comm.png


    6. Back to QXDM main window, in the "View" drop-down menu, select NV Browser

    2-nv_browser.png


    Now the fun part begin
    7. Inside the NV Browser window, scroll down and click on line 01877 (rf_bc_config)(1); click the Read button(2), save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 3460734838925427584(3) and click on Write button(4).

    3-nv_edit.png


    8. Inside the NV Browser window, scroll down and click on line 00946 (band_pref_16_31); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x0FF8 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (copy-pasta FTW)

    9. Inside the NV Browser window, scroll down and click on line 02954 (band_pref_32_63); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 805765120 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (Man, I love copy-pasta)

    10. Inside the NV Browser window, scroll down and click on line 00441 (band_pref); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x380 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (I fkin love copy-pasta)
    edit: If you have problem with selection, you can either choose 0xFFFF or editing it directly from your phone: call / *#*#4636#*#* / Device info / Menu / Radio band select > Automatic (more infos on 00441)

    11. Inside the NV Browser window, scroll down and click on line 06828 (lte_bc_config); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 1904863 (please don't be an idiot and don't edit the empty one with "ext" in the name) and click on Write button. (Did I told you how much I love copy-pasta?)

    12. Now Close QXDM; Wait 23 seconds (because, like OP, I like arbitrary waiting times), disable Android Debugging on your phone, unplug it and reboot your device; Once it comes back on, it might take a minute or two for it to acquire signal so don't panic.

    Conclusion:

    The only real way to know if the whole thing got applied is to do steps 1 through 6 again (obviously skipping installations) and reading all values or if you are in an area where you previously had bad or no reception.
    You can see unlocked GSM/UMPTS bands from the *#*#4636#*#* service menu (3dots > set GSM/UMTS band)

    Original Values (in case you didn't saved your values):
    My Intl 1+1:
    01877: 562950069289856
    00946: 0x06E8
    02954: 131072
    00441: 0x380
    06828: 687194832973


    Chinese 1+1:
    01877 : 562950035735424
    00946 : 0x04A8
    02954 : 0
    00441 : 0x0
    06828 : 962072674373


    Sources:
    NV Values
    rmt_storage patch
    original chinese values

    Thanks:
    Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software, for the modified OPO Drivers and for the LTE NV values
    Thanks to @olokos for his original tutorial
    Thanks to @Glatzi for bringing the original thread to my attention
    Thanks to @fards for finding the diagnostics command that made all this possible

    Thanks to @devilsshadow(OP) for his 1+1 specific tutorial and QXDM package
    Thanks to @dlhxr for his rmt_storage patch
    Thanks to @Flint2 for chinese 1+1's original values and 00441
    And last but not least: @Cafeboy who raised my will in one post, when I was struggling writing this tutorial. :p

    Update1: added chinese values and specify witch bands are enabled.
    Update2: added details about 00441
    Update3: forgot to check 11's name of value not to edit. updated thanks to @SoWErA
    Update4: unusability of band 20
    Update5: added service menu code to see 3G band unlock
    Update6: spelling correction + unusability of band 5
    Update7: added band 12 and link
    Update8: canceled update 7 (reason)
    Update9: removed band 2 (src)
    update10: added statement that it won't ****ing work with other ****ing phones or upper versions.
    77
    STOP!

    By following this guide, you acknowledge that you and you alone are responsible for the proper-functioning state of your device.

    I am not responsible for any harm that may come to your device.

    In an attempt to make this guide short and comprehensive and also to prevent the completely uninitiated from doing something stupid, I'm going to skip babysteps like <power on your coputer> or <browse to x folder and doubleclick on y>
    I start this assuming anyone following it has a basic understanding of what they're doing, what ADB is and also of the risks that come with messing with their device.


    Introduction:


    This guide will show you how to alter the default baseband frequencies of your qualcomm-based device, augmenting them so that (theoretically) it should work more like a global phone.

    Those with an international version of the OPO can still follow this guide, if only to check your unlocked bands against those of your fellow chinese OPO owners. I'm of the opinion that even the international version lacks a few GSM/WCDMA bands, so no harm in trying to unlock some aditional ones.

