How To Guide How to Enable All Bands Through Service Menu on ALL International Snapdragon Samsung S20/S21/S22/Fold2/Fold3/Fold4+ series (including 4G LTE, 5G NR)

[rayw_xda]

Background​

Previous methods have only worked on US and Canada phones due to the dialer code only working on US/Canada phones on U and U1 firmware, and also the presence of IOTHiddenMenu on those devices' firmware. However, thanks to @K0mraid3's successful resurrection of the System Shell exploit, the Service Menu method can now be applied to International Snapdragon phones as well.

This means, any international Samsung S20/S21/S22/Fold2/Fold3/Fold4/... with Snapdragon processors, including but not limited to G9880, G988N, G9980, S908E, F936B...

The method used in this post is to directly launch the Service Menu by invoking the Service Mode RIL directly and bypass the need for IOTHiddenMenu or equivalent dialer codes. I found this specific command by decompiling Service Mode RIL APK and tracing through its AndroidManifest and BroadcastReceiver implementation.

How to (new method)​

1. Download Samsung Toolkit app onto your phone
2. Follow the instructions for running the app.
3. Use the Service Menu option in the app and follow from #5 in the below instructions

How to (original)​

1. Obtain System Shell access on your phone by following the instructions in @K0mraid3 's System Shell Exploit thread.
2. In the newly-opened System Shell, copy and paste the following command,

am broadcast -a com.samsung.android.action.SECRET_CODE -d android_secret_code://27663368378 -n com.sec.android.RilServiceModeApp/.SecKeyStringBroadcastReceiver

Ensure the entire command is copied correctly.
3. Run the command.
4. You should now see the Service Menu appear on the phone.
5. Follow instructions for Method 2 in the original How to unlock bands thread.
6. Follow instructions for Method 1 in the original How to unlock bands thread.
7. Now all bands, both 4G LTE and 5G NR that the hardware is capable of, are unlocked.

Proof​

I got my hands on a Korean model S20 Ultra (G988N) which has a Snapdragon CPU. Out of the box, it ONLY supports 5G NR n78. After doing the above steps, it now supports n5, n77, n78.

Before After

Bonus​

On certain international phones *#0011# or *#2263# don't work the way you expect them to. But with the service menu, you can access the same exact ones as the US models through the service menu (RF Test -> Band Selection to replace 2263, and Protocol State ->Basic Information to replace 0011)

In the case of the Korean phone, 2263 did not work at all. But 0011 brought up a totally different looking screen than the US version did.

Limitations​

For Exynos models owners - sorry, you're out of luck for now. I haven't been able to find a single menu that helps unlock bands on those models. The menus that open are VERY different and limited in functionality. Unfortunately, that's just how Samsung made it.

While "Disable CA Combos" is enabled by forcing GCF, it does not overcome hardware supported CA combos. So using a US SIM on the Korean phone for example, will still refuse to engage Carrier Aggregation on US carriers' bands.

Credits​

@K0mraid3 for the System Shell exploit
@peacey8 / @wr3cckl3ss1 / @bigdave79 for the Band Unlocking instructions on US/CA models

 

[Swaddy]

Respect!
Is there a way to check the activated bands before going through all the steps?
With *#0011# on my SM-9010 (S22 SD), I can see that my phone uses n28 here.

 

[rayw_xda]

Respect!
Is there a way to check the activated bands before going through all the steps?
With *#0011# on my SM-9010 (S22 SD), I can see that my phone uses n28 here.

Yes you can check the current available bands by going into the Service Menu and RF Test, Band Selection

 

[jason8612]

I would love to find a way to get this to work on Exynos chips. I have the intl S21+ and while I do have a 5G band for Tmobile in USA, I just can't ever connect to it.

 

[Murdock80]

You Sir, might just be a legend. I've got the Japanese Olympic Edition of the S21 here and never got to use the full potential of it here in Europe because of its limited band compatibility.

All other methods I tried so far didn't work, so I was just about to sell it- when I found this thread by accident. I'll give it a shot tomorrow.

Any idea if this change is persistent or will it be reset after an update?

 

[rayw_xda]

You Sir, might just be a legend. I've got the Japanese Olympic Edition of the S21 here and never got to use the full potential of it here in Europe because of its limited band compatibility.

All other methods I tried so far didn't work, so I was just about to sell it- when I found this thread by accident. I'll give it a shot tomorrow.

Any idea if this change is persistent or will it be reset after an update?

It's persistent, until a CSC change or a firmware update that makes changes to the CSC.

 

[Murdock80]

It's persistent, until a CSC change or a firmware update that makes changes to the CSC.

Thanks mate, I seemingly got it to work up to (and including) Step 5 of your description.

