[GUIDE] UNLOCK ADITIONAL BANDS FOR QUALCOMM DEVICES <OnePlus One EDITION>

Search This thread

nophyan

Senior Member
Jul 26, 2013
117
29
magelang
I have unlock lte band 3 for my xperia so-02e aka xperia z japan version, everything done well, i can see my lte carrier in network selection list, just need a little help. I can't register to that network. How to register to it?
 

shivangshukla

Senior Member
Aug 8, 2013
245
33
kanpur
STOP!


In an attempt to make this guide short and comprehensive and also to prevent the completely uninitiated from doing something stupid, I'm going to skip babysteps like <power on your coputer> or <browse to x folder and doubleclick on y>
I start this assuming anyone following it has a basic understanding of what they're doing, what ADB is and also of the risks that come with messing with their device.


Introduction:


This guide will show you how to alter the default baseband frequencies of your qualcomm-based device, augmenting them so that (theoretically) it should work more like a global phone.

Those with an international version of the OPO can still follow this guide, if only to check your unlocked bands against those of your fellow chinese OPO owners. I'm of the opinion that even the international version lacks a few GSM/WCDMA bands, so no harm in trying to unlock some aditional ones.

This guide will, however, NOT UNLOCK ADITIONAL LTE BANDS. At least not for now. It will be updated if and when someone discovers a way to tamper with the LTE bands.

The Guide:

1. Download this archive containing all the necessary files and extract it wherever you please.

2. Enable Android Debugging on your phone and connect it to your computer, making sure MTP and PTP are not enabled in Storage > USB computer connection

3. Open up ADB and type the following:
Code:
adb shell
Code:
su
Code:
setprop sys.usb.config diag,adb

4. Launch Device Manager and look for the Other Devices expandable menu.

5. Right click on the first device listed under that menu (the first of the two A0001 devices listed there) and choose Update Driver Software, Browse my computer for driver software, Let me pick from a list of device drivers on my computer, Show All Drivers, Have Disk and Browse

6. Browse to where you extracted OPO SPECIFIC QUALCOMM BAND UNLOCKER and locate the OPO Diagnostics Driver folder; Inside you will find 32bit and 64bit versions, pick the one relevant to you and inside you will find an .inf file that you will Open. Accept any warning messages that might pop up and let the installation of the driver complete.

7. Once everything is done installing, under Modems in Device Manager you will find HTC USB Modem. Rightclick and select Properties; In the Modem tab in the top left corner you will see Port: COM<number>. Remember that COM<number> or write it down or simply leave the window open for future reference.

8. Open the OPO SPECIFIC QUALCOMM BAND UNLOCKER folder, locate and install QPST 2.7.411 inside QPST > QPST v2.7 Build 4.11

9. Open QPST Configuration, go to the Ports tab, Add New Port (right bottom corner); In the Port field type in the COM<number> you wrote down/remembered from step 7 and in Port Label type OPO and finally click OK (left bottom corner). If you've followed all the steps correctly until here, you should be able to see this in the Active Phones tab:

byEQa.png


10. Locate and launch RF_NV_Manager.exe in the bin folder of the QPST installation directory (normally C:\Program Files (x86)\Qualcomm\QPST\bin)

11. Once you have RF_NV_Manager.exe open, click on Setting > Comport and select COM<number> from the dropdown menu and click OK; Go to File (top right corner) and select Read from Phone and let it finish.

12. Scroll down and click on line 1877 (NV_RF_BC_CONFIG_I); Copy the number displayed on the right-hand side field (the one next to < unsigned 8 bytes > Band Class(s) Supported >)

13. Locate and open mzTool_1.2.1a.exe inside OPO SPECIFIC QUALCOMM BAND UNLOCKER; select Decimal under Input Radix (top left side); Paste the number you copied in step 12 into the Decimal field under RF BC Config. You should now see your currently available bands in the Bit Information field underneath. It should look similar to this:

bxJoA.png


14. Go to Band Performance (NV Value) tab and check all the GSM and WCDMA bands; Copy the number in the Decimal field under RF BC Config (2,307,813,334,319,039,360); Copy it into a text editor and remove the ","

15. Go back to RF NV Manager and paste the clean number (2307813334319039360) into the number field next to < unsigned 8 bytes > Band Class(s) > --- if you paste the number with commas or brackets instead of just the number, you're an idiot.

