How To Guide How to Enable All Bands Through Service Menu on US/CA S23 series (including Sub-6 and mmWave)

Search This thread

jcsww

Senior Member
Thanks for the answer! Here are the screenshots from both Netmonster and Cellular Pro. No signs of 5G networks...
And a question to all members😊: Anybody who managed to get this working somewhere in Europe?
Sometimes bands can be restricted through carrier profiles for roaming only. Have you tried removing the carrier aggregation and any other carrier restrictions to see if that works?
 

kornelme

Member
Mar 23, 2023
8
0
Sometimes bands can be restricted through carrier profiles for roaming only. Have you tried removing the carrier aggregation and any other carrier restrictions to see if that works?
Thanks for the hint! No, I didn't try this. Where can I remove these? For CA i guess this is the place:
 

Attachments

  • Screenshot_20230325_133515_Service mode RIL.jpg
    Screenshot_20230325_133515_Service mode RIL.jpg
    204.4 KB · Views: 67

SoNic67

Senior Member
Apr 10, 2011
1,065
201
Samsung phones, when a new SIM is inserted, re-flashes the CSC firmware with a new one, that matches whatever the SIM carrier requires. If there is no requirement, then the unlocked phones flash the XAA CSC.
That firmware flash rewrites the bands selection, and possible adds many other limitations, like disabling the *#INFO* dial code.
 

dDesuKb

Senior Member
Nov 13, 2012
58
22
Samsung phones, when a new SIM is inserted, re-flashes the CSC firmware with a new one, that matches whatever the SIM carrier requires. If there is no requirement, then the unlocked phones flash the XAA CSC.
That firmware flash rewrites the bands selection, and possible adds many other limitations, like disabling the *#INFO* dial code.
You can still bring up the info service menu via shortcuts. Hell the full service mode is still there and still listed. Doesn't open due to lack of permissions of course.
 

kornelme

Member
Mar 23, 2023
8
0
Samsung phones, when a new SIM is inserted, re-flashes the CSC firmware with a new one, that matches whatever the SIM carrier requires. If there is no requirement, then the unlocked phones flash the XAA CSC.
That firmware flash rewrites the bands selection, and possible adds many other limitations, like disabling the *#INFO* dial code.
Thank for the reply! I'm not sure if I understand the effect of this. Does this mean that what I see in the service menu under band configuration are not the effective settings?or it only means that they could have applied some addictional restrictions? But why would they restrict any phone using their service?
 

SoNic67

Senior Member
Apr 10, 2011
1,065
201
But why would they restrict any phone using their service?
They restrict the usage because.. they want to control how devices behave in their network. They want to be able to do network load management, not let users mess with the bands.
Also, when Samsung flashes a specific CSC radio, some bands, that are not in use by that provider, get turned off. That saves power and possibly improves network connectivity.
My factory unlocked U1 version has multiple CSC in the firmware that can be automatically applied.

Those are my educated guesses, the providers can have their own reasons. And if we don't like it, we can choose a different provider...
 
Last edited:

SoNic67

Senior Member
Apr 10, 2011
1,065
201
You can still bring up the info service menu via shortcuts. Hell the full service mode is still there and still listed. Doesn't open due to lack of permissions of course.
Not with Verizon/Tracfone SIM in the phone, or at least I can't on mine. That SIM flashes a specific CSC and that blocks the service menu display.
 
Jan 26, 2023
31
2
Currently in Frankfurt Germany with a US unlocked Galaxy S23 Ultra. I'm thinking Samsung puts a 5G geolock to North America. My phone can read the 5G Networks in Germany but won't connect.
 

