Unlock all bands of your Qualcomm device! Use your phone globally! No bs!

[Zacharee1]

In your Zip file is outdated, here fresher. https://drive.google.com/drive/folders/0B5ePoKNP9UFtZlJyUWJfTWZSejA Say thank you BlackSoulxxx.

---------- Post added at 18:52 ---------- Previous post was at 18:25 ----------

For Sony Z5C not enough change in QXDM, as the file amss_fsg_suzuran_***_tar.mbn does the modem configuration.

Clarify:
* Added new ranges, but in the end only one of them added;
* When you change SIM-card (operator) restores the default ranges.

None of those licenses actually work though.

 

[x2bc4]

None of those licenses actually work though.

No need to use them. Simply avoid for now the unlicensed ones .
Follow the instructions included in the patched ones [P].
I have to say that is really a very valuable colection. It is an exclusive source, at least in the english spoken forums.
Thanks to BlackSoulxxx for his gift to all.

---------- Post added at 04:10 PM ---------- Previous post was at 03:29 PM ----------

The correct way to fix variable is to backup whole NVRAM contents using QPST->Software Download->Backup to the .QCN file, binary patch it with some HexEditor, then Restore patched .QCN backup back to the phone. This way should quarantee correct NVRAM maintenance for most modern Qualcomm-based phones.

According to 2016/06 QDART Help, it's not advisable to backup NVRAM contents in .QCN file format anymore:

Use xQCN as backup format from QPST Backup program.
Due to the growing number of RFNV, modem EFS and QTuner data files in modem EFS, QPST SW Download backup may not be able to back up all RFNV items in QCN file.
This is due to a Microsoft COM APIs failure to create additional streams in QCN file. This is similar to fopen API failure in C.

Resolution?
The recommandation is to use xQCN as the backup format.

What is xQCN?
xQCN is the XML representaton for MSFT structured storage format. It is in byte stream form

Can QCNView to be used to open xQCN?
Yes

Does QRCT/QMSL support reading/writing xQCN file?
Yes

... Though I dont know how relevant is this strategy for older Qualcomm phone models.

 

[heiitorxd]

Anyone know how to enable 900mhz 3g band on my lg g3 f410s (korea version) ?

 

[TheDrive]

According to 2016/06 QDART Help, it's not advisable to backup NVRAM contents in .QCN file format anymore:

Thank you for your addition. I didn't known about these possible issues which could occure in any various aspects while working with Qualcomm EFS/NVRAM data (e.g. fixation/recovery of the dead phones). However if one have any suspections and to be on the safe side we could backup NVRAM contents to the xQCN format. xQCN seems to be the same storage as QCN with the difference it stores QCN's binary data as a text 'codes' between the xml tags, while QCN simply stores the binary data as binary data with some proprietary Qualcomm and M$-document headers.
It is simplier to patch binary data directly neither convert text to the binary data, patch it, then revert back to the 'text codes' and write into the xml.

There is no technical problem to store NVRAM in the text file with the binary tree. You can use provided (w/QPST) QCNView utility to load QCN/xQCN and view all the contents as a binary tree of the named hives and fields and even export this text tree to the text file to process with any tools you want. In this text you will see named ITEMs and EFS files with a quoted text of binary values that is relatively much easier to understand and patch. The problem is QCNView can NOT load/import [patched/any] text files and export them to the QCN/xQCN. It can only load/import QCN/xQCN and export it to the text. It's the one direction road. Qualcomm intentionally prevents us from easy patching of the modem data.

Unlike the described text file xQCN, which in fact is also the text file, quotes the binary structures of the proprietary format QCN data but not the readable ITEMs and EFS files structure. You'll not see plain text ITEM with numbers and EFS files with name definitions there. Just an 3-times size excessive way to store binary file as xml-text.