16. Press WRITE NV then go to File and select Write Changed NV Items To Phone; Wait 23 seconds (because I like arbitrary waiting times), disable Android Debugging on your phone, unplug it and reboot your device; Once it comes back on, it might take a few seconds for it to acquire signal so don't panic.

ADDENDUM:

NEW LTE UNLOCKING GUIDE
Courtesy of @Albirew

Conclusion:

The only real way to know if the whole thing got applied is to do steps 1 through 13 again (obviously skipping installations) or if you are in an area where you previously had bad or no reception.

I've tested this on my 64GB Chinese OPO running stock rooted CM11S. Everything seems to work properly radio-wise, no worse than before. I'll have to travel a bit around to see if i get better or worse reception.

I'll edit this thread with any relevant information if any becomes available in the future or if anyone feels something is missing.

Thanks:

Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software and for the modified OPO Drivers
Thanks to @olokos for his original tutorial
Thanks to @Glatzi for bringing the original thread to my attention
Thanks to @fards for finding the diagnostics command that made all this possible
Thanks to @Albirew for writing an extensive LTE tutorial

will this works with my Htc one m9
 

smartty68

Member
Feb 25, 2013
12
0
calabar
Is the device supposed to be rooted for this to work? Please

LTE Tutorial (yet another addendum for OP)

Here I tried to make a step by step compilation of all you need to unlock LTE bands in OP style. Tested only on kitkat and below

Introduction:

Since OP, we got bads and goods, all NV write ability are belong to CM, for great justice, dlhxr took off every lock, etc. but since I'm lazy and all, I'm going to stop introduction there.
It will theoretically unlock:
GSM: DCS-1800/P-GSM/E-GSM/GSM-850/Railways-900/PCS-1900
WCDMA: Band I to XI
LTE: Band 1, 2, 3, 4, 5, 7, 8, 12, 13, 17, 19, 20, 21
PS: Even if they're theoretically enabled, some band cannot be used because of hardware limitation...

The Guide:

1. Download the rmt_storage patch and put it in your phone storage's root.

2. reboot your phone in recovery mode, install the rmt_storage patch then reboot in system mode aka normal mode. (when phone start, you won't have any signal for a min or two so don't panic)

3. Follow OP's steps from 1 to 9 (we need QPST configuration's server configured and active)

4. Download and install QXDM.

5. Open QXDM Pro, go to Options menu, Communications and set Target port to your phone.

1-comm.png


6. Back to QXDM main window, in the "View" drop-down menu, select NV Browser

2-nv_browser.png


Now the fun part begin
7. Inside the NV Browser window, scroll down and click on line 01877 (rf_bc_config)(1); click the Read button(2), save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 3460734838925427584(3) and click on Write button(4).

3-nv_edit.png


8. Inside the NV Browser window, scroll down and click on line 00946 (band_pref_16_31); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x0FF8 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (copy-pasta FTW)

9. Inside the NV Browser window, scroll down and click on line 02954 (band_pref_32_63); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 805765120 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (Man, I love copy-pasta)

10. Inside the NV Browser window, scroll down and click on line 00441 (band_pref); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x380 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (I fkin love copy-pasta)
edit: If you have problem with selection, you can either choose 0xFFFF or editing it directly from your phone: call / *#*#4636#*#* / Device info / Menu / Radio band select > Automatic (more infos on 00441)

11. Inside the NV Browser window, scroll down and click on line 06828 (lte_bc_config); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 1904863 (please don't be an idiot and don't edit the empty one with "ext" in the name) and click on Write button. (Did I told you how much I love copy-pasta?)

12. Now Close QXDM; Wait 23 seconds (because, like OP, I like arbitrary waiting times), disable Android Debugging on your phone, unplug it and reboot your device; Once it comes back on, it might take a minute or two for it to acquire signal so don't panic.

