How To Guide How to Enable All Bands Through Service Menu on US/CA S23 series (including Sub-6 and mmWave)

Search This thread

EtherealRemnant

Senior Member
Sep 15, 2007
5,147
2,307
39
Denver, CO
OnePlus 9
Samsung Galaxy Watch 4
I'm using SIM + eSIM but could only get NRDC on both SIMs... I'm on U1 with TMB.
I used method two and set GCF today and that got SA and all bands enabled on both SIMs. I don't care about NRDC since we don't have mmWave here but I got a new T-Mobile MVNO SIM the other day and was shocked to find it has SA disabled by default.

Unfortunately I just forced SA and it was kicked from the network. Seems that T-Mobile is still not giving SA access to all MVNOs automatically, even ones with the 240 SIM cards.

Yea I had to re-download the Samsung driver's and then it worked for me but then the band selection didn't work so I had to change the CSC to the global one and that have me access to the band selection menu.
That's something I didn't even think about. If I don't have to re-enable RAT selection every time I reboot when using an AT&T network SIM, that would be awesome.
 
I used method two and set GCF today and that got SA and all bands enabled on both SIMs. I don't care about NRDC since we don't have mmWave here but I got a new T-Mobile MVNO SIM the other day and was shocked to find it has SA disabled by default.

Unfortunately I just forced SA and it was kicked from the network. Seems that T-Mobile is still not giving SA access to all MVNOs automatically, even ones with the 240 SIM cards.


That's something I didn't even think about. If I don't have to re-enable RAT selection every time I reboot when using an AT&T network SIM, that would be awesome.
I haven't tried that yet, I do get mmWave here so I'll just keep my settings with NRDC.

Interesting, I wonder if T-Mobile will give SA access on Mint service... since they recently acquired the company.

Wondering if anyone is using the GCF CSC and getting all these bands....

I just read the method 2 🤣 it's GCF CSC
 
Last edited:

EtherealRemnant

Senior Member
Sep 15, 2007
5,147
2,307
39
Denver, CO
OnePlus 9
Samsung Galaxy Watch 4
I haven't tried that yet, I do get mmWave here so I'll just keep my settings with NRDC.

Interesting, I wonder if T-Mobile will give SA access on Mint service... since they recently acquired the company.

Wondering if anyone is using the GCF CSC and getting all these bands....

I just read the method 2 🤣 it's GCF CSC
It's interesting that Mint, the largest T-Mobile MVNO, doesn't have SA either. I thought they did but I just checked reddit and just 4 days ago people were talking about SA SIMs coming. Meanwhile, my Tello SIM, which is a massively smaller MVNO, has had 5G SA since some time in 2021. I know this because it caused a lot of issues and required getting a new SIM.
 
  • Like
Reactions: sysopkotton
It's interesting that Mint, the largest T-Mobile MVNO, doesn't have SA either. I thought they did but I just checked reddit and just 4 days ago people were talking about SA SIMs coming. Meanwhile, my Tello SIM, which is a massively smaller MVNO, has had 5G SA since some time in 2021. I know this because it caused a lot of issues and required getting a new SIM.
I ended up testing out method 2 with GCF CSC, I forced SA on TMB, funny thing is I can only stay connected for about 5 minutes before it switches back to NR Advanced or NR NSA.

Here is what I ended up with on both Sim1 and Sim2. Going to do some testing this week around the city and see what bands I can pickup.

That's interesting about Mint... you would think they would support SA... Maybe here in the near future with the TMB acquisition.
 

Attachments

  • Screenshot_20230402_221304_Service mode RIL.jpg
    Screenshot_20230402_221304_Service mode RIL.jpg
    748.9 KB · Views: 87
  • Like
Reactions: EtherealRemnant

Jeroen1000

Senior Member
Jul 26, 2012
137
23
@lancehardwood1313 have you tried flashing the firmware for the European / global model and see if 5G connects?

