Poco F1 US LTE Bands 2 & 4 Unlock Possible?? (No Longer Being Pursued)

Search This thread
By:
Advanced…
H

Huncriter

Senior Member
Aug 24, 2011
111
13
santoimam said:
Just found this thread after I unlock carrier locked my Hisense B16C2G phone that can't be unlocked for almost 3 years. This is just hypothesis, I suggest to try this with concern.

There are several file that determine bands capability in the devices. Most of it is in NV partition, but from the discussion I know that you guys have tried some popular ways to unlock it, but it failed. Like my phone at first i believe its hardware locked too, but i just discovered some Chinese article about unlocking oneplus device. Maybe you can try it too.

Here it is:
1. Connect to QPST and open EFS explorer
2. In policyman folder there are 3 file that most likely can be the cause of this network restiction
carrier_policy.xml
post.xml (in my phone there is none)
rat_mask (in my case this file that restrict my network even after I change NV values to support all bands)
3. Compare all three file with other phone's that most likely have same architechture (maybe MI8 or Pixel). For rat_mask, make sure it have same bits number(compare with Hex Editor)
4. replace that carrrier_policy.xml(and any file that contain this name) and rat_mask with modified files or use you can use other unrestricted phone's instead
These file originally in modem.img. Some phone replace them back with the original file when boot, you can modified init.radio.sh to prevent that.
We can modify carrier_policy.xml in modem.img and flash it to the phone but i cant find where rat_mask located
5. Reboot and hope if it solve your problem

I can't find any reference about how to generate unrestricted rat_mask and device_config so make sure you backup your original file before you make modification. Sorry I can confirm whether it will work or not because i don't own poco

NB: I solve my problem just with replacing carrier_config.xml and rat_mask. There is a file called device_config, be careful with this file because it control how the phone modem interact with qpst too, wrong modification can cause you cant connect to PC even in diag mode.
Click to expand...
Click to collapse
somebody tried this?
 
S

santoimam

Senior Member
Apr 4, 2016
50
46
Huncriter said:
somebody tried this?
Click to expand...
Click to collapse

Just discover some more information....

In general , there are the important thing to unlock network capabilities in a phone

1 [in EFS explorer] /policyman/
==carrier policy.xml (usually define conditions that configured by the carrier how the network react depend on what kind of SIMcard or waht operator are you use). this can be modified with some programming skill
==rat_mask (masking radio network capability, even if in band config you already unlocked them all)
==so_mask(mostly like rat_mask, but for service capabilities)
->this three kinds of file can be modified if you can understand how it work or you can copied them from other phone kind of similiar

2. [in EFS explorer]/nv/item_files/rfmv/ or can be viewed in QXDM (their name usually begin with RFNV_XXX)
These files are the most important thing, because they carried the devices specific antenna configuration for each band. For example you want to unlock LTE B20, so you must have RFNV_LTE_B20_xxxxxxx files (usually 10 or more per band) already in your devices, you can copy from exact same kind of device(in your case POCO F1) that are you use, but you can't use other kind of phone even only slightly different. If your device have that, you are good to go, just modified 3 files I menstioned above, if not then try your luck to find another unlocked poco)

More detail here: https://forum.xda-developers.com/mi-5/how-to/progress-trying-to-unlock-bands-t3337476
 
Last edited:
You must log in or register to reply here.

Similar threads

F
Poco F1 MHL / HDMI ?
Replies
55
Views
96K
X1M4
X1M4
T
Best place to buy a Poco[phone] F1 for European import?
Replies
212
Views
39K
O
onairda
S
How to enable 5Ghz Wifi on Poco F1?
Replies
21
Views
30K
M
md.rifah
T
Poco f1 Not getting detected in pc...
Replies
36
Views
24K
B
Blue Urse
S
No IR face unlock on my Pocophone. Why?
Replies
44
Views
53K
K
katoda_ltd

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 8
    H
    Heronicola
    @munchy_cool @pringlet

    So these are the steps I took in attempting the QPST method.

    1. Upon receiving the phone, I immediately linked it to my MIUI account and associated the phone with Mi Cloud, turning on sync and find my phone as well. (My account is 3 years old, but this should not make a difference due to the limit Xiaomi has imposed on bootloader unlocking wait.)

    2. An hour later, I then accessed my Windows machine and used Mi Flash Unlock, specifically version 3.3.525.23 which is available here. https://www.mediafire.com/file/ykvjawchrhtekwc/MiFlashUnlock_3.3.525.23.zip
    I powered off and held power and volume down to enter fastboot mode, and connected the phone to the computer. If the flash unlock tool does not already install the drivers, click on (from within the tool) Settings Gear Icon -> "Check" button (next to the sentence: "Click the button to install the drive.")
    d8hz35ddg0ni3dmzg.jpg

    I was met with an error at 99% which told me to wait another 71 hours, and henceforth I waited the 3 days which Xiaomi now imposes on Pocophone owners before the bootloader can be unlocked.