Conclusion:

The only real way to know if the whole thing got applied is to do steps 1 through 6 again (obviously skipping installations) and reading all values or if you are in an area where you previously had bad or no reception.
You can see unlocked GSM/UMPTS bands from the *#*#4636#*#* service menu (3dots > set GSM/UMTS band)

Original Values (in case you didn't saved your values):
My Intl 1+1:
01877: 562950069289856
00946: 0x06E8
02954: 131072
00441: 0x380
06828: 687194832973


Chinese 1+1:
01877 : 562950035735424
00946 : 0x04A8
02954 : 0
00441 : 0x0
06828 : 962072674373


Sources:
NV Values
rmt_storage patch
original chinese values

Thanks:
Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software, for the modified OPO Drivers and for the LTE NV values
Thanks to @olokos for his original tutorial
Thanks to @Glatzi for bringing the original thread to my attention
Thanks to @fards for finding the diagnostics command that made all this possible

Thanks to @devilsshadow(OP) for his 1+1 specific tutorial and QXDM package
Thanks to @dlhxr for his rmt_storage patch
Thanks to @Flint2 for chinese 1+1's original values and 00441
And last but not least: @Cafeboy who raised my will in one post, when I was struggling writing this tutorial. :p

Update1: added chinese values and specify witch bands are enabled.
Update2: added details about 00441
Update3: forgot to check 11's name of value not to edit. updated thanks to @SoWErA
Update4: unusability of band 20
Update5: added service menu code to see 3G band unlock
Update6: spelling correction + unusability of band 5
Update7: added band 12 and link
Update8: canceled update 7 (reason)
Update9: removed band 2 (src)
Is the device supposed to be rooted for this to work please?
 

kabilash

New member
Oct 24, 2017
1
0
Volte will work in Oneplus One.?

LTE Tutorial (yet another addendum for OP)

Here I tried to make a step by step compilation of all you need to unlock LTE bands in OP style. Tested only on kitkat and below

Introduction:

Since OP, we got bads and goods, all NV write ability are belong to CM, for great justice, dlhxr took off every lock, etc. but since I'm lazy and all, I'm going to stop introduction there.
It will theoretically unlock:
GSM: DCS-1800/P-GSM/E-GSM/GSM-850/Railways-900/PCS-1900
WCDMA: Band I to XI
LTE: Band 1, 2, 3, 4, 5, 7, 8, 12, 13, 17, 19, 20, 21
PS: Even if they're theoretically enabled, some band cannot be used because of hardware limitation...

The Guide:

1. Download the rmt_storage patch and put it in your phone storage's root.

2. reboot your phone in recovery mode, install the rmt_storage patch then reboot in system mode aka normal mode. (when phone start, you won't have any signal for a min or two so don't panic)

3. Follow OP's steps from 1 to 9 (we need QPST configuration's server configured and active)

4. Download and install QXDM.

5. Open QXDM Pro, go to Options menu, Communications and set Target port to your phone.

1-comm.png


6. Back to QXDM main window, in the "View" drop-down menu, select NV Browser

2-nv_browser.png


Now the fun part begin
7. Inside the NV Browser window, scroll down and click on line 01877 (rf_bc_config)(1); click the Read button(2), save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 3460734838925427584(3) and click on Write button(4).

3-nv_edit.png


8. Inside the NV Browser window, scroll down and click on line 00946 (band_pref_16_31); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x0FF8 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (copy-pasta FTW)

9. Inside the NV Browser window, scroll down and click on line 02954 (band_pref_32_63); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 805765120 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (Man, I love copy-pasta)

10. Inside the NV Browser window, scroll down and click on line 00441 (band_pref); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x380 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (I fkin love copy-pasta)
edit: If you have problem with selection, you can either choose 0xFFFF or editing it directly from your phone: call / *#*#4636#*#* / Device info / Menu / Radio band select > Automatic (more infos on 00441)

11. Inside the NV Browser window, scroll down and click on line 06828 (lte_bc_config); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 1904863 (please don't be an idiot and don't edit the empty one with "ext" in the name) and click on Write button. (Did I told you how much I love copy-pasta?)

12. Now Close QXDM; Wait 23 seconds (because, like OP, I like arbitrary waiting times), disable Android Debugging on your phone, unplug it and reboot your device; Once it comes back on, it might take a minute or two for it to acquire signal so don't panic.

