Unlock LTE bands step by step - XIaomi Mi Note specific

GeorgeZZzz

Member
Apr 8, 2015
19
17
0
London
I bought a Xiaomi Mi Note LTE (Dual Sim) from China recently but cannot use LTE 4G in the UK.



It turned out that Mi Note LTE (Dual Sim) support LTE B3 and B7 (The international version supports B1 and B3)

But my carrier Vodafone UK rolled out LTE throughout the courtry with band 20 (800Mhz) but LTE Band 7 is only available for 3 cities at the moment. ( Only EE and Three support B3/B7, which is the reason I cannot see 'Vodafone 4G' and 'O2 4G' but 'EE 4G' and 'Three 4G' in the network list. source, source, source)

So I tried the guides: here, here, here and here to unlock B20 on my phone. (Many thank to @BlackSoulxxx, @fffft, @olokos, @devilsshadow and @Albirew)

I went through all the steps and set the value into 6828 (and even 6829) permanently but still cannot see 'Vodafone UK 4G' or 'O2 UK 4G' on the network list.


I googled a lot but still couldn't find the solution.


I found others who have Xiaomi Mi Note or Redmi have the same problem and want to unlock different LTE bands. But some of them stuck in the middle of the steps especially the prerequisites and couldn't go through. Maybe unlocking other LTE bands is working for them. So I decided to write the step by step guide and hopefully throw out a brick to attract a jade.

The lawyers made us do it.
We have to post an obligatory warning.

We don't think that this mod will cause you any problems. But we can't guarantee that. I never tried it on devices other than Mi Note LTE (dual sim).
You assume all risks if you proceed, including the risk that your phone might object, meltdown, brick or void your warranty.

Let's start

1. Root your device.

2. enable diag mode by entering *#*#717717#*#* on the dialer and download the driver from here (thank @m11kkaa).

Once diag mode enabled, you can see the Device Manager from PC like this:

then right click the first 'MI NOTE LTE' and install the driver you just downloaded

you will see this if successful



3. Download and install QPST

4. Download and install QXDM

5. Open the "QPST Configuration" program, you should see below straightaway:

You couldn't see this until you finished step 2 successfully

6. Now select the QPST Start Clients > Software download > Backup > Start. Wait until the status says 'memory backup completed'. This saves a backup copy of your phone's stock NV memory to your computer in case you need it later.

7. Leave QPST open and navigate to the C:\Program Files (x86)\Qualcomm\QXDM\Bin folder. And right click on QXDM.exe > run as administrator.



8. Go to options -> communications
Target port -> select COM6, then OK


9. select Nv Browser from view





10. select LTE from Category Filter, then you can see 06828 and 06829



11. click on line 06828 (lte_bc_config); click the Read button, save somewhere the original value in case something goes wrong (inside notepad or anything), the original value on my device is 2061584302148

12. Let's talk more about the value, source

in my case, the value for 06828 is 2061584302148, using Calculator (programmer mode) to change it to binary value is
11110000000000000000000000000000001000100
from right to left, the 3rd, 7th, 38, 39, 40,41 bit are 1, which means band 3/7/38/39/40/41 are enabled

I want to enable band 20 so change the 20th bit to 1
11110000000000000000010000000000001000100
the corresponding Dec value is 2061584826436

13. click on line 06828 (lte_bc_config); click the Read button, replace Input value with 2061584826436 (please don't be an idiot and don't edit the empty one with "ext" in the name) and click on Write button

OK THAT IS IT. Restarted Mi Note, and then see if the value set permanently.



BUT LTE BAND 20 IS STILL NOT UNLOCKED.



I changed the value to 2061584826368 which is
11110000000000000000010000000000000000000
Disable B3 and B7 to see if the value is working, It worked, I cannot see EE 4G and Three 4G any more.



let me know if anyone unlocks other bands

ps: don't forget to disable diag mode by entering *#*#717717#*#* on the dialer.

