How To Guide How to Enable All Bands Through Service Menu on US/CA S22 series (including Sub-6 and mmWave)

Search This thread
By:
Advanced…
peacey8

peacey8

Senior Member
Jul 28, 2013
324
239
jerry855202 said:
My current celluar plan is not a 5G capable one, sorry for not being more clear.
I did load testing by having a livestream in PIP mode while messing around with service menu.
And I was having trouble with LTE CA. It was unlocked (to just 2CA I think?) but I thought it was still broken because:

For whatever reason, my S22 (or my carrier/tower?) likes Band 7 waaaaaaaay too much.
Whenever it has B7 it just locks on to it and refuses to
1. Do CA with another available band like B3 or B28 that IS available and is a CA profile that my carrier supports, and
2. Get off B7 and moves to a better CA pair like B3+B28, even though it's considerably faster due to congestion on B7 with my carrier.
If I manually take B7 off with Band Selection, then it happily runs 100M+ on B3+B28 2CA.

I'm gussing it's some kind of cost-cutting measure or QoS, and not my phone's modem then in this case.
For the meantime I'll probably just manually lockout B7.
Thanks for the help.
Click to expand...
Click to collapse
I would also try simulating your CSC to XAA and doing the first method to unlock the bands. Perhaps XAA treats aggregations differently and have different costs.

Does your other local phone use this aggregation at the same place when connected to the same tower?
 
R

rayw_xda

Senior Member
Apr 25, 2020
86
31
jerry855202 said:
My current celluar plan is not a 5G capable one, sorry for not being more clear.
I did load testing by having a livestream in PIP mode while messing around with service menu.
And I was having trouble with LTE CA. It was unlocked (to just 2CA I think?) but I thought it was still broken because:

For whatever reason, my S22 (or my carrier/tower?) likes Band 7 waaaaaaaay too much.
Whenever it has B7 it just locks on to it and refuses to
1. Do CA with another available band like B3 or B28 that IS available and is a CA profile that my carrier supports, and
2. Get off B7 and moves to a better CA pair like B3+B28, even though it's considerably faster due to congestion on B7 with my carrier.
If I manually take B7 off with Band Selection, then it happily runs 100M+ on B3+B28 2CA.

I'm gussing it's some kind of cost-cutting measure or QoS, and not my phone's modem then in this case.
For the meantime I'll probably just manually lockout B7.
Thanks for the help.
Click to expand...
Click to collapse
I think it's due to XAA or GCF not having band priorities. When I force GCF or XAA on T-Mobile USA it keeps hanging onto n71 SA 5 Mhz even though faster options like 100 Mhz n41 is available.

I ended up reverting to TMB CSC and but continuing to use the unlock instructions in the OP to have mostly the best of both worlds. However that probably won't help international users.
 
peacey8

peacey8

Senior Member
Jul 28, 2013
324
239
rayw_xda said:
I think it's due to XAA or GCF not having band priorities. When I force GCF or XAA on T-Mobile USA it keeps hanging onto n71 SA 5 Mhz even though faster options like 100 Mhz n41 is available.

I ended up reverting to TMB CSC and but continuing to use the unlock instructions in the OP to have mostly the best of both worlds. However that probably won't help international users.
Click to expand...
Click to collapse
Intersting. In that case @jerry855202, maybe you should try simulating CSC to TMB if XAA also doesn't work (but make sure to unlock all bands with method 1 after simulating). Worth a try.
 
J

jerry855202

Member
May 12, 2016
14
2
Samsung Galaxy S22
peacey8 said:
I would also try simulating your CSC to XAA and doing the first method to unlock the bands. Perhaps XAA treats aggregations differently and have different costs.

Does your other local phone use this aggregation at the same place when connected to the same tower?
Click to expand...
Click to collapse
My other phone (pixel 4a5g) with the same sim happily runs on 3CA at the same location/tower.
My phone is originally XAA, for whatever reason, DISABLE CA COMBO CHECK does not presistafter reboot, thus I just get no CA with XAA, with or without protocal simulation. That's why I sim'd GCF.
However it also seems to much prefer Band 7 on XAA, then B28 without CA.

Sim TMB is the same behavior as XAA. DISABLE CA COMBO CHECK also does not presist after reboot.
 
R

rayw_xda

Senior Member
Apr 25, 2020
86
31
jerry855202 said:
My other phone (pixel 4a5g) with the same sim happily runs on 3CA at the same location/tower.
My phone is originally XAA, for whatever reason, DISABLE CA COMBO CHECK does not presistafter reboot, thus I just get no CA with XAA, with or without protocal simulation. That's why I sim'd GCF.
However it also seems to much prefer Band 7 on XAA, then B28 without CA.