Conclusion:

The only real way to know if the whole thing got applied is to do steps 1 through 6 again (obviously skipping installations) and reading all values or if you are in an area where you previously had bad or no reception.
You can see unlocked GSM/UMPTS bands from the *#*#4636#*#* service menu (3dots > set GSM/UMTS band)

Original Values (in case you didn't saved your values):
My Intl 1+1:
01877: 562950069289856
00946: 0x06E8
02954: 131072
00441: 0x380
06828: 687194832973


Chinese 1+1:
01877 : 562950035735424
00946 : 0x04A8
02954 : 0
00441 : 0x0
06828 : 962072674373


Sources:
NV Values
rmt_storage patch
original chinese values

Thanks:
Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software, for the modified OPO Drivers and for the LTE NV values
Thanks to @olokos for his original tutorial
Thanks to @Glatzi for bringing the original thread to my attention
Thanks to @fards for finding the diagnostics command that made all this possible

Thanks to @devilsshadow(OP) for his 1+1 specific tutorial and QXDM package
Thanks to @dlhxr for his rmt_storage patch
Thanks to @Flint2 for chinese 1+1's original values and 00441
And last but not least: @Cafeboy who raised my will in one post, when I was struggling writing this tutorial. :p

Update1: added chinese values and specify witch bands are enabled.
Update2: added details about 00441
Update3: forgot to check 11's name of value not to edit. updated thanks to @SoWErA
Update4: unusability of band 20
Update5: added service menu code to see 3G band unlock
Update6: spelling correction + unusability of band 5
Update7: added band 12 and link
Update8: canceled update 7 (reason)
Update9: removed band 2 (src)

If i enable all bands Volte will work in Oneplus One.?
 

devilsshadow

Senior Member
Sep 15, 2011
672
337
Bucharest
link in OP has been updated and the archive has been reupload it. Don't know how long it will stay up as the software in question violates copyright and is being taken down constantly. This guide is deprecated though. It doesn't work on anything higher than kitkat. Feel free to tinker around but don't expect any results if you're not running 3year old android.
 
  • Like
Reactions: MaestroCharan

Mr.Ak

Senior Member
Jan 14, 2015
4,411
1,969
21
*RESTRICTED AREA*
Nope.

Bands are 'mediums' , VoLTE is a hardware dependent technology.
Current OPO hardware is 'insufficient' to do VoLTE.

Hope that's clear enough.
I beg to differ.The hardware is compatible for v0lte.Look at Galaxy S5 and Xperia Z3,and you'll understand what I'm trying to say.The only thing we don't have is support from oneplus for v0lte blobs.
 
  • Like
Reactions: MaestroCharan

MaestroCharan

Senior Member
Mar 19, 2012
174
39
Visakhapatnam
link in OP has been updated and the archive has been reupload it. Don't know how long it will stay up as the software in question violates copyright and is being taken down constantly. This guide is deprecated though. It doesn't work on anything higher than kitkat. Feel free to tinker around but don't expect any results if you're not running 3year old android.

It would be great and quite clarifying if this info is added in the main post.

Thank you.
 

Arise

Senior Member
Nov 29, 2005
197
42
rmt storage patch update seems to replace rmt_storage in the /system/bin folder, but if I do that on Lineage OS 7.1.2 it will go in a frequent reboot from time to time. Also the modem seems not loading, no wifi or cell signal.
I guess everything should work if the rmt_storage is updated to work with latest OS, but as it is now what we have looks compatible with older versions of Android only.

Other ways to disable the write protection on the nv area?
 

kurzseb

New member
Sep 22, 2016
1
0
Unfortunately I can 100% confirm that none of these methods unlock LTE band 20. Have tried a variety of values, including the "switch on everything" one, and despite that I can not connect to O2 UK LTE signal which is exclusively Band 20. Same SIM card in my Galaxy S4 connects to LTE instantly.

This now proves that LTE Band 20 functionality is hardware limited in the Oneplus One.

I am under LineageOS on Orange and I saw this band active on my phone with "LTE discovery" software. I just ask for European radio band in the service menu.
 

aurfawce

Senior Member
Sep 9, 2007
158
33
  • Like
Reactions: durgraj17

mrferras

New member
Jul 10, 2018
1
0
Write Problem

Hello, My name is Amauri, I have installed QDART, QPST, QXDM, Z3X samaung tool box, I have a samsung s5 model number G900w8 Android version 6.0.1 Base Band Version G900W8UMU1DPH1.....microprocesor snapdragon 801 msm8974 AC has the band wcdma 900mhz VIII Europe Japan but in my smartphone is locked.I read many tutorials, support manuals about: How to change baseband frequency?
All is in the line 1877 NF_RF_BC CONFIG this original value enable 115868544 but when I change this value for other and write, reset the phone and this value comeback. I need you help me?