DID I MISS ANYTHING?!
and thanks in advance for any idea.


Thanks @BlackSoulxxx, @fffft, @olokos, @devilsshadow,
@Albirew and @m11kkaa anyway even if I couldn't unlock Mi Note, I had a lot fun playing it.
 

Attachments

Last edited:

blackysan

Member
Nov 3, 2013
16
0
0
how do u calculate the NV value for 6828? in my case i needed band: 1, 2, 3, 4, 7, 38, 39, 40, 41. could u get the value for me? thankyou
 
Last edited by a moderator:

skezza

Senior Member
Sep 29, 2007
1,474
191
0
I used Nv Calculator
https://play.google.com/store/apps/details?id=org.vndnguyen.nvcalc

And found out Calculator is good enough in my case.
Hello,

I need to unlock just one band on my Redmi Note, band 20. I don't have a Mi Note, I have the cheaper more affordable option the Redmi Note 4G.

However, I know this trick will work on it, it's a similar Snapdragon chipset, I just haven't tried it yet, as I'd love some advice before diving in.

Currently, my phone has:
FDD-LTE (1800/2100MHz) & TDD-LTE (2600MHz)

So basically, that's band
2100Mhz - Band 1
1800Mhz - Band 3
2600Mhz - Band 7

I'm on Three UK, which only has 2 bands on it's current spectrum,
Band 3 and Band 20, which of course is 800 and is NOT unlocked by this phone.

Is it possible to unlock Band 20, without losing other bands. I only need Band 3, and Band 20, and I'll have full 4G support.
 

skezza

Senior Member
Sep 29, 2007
1,474
191
0
10000000000000000000000000000000000000101

Yikes, this is my binary. Which is more confusing than ever. I get that it's little endian, so that means left to right, 101 that's 1 and 3. I'm confused though why Band 7 hasn't got a bit and what the very last bit refers to in my case.

---------- Post added at 01:41 PM ---------- Previous post was at 01:33 PM ----------

OK. I think I've found my mistake. Apparently, it supports Band 3 and Band 40. So maybe not Band 7 after all. This would make sense.

Band 1
Band 3
Band 40

I'll work it out for sure now ;)

---------- Post added at 01:50 PM ---------- Previous post was at 01:41 PM ----------

Balls
10000000000000000000000000000000000000101

There's 41 characters there. That's now messed up my head because surely that means it supports Band 1 and 3 and 41, not 40. I'll continue to work on this.

---------- Post added at 02:00 PM ---------- Previous post was at 01:50 PM ----------

Nope. I was right. I downloaded LTE Band Calculator off the Play Store, and 1 3 and 41 = 1099511627781, the number in my NV RAM.

What the hell is going on!!? I've read this phone supports 1, 3, 7, then it was 1, 3, 38, then 1, 3, 40... Now my NVRAM tells me it's 1, 3, 41.

Christ almighty. Apparently, band 41 is accessible from devices with Band 38 unlocked, but that doesn't make sense because India is running on Band 40.

Seriously, getting, pissed, off.
 
Last edited:

skezza

Senior Member
Sep 29, 2007
1,474
191
0
OK. An update.

I set my value to 10000000000000000000010000000000000000101 which is 1099512152069. This is Band 1, 3 20, and.... 41, which was apparently unlocked before. Not convinced though.

So far, can't tell whether it's actually done anything. EE 4G is still there, which makes sense because they have strong 4G in the UK. O2 which has piss poor 4G in the UK, only use Band 20, so seeing that as an option in the Network selection list would be a perfect way to check how valid this experiment is. I'm currently in Wilmslow in which O2 suggests I should have strong coverage, but nothing showing up yet, only EE.

However, I'm in a building, and it's a big building, and signal varies. Really, the best time to know is outside. Perhaps I will get O2 showing up with 4G in the network selection as an option.