I am particularly interested in this. It seems at least 3 variables are at play:

1. The Efs partition. We know it isn't flashed with regular updates. It could be flashed in 'special' updates, not sure. It does seem to dictate which bands can be used. Some bands (mm wave) will require additional Hw like rf chips and antennas. Those might be missing in euro phones
2. Carrier profiles. You can have all the bands in existence, without proper configuration profiles the phone won't register to the ims. It will just fail or even get denied. Even if it does connect, It could lack CA parameters and other tweaks
3. I think Samsung csc manages these profiles


So seeing (dragons be here) your US model has the required bands (it does see the 5G networks) I would try to flash the multi csc stuff euro phones have.
This assumes there is no hard dependency between the Efs partition and the phone software.

If that doesn't work, I'd try to copy an euro Efs partition to your US phone. You would need a way to restore a backup as you cannot flash a Sammy firmware to get it back. 99.9% sure Samsung does.

Oh don't be cross at me if you brick your phone. This Efs stuff in particular can brick a phone🙂. Somehow this always reminds me why ppl who travel should just get an IPhone
 
Jan 26, 2023
31
2
@lancehardwood1313 have you tried flashing the firmware for the European / global model and see if 5G connects?

I am particularly interested in this. It seems at least 3 variables are at play:

1. The Efs partition. We know it isn't flashed with regular updates. It could be flashed in 'special' updates, not sure. It does seem to dictate which bands can be used. Some bands (mm wave) will require additional Hw like rf chips and antennas. Those might be missing in euro phones
2. Carrier profiles. You can have all the bands in existence, without proper configuration profiles the phone won't register to the ims. It will just fail or even get denied. Even if it does connect, It could lack CA parameters and other tweaks
3. I think Samsung csc manages these profiles


So seeing (dragons be here) your US model has the required bands (it does see the 5G networks) I would try to flash the multi csc stuff euro phones have.
This assumes there is no hard dependency between the Efs partition and the phone software.

If that doesn't work, I'd try to copy an euro Efs partition to your US phone. You would need a way to restore a backup as you cannot flash a Sammy firmware to get it back. 99.9% sure Samsung does.

Oh don't be cross at me if you brick your phone. This Efs stuff in particular can brick a phone🙂. Somehow this always reminds me why ppl who travel should just get an IPhone
Haha I do have an unlocked iphone 13 pro with a European sim in it and it connects to 5G just fine over here. As far as flashing goes....I'm not computer savvy and my galaxy is in stock out of the box unlocked config and I'm afraid to mess it up. I'm not sure why Samsung does that stupid **** knowing apple doesn't take away that capability of 5G roaming.....since they're trying to compete with apple! 🤷 took this screenshot while in Italy.
 

Attachments

  • Screenshot_20230405_134758_Phone services.jpg
    Screenshot_20230405_134758_Phone services.jpg
    676 KB · Views: 62
Last edited:

Jeroen1000

Senior Member
Jul 26, 2012
137
23
Haha I do have an unlocked iphone 13 pro with a European sim in it and it connects to 5G just fine over here. As far as flashing goes....I'm not computer savvy and my galaxy is in stock out of the box unlocked config and I'm afraid to mess it up. I'm not sure why Samsung does that stupid **** knowing apple doesn't take away that capability of 5G roaming.....since they're trying to compete with apple! 🤷
Apple has a lot of leverage. Every carrier sells iPhones. Carriers go far and beyond to support Apple. Imagine the customers they would lose if they didn't support Apple. Android manufacturers seem to 'conspire' with the carriers seemingly not caring to get a phone globally working.

A Oneplus actually has more bands out of the box vs Samsung. But alas... Carrier profiles are key to doing something with it. A Pixel 7 even has more. But it won't work in half of Europe for voLTE or voWiFi.