Reply to my email address : [email protected] or here XDA
 

htchd2sucks

Senior Member
May 23, 2010
897
363
LTE Tutorial (yet another addendum for OP)

Here I tried to make a step by step compilation of all you need to unlock LTE bands in OP style. Tested only on kitkat and below

Introduction:

Since OP, we got bads and goods, all NV write ability are belong to CM, for great justice, dlhxr took off every lock, etc. but since I'm lazy and all, I'm going to stop introduction there.
It will theoretically unlock:
GSM: DCS-1800/P-GSM/E-GSM/GSM-850/Railways-900/PCS-1900
WCDMA: Band I to XI
LTE: Band 1, 2, 3, 4, 5, 7, 8, 12, 13, 17, 19, 20, 21
PS: Even if they're theoretically enabled, some band cannot be used because of hardware limitation...

@Albirew
Hi,
I was hoping you could help me a little with your tutorial.

I am trying to unlock LTE bands on a Redmi Xiaomi 2 (device: 2014813 ).
It has Firmware wt86047-firmware_20161223.zip and LineageOS15.1.
I think it's about unlocking band 8 and band 20 (if possible, I read various contradicting info, I think B8 is possible, not sure about B20).

Some claimed to have done it this way:
http://en.miui.com/thread-476545-1-1.html.

After many steps different than that person instructions, I am at the stage of reading in qxdm.exe "ID 06828 Description LTE BC Config" .
My default value is 2061584302148.

1. According to that guy, one only needs to change that number to unlock LTE; which is not what you seems to say here, can you help or comment?
He wrote: "10.in mine the default value is 2061584302149, thats mean the active bands are B1,B3,B7,B37,B38,B39,B40".

2. I don't understand what value I should write or how to understand the logic behind that "2061584302148" value. It's the same behind your steps, you tell to put some values, where they come from?


Thanks!
 

htchd2sucks

Senior Member
May 23, 2010
897
363
@htchd2sucks
My default value is 2061584302148. if you want to try to add b8 and b20 , thre new value is 2061584826564

SPIE0L5.jpg


how to calculate : https://forum.xda-developers.com/android/general/3g-lte-frequency-nv-items-qualcomm-t2950491

regards

Thanks!
Indeed the explanation is complicated, I will read when I will have more time :)
I tried your value (2061584826564) and "write" in QXDM for the LTE BC Config.
Now I am trying for the LTE BC Config DIV, the read shows 0 and error: " NV status error received: item inactive".

I'm googling to find out why.
Thanks!
Edit: I saw one of your answer (
but some devices have no NV06829 (0x1AAD) - Inactive item :
E250L G730A G870A G900A G900F G900P G900W8 I257 I317 I317M I337 I437 I537 I747 I747M I9195 I9205 I9305 I9505 I9506 M819M M919 N900T N900W8 N910T N915T N9005 S7275R SC04E T889 T889V T999L
).
Unfortunately it does not explains what to do (I also don't know what is these codes, are they reference to other devices code names?)

Shall I turn of the diagnostic mode and reboot the phone with only NV06828?

Thanks,

Edit 2: I tested with your value. I rebooted and enabled again modes to read the value, it's still the one I changed (your value), which is good.
I will test if it works or not now, and report.

Thanks!
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 82
    LTE Tutorial (yet another addendum for OP)

    Here I tried to make a step by step compilation of all you need to unlock LTE bands in OP style.

    Working only on kitkat and below
    ONLY FOR 1+1


    Introduction:

    Since OP, we got bads and goods, all NV write ability are belong to CM, for great justice, dlhxr took off every lock, etc. but since I'm lazy and all, I'm going to stop introduction there.
    It will theoretically unlock:
    GSM: DCS-1800/P-GSM/E-GSM/GSM-850/Railways-900/PCS-1900
    WCDMA: Band I to XI
    LTE: Band 1, 2, 3, 4, 5, 7, 8, 12, 13, 17, 19, 20, 21
    PS: Even if they're theoretically enabled, some band cannot be used because of hardware limitation...