    This guide will, however, NOT UNLOCK ADITIONAL LTE BANDS. At least not for now. It will be updated if and when someone discovers a way to tamper with the LTE bands.

    The Guide:

    1. Download this archive containing all the necessary files and extract it wherever you please.

    2. Enable Android Debugging on your phone and connect it to your computer, making sure MTP and PTP are not enabled in Storage > USB computer connection

    3. Open up ADB and type the following:
    Code:
    adb shell
    Code:
    su
    Code:
    setprop sys.usb.config diag,adb

    4. Launch Device Manager and look for the Other Devices expandable menu.

    5. Right click on the first device listed under that menu (the first of the two A0001 devices listed there) and choose Update Driver Software, Browse my computer for driver software, Let me pick from a list of device drivers on my computer, Show All Drivers, Have Disk and Browse

    6. Browse to where you extracted OPO SPECIFIC QUALCOMM BAND UNLOCKER and locate the OPO Diagnostics Driver folder; Inside you will find 32bit and 64bit versions, pick the one relevant to you and inside you will find an .inf file that you will Open. Accept any warning messages that might pop up and let the installation of the driver complete.

    7. Once everything is done installing, under Modems in Device Manager you will find HTC USB Modem. Rightclick and select Properties; In the Modem tab in the top left corner you will see Port: COM<number>. Remember that COM<number> or write it down or simply leave the window open for future reference.

    8. Open the OPO SPECIFIC QUALCOMM BAND UNLOCKER folder, locate and install QPST 2.7.411 inside QPST > QPST v2.7 Build 4.11

    9. Open QPST Configuration, go to the Ports tab, Add New Port (right bottom corner); In the Port field type in the COM<number> you wrote down/remembered from step 7 and in Port Label type OPO and finally click OK (left bottom corner). If you've followed all the steps correctly until here, you should be able to see this in the Active Phones tab:

    byEQa.png


    10. Locate and launch RF_NV_Manager.exe in the bin folder of the QPST installation directory (normally C:\Program Files (x86)\Qualcomm\QPST\bin)

    11. Once you have RF_NV_Manager.exe open, click on Setting > Comport and select COM<number> from the dropdown menu and click OK; Go to File (top right corner) and select Read from Phone and let it finish.

    12. Scroll down and click on line 1877 (NV_RF_BC_CONFIG_I); Copy the number displayed on the right-hand side field (the one next to < unsigned 8 bytes > Band Class(s) Supported >)

    13. Locate and open mzTool_1.2.1a.exe inside OPO SPECIFIC QUALCOMM BAND UNLOCKER; select Decimal under Input Radix (top left side); Paste the number you copied in step 12 into the Decimal field under RF BC Config. You should now see your currently available bands in the Bit Information field underneath. It should look similar to this:

    bxJoA.png


    14. Go to Band Performance (NV Value) tab and check all the GSM and WCDMA bands; Copy the number in the Decimal field under RF BC Config (2,307,813,334,319,039,360); Copy it into a text editor and remove the ","

    15. Go back to RF NV Manager and paste the clean number (2307813334319039360) into the number field next to < unsigned 8 bytes > Band Class(s) > --- if you paste the number with commas or brackets instead of just the number, you're an idiot.

    16. Press WRITE NV then go to File and select Write Changed NV Items To Phone; Wait 23 seconds (because I like arbitrary waiting times), disable Android Debugging on your phone, unplug it and reboot your device; Once it comes back on, it might take a few seconds for it to acquire signal so don't panic.

    ADDENDUM:

    NEW LTE UNLOCKING GUIDE
    Courtesy of @Albirew

    Conclusion:

    The only real way to know if the whole thing got applied is to do steps 1 through 13 again (obviously skipping installations) or if you are in an area where you previously had bad or no reception.

    I've tested this on my 64GB Chinese OPO running stock rooted CM11S. Everything seems to work properly radio-wise, no worse than before. I'll have to travel a bit around to see if i get better or worse reception.

    I'll edit this thread with any relevant information if any becomes available in the future or if anyone feels something is missing.