So I just can advise you to save NVRAM backups as QCN and xQCN one by one, then export both files to the text (by QCNView) and compare to be sure all the required NVRAM/EFS data was backed up. You should then explore text and find the ITEMs you need to patch. If QCN and xQCN backups seems to be equivalent in the containing data you can patch QCN and Restore it to the device to check/use your patch targets. If xQCN seems to store more data, then QCN, you will be forced to patch xQCN. To do so you may need convert binary data twice, once from text to the unique binary sequence (you have found in the plain text backup), then revert it to the text sequence encoding the QCN binary data to the xml xQCN. The search these data in xQCN and patch as you need.

It would be nice if someone will write an app to convert data between plain text NVRAM backup and QCN/xQCN format. To be more correct we just miss the one direction converter from text to QCN (while we can export text from QCN/xQCN in the QCNView). Form some stupid reason no one have written app to deal with QCN/xQCN backups. The authors of the commercial 'box' apps prefer to read/write NVRAM/EFS directly mostly using QMI protocol ('Diag port'). Qualcomm noted a long ago that preferred way to deal with NVRAM from outside the device, is to backup/restore the whole contents neither edit particular ITEMs directly (e.g. by older RF_NV_Manager like apps). Qualcomm have added some protective techs to the NVRAM/EFS procedures (e.g. IMEI OTP feature). OEM's add their own stupid custom protections, especially related to their unlawful SIM locking techs (locking directly violates consumer right and antimonopoly laws in many countries but big-money overall any laws).

At the same moment NVRAM backup/restore protocol/procedure uses some Qualcomm-common-reference-design backup privilege rights inside of the modem FW (any QMI dealing SW, including 'miracle boxed', fully depends on the modem FW and doesn't edit any data directly, I never heard the one have decrypted EFS storage, i.e. ModemST* partitions, independently of the modem FW). This make service SW dev dependable on the modem FW, which could be easily customized in any new version to prevent 'boxes' to make a things OEM doesn't want they do. On other hand service SW dev isn't fully aware of all the internals of the modem FW. It tries to support more and more models selling more and more 'box' copies and he has no enough time to fully reverse every model and every FW version. And as a final point, many boxed SW's do NOT backup NVRAM data before they try to edit it, or DO backup, but in the proprietary encrypted format (trying to 'protect' their 'TOP Secret' techs) which is not easy or impossible to restore by the SW itself and/or common SW like QPST and partition restore using ADB. This situation leads to the multiple failures when users and/or service engineers stuck with a NVRAM-broken devices with no backups and no recovery technique and forced to participate in a long term product support dialogs (which, BTW, doesn't warrant the successfull solution)..

There are the tools in the QDART package available to make such or simular actions with NVRAM (to provide devs with ability to initially make and tune custom NVRAM image). But QDART is a monster app of 400-700MB in size. It is designed to create full cycle test environment for devs, while we need just a 10-1000KB app to make our narrow job most comfortable way. I will not setup QDART even too I have a few modern versions. It's too excessive. I have extracted some console QCN/xQCN related utils from the QDART package (forgot the names) and got half a way to use it but failed to finish due to the time lack. One can explore and find/make the fully working solution for the problem.

But I prefer one(s) will reverse not-so-complicated QCN/xQCN format and write an independent app (most preferred open sourced at least since the EOD) to provde the community with open technology independent of the any proprietary SW. It's a long term project of honor. Other goal is to find a common way to decrypt/encrypt-back EFS partitions (ModemST*) using/not-using internal modem FW procedures, but it seems to be much more harder tech to develop. One who will make it will be the Earth scale Hero. Old good RevSkills/QMAT can import (it seems to be no export there) unencrypted EFS image but just from very old devices (up to the beginning of the 201x) and someone seems to have forced the author to stop development in the 2012. You shouldn't be here, Neo!

 

[Zehlek]

Has anyone been able to unlock Band 66 on Redmi Note 3 Qualcomm?

 

[GreyLeshy]

Maybe someone knows how to calculate the value of "LTE BC Configuration"?
NV Calculator is not appropriate, it lacks some of the ranges.

 

[Sharashchandra]

Someone just leak another version of QPST and QXDM which fully support new snapdragon chip.... I will try them out (Better beware of virus, like 422 build...)