Attachments

  • Screenshot_20230328_090952_NetMonster.jpg
    Screenshot_20230328_090952_NetMonster.jpg
    453.3 KB · Views: 85
  • Screenshot_20230328_082946_NetMonster.jpg
    Screenshot_20230328_082946_NetMonster.jpg
    609.1 KB · Views: 93
  • Screenshot_20230328_095401_NetMonster.jpg
    Screenshot_20230328_095401_NetMonster.jpg
    647.8 KB · Views: 75
  • Screenshot_20230328_092648_NetMonster.jpg
    Screenshot_20230328_092648_NetMonster.jpg
    646.1 KB · Views: 73
  • Screenshot_20230328_092453_NetMonster.jpg
    Screenshot_20230328_092453_NetMonster.jpg
    469.9 KB · Views: 85

jcsww

Senior Member
Currently in Frankfurt Germany with a US unlocked Galaxy S23 Ultra. I'm thinking Samsung puts a 5G geolock to North America. My phone can read the 5G Networks in Germany but won't connect.
Personally, I am going to guess that it is the carrier blocking 5G access from an international device. Canadian carriers do this with a lot of models outside of North America.
 
Jan 26, 2023
31
2
Currently in Frankfurt Germany with a US unlocked Galaxy S23 Ultra. I'm thinking Samsung puts a 5G geolock to North America. My phone can read the 5G Networks in Germany but won't connect.
In Canada the
Personally, I am going to guess that it is the carrier blocking 5G access from an international device. Canadian carriers do this with a lot of models outside of North America.
Then why is my US iphone with a German sim card getting 5G?
 

SoNic67

Senior Member
Apr 10, 2011
1,065
201
The carriers have lists of "compatible" devices, based on IEMI.
Samsung phones sold in US have bands that are different than Samsung sold in EU.
iPhones have the same bands.
I don't know, I'm just saying that there can be technical reasons why 5G is declined by other countries/carriers. Some require certification for specific models, depending on the bands they have allocated for 5G.
The 5G setting DCNR_RESTRICTION true/false, is pushed in the phone by the carrier. It needs to be FALSE to get 5G.
You can check it with*#0011# (if is not blocked by SIM).
 
Jan 26, 2023
31
2
The carriers have lists of "compatible" devices, based on IEMI.
Samsung phones sold in US have bands that are different than Samsung sold in EU.
iPhones have the same bands.
I don't know, I'm just saying that there can be technical reasons why 5G is declined by other countries/carriers. Some require certification for specific models, depending on the bands they have allocated for 5G.
The 5G setting DCNR_RESTRICTION true/false, is pushed in the phone by the carrier. It needs to be FALSE to get 5G.
You can check it with*#0011# (if is not blocked by SIM).
I'm now in Italy on Tim....same problem....the restriction is set to false.
 

Attachments

  • Screenshot_20230329_024254_NetMonster.jpg
    Screenshot_20230329_024254_NetMonster.jpg
    366.1 KB · Views: 47
  • Screenshot_20230329_024154_Service mode RIL.jpg
    Screenshot_20230329_024154_Service mode RIL.jpg
    704.6 KB · Views: 48

kornelme

Member
Mar 23, 2023
8
0
They restrict the usage because.. they want to control how devices behave in their network. They want to be able to do network load management, not let users mess with the bands.
Also, when Samsung flashes a specific CSC radio, some bands, that are not in use by that provider, get turned off. That saves power and possibly improves network connectivity.
My factory unlocked U1 version has multiple CSC in the firmware that can be automatically applied.

Those are my educated guesses, the providers can have their own reasons. And if we don't like it, we can choose a different provider...
thanks!I have checked the article. So in theory I could apply my country/provider specific CSC to my phone which could resolve the issue? Or even if I do it IMEI blocking will stay in effect as this is done on the provider side?
 

SoNic67

Senior Member
Apr 10, 2011
1,065
201
thanks!I have checked the article. So in theory I could apply my country/provider specific CSC to my phone which could resolve the issue? Or even if I do it IMEI blocking will stay in effect as this is done on the provider side?
A while back I flashed the U version of firmware over a branded version and it worked. Even got the U updates.
But they were both for the Snapdragon variant of Galaxy S.
I think that if the specific country had shipped Exynos variants and you have a Snapdragon, it would not work to swap CSC firmware. I don't know...
 

kornelme

Member
Mar 23, 2023
8
0
Anybody in Europe with a phone bought in US who got this working? I did all described changes and tried many other things as well but still no 5G. Even on Netmonster I see no signs of 5G.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    Does this also work on the European version of the S24 Ultra (SM-S928B/DS)?
  • 20
    What is this?