But I digress. I am sure someone here can tell you how to flash to European multi csc. But it's up to you hehe. Actually the US model is superior technically (both physical Hw and enabled bands) but Samsung is holding it back
 
Jan 26, 2023
31
2
Must have been a fluke....while in Germany at Munich Airport.... T-Mobile USA sim briefly got 5G NSA.... My German sim however wouldn't connect even though it could see the 5G Network
 

Attachments

  • Screenshot_20230411_120713_CellMapper.jpg
    Screenshot_20230411_120713_CellMapper.jpg
    750.2 KB · Views: 42
  • Screenshot_20230411_120623_CellMapper.jpg
    Screenshot_20230411_120623_CellMapper.jpg
    752.8 KB · Views: 39
  • Screenshot_20230411_120532_CellMapper.jpg
    Screenshot_20230411_120532_CellMapper.jpg
    683.8 KB · Views: 37
  • Screenshot_20230411_120452_NetMonster.jpg
    Screenshot_20230411_120452_NetMonster.jpg
    665 KB · Views: 39
  • Screenshot_20230411_103657_NetMonster.jpg
    Screenshot_20230411_103657_NetMonster.jpg
    389.6 KB · Views: 38
  • Screenshot_20230411_120730_NetMonster.jpg
    Screenshot_20230411_120730_NetMonster.jpg
    634.1 KB · Views: 43

Frogger4600

Senior Member
Feb 26, 2016
107
58
Shanghai
Hi all, quick question! I am considering buying an S23 Ultra international version (S918B/DS). I travel a lot between China and the US, and I'm hoping to use this phone both on China Mobile in China and Verizon in the US, ideally with 5G on both networks. Would the procedure outlined at the beginning of this thread allow this to work on the S918B/DS?
 
Hi all, quick question! I am considering buying an S23 Ultra international version (S918B/DS). I travel a lot between China and the US, and I'm hoping to use this phone both on China Mobile in China and Verizon in the US, ideally with 5G on both networks. Would the procedure outlined at the beginning of this thread allow this to work on the S918B/DS?
Someone in this thread is getting 5G on the s918B/DS after unlocking the bands. That model doesn't have the mmWave hardware.
 
  • Like
Reactions: Frogger4600

mjohnson4580

Senior Member
Jun 18, 2010
456
31
Baltimore
If there is only one sim in the phone whether its esim or physical sim is it always under sim 1? For instance if you had a physical sim then changed to esim would it still be considered sim 1?
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    What network are you using your device on, I have unlocked the bands but Airtel don't work as expected even though I see 5G on status bar.
    I have tried with Airtel and Jio SIM. It works for all bands on Jio which means you will get 5G on your cell anywhere jio has 5G coverage. However with Airtel it works on few band(s) and doesn't work on a few.. meaning coverage will be limited.. Airtel works on NonStandalone architecture ..meaning their 5G works on top of 4G network/frequency.. which means a combination of frequencies at any point. No solutionas such on how to make 5G work seamlessly with Airtel.. Guess the only option you have is to port to Jio if you want to use 5G seamlessly.
    1
    I have already unloacked the 5G SA Bands, Can we upgrade the software in the phone?

    It constantly asks me to upgrade.
    If it's a monthly patch, it won't most probably impact. But, if it's a major update - like One UI 5 to 5.1 or 6, it will mostly impact and you would need to redo some of the steps mentioned in the original post. I installed One UI 6 beta and all the hotfixes thereafter reset my bands and I had to redo some of the steps - set default LTE band, Disable Prune, Reset NR whitelist.
    1
    Update: Googling for "Samsung USB Drivers" and downloading and installing the version from Oct 2022 did the trick and got me past the "WAITING FOR DIAG" issue.

    That said, if I have to redo all the service menu settings after every update, I'm not sure if the trouble is worth it. I will give it an honest go and see how long I last!
    You don't have to redo all the settings. Just 3 of them worked for me - Enable Default LTE band, Clear NR Whitelist and Reset Prune Status.
    1
    Update: Googling for "Samsung USB Drivers" and downloading and installing the version from Oct 2022 did the trick and got me past the "WAITING FOR DIAG" issue.