Hi,for Xperia T2ultra dual (D5322)
Snapdragon 400(msm8228) please can u tell how to enable 4G

 

[theandroidguy]

Hi,for Xperia T2ultra dual (D5322)
Snapdragon 400(msm8228) please can u tell how to enable 4G

I'm also running a SD400 device, mine is 8226 nd it doesn't support LTE nd the 8228 also doesn't support 4G capabilities, so no 4G for this device, mostly the 8926 supports it

 

[Zacharee1]

If the chip doesn't support LTE at all, it probably isn't just disabled, but rather nonexistent.

 

[youxiaojie]

very good

 

[ipus89]

wish one can tell me if work on lg g3 d850?

 

[thecomputerguy81]

good lord this thread is huge.. i have the zenfone ultra.. will i be the first one willing to try this? or has somebody beat me to the punch?

 

[rbeavers]

good lord this thread is huge.. i have the zenfone ultra.. will i be the first one willing to try this? or has somebody beat me to the punch?

After a quick search you seem to be the first!

Sent from my SM-N950U using XDA-Developers Legacy app

 

[Ser71MB1]

Hello,
I have tried it for Asus Zenfone ZE520KL, but without success.
I cannot make it connect (or to be found) on QPST, even add port does not work.
Do you have any idea what is wrong? I installed many different drivers and also use a skript
on the phone to force Qualcomm USB driver installation.

I will be thankful for any help.

 

[GreyLeshy]

Has anyone been able to unlock Band 66 on Redmi Note 3 Qualcomm?

Maybe someone knows how to calculate the value of "LTE BC Configuration"?
NV Calculator is not appropriate, it lacks some of the ranges.

People, can somebody provide answers to these questions?

Maybe someone knows how to edit the configuration amss_fsg_***_ims_tar.mbn?

 

[patrol-cz]

People, can somebody provide answers to these questions?

Maybe someone knows how to edit the configuration amss_fsg_***_ims_tar.mbn?

There is a hidden activity for it. It's called "Customization Selector/Modem switcher" and you can find it with various shortcut managers, I'm using Quick Shortcut Maker for this purpose. Just open the ACTIVITIES tab and search for "modem". Only the right one will be found.
BUT: Normaly it won't run, you need to edit build.prop and change the "user" build type to "userdebug". After that it will be startable (just make a shortcut or do "Try" in QSM).
WIth regards,
Pavel

 

[GreyLeshy]

There is a hidden activity for it. It's called "Customization Selector/Modem switcher" and you can find it with various shortcut managers, I'm using Quick Shortcut Maker for this purpose. Just open the ACTIVITIES tab and search for "modem". Only the right one will be found.
BUT: Normaly it won't run, you need to edit build.prop and change the "user" build type to "userdebug". After that it will be startable (just make a shortcut or do "Try" in QSM).

Why did you write this?
I need to change the configuration file in order not to adjust every time the settings in QXDM.

 

[patrol-cz]

Why did you write this?
I need to change the configuration file in order not to adjust every time the settings in QXDM.

I wrote it, because you asked for it.
Quoting:
"Maybe someone knows how to edit the configuration amss_fsg_***_ims_tar.mbn?"
So, my answer is an exact answer for your question. By Modem switcher, you can permanently edit the configuration of modem being used.
Otherwise, you know: Stupid quetion -> Stupid answer .

 

[GreyLeshy]

I wrote it, because you asked for it.
Quoting:
"Maybe someone knows how to edit the configuration amss_fsg_***_ims_tar.mbn?"
So, my answer is an exact answer for your question. By Modem switcher, you can permanently edit the configuration of modem being used.
Otherwise, you know: Stupid quetion -> Stupid answer .

Okay, You didn't even bother to read the last few pages before replying.

 

[spire-hunter]

good lord this thread is huge.. i have the zenfone ultra.. will i be the first one willing to try this? or has somebody beat me to the punch?

Did you ever try this on your Zonefone 3 Ultra? I have the same phone and would love to give it a shot.