The saga continues ;)

---------- Post added at 03:23 PM ---------- Previous post was at 03:19 PM ----------

Hah, another update. OpenSignal map, which uses data collected from actual devices shows that O2's 4G data is piss poor in Wilmslow (despite their claims). I'll wait then, and report back with further results ;)
 

skezza

Senior Member
Sep 29, 2007
1,474
191
0
You did a great job on this tutorial with a load of screens.
Have you considered there may be hardware limitation concerning LTE20 ?
My last couple of posts seems to possibly clear this up. It's very possible that Qualcomm haven't enabled Band 20 in the modem.

I wonder though, if we flashed a modem for a different device, whether we could unlock band 20....... food for thought isn't it?

---------- Post added at 04:06 PM ---------- Previous post was at 04:02 PM ----------

From the Zenfone 5 with the same chipset, again no band 20:

GSM: Band 2/3/5/8
WCDMA: Band 1/2/5/8
TD-SCDMA: Band 34/39
FDD-LTE: Band 1/3/7
TD-LTE: Band 38/39/40/41

From the Lenovo 856:
(4G): FDD - LTE: B1 (2100 MHZ) / B3 (1800 MHZ)

However, contradicting all that, from Moto G 4G, which uses the same chipset:
US Model: Bands 2, 4, 5, 17 (1900, 1700, 850, 700 MHz)
European model: Bands 1, 3, 7, 8, 20 (800, 900, 1800, 2100, 2600 MHz)

So from a purely hardware perspective, it looks as though it's very possible to do this. I wonder if flashing a Moto G 4G Modem would unlock Band 20.... :eek:

---------- Post added at 04:10 PM ---------- Previous post was at 04:06 PM ----------

Some China mobile. Same chipset:

FDD-LTE BAND 1/3/7/20; TDD-LTE BAND 41

Again.... Band 20.

It's possible, we need to flash a Moto G 4G Modem though.... now, talking about it is easy, but how we do it, without killing our devices, that's where it becomes fun, because I doubt we can just flash the baseband and assume it'll work. That's got lost IMEI written all over it.
 

blackysan

Member
Nov 3, 2013
16
0
0
Thanks for all your hard work AMD details how to. I'm able to add those band to my Redmi NOTE 4g but unfortunately, nothing works. I believed it's the hardware limitation. My Redmi Note 4g only supports FDD-LTE band 1, 3, 41. I needed band 2, 4 to beable to work with my US network.

Luckyly, I'm fortunate to purchase a HK model of Xiaomi Redmi NOTE 4G. this one ssupported FDD-LTE band 1, 2, 3, 4, 7! I can now use my US tmobile LTE network without any problems!

The questions I have now is:
is there any way to extract the modem that I have in the HK model Xiaomoi Redmi NOTE 4G and make a flashable zip file to flash it in my China Model Redmi NOTE 4G using CWM recovery? I would LOVE to help those people who bought the China model of Redmi NOTE 4G that couldn't use the LTE in the States. Anyone knows how to make a flashable zip with my modem in it?
 

blackysan

Member
Nov 3, 2013
16
0
0
My last couple of posts seems to possibly clear this up. It's very possible that Qualcomm haven't enabled Band 20 in the modem.

I wonder though, if we flashed a modem for a different device, whether we could unlock band 20....... food for thought isn't it?

---------- Post added at 04:06 PM ---------- Previous post was at 04:02 PM ----------

From the Zenfone 5 with the same chipset, again no band 20:

GSM: Band 2/3/5/8
WCDMA: Band 1/2/5/8
TD-SCDMA: Band 34/39
FDD-LTE: Band 1/3/7
TD-LTE: Band 38/39/40/41

From the Lenovo 856:
(4G): FDD - LTE: B1 (2100 MHZ) / B3 (1800 MHZ)

However, contradicting all that, from Moto G 4G, which uses the same chipset:
US Model: Bands 2, 4, 5, 17 (1900, 1700, 850, 700 MHz)
European model: Bands 1, 3, 7, 8, 20 (800, 900, 1800, 2100, 2600 MHz)

So from a purely hardware perspective, it looks as though it's very possible to do this. I wonder if flashing a Moto G 4G Modem would unlock Band 20.... :eek:

---------- Post added at 04:10 PM ---------- Previous post was at 04:06 PM ----------

Some China mobile. Same chipset:

FDD-LTE BAND 1/3/7/20; TDD-LTE BAND 41

Again.... Band 20.