Sim TMB is the same behavior as XAA. DISABLE CA COMBO CHECK also does not presist after reboot.
Click to expand...
Click to collapse
The disable CA Combo check is persisting after reboots for me, but I also run dual SIM setup.

Physical SIM is T-Mobile SIM and CSC is TMB. eSIM is an international roaming SIM and is XAA. I did not override the CSCs in this case. But, I did disable cidmanager to prevent the CSCs from changing when I switch to a different eSIM.
 
N

Neeko72

Senior Member
Sep 26, 2016
94
10
i have a few questions, will this fix improper carrier aggregation for international users(slow network speeds?) On my older sm-s908u1 bands seem to be unlocked but the phone wouldnt aggregate them resulting in slow network speeds. Is there any way to permanently fix aggregation(throughout updates) and retain OTA's working on U1/XAA fw/csc meaning without changing CSC or even messing with flashing other fw at all??

edit: method 2 seems to be a "permanent Fix"(meaning that it remains working throughout updates from what i figure) is it not? is it dangerous? is it possible to revert back to default if one wants to afterwards? as OP mentioned in the first post method 1 will revert back to default with fw update and/or csc update.
 
Last edited:
lexcyn

lexcyn

Senior Member
Apr 4, 2010
820
779
Sudbury
So I have a U1 S22U and for some reason I do not see the N78 band but I do see N71 - is this a limitation with the U1 model? I am on the XAA firmware.
 
R

rayw_xda

Senior Member
Apr 25, 2020
86
31
lexcyn said:
So I have a U1 S22U and for some reason I do not see the N78 band but I do see N71 - is this a limitation with the U1 model? I am on the XAA firmware.
Click to expand...
Click to collapse
It's due to Samsung being Samsung and locking bands behind CSCs. The XAA CSC sometimes freaks out and gets locked to 5G bands from the last inserted US SIM.

Following instructions in the OP will fix this issue for you.
 
lexcyn

lexcyn

Senior Member
Apr 4, 2010
820
779
Sudbury
rayw_xda said:
It's due to Samsung being Samsung and locking bands behind CSCs. The XAA CSC sometimes freaks out and gets locked to 5G bands from the last inserted US SIM.

Following instructions in the OP will fix this issue for you.
Click to expand...
Click to collapse
Yeah I did, but I am still not seeing N78. Phone was originally activated with a TMB SIM but the CSC is still set to XAA/XAA. Wondering if I flash to "XAC" (Canadian unlocked) it would unlock that band?
 
R

rayw_xda

Senior Member
Apr 25, 2020
86
31
lexcyn said:
Yeah I did, but I am still not seeing N78. Phone was originally activated with a TMB SIM but the CSC is still set to XAA/XAA. Wondering if I flash to "XAC" (Canadian unlocked) it would unlock that band?
Click to expand...
Click to collapse
That means some steps in the OP were missed.

Did you follow exactly the outlined steps in "METHOD 1: Use the Service Menu to Unlock All Bands"?

For the "Protocol -> NR5G" section, did you repeat the steps for both stacks?
 
Last edited:
lexcyn

lexcyn

Senior Member
Apr 4, 2010
820
779
Sudbury
rayw_xda said:
That means some steps in the OP were missed.

Did you follow exactly the outlined steps in "METHOD 1: Use the Service Menu to Unlock All Bands"?

For the "Protocol -> NR5G" section, did you repeat the steps for both stacks?
Click to expand...
Click to collapse
Yep I did, and actually I fixed it but not with method 1 (I've gone through that a bunch of times) - after switching to GCF for the second time and rebooting, I can see N78. Not sure what was going on there.
 
Jimmy_J

Jimmy_J

New member
Dec 7, 2022
1
0
netnerd said:
yes, I'm on s908U1 with FKR/FKR, TMB/XAA (Visible wireless on sim, tmobile on esim).
if i downgrade to Android 12, will it wipe my data? i really don't wanna wipe my phone :)
Click to expand...
Click to collapse
Try install latest Samsung usb drive then try again. I got the same problem and it works for me. I'm on Android 13.
 