    The Guide:

    1. Download the rmt_storage patch and put it in your phone storage's root.

    2. reboot your phone in recovery mode, install the rmt_storage patch then reboot in system mode aka normal mode. (when phone start, you won't have any signal for a min or two so don't panic)

    3. Follow OP's steps from 1 to 9 (we need QPST configuration's server configured and active)

    4. Download and install QXDM.

    5. Open QXDM Pro, go to Options menu, Communications and set Target port to your phone.

    1-comm.png


    6. Back to QXDM main window, in the "View" drop-down menu, select NV Browser

    2-nv_browser.png


    Now the fun part begin
    7. Inside the NV Browser window, scroll down and click on line 01877 (rf_bc_config)(1); click the Read button(2), save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 3460734838925427584(3) and click on Write button(4).

    3-nv_edit.png


    8. Inside the NV Browser window, scroll down and click on line 00946 (band_pref_16_31); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x0FF8 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (copy-pasta FTW)

    9. Inside the NV Browser window, scroll down and click on line 02954 (band_pref_32_63); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 805765120 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (Man, I love copy-pasta)

    10. Inside the NV Browser window, scroll down and click on line 00441 (band_pref); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 0x380 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on Write button. (I fkin love copy-pasta)
    edit: If you have problem with selection, you can either choose 0xFFFF or editing it directly from your phone: call / *#*#4636#*#* / Device info / Menu / Radio band select > Automatic (more infos on 00441)

    11. Inside the NV Browser window, scroll down and click on line 06828 (lte_bc_config); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), replace Input value with 1904863 (please don't be an idiot and don't edit the empty one with "ext" in the name) and click on Write button. (Did I told you how much I love copy-pasta?)

    12. Now Close QXDM; Wait 23 seconds (because, like OP, I like arbitrary waiting times), disable Android Debugging on your phone, unplug it and reboot your device; Once it comes back on, it might take a minute or two for it to acquire signal so don't panic.

    Conclusion:

    The only real way to know if the whole thing got applied is to do steps 1 through 6 again (obviously skipping installations) and reading all values or if you are in an area where you previously had bad or no reception.
    You can see unlocked GSM/UMPTS bands from the *#*#4636#*#* service menu (3dots > set GSM/UMTS band)

    Original Values (in case you didn't saved your values):
    My Intl 1+1:
    01877: 562950069289856
    00946: 0x06E8
    02954: 131072
    00441: 0x380
    06828: 687194832973


    Chinese 1+1:
    01877 : 562950035735424
    00946 : 0x04A8
    02954 : 0
    00441 : 0x0
    06828 : 962072674373


    Sources:
    NV Values
    rmt_storage patch
    original chinese values

    Thanks:
    Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software, for the modified OPO Drivers and for the LTE NV values
    Thanks to @olokos for his original tutorial
    Thanks to @Glatzi for bringing the original thread to my attention
    Thanks to @fards for finding the diagnostics command that made all this possible

    Thanks to @devilsshadow(OP) for his 1+1 specific tutorial and QXDM package
    Thanks to @dlhxr for his rmt_storage patch
    Thanks to @Flint2 for chinese 1+1's original values and 00441
    And last but not least: @Cafeboy who raised my will in one post, when I was struggling writing this tutorial. :p

    Update1: added chinese values and specify witch bands are enabled.
    Update2: added details about 00441
    Update3: forgot to check 11's name of value not to edit. updated thanks to @SoWErA
    Update4: unusability of band 20
    Update5: added service menu code to see 3G band unlock
    Update6: spelling correction + unusability of band 5
    Update7: added band 12 and link
    Update8: canceled update 7 (reason)
    Update9: removed band 2 (src)
    update10: added statement that it won't ****ing work with other ****ing phones or upper versions.
    77
    STOP!

    By following this guide, you acknowledge that you and you alone are responsible for the proper-functioning state of your device.

    I am not responsible for any harm that may come to your device.

    In an attempt to make this guide short and comprehensive and also to prevent the completely uninitiated from doing something stupid, I'm going to skip babysteps like <power on your coputer> or <browse to x folder and doubleclick on y>
    I start this assuming anyone following it has a basic understanding of what they're doing, what ADB is and also of the risks that come with messing with their device.


    Introduction:


    This guide will show you how to alter the default baseband frequencies of your qualcomm-based device, augmenting them so that (theoretically) it should work more like a global phone.