    That said, if I have to redo all the service menu settings after every update, I'm not sure if the trouble is worth it. I will give it an honest go and see how long I last!
    The Samsung USB drivers you found are linked in the OP, you didn't have to Google them lol. Anyhow glad it worked after using them!

    Are you able to access *#73# now? Since you said in the other thread you want to use GCF CSC, that dial code should still work after you switch to GCF CSC since you unlocked the code now. Since you're using GCF CSC, the bands might already be unlocked without doing these steps. So switch to GCF CSC and enter band selection with *#73# to see if the bands are unlocked before bothering to try these steps.

    And if they're not unlocked, as aps99, you only really have to do those 3 settings to unlock the bands. The rest is just extra for other things.
    1
    Yes, *#73# is now working when the CSC is set to GCF. None of the others do, but at least this is a "sign of life" lol.

    Unfortunately, selecting GCF does not unlock or enable the non-standard U1 bands. I had to revert to XAA to make those changes.

    I'm glad to hear it's only those 3 settings that need to be changed. But are you on Telus as well? I'm getting worse speeds on Telus than I am with Koodo! 160 Mbps vs 250 Mbps! I wonder if I need to turn CIDManager back on, switch to Telus to "update the config" and then see if I get the insane download speeds that I used to?
    You don't need to switch to XAA to enable the bands. As long as *#73# works from GCF, you can access the engineering menu. You don't need any other code. This is how you access the engineering menu with *#73#.

    Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.

    You shouldn't need to turn on CIDManager if you unlock the bands. All CIDManager does is basically set up the correct bands for your provider.
  • 15
    What is this?

    This is a guide on how to enable all LTE and 5G bands on the US or Canadian S23 series phones by going through the service menu. This guide is a copy of my S22U guide, which is mostly based on this S20U guide by mellojosh, but has been adapted for the S23U phone with more information added.

    Who needs this?

    Different countries and carriers use different 5G frequency bands, so the phone's software limits 5G bands to your model's country and carrier even though the phone hardware supports more bands. Here are some cases when unlocking all 5G bands could be useful:
    • You live outside the US/Canada but bought a US/Canadian model and want to use 5G in your country that uses different 5G bands than US/Canadian carriers.
    • You live in the US/Canada but are travelling to a different country and want to use their 5G service which uses different 5G bands than US/Canada.
    • You live in the US/Canada but think your carrier is limiting your 5G service for some reason and think that you can optimize it better.
    Which bands can be enabled this way?

    All bands the phone supports in hardware can be enabled through the service menu. For the US S23 Ultra, that includes all Sub-6 bands like n78, and mmWave bands, as well as 5G SA bands, as shown in this screenshot below. For the Canadian S23 Ultra, this method will unlock all the same bands as the US model except mmWave (a hardware limitation with the antennas in the Canadian model).

    Bands List.jpeg

    Which phones does this method support?

    This method has been confirmed to work on:
    • Samsung S23 Ultra (S918U, S918U1, S918W).
    • Samsung S22 Ultra (S908U, S908U1, S908W).
    • Galaxy Z Fold 4 and Z Flip 4. Thanks @Abaddon and @otteporihs.
    This method works on both Android 12 (One UI 4.1), Android 13 (One UI 5.0, 5.1), or Android 14 (One UI 6.0).

    This method works for both US firmware (XAA or other US CSC) and Canadian firmware. Canadian models do not need to flash XAA firmware, and this method should work directly on Canadian firmware.

    If you get this method working on your phone that isn't in the known list, post it here and I will add it to the list above.

    How To Guide

    You will need a Windows computer (or VM) and the Samsung USB Driver installed to do the following steps. Install the USB driver from here before proceeding if you do not have it installed.

    A. Flash US or Canadian Firmware

    First, your device must be on US or Canadian firmware (XAA, XAC, or other CSC). You can skip this step and go to B if your device is already on US or Canadian firmware.