D

DoctorNasty

Member
Nov 20, 2018
38
33
I followed this guide and unlocked all bands but every second LTE goes to LTE+ and than back. LTE+ doesn't last more then 3 seconds. Can anyone help me with that?
 
lexcyn

lexcyn

Senior Member
Apr 4, 2010
820
779
Sudbury
DoctorNasty said:
I followed this guide and unlocked all bands but every second LTE goes to LTE+ and than back. LTE+ doesn't last more then 3 seconds. Can anyone help me with that?
Click to expand...
Click to collapse
Did you try and do this:

  • Optional if you have issues going from LTE to LTE+ (carrier aggregation not working properly): Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> DISABLE CA COMBO CHECK -> DISABLE ON.
Click to expand...
Click to collapse
 
You must log in or register to reply here.

Similar threads

kangi26
How To Guide OTA and Non-OTA Firmware for S22 Ultra SM-S908U and S22 Ultra SM-S908U1 Versions
Replies
3K
Views
208K
P
pushkar0501
P
General [ENDED][OneUI 5 Beta] (Exynos) Galaxy S22/S22+/S22 Ultra Beta Thread
Replies
1K
Views
119K
sir_veloso
sir_veloso
EmilZackrisson
Question S22 Ultra Very Laggy and slow
Replies
1K
Views
135K
SyCoREAPER
SyCoREAPER
zaydenQ
Question [INDIA] Galaxy S22 Ultra news + discussion thread.
Replies
3K
Views
148K
P
pratik_193
dr.ketan
  • Poll
Development [15.03.23] Full ROM System-RW for S908E/B I Magisk ROM Module for all S22 I Dr.Ketan ROM
Replies
2K
Views
153K
dr.ketan
dr.ketan

Top Liked Posts

24 Hours 30 Days All time
  • There are no posts matching your filters.
  • 1
    peacey8
    peacey8
    zyasin said:
    Thanks for this great post to unlock 5G and 4+/LTE+ bands on Canadian S22 Ultra version.

    S22 Ultra: Will I get OTA update of oneui5.1 on XAA version or will I have to flash full firmware (factory reset) when XAA version will be released officially?
    Click to expand...
    Click to collapse
    If you are on XAA CSC, then you will receive OTA updates from XAA and will get 5.1 when the OTA is released for XAA.

    Btw, you can also re-flash Canadian firmware after unlocking the service menu on US firmware, then you can unlock all bands and keep getting Canadian OTA updates. Up to you whether you wish to stay on US firmware or go back to Canadian.
    View
    1
    peacey8
    peacey8
    zyasin said:
    I got Canadian version and LTE+/4g+ /5g were not working in Kuwait so I flashed XAA USA version and everything is working fine. but my concern is that if i will get OTA updates from XAA or not because I have read some posts on XDA that if you change CSC to different region, you will not get OTA updates....

    I am still waiting for oneui 5.1 update from Samsung for XAA version which is not released yet to see if OTA update works or not.

    I am happy with US XAA version and I don't want to go back to Canadian version because latest Canadian version is still on December 2022 patch.
    Click to expand...
    Click to collapse
    Yes, you will get OTA from XAA since you are on XAA CSC.
    View
    1
    Z
    zyasin
    peacey8 said:
    Yes, you will get OTA from XAA since you are on XAA CSC.
    Click to expand...
    Click to collapse
    I just got OTA 5.1 update on XAA. Thanks for your reply
    View
    1
    G
    galib
    Hi All,
    I have Samsung galaxy z fold 4 US version running Android 13. Its worked for me as I need to use the 5g network outside USA. Thank you @peacey8 , @Abaddon
    View
    1
    jcsww
    jcsww
    nnighthawk said:
    Hardware-wise it should be partially compatible with T-Mobile's 5G, and the device should at least be functional on T-Mobile (you might have coverage issues.) It's worth a shot as T-Mobile is known to not aggressively blacklist devices like AT&T.
    Click to expand...
    Click to collapse
    T-Mobile now requires any BYOD to be compatible with T-Mobile's implementation of VoLTE for the device to work on their network.
    View
  • 35
    peacey8
    peacey8
    What is this?

    This is a guide on how to enable all LTE and 5G bands on the US or Canadian S22 series phones by going through the service menu. This guide is mostly based on this S20U guide by mellojosh, but has been adapted for the S22U phone with more information added.

    Which bands can be enabled this way?

    All bands the phone supports in hardware can be enabled through the service menu. For the S22 Ultra, that includes all Sub-6 bands like n78, and mmWave bands, as well as 5G SA bands, as shown in this screenshot below.

    Bands List.jpeg

    Which phones does this method support?

    This method has been confirmed to work on:
    • Samsung S22 Ultra (S908U, S908U1, S908W).
    • Galaxy Z Fold 4. Thanks @Abaddon.
    This method works on both Android 12 (One UI 4.1) or Android 13 (One UI 5.0 beta).

