LTE Tutorial (yet another addendum for OP)
Here I tried to make a step by step compilation of all you need to unlock LTE bands in OP style. Tested only on kitkat and below
Introduction:
Since OP, we got bads and goods,
all NV write ability are belong to CM,
for great justice, dlhxr took off every lock, etc. but since I'm lazy and all, I'm going to stop introduction there.
It will
theoretically unlock:
GSM: DCS-1800/P-GSM/E-GSM/GSM-850/Railways-900/PCS-1900
WCDMA: Band I to XI
LTE: Band 1,
2, 3, 4,
5, 7, 8,
12, 13, 17, 19,
20, 21
PS: Even if they're theoretically enabled,
some band cannot be used because of hardware limitation...
The Guide:
1.
Download the rmt_storage patch and put it in your phone storage's root.
2. reboot your phone in recovery mode, install the rmt_storage patch then reboot in system mode aka normal mode. (when phone start, you won't have any signal for a min or two so don't panic)
3. Follow
OP's steps from 1 to 9 (we need QPST configuration's server configured and active)
4.
Download and install QXDM.
5. Open
QXDM Pro, go to
Options menu,
Communications and set
Target port to your phone.
6. Back to QXDM main window, in the
"View" drop-down menu, select
NV Browser
Now the fun part begin
7. Inside the NV Browser window, scroll down and click on line
01877 (rf_bc_config)(1); click the
Read button(2),
save somewhere the original value in case something goes wrong (inside notepad or anything), replace
Input value with
3460734838925427584(3) and click on
Write button(4).
8. Inside the NV Browser window, scroll down and click on line
00946 (band_pref_16_31); click the
Read button,
save somewhere the original value in case something goes wrong (inside notepad or anything), replace
Input value with
0x0FF8 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on
Write button.
(copy-pasta FTW)
9. Inside the NV Browser window, scroll down and click on line
02954 (band_pref_32_63); click the
Read button,
save somewhere the original value in case something goes wrong (inside notepad or anything), replace
Input value with
805765120 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on
Write button.
(Man, I love copy-pasta)
10. Inside the NV Browser window, scroll down and click on line
00441 (band_pref); click the
Read button,
save somewhere the original value in case something goes wrong (inside notepad or anything), replace
Input value with
0x380 (please don't be an idiot and don't edit the empty one with "nam" in the name) and click on
Write button.
(I fkin love copy-pasta)
edit: If you have problem with selection, you can either choose 0xFFFF or editing it directly from your phone: call / *#*#4636#*#* / Device info / Menu / Radio band select > Automatic (
more infos on 00441)
11. Inside the NV Browser window, scroll down and click on line
06828 (lte_bc_config); click the
Read button,
save somewhere the original value in case something goes wrong (inside notepad or anything), replace
Input value with
1904863 (please don't be an idiot and don't edit the empty one with "ext" in the name) and click on
Write button.
(Did I told you how much I love copy-pasta?)
12. Now
Close QXDM; Wait 23 seconds (
because, like OP, I like arbitrary waiting times), disable
Android Debugging on your phone,
unplug it and
reboot your device; Once it comes back on, it might take a minute or two for it to acquire signal so don't panic.
Conclusion:
The only real way to know if the whole thing got applied is to do steps 1 through 6 again (obviously skipping installations) and reading all values or if you are in an area where you previously had bad or no reception.
You can see unlocked GSM/UMPTS bands from the *#*#4636#*#* service menu (3dots > set GSM/UMTS band)
Original Values (in case you didn't saved your values):
My Intl 1+1:
01877: 562950069289856
00946: 0x06E8
02954: 131072
00441: 0x380
06828: 687194832973
Chinese 1+1:
01877 : 562950035735424
00946 : 0x04A8
02954 : 0
00441 : 0x0
06828 : 962072674373
Sources:
NV Values
rmt_storage patch
original chinese values
Thanks:
Thanks to @
BlackSoulxxx for his original work with the Qualcomm baseband software, for the modified OPO Drivers and for the LTE NV values
Thanks to @
olokos for his original tutorial
Thanks to @
Glatzi for bringing the original thread to my attention
Thanks to @
fards for finding the diagnostics command that made all this possible
Thanks to @
devilsshadow(OP) for his 1+1 specific tutorial and QXDM package
Thanks to @
dlhxr for his
rmt_storage patch
Thanks to @
Flint2 for chinese 1+1's original values and 00441
And last but not least: @
Cafeboy who raised my will
in one post, when I was struggling writing this tutorial.
Update1: added chinese values and specify witch bands are enabled.
Update2: added details about 00441
Update3: forgot to check 11's name of value not to edit. updated thanks to @
SoWErA
Update4: unusability of band 20
Update5: added service menu code to see 3G band unlock
Update6: spelling correction + unusability of band 5
Update7: added band 12 and link
Update8: canceled update 7 (
reason)
Update9: removed band 2 (
src)