    This is a guide on how to enable all LTE and 5G bands on the US or Canadian S23 series phones by going through the service menu. This guide is a copy of my S22U guide, which is mostly based on this S20U guide by mellojosh, but has been adapted for the S23U phone with more information added.

    Who needs this?

    Different countries and carriers use different 5G frequency bands, so the phone's software limits 5G bands to your model's country and carrier even though the phone hardware supports more bands. Here are some cases when unlocking all 5G bands could be useful:
    • You live outside the US/Canada but bought a US/Canadian model and want to use 5G in your country that uses different 5G bands than US/Canadian carriers.
    • You live in the US/Canada but are travelling to a different country and want to use their 5G service which uses different 5G bands than US/Canada.
    • You live in the US/Canada but think your carrier is limiting your 5G service for some reason and think that you can optimize it better.
    Which bands can be enabled this way?

    All bands the phone supports in hardware can be enabled through the service menu. For the US S23 Ultra, that includes all Sub-6 bands like n78, and mmWave bands, as well as 5G SA bands, as shown in this screenshot below. For the Canadian S23 Ultra, this method will unlock all the same bands as the US model except mmWave (a hardware limitation with the antennas in the Canadian model).

    Bands List.jpeg

    Which phones does this method support?

    This method has been confirmed to work on:
    • Samsung S23 Ultra (S918U, S918U1, S918W).
    • Samsung S22 Ultra (S908U, S908U1, S908W).
    • Galaxy Z Fold 4 and Z Flip 4. Thanks @Abaddon and @otteporihs.
    This method works on both Android 12 (One UI 4.1), Android 13 (One UI 5.0, 5.1), or Android 14 (One UI 6.0).

    This method works for both US firmware (XAA or other US CSC) and Canadian firmware. Canadian models might need to flash XAA firmware first, however in some cases this method might work directly on Canadian firmware.

    If you get this method working on your phone that isn't in the known list, post it here and I will add it to the list above.

    How To Guide

    You will need a Windows computer (or VM) and the Samsung USB Driver installed to do the following steps. Install the USB driver from here before proceeding if you do not have it installed.

    A. Flash US or Canadian Firmware

    First, your device must be on US firmware (XAA or other CSC). You can skip this step and go to B if your device is already on US firmware.

    Note for Canadian firmware, sometimes the unlocking instructions in B work without needing to flash US firmware first, so you should try that first. However if it doesn't work directly, you should flash US firmware first with these instructions below, then unlock the service menu with the instructions in B, then reflash Canadian firmware and the service menu will still be accessible.

    Follow the steps below to flash XAA firmware. Note this will WIPE and FACTORY RESET your device. ALL DATA WILL BE LOST. So backup if you need to.
    1. Download Odin 3.14.4 or latest version.
    2. Download US XAA U1 firmware for your device from SamMobile.com or SamFw.com. For example, for the S23 Ultra, download the XAA firmware for S918U1. Extract the contents of the firmware to somewhere on your computer. You should have 5 files (BL, AP, CP, CSC, HOME_CSC). We won't use HOME_CSC.
    3. Restart your phone and go into download mode. On the S23 Ultra, hold all three power and up + down volume at the same time until the phone starts, then press the up volume key to get into download mode.
    4. Open Odin and connect your phone to your computer with a USB. Odin should say your phone was added.
    5. Click each of the BL, AP, CP, CSC buttons and select the corresponding files from the firmware zip you extracted. For CSC, use the file that starts with CSC and not HOME_CSC (we won't be using HOME_CSC). Do not load anything into USERDATA.
    6. Click start and let it flash the firmware (see the picture below). If it flashed correctly, your phone will be on XAA firmware after it restarts and you will have to set it up again from scratch.
    7. Set up your phone and verify it is on XAA firmware by going to Settings -> About Phone -> Software information -> check that it says XAA/XAA,XAA/OOO under "Software provider software version". OOO here will be your phone's original CSC like XAC which you cannot change and do not need to.
    A - Odin Flash.png

    B. Unlock Service Menu Secret Codes

    The next step is we need to unlock access to the service menu. Usually this is locked by default, but it might already be unlocked for you.