    Follow the steps below to flash XAA firmware. Note this will WIPE and FACTORY RESET your device. ALL DATA WILL BE LOST. So backup if you need to.
    1. Download Odin 3.14.4 or latest version.
    2. Download US XAA U1 firmware for your device from SamMobile.com or SamFw.com. For example, for the S23 Ultra, download the XAA firmware for S918U1. Extract the contents of the firmware to somewhere on your computer. You should have 5 files (BL, AP, CP, CSC, HOME_CSC). We won't use HOME_CSC.
    3. Restart your phone and go into download mode. On the S23 Ultra, hold all three power and up + down volume at the same time until the phone starts, then press the up volume key to get into download mode.
    4. Open Odin and connect your phone to your computer with a USB. Odin should say your phone was added.
    5. Click each of the BL, AP, CP, CSC buttons and select the corresponding files from the firmware zip you extracted. For CSC, use the file that starts with CSC and not HOME_CSC (we won't be using HOME_CSC). Do not load anything into USERDATA.
    6. Click start and let it flash the firmware (see the picture below). If it flashed correctly, your phone will be on XAA firmware after it restarts and you will have to set it up again from scratch.
    7. Set up your phone and verify it is on XAA firmware by going to Settings -> About Phone -> Software information -> check that it says XAA/XAA,XAA/OOO under "Software provider software version". OOO here will be your phone's original CSC like XAC which you cannot change and do not need to.
    A - Odin Flash.png

    B. Unlock Service Menu Secret Codes

    The next step is we need to unlock access to the service menu. Usually this is locked by default, but it might already be unlocked for you.

    First check if you can access the service menu by trying each of these ways (you only need one way to work):
    1. Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
    2. Open dialer and enter *#27663368378# to try to get directly into the service mode main menu. The menu should open after you press the last # character, you shouldn't have to press call.
    3. If either of the above ways works for you to get to the service mode main menu, then you can skip the below steps to unlock the menu and go directly to instructions C.
    If you cannot access the menu with the above codes, then follow these instructions to unlock the secret codes.

    1. Install the Samsung USB drivers from here if you have not already done so (note these are different then the driver's included with Smart Switch).
    2. Enable USB Debugging in Developer menu.
    3. Download SamFW FRP tool 4.0 or latest version from here.
    4. Open SamFW FRP tool and connect your phone to the computer with a USB.
    5. Using SamFW FRP tool, go to MTP tab and click on "Enable Secret Code for Verizon". See the picture below. Note it works on any US or Canadian CSC even though it says "for Verizon".
      • If in the program output you see it's getting stuck on "Waiting for DIAG", then dial *#0808# on your phone to open USB settings and select "DM + MODEM + ADB" then press OK. The program should then complete the step and then get stuck on "Disabling DIAG". When it does, using the *#0808# menu again, select "MTP + ADB" this time and press OK. Now the program should complete the step and say that secret codes was unlocked.
    6. Now you should be able to use *#73# for RF test, or *#27663368378#* to go directly to service menu. Test it to make sure at least one of the codes works and the service menu is opening.
    B - SamFW FRP Tool.png