Just to avoid a misunderstanding: Do you suggest to go through Method 2 AND then Method 1 of the "How to unlock bands" thread or is one of them sufficient?

Edit:
Proceeded with Method 2, then 1. All Bands enabled, verified via Band selection menu.
Awesome!

Can I buy you a beer?

 

[rayw_xda]

Thanks mate, I seemingly got it to work up to (and including) Step 5 of your description.

Just to avoid a misunderstanding: Do you suggest to go through Method 2 AND then Method 1 of the "How to unlock bands" thread or is one of them sufficient?

Edit:
Proceeded with Method 2, then 1. All Bands enabled, verified via Band selection menu.
Awesome!

Can I buy you a beer?

Glad it worked for you!

Beer would be appreciated too . My signature has links for that if you'd like

 

[dyeager]

Any way to get *#73# back for Verzion and T-Mobile etc? Since at least the Jan 1, 2023 update, the the SamFW FRP tool, go to MTP tab and click on "Enable Secret Code for Verizon" no longer works on the S21 Ultra (SM-G998U1).

 

[bdvince]

Can you PLEASE determine if this same command works on the S23U to launch the Service Menu, or what steps are needed to find out?

Now that Snapdragon is being used across all regions, I think this will be huge for US customers who want an unlocked bootloader if they can easily purchase an EU S23U and enable all bands with this method!

 

[rayw_xda]

Can you PLEASE determine if this same command works on the S23U to launch the Service Menu, or what steps are needed to find out?

Now that Snapdragon is being used across all regions, I think this will be huge for US customers who want an unlocked bootloader if they can easily purchase an EU S23U and enable all bands with this method!

If you buy me an S23 then sure

 

[rayw_xda]

Any way to get *#73# back for Verzion and T-Mobile etc? Since at least the Jan 1, 2023 update, the the SamFW FRP tool, go to MTP tab and click on "Enable Secret Code for Verizon" no longer works on the S21 Ultra (SM-G998U1).

There's this alternative method: https://www.reddit.com/r/samsung/comments/ybpnng
If that still doesn't work, here's a surefire way that works,

https://www.reddit.com/r/samsung/comments/10zdhv1

 

[rayw_xda]

Can you PLEASE determine if this same command works on the S23U to launch the Service Menu, or what steps are needed to find out?

Now that Snapdragon is being used across all regions, I think this will be huge for US customers who want an unlocked bootloader if they can easily purchase an EU S23U and enable all bands with this method!

There's now an easier method to find out (without a PC, or USB cable),

https://www.reddit.com/r/samsung/comments/10zdhv1

 

[bdvince]

There's now an easier method to find out (without a PC, or USB cable),

https://www.reddit.com/r/samsung/comments/10zdhv1

I don't have an S23 yet but I'm trying to get S23 users to confirm they can launch the service menu/access band selection.

I see welshkiwi95 from that reddit stated he couldn't get Shizuku to work due to a VERSION_LOCKED message. For users that already have rooted their phones they wouldn't need a system level shell, wouldn't this be circumvented?

 

[dDesuKb]

I don't have an S23 yet but I'm trying to get S23 users to confirm they can launch the service menu/access band selection.

I see welshkiwi95 from that reddit stated he couldn't get Shizuku to work due to a VERSION_LOCKED message. For users that already have rooted their phones they wouldn't need a system level shell, wouldn't this be circumvented?

Welshkiwi95 is also me (also am not a he ).

I have been able to change my carrier vanity name but it also doesn't work at the same time. Very much thinking we need a new exploit or root. Because as I said in another thread, could be a OneUI issue or a S23 series issue.

 

[jchq]

Thank you, I've successfully unlocked China 5G bands on 908N with Korean LUC carrier.

 

[Neomorpheus8988]

Dear All Members,

I'm trying to see if anyone has successfully unlock all the respective LTE Bands for the G998UZKAWZW. I'm currently using the phone in Malaysia on a Malaysian Telco Provider and require the LTE Band 28 to be enabled and following the instructions did not yield any results in enabling the LTE Roaming Bands .

Hope to get some guidance from someone who has managed to enable all the LTE Bands

 

[Abaddon]

Dear All Members,

I'm trying to see if anyone has successfully unlock all the respective LTE Bands for the G998UZKAWZW. I'm currently using the phone in Malaysia on a Malaysian Telco Provider and require the LTE Band 28 to be enabled and following the instructions did not yield any results in enabling the LTE Roaming Bands .

Hope to get some guidance from someone who has managed to enable all the LTE Bands

View attachment 5844895

convert your firmware to U1 then follow this https://forum.xda-developers.com/t/...22-series-including-sub-6-and-mmwave.4488435/

 

[Abaddon]

deleted

 

[ngc1952]

I am on Korean Lg U+, and if i change the CSC to GCF, the Service does not work. How do i fix it?