    First check if you can access the service menu by trying each of these ways (you only need one way to work):
    1. Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
    2. Open dialer and enter *#27663368378# to try to get directly into the service mode main menu. The menu should open after you press the last # character, you shouldn't have to press call.
    3. If either of the above ways works for you to get to the service mode main menu, then you can skip the below steps to unlock the menu and go directly to instructions C.
    If you cannot access the menu with the above codes, then follow these instructions to unlock the secret codes.

    1. Install the Samsung USB drivers from here if you have not already done so (note these are different then the driver's included with Smart Switch).
    2. Enable USB Debugging in Developer menu.
    3. Download SamFW FRP tool 4.0 or latest version from here.
    4. Open SamFW FRP tool and connect your phone to the computer with a USB.
    5. Using SamFW FRP tool, go to MTP tab and click on "Enable Secret Code for Verizon". See the picture below. Note it works on any US or Canadian CSC even though it says "for Verizon".
      • If in the program output you see it's getting stuck on "Waiting for DIAG", then dial *#0808# on your phone to open USB settings and select "DM + MODEM + ADB" then press OK. The program should then complete the step and then get stuck on "Disabling DIAG". When it does, using the *#0808# menu again, select "MTP + ADB" this time and press OK. Now the program should complete the step and say that secret codes was unlocked.
    6. Now you should be able to use *#73# for RF test, or *#27663368378#* to go directly to service menu. Test it to make sure at least one of the codes works and the service menu is opening.
    B - SamFW FRP Tool.png

    C. METHOD 1: Use the Service Menu to Unlock All Bands
    • Enter the service menu using either way (you only need one way to work).
      • Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
      • Open dialer and enter *#27663368378# to get directly into the service mode main menu.
    • Use the service mode to set the following options. Note you can go back between screens with three dots -> back for quicker navigation, but I am just starting each option below from the main menu so it's easy to read.
      1. Enable all LTE and 5G bands.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> SYSTEM -> Next page 4 times -> SET LTE BAND CONFIG -> SET DEFAULT LTE BAND.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> PRUNE STATUS -> REMOVE NR5G PRUNE.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> GCF -> REMOVE ONLY NR WHITELIST.
        • Optional if you need to enable mmWave bands on US model: Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Sub6/mmWave -> ALL ENABLE.
        • Optional if you have issues going from LTE to LTE+ (carrier aggregation not working properly): Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> DISABLE CA COMBO CHECK -> DISABLE ON.
      2. Enable 5G NR features (DSS & CDRX) if needed. These options might already be enabled for you by default.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> NR CDRX CONTROL -> NR CDRX ENABLE. NR CDRX is 5G power saving mode.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page 2 times -> NR DSS CONTROL -> NR DSS ENABLE. NR DSS is 5G Dynamic Spectrum Sharing.
      3. Enable 5G SA if you're lucky enough to have a carrier with standalone 5G networks. This option might be enabled by default already.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> SA/NSA Mode Control -> SA/NSA ENABLE.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> SA/NSA Mode Control -> Remove SA permit list.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NRDC -> NRDC ENABLE. NRDC is for dual connectivity with Sub6 + mmWave bands in parallel. Only applies to 5G SA networks and only if your carrier uses it.
      4. Restart your phone, then dial *#73# to get into RF Test Mode. Click Band Selection -> Sim 1 or Sim 2 (whichever you use). On this screen if you scroll down, you'll see a list of enabled NR5G bands. Make sure all bands are enabled. See my picture below.
      5. NOTE: Band selection won't be reset with a reboot, but might be reset after a CSC update (or a software update that includes a CSC update). You will have to re-do the service menu settings every update or re-flash of a CSC.
      6. NOTE: If you use an eSIM or a dual-SIM phone with a 2nd SIM, you need to change the NR5G stack before changing the NR5G related options above. Change the NR5G stack to Stack 2 with the following setting first.
        • Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Stack Selection -> Select STACK 2.
      7. OPTIONAL: Now that all bands are enabled and usable, you can use the Band Selection menu under *#73# to selectively disable certain bands if you need to. This is not covered here but that menu is self-explanatory.
      8. If this method isn't working, try METHOD 2 below. You do not need to try METHOD 2 if this method ended up working for you.
    D. METHOD 2: Unlock all bands via Protocol Simulation menu (requires US firmware)
    • If METHOD 1 above didn't work or not all bands were unlocked, you can try to unlock all bands by simulating a change in your CSC to GCF (Global Certification Forum). This won't actually change your CSC to GCF, but will change the options in the service menu as if you were on GCF CSC, which should give you access to all SA and NSA bands. Credits to @wr3cckl3ss1 for figuring out this method.
    • To do this method, first enter the service mode main menu using either of the following ways.
      • Open dialer and enter *#27663368378# to get directly into the service mode main menu.
      • Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
    • Using the service menu, change the following options
    1. Go to: Service Mode Main Menu -> PROTOCOL STATE -> PROTOCOL SIMULATION -> IMEI PRE CFG SIMULATION.
    2. In this menu, click [1] AP, then click GCF (last option). Then click [2] NET1 and change it to GCF as well. Do the same for [3] NET2. All GCF.
    3. Press [4] Write. Then restart phone.
    4. Check if all SA bands were unlocked. If not, repeat the band unlocking instructions from METHOD 1 above and then restart the phone and check again.