    Those with an international version of the OPO can still follow this guide, if only to check your unlocked bands against those of your fellow chinese OPO owners. I'm of the opinion that even the international version lacks a few GSM/WCDMA bands, so no harm in trying to unlock some aditional ones.

    This guide will, however, NOT UNLOCK ADITIONAL LTE BANDS. At least not for now. It will be updated if and when someone discovers a way to tamper with the LTE bands.

    The Guide:

    1. Download this archive containing all the necessary files and extract it wherever you please.

    2. Enable Android Debugging on your phone and connect it to your computer, making sure MTP and PTP are not enabled in Storage > USB computer connection

    3. Open up ADB and type the following:
    Code:
    adb shell
    Code:
    su
    Code:
    setprop sys.usb.config diag,adb

    4. Launch Device Manager and look for the Other Devices expandable menu.

    5. Right click on the first device listed under that menu (the first of the two A0001 devices listed there) and choose Update Driver Software, Browse my computer for driver software, Let me pick from a list of device drivers on my computer, Show All Drivers, Have Disk and Browse

    6. Browse to where you extracted OPO SPECIFIC QUALCOMM BAND UNLOCKER and locate the OPO Diagnostics Driver folder; Inside you will find 32bit and 64bit versions, pick the one relevant to you and inside you will find an .inf file that you will Open. Accept any warning messages that might pop up and let the installation of the driver complete.

    7. Once everything is done installing, under Modems in Device Manager you will find HTC USB Modem. Rightclick and select Properties; In the Modem tab in the top left corner you will see Port: COM<number>. Remember that COM<number> or write it down or simply leave the window open for future reference.

    8. Open the OPO SPECIFIC QUALCOMM BAND UNLOCKER folder, locate and install QPST 2.7.411 inside QPST > QPST v2.7 Build 4.11

    9. Open QPST Configuration, go to the Ports tab, Add New Port (right bottom corner); In the Port field type in the COM<number> you wrote down/remembered from step 7 and in Port Label type OPO and finally click OK (left bottom corner). If you've followed all the steps correctly until here, you should be able to see this in the Active Phones tab:

    byEQa.png


    10. Locate and launch RF_NV_Manager.exe in the bin folder of the QPST installation directory (normally C:\Program Files (x86)\Qualcomm\QPST\bin)

    11. Once you have RF_NV_Manager.exe open, click on Setting > Comport and select COM<number> from the dropdown menu and click OK; Go to File (top right corner) and select Read from Phone and let it finish.

    12. Scroll down and click on line 1877 (NV_RF_BC_CONFIG_I); Copy the number displayed on the right-hand side field (the one next to < unsigned 8 bytes > Band Class(s) Supported >)

    13. Locate and open mzTool_1.2.1a.exe inside OPO SPECIFIC QUALCOMM BAND UNLOCKER; select Decimal under Input Radix (top left side); Paste the number you copied in step 12 into the Decimal field under RF BC Config. You should now see your currently available bands in the Bit Information field underneath. It should look similar to this:

    bxJoA.png


    14. Go to Band Performance (NV Value) tab and check all the GSM and WCDMA bands; Copy the number in the Decimal field under RF BC Config (2,307,813,334,319,039,360); Copy it into a text editor and remove the ","

    15. Go back to RF NV Manager and paste the clean number (2307813334319039360) into the number field next to < unsigned 8 bytes > Band Class(s) > --- if you paste the number with commas or brackets instead of just the number, you're an idiot.

    16. Press WRITE NV then go to File and select Write Changed NV Items To Phone; Wait 23 seconds (because I like arbitrary waiting times), disable Android Debugging on your phone, unplug it and reboot your device; Once it comes back on, it might take a few seconds for it to acquire signal so don't panic.

    ADDENDUM:

    NEW LTE UNLOCKING GUIDE
    Courtesy of @Albirew

    Conclusion:

    The only real way to know if the whole thing got applied is to do steps 1 through 13 again (obviously skipping installations) or if you are in an area where you previously had bad or no reception.

    I've tested this on my 64GB Chinese OPO running stock rooted CM11S. Everything seems to work properly radio-wise, no worse than before. I'll have to travel a bit around to see if i get better or worse reception.