    This method requires your device be on the US firmware (XAA or other US CSC), so as long as you can Odin flash XAA firmware on your device (such as Canadian variant), you should be able to do this.

    If you get this method working on your phone that isn't in the known list, post it here and I will add it to the list above.

    How To Guide

    You will need a Windows computer (or VM) and the Samsung USB Driver installed to do the following steps. Install the USB driver from here before proceeding if you do not have it installed.

    A. Flash US Firmware

    First, your device must be on US firmware (XAA or other CSC). You can skip this step and go to B if your device is already on US firmware.

    If you're not on a US firmware because you have another Snapdragon variant (like Canadian), follow the steps below to flash XAA firmware. Note this will WIPE and FACTORY RESET your device. ALL DATA WILL BE LOST. So backup if you need to.
    1. Download Odin 3.14.4 or latest version.
    2. Download US XAA U1 firmware for your device from SamMobile.com or SamFw.com. For example, for the S22 Ultra, download the XAA firmware for S908U1. Extract the contents of the firmware to somewhere on your computer. You should have 5 files (BL, AP, CP, CSC, HOME_CSC). We won't use HOME_CSC.
    3. Restart your phone and go into download mode. On the S22 Ultra, hold all three power and up + down volume at the same time until the phone starts, then press the up volume key to get into download mode.
    4. Open Odin and connect your phone to your computer with a USB. Odin should say your phone was added.
    5. Click each of the BL, AP, CP, CSC buttons and select the corresponding files from the firmware zip you extracted. For CSC, use the file that starts with CSC and not HOME_CSC (we won't be using HOME_CSC). Do not load anything into USERDATA.
    6. Click start and let it flash the firmware (see the picture below). If it flashed correctly, your phone will be on XAA firmware after it restarts and you will have to set it up again from scratch.
    7. Set up your phone and verify it is on XAA firmware by going to Settings -> About Phone -> Software information -> check that it says XAA/XAA,XAA/OOO under "Software provider software version". OOO here will be your phone's original CSC like XAC which you cannot change and do not need to.
    A - Odin Flash.png

    B. Unlock Service Menu Secret Codes

    The next step is we need to unlock access to the service menu. Usually this is locked by default, but it might already be unlocked for you.

    First check if you can access the service menu by trying each of these ways:
    1. Open dialer and enter *#27663368378# to try to get directly into the service mode main menu. The menu should open after you press the last # character, you shouldn't have to press call.
    2. Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
    3. If either of the above ways works for you to get to the service mode main menu, then you can skip the below steps to unlock the menu and go directly to instructions C.
    If you cannot access the menu with the above codes, then follow these instructions to unlock the secret codes.
    1. Enable USB Debugging in Developer menu.
    2. Download SamFW FRP tool 3.1 or latest version from here.
    3. Open SamFW FRP tool and connect your phone to the computer with a USB.
    4. Using SamFW FRP tool, go to MTP tab and click on "Enable Secret Code for Verizon". See the picture below. Note it works on any US CSC even though it says "for Verizon".
      • If in the program output you see it's getting stuck on "Waiting for DIAG", then dial *#0808# on your phone to open USB settings and select "DM + MODEM + ADB" then press OK. The program should then complete the step and then get stuck on "Disabling DIAG". When it does, using the *#0808# menu again, select "MTP + ADB" this time and press OK. Now the program should complete the step and say that secret codes was unlocked.
    5. Now you should be able to use *#73# for RF test, *#27663368378#* to go directly to service menu. Test it to make sure the codes work and the service menu is opening.
    B - SamFW FRP Tool.png