    Enjoy your unlocked LTE and 5G bands!

    CREDITS

    @mellojosh for his guide on service menu band options on the S20U1.
    @wr3cckl3ss1 for instructions on protocol simulation.
    5
    It looks like this may have stopped working on the S24 series - I just ran the SamFirm secret code unlock and even though it says successful, I can't access the service menu. Uggghhh.
    Actually I just got my S24 Ultra and did this. The secret codes method unlocking works, but not on the Canadian firmware anymore. It has to be done in the US firmware first, then you can reflash Canadian.

    I flashed VZW U firmware (U1 isn't available yet) using Odin patched (with CSC file, not HOME_CSC), then was able to unlock the service menu using SamFW, then unlock all the bands in service menu. Now I'm just waiting for Canadian firmware to get posted so I can reflash and confirm the menu stays unlocked. It definitely should, I'm not too worried about that.

    Here's the unlocked bands on Canadian S24 Ultra model (no mmWave again):

    Screenshot_20240126_174119_Service mode RIL.png

    Proof that picture is from the S24 Ultra is in the WiFi icon ;p
    3
    Side Note: I did this on a SM-S918B and enabled all bands. The phone now has 5G on T-Mobile in the US.
    3
    can anyone with a German or European S23 say if this is useful for us?
    I would like to know this too. Even though 5G isn't widespread in EU (no mmWave etc.), I'd like to enable it if the phone supports this but is limited/unabled for no reason.
    No unfortunately this method is for US/Canadian phones only.
    2
    What if you flash the XAA firmware? And change CSC to GCF? I would be surprised if the hardware was different.
    Unfortunately I tried that and it is still doesn't work. I do know why though. If you put the Canadian phone (on XAA firmware) in diag mode and check with QPST EFS explorer, you can browse the Qualcomm modem firmware files in the EFS and see that the mmWave firmware file is missing (/nv/item_files/rfnv/00029652). On my US model S22U, this file exists. Without this file, the mmWave frequencies will not show up. I think these EFS firmware files are not included with the software updates, and instead are written to the hardware when the phone is made (like IMEI).

    Now I tried to copy this firmware file over from my S22U to S23W with QPST EFS explorer, but the file is deleted once the phone is rebooted (which is needed to load the file). It seems the EFS partition is not really writable with QPST explorer, or there is some master read-only copy that gets copied every boot. If anybody knows how to make changes stick with QPST EFS explorer on non-rooted devices, please tell me your experience.

    Perhaps if one were rooted it would be possible to add this file since I have seen people modifying the EFS partition with root. But I have no experience with this so I cannot help if one wants to try that. And anyways I cannot root the Canadian version so that's not an option for Canadian model.