    C. METHOD 1: Use the Service Menu to Unlock All Bands
    • Enter the service menu using either way (you only need one way to work).
      • Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
      • Open dialer and enter *#27663368378# to get directly into the service mode main menu.
    • Use the service mode to set the following options. Note you can go back between screens with three dots -> back for quicker navigation, but I am just starting each option below from the main menu so it's easy to read.
      1. Enable all LTE and 5G bands.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> SYSTEM -> Next page 4 times -> SET LTE BAND CONFIG -> SET DEFAULT LTE BAND.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> PRUNE STATUS -> REMOVE NR5G PRUNE.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> GCF -> REMOVE ONLY NR WHITELIST.
        • Optional if you need to enable mmWave bands on US model: Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Sub6/mmWave -> ALL ENABLE.
        • Optional if you have issues going from LTE to LTE+ (carrier aggregation not working properly): Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> DISABLE CA COMBO CHECK -> DISABLE ON.
      2. Enable 5G NR features (DSS & CDRX) if needed. These options might already be enabled for you by default.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> NR CDRX CONTROL -> NR CDRX ENABLE. NR CDRX is 5G power saving mode.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page 2 times -> NR DSS CONTROL -> NR DSS ENABLE. NR DSS is 5G Dynamic Spectrum Sharing.
      3. Enable 5G SA if you're lucky enough to have a carrier with standalone 5G networks. This option might be enabled by default already.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> SA/NSA Mode Control -> SA/NSA ENABLE.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> SA/NSA Mode Control -> Remove SA permit list.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NRDC -> NRDC ENABLE. NRDC is for dual connectivity with Sub6 + mmWave bands in parallel. Only applies to 5G SA networks and only if your carrier uses it.
      4. Restart your phone, then dial *#73# to get into RF Test Mode. Click Band Selection -> Sim 1 or Sim 2 (whichever you use). On this screen if you scroll down, you'll see a list of enabled NR5G bands. Make sure all bands are enabled. See my picture below.
      5. NOTE: Band selection won't be reset with a reboot, but might be reset after a CSC update (or a software update that includes a CSC update). You will have to re-do the service menu settings every update or re-flash of a CSC.
      6. NOTE: If you use an eSIM or a dual-SIM phone with a 2nd SIM, you need to change the NR5G stack before changing the NR5G related options above. Change the NR5G stack to Stack 2 with the following setting first.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Stack Selection -> Select STACK 2.
      7. OPTIONAL: Now that all bands are enabled and usable, you can use the Band Selection menu under *#73# to selectively disable certain bands if you need to. This is not covered here but that menu is self-explanatory.
      8. If this method isn't working, try METHOD 2 below. You do not need to try METHOD 2 if this method ended up working for you.
    D. METHOD 2: Unlock all bands via Protocol Simulation menu (requires US firmware)
    • If METHOD 1 above didn't work or not all bands were unlocked, you can try to unlock all bands by simulating a change in your CSC to GCF (Global Certification Forum). This won't actually change your CSC to GCF, but will change the options in the service menu as if you were on GCF CSC, which should give you access to all SA and NSA bands. Credits to @wr3cckl3ss1 for figuring out this method.
    • To do this method, first enter the service mode main menu using either of the following ways.
      • Open dialer and enter *#27663368378# to get directly into the service mode main menu.
      • Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
    • Using the service menu, change the following options
    1. Go to: Service Mode Main Menu -> PROTOCOL STATE -> PROTOCOL SIMULATION -> IMEI PRE CFG SIMULATION.
    2. In this menu, click [1] AP, then click GCF (last option). Then click [2] NET1 and change it to GCF as well. Do the same for [3] NET2. All GCF.
    3. Press [4] Write. Then restart phone.
    4. Check if all SA bands were unlocked. If not, repeat the band unlocking instructions from METHOD 1 above and then restart the phone and check again.

    Enjoy your unlocked LTE and 5G bands!

    CREDITS

    @mellojosh for his guide on service menu band options on the S20U1.
    @wr3cckl3ss1 for instructions on protocol simulation.
    3
    Side Note: I did this on a SM-S918B and enabled all bands. The phone now has 5G on T-Mobile in the US.
    3
    can anyone with a German or European S23 say if this is useful for us?
    I would like to know this too. Even though 5G isn't widespread in EU (no mmWave etc.), I'd like to enable it if the phone supports this but is limited/unabled for no reason.
    No unfortunately this method is for US/Canadian phones only.
    2
    The mmWave antenna is expensive. It was like $50 per device during the X55 days and I'd be surprised if that cost has gone down much so it's no surprise manufacturers continue to leave it out when it's not in use in that market. Heck, Google leaves it out of their base model unless you have Verizon or AT&T (even though T-Mobile has mmWave too) and only includes it in the unlocked Pro models.
    2
    From a T-Mobile branded S23 Ultra (SM-S918U) using eSIM:

    TMobile_SMS918U_All_Bands.jpg