    I'll edit this thread with any relevant information if any becomes available in the future or if anyone feels something is missing.

    Thanks:

    Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software and for the modified OPO Drivers
    Thanks to @olokos for his original tutorial
    Thanks to @Glatzi for bringing the original thread to my attention
    Thanks to @fards for finding the diagnostics command that made all this possible
    Thanks to @Albirew for writing an extensive LTE tutorial
    15
    News: I just found out a totally new way to change the band, bypass all the Qualcomm tool things and will give you a straight asnwer if the band isn't available on your cell tower of just hardware limitation (App with LTE band display included)...This time with my new tool you just have to plug on a PC and type the band you want and let the magic appear....Stay tune.....
    10
    would you care to write and updated guide one exactly what you did? the first post isnt updated with the htc modem fix.

    I am on T-Mobile and just this week they've turned on another band. dont know if its 2 or 12 or the 700mhz for LTE. the wifes phone was just 4G and then it popped LTE.

    I would be happy to try it. I just wish someone would make an easy installer app or script or something.

    I have not installed the latest update yet as i was holding off trying it. thanks in advance.

    Sure. Here goes:
    1. Download the OPO archive files to your pc andRMT patch for your phone. Flash the rmt zip in recovery. This makes everything writeable for the NV edits. QPST is inside the OPO archive files in the bin folder.

    2.Make sure QPST and QXDM are on your computer.

    3.If it's not already, turn off MTP/PTP (everything should be unchecked) and turn on USB debugging.

    4.In terminal: adb shell>su>setprop sys.usb.config diag,adb (it should make a disconnected sound, it's ok)

    5.Now open device manager>other devices>right click first A0001>update driver software>browse for driver soft.>pick from list>show all>have disk>browse
    Navigate to the folder where you extracted the OPO archive flies, and select the OPO diagnostics folder. Install the 32 or 64 bit inf file that shows up.

    6.Back in device manager, modems>HTC modems>right click>properties>Modem tab. Write down or remember the Port:COM number.

    7.Open QPST config>Ports tab>add new port>in port field type COM number. Port label OPO. Click ok. If you did everything right, your phone should show up under the active phones tab. As long as you see port, phone and banner, you're good.

    8.Open QXDM Pro>Options>communications>set target port to your phone (the COM port).

    9.In QXDM Main window, view>NV Browser.
    -This is where the editing starts. I will preface by saying write down all original values in case you need them! If you have two values, don't change the nam or ext ones! Read carefully!-

    10. Inside the NV Browser window, scroll down and click on line 01877 (rf_bc_config)(1); click the Read button, replace Input value with 3460734838925427584 and click on Write button.

    11. Inside the NV Browser window, scroll down and click on line 00946 (band_pref_16_31); click the Read button, replace Input value with 0x0FF8 and click on Write button.

    12. Inside the NV Browser window, scroll down and click on line 02954 (band_pref_32_63); click the Read button, replace Input value with 805765120 and click on Write button.

    13. Inside the NV Browser window, scroll down and click on line 00441 (band_pref); click the Read button, replace Input value with 0x380 and click on Write button. If you have problem with selection, you can choose 0xFFFF or editing it directly from your phone: call / *#*#4636#*#* / Device info / Menu / Radio band select > Automatic

    14. Inside the NV Browser window, scroll down and click on line 06828 (lte_bc_config); click the Read button, replace Input value with 1906911 and click on Write button.

    15. Close QXDM, disable Android Debugging on your phone, unplug it and reboot your device.

    The last value should theoretically unlock bands 1, 2, 3, 4, 5, 7, 8, 12, 13, 17, 19, 20, 21. I used LTE Discovery to check it. I can confirm that after using this mod and updating to the latest CM build, all t-mo bands are working for me. Of course, it's dependent on what they have going in your area. Band 12 still isn't everywhere yet. But, with everything ready to go, as soon as they roll it out, you should be able to use these bands! Good luck!
    8
    Unfortunately I can 100% confirm that none of these methods unlock LTE band 20. Have tried a variety of values, including the "switch on everything" one, and despite that I can not connect to O2 UK LTE signal which is exclusively Band 20. Same SIM card in my Galaxy S4 connects to LTE instantly.

    This now proves that LTE Band 20 functionality is hardware limited in the Oneplus One.