    C. METHOD 1: Use the Service Menu to Unlock All Bands
    • Enter the service menu using either way.
      • Open dialer and enter *#27663368378# to get directly into the service mode main menu.
      • Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
    • Use the service mode to set the following options. Note you can go back between screens with three dots -> back for quicker navigation, but I am just starting each option below from the main menu so it's easy to read.
      1. Enable all LTE and 5G bands.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> SYSTEM -> Next page 4 times -> SET LTE BAND CONFIG -> SET DEFAULT LTE BAND.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NR5G PRUNE STATUS -> REMOVE NR5G PRUNE.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> GCF -> REMOVE ONLY NR WHITELIST.
        • Optional if you need to enable mmWave bands: Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Sub6/mmWave -> ALL ENABLE.
        • Optional if you have issues going from LTE to LTE+ (carrier aggregation not working properly): Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> DISABLE CA COMBO CHECK -> DISABLE ON.
      2. Enable 5G NR features (DSS & CDRX) if needed. These options might already be enabled for you by default.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> NR CDRX CONTROL -> NR CDRX ENABLE. NR CDRX is 5G power saving mode.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page 2 times -> NR DSS CONTROL -> NR DSS ENABLE. NR DSS is 5G Dynamic Spectrum Sharing.
      3. Enable 5G SA if you're lucky enough to have a carrier with standalone 5G networks. This option might be enabled by default already.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NR5G SA/NSA Mode Control -> SA/NSA ENABLE.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NR5G SA/NSA Mode Control -> Remove SA permit list.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Next Page -> NR5G NRDC -> NRDC ENABLE. NRDC is for dual connectivity with Sub6 + mmWave bands in parallel. Only applies to 5G SA networks and only if your carrier uses it.
      4. Restart your phone, then dial *#73# to get into RF Test Mode. Click Band Selection -> Sim 1 or Sim 2 (whichever you use). On this screen if you scroll down, you'll see a list of enabled NR5G bands. Make sure all bands are enabled. See my picture below.
      5. NOTE: Band selection won't be reset with a reboot, but might be reset after a CSC update (or a software update that includes a CSC update). You will have to re-do the service menu settings every update or re-flash of a CSC.
      6. NOTE: If you use an eSIM or a dual-SIM phone with a 2nd SIM, you need to change the NR5G stack before changing the NR5G related options above. Change the NR5G stack to Stack 2 with the following setting first.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NR5G STACK SELECTION -> Select STACK 2.
      7. OPTIONAL: Now that all bands are enabled and usable, you can use the Band Selection menu under *#73# to selectively disable certain bands if you need to. This is not covered here but that menu is self-explanatory.
      8. If this method isn't working, try METHOD 2 below. You do not need to try METHOD 2 if this method ended up working for you.
    D. METHOD 2: Unlock all bands via Protocol Simulation menu.
    • If METHOD 1 above didn't work or not all bands were unlocked, you can try to unlock all bands by simulating a change in your CSC to GCF (Global Certification Forum). This won't actually change your CSC to GCF, but will change the options in the service menu as if you were on GCF CSC, which should give you access to all SA and NSA bands. Credits to @wr3cckl3ss1 for figuring out this method.
    • To do this method, first enter the service mode main menu using either of the following ways.
      • Open dialer and enter *#27663368378# to get directly into the service mode main menu.
      • Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
    • Using the service menu, change the following options
    1. Go to: Service Mode Main Menu -> PROTOCOL STATE -> PROTOCOL SIMULATION -> IMEI PRE CFG SIMULATION.
    2. In this menu, click [1] AP, then click GCF (last option). Then click [2] NET1 and change it to GCF as well. Do the same for [3] NET2. All GCF.
    3. Press [4] Write. Then restart phone.
    4. Check if all SA bands were unlocked. If not, repeat the band unlocking instructions from METHOD 1 above and then restart the phone and check again.

    Enjoy your unlocked LTE and 5G bands!

    FYI, I have personally tested this on a Canadian S908W on XAA firmware to enable 5G in Canada. In fact, I was even able to update to One UI 5.0 using the adb sideload method since I was on XAA firmware, and then I repeated the steps above to enable all 5G bands on the beta (service menu was still unlocked). So now I have 5G on One UI 5.0 beta in Canada! The trifecta!

    CREDITS

    @mellojosh for his guide on service menu band options on the S20U1.
    @wr3cckl3ss1 for his guide on selecting bands from the dialer for the S22 series phones, and for instructions on protocol simulation.
    @bigdave79 for reminding me about needing the Samsung USB Driver for this to work.
    View
    7
    wr3cckl3ss1
    wr3cckl3ss1
    COMING SOON....THE RETURN OF CSC CHANGE WITHOUT ANY COMPUTERS.....still under heavy testing right now but coming soon, as well as other tricks. 😁😁😁

    @peacey8 @PapaDocta @Abaddon
    View
    4
    peacey8
    peacey8
    Good news everyone! This method still works on US/Canadian S23 series and One UI 5.1. I've copied this guide over to the S23 forum.

    Just tested it with my Canadian S23 Ultra by flashing US firmware first. The service menu will only unlock on US firmware (though stays unlocked after re-flashing Canadian firmware).
    View
    3
    wr3cckl3ss1
    wr3cckl3ss1
    Excellent job sir.
    View
    3
    danielcampos
    danielcampos
    Good morning, I confirm the method works on the SM-G998U1 with android 13 beta 2, YES IT WORKS
    View

New posts