    Thanks:

    Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software and for the modified OPO Drivers
    Thanks to @olokos for his original tutorial
    Thanks to @Glatzi for bringing the original thread to my attention
    Thanks to @fards for finding the diagnostics command that made all this possible
    Thanks to @Albirew for writing an extensive LTE tutorial
    15
    News: I just found out a totally new way to change the band, bypass all the Qualcomm tool things and will give you a straight asnwer if the band isn't available on your cell tower of just hardware limitation (App with LTE band display included)...This time with my new tool you just have to plug on a PC and type the band you want and let the magic appear....Stay tune.....
    10
    would you care to write and updated guide one exactly what you did? the first post isnt updated with the htc modem fix.

    I am on T-Mobile and just this week they've turned on another band. dont know if its 2 or 12 or the 700mhz for LTE. the wifes phone was just 4G and then it popped LTE.

    I would be happy to try it. I just wish someone would make an easy installer app or script or something.

    I have not installed the latest update yet as i was holding off trying it. thanks in advance.

    Sure. Here goes:
    1. Download the OPO archive files to your pc andRMT patch for your phone. Flash the rmt zip in recovery. This makes everything writeable for the NV edits. QPST is inside the OPO archive files in the bin folder.

    2.Make sure QPST and QXDM are on your computer.

    3.If it's not already, turn off MTP/PTP (everything should be unchecked) and turn on USB debugging.

    4.In terminal: adb shell>su>setprop sys.usb.config diag,adb (it should make a disconnected sound, it's ok)

    5.Now open device manager>other devices>right click first A0001>update driver software>browse for driver soft.>pick from list>show all>have disk>browse
    Navigate to the folder where you extracted the OPO archive flies, and select the OPO diagnostics folder. Install the 32 or 64 bit inf file that shows up.

    6.Back in device manager, modems>HTC modems>right click>properties>Modem tab. Write down or remember the Port:COM number.

    7.Open QPST config>Ports tab>add new port>in port field type COM number. Port label OPO. Click ok. If you did everything right, your phone should show up under the active phones tab. As long as you see port, phone and banner, you're good.

    8.Open QXDM Pro>Options>communications>set target port to your phone (the COM port).

    9.In QXDM Main window, view>NV Browser.
    -This is where the editing starts. I will preface by saying write down all original values in case you need them! If you have two values, don't change the nam or ext ones! Read carefully!-

    10. Inside the NV Browser window, scroll down and click on line 01877 (rf_bc_config)(1); click the Read button, replace Input value with 3460734838925427584 and click on Write button.

    11. Inside the NV Browser window, scroll down and click on line 00946 (band_pref_16_31); click the Read button, replace Input value with 0x0FF8 and click on Write button.

    12. Inside the NV Browser window, scroll down and click on line 02954 (band_pref_32_63); click the Read button, replace Input value with 805765120 and click on Write button.

    13. Inside the NV Browser window, scroll down and click on line 00441 (band_pref); click the Read button, replace Input value with 0x380 and click on Write button. If you have problem with selection, you can choose 0xFFFF or editing it directly from your phone: call / *#*#4636#*#* / Device info / Menu / Radio band select > Automatic

    14. Inside the NV Browser window, scroll down and click on line 06828 (lte_bc_config); click the Read button, replace Input value with 1906911 and click on Write button.

    15. Close QXDM, disable Android Debugging on your phone, unplug it and reboot your device.

    The last value should theoretically unlock bands 1, 2, 3, 4, 5, 7, 8, 12, 13, 17, 19, 20, 21. I used LTE Discovery to check it. I can confirm that after using this mod and updating to the latest CM build, all t-mo bands are working for me. Of course, it's dependent on what they have going in your area. Band 12 still isn't everywhere yet. But, with everything ready to go, as soon as they roll it out, you should be able to use these bands! Good luck!
    8
    Unfortunately I can 100% confirm that none of these methods unlock LTE band 20. Have tried a variety of values, including the "switch on everything" one, and despite that I can not connect to O2 UK LTE signal which is exclusively Band 20. Same SIM card in my Galaxy S4 connects to LTE instantly.

    This now proves that LTE Band 20 functionality is hardware limited in the Oneplus One.