    3. As promised on the third day, I hit the unlock button and the bootloader unlocked. In order to enter Diagnostic Mode, I needed root access, and since I wanted a cleaner ROM I installed the Project Treble GSI through a modified TWRP using this guide: https://www.youtube.com/watch?v=j4oV9OOT5q8.
    I enabled root access by flashing Magisk through TWRP.
    Make sure to backup not only your system/data, but also the "EFS" partition which contains the NV variables which we mess with in QXDM. This can be done through TWRP.

    4. At this point I decided to try the QPST method, and so I downloaded QPST 2.7 Build 411 and QXDM Professional 03.12.714 (Both of which are readily available around the internet and easy to obtain).

    5. I enabled USB debugging and plugged the Pocophone into the Windows machine, and opened up an ADB shell. I gained root access through
    Code: 
    su
    and set the USB mode to debugging using
    Code: 
    setprop sys.usb.config diag,adb

    At this point, I opened up Device Manager and was met with the following device
    8bkdoas1cf538opbg.jpg

    which meant that the correct Qualcomm drivers were already installed as the following shows
    dvrwts4dizy6110zg.jpg


    However, if Windows does not automatically install the drivers for you, I tested the Xiaomi Mi5 diagnostic drivers which are available over at https://forum.xda-developers.com/mi-5/development/xiaomi-mi5-qualcomm-diagnostic-drivers-t3336200 and seem to work just fine with the Pocophone on my end.

    6. I then opened QPST Configuration (which can be accessed from Start Menu), and was met with the Pocophone in the list of connected devices
    kddfr8dfyfg8byebg.jpg

    If not, then you need to make sure the Qualcomm diagnostic driver is properly installed, and the device shows in Device Manager in the same fashion it did for me.
    Click on "Ports" in the QPST Configuration, and check to see if the port on which the device is connected is enabled
    nnn3vss0rdpxx2vbg.jpg


    If not, then click on "Add New Port" and type the connected COM port + number, as well as a label:
    zargv5ng0oi7nitbg.jpg


    7. At this point, I followed the standard procedure and kept QPST open while opening up QXDM, and added the target port by accessing "Options" -> "Communications" from within QXDM, and setting the Target Port option, followed by OK.
    b7qapqqbzmcbkytbg.jpg



    It was at this point where upon selecting "NV Browser" in View and attempting to read the LTE band configurations, I received "NV Status Error Received: Item Inactive."

    pskha65igt5ctk8bg.jpg
    View
    6
    V
    villahed94
    Thanks to a fellow member of the Poco F1 channel that also happened to have a Mi mix 2s, I am glad to provide these partitions.
    modemst1 ->sdf6
    modemst2->sdf7
    FSG ->sde36
    Hope this becomes useful.
    View
    4
    J
    JR_44
    munchy_cool said:
    if anyone has a Xiaomi Mi 8 and can provide a qcn file please HMU.

    you need to root, and then backup qcn using QPST.
    Click to expand...
    Click to collapse

    check your dms i sent you link to my mi8 xqcn backup
    View
    4
    H
    Heronicola
    I just tried adding bands 2 and 4 through QPST using QXDM NV editor. However, upon attempting to read values #6828 and #6829, I get the message "NV Status Error Received: Item Inactive." I went ahead and wrote an updated decimal value for the two variables anyways, "1786757322975", which should unlock bands 1,2,3,4,5,7,8,12,13,17,20,25,26,38,40,41. Upon rebooting out of diagnostic mode, however, I observed no change in the recognized bands.

    Can somebody explain what this "item inactive" message would implicate?
    As far as I can tell, all of the other phones I have seen which have had their bands unlocked through this method had the LTE bands stored in the variables #6828 and #6829, and reading these variables would return a string similar to the one I wrote, which held the original unlocked bands set by the manufacturer.
    View
    3
    H
    Heronicola
    munchy_cool said:
    so you did disable 3 and 5. but are we sure this is the value which can be used to enable 2 and 4.

    from the multiple threads i have read, once you enable 2 and 4 they show up in network signal guru list, whether they work or not is a different thing.

    what i am trying to say is since 2 and 4 did not show up in the app's list there might be some place else where they need to be enabled.
    Click to expand...
    Click to collapse
    This LTE preference variable doesn't seem to actually affect what bands are detected as being present, since on Network Signal Guru all the original bands were still showing, just without a checkmark on 3,5.

    Still searching for leads on how the bands work on this phone.
    View

New posts