It's possible, we need to flash a Moto G 4G Modem though.... now, talking about it is easy, but how we do it, without killing our devices, that's where it becomes fun, because I doubt we can just flash the baseband and assume it'll work. That's got lost IMEI written all over it.

i have a compatiable Hongkong version band 1, 2, 3, 4, 7 LTE redmi NOTE 4G. do u know how to extract the modem or baseband from my compatiable phone and flash it to my uncompatiable phone (China model).
 

GeorgeZZzz

Member
Apr 8, 2015
19
17
0
London
You did a great job on this tutorial with a load of screens.
Have you considered there may be hardware limitation concerning LTE20 ?
My last couple of posts seems to possibly clear this up. It's very possible that Qualcomm haven't enabled Band 20 in the modem.

I wonder though, if we flashed a modem for a different device, whether we could unlock band 20....... food for thought isn't it?

---------- Post added at 04:06 PM ---------- Previous post was at 04:02 PM ----------

From the Zenfone 5 with the same chipset, again no band 20:

GSM: Band 2/3/5/8
WCDMA: Band 1/2/5/8
TD-SCDMA: Band 34/39
FDD-LTE: Band 1/3/7
TD-LTE: Band 38/39/40/41

From the Lenovo 856:
(4G): FDD - LTE: B1 (2100 MHZ) / B3 (1800 MHZ)

However, contradicting all that, from Moto G 4G, which uses the same chipset:
US Model: Bands 2, 4, 5, 17 (1900, 1700, 850, 700 MHz)
European model: Bands 1, 3, 7, 8, 20 (800, 900, 1800, 2100, 2600 MHz)

So from a purely hardware perspective, it looks as though it's very possible to do this. I wonder if flashing a Moto G 4G Modem would unlock Band 20.... :eek:

---------- Post added at 04:10 PM ---------- Previous post was at 04:06 PM ----------

Some China mobile. Same chipset:

FDD-LTE BAND 1/3/7/20; TDD-LTE BAND 41

Again.... Band 20.

It's possible, we need to flash a Moto G 4G Modem though.... now, talking about it is easy, but how we do it, without killing our devices, that's where it becomes fun, because I doubt we can just flash the baseband and assume it'll work. That's got lost IMEI written all over it.
Thanks for all your hard work AMD details how to. I'm able to add those band to my Redmi NOTE 4g but unfortunately, nothing works. I believed it's the hardware limitation. My Redmi Note 4g only supports FDD-LTE band 1, 3, 41. I needed band 2, 4 to beable to work with my US network.

Luckyly, I'm fortunate to purchase a HK model of Xiaomi Redmi NOTE 4G. this one ssupported FDD-LTE band 1, 2, 3, 4, 7! I can now use my US tmobile LTE network without any problems!

The questions I have now is:
is there any way to extract the modem that I have in the HK model Xiaomoi Redmi NOTE 4G and make a flashable zip file to flash it in my China Model Redmi NOTE 4G using CWM recovery? I would LOVE to help those people who bought the China model of Redmi NOTE 4G that couldn't use the LTE in the States. Anyone knows how to make a flashable zip with my modem in it?
Thanks for all your replies guys.

I remember last time I flashed this kind of thing is when I was still in uni and flashed BIOS on motherboard......over 15 years ago......

Flashing the modern or baseband sounds promising but dangerous as well.
 

blackysan

Member
Nov 3, 2013
16
0
0
Thanks for all your replies guys.

I remember last time I flashed this kind of thing is when I was still in uni and flashed BIOS on motherboard......over 15 years ago......

Flashing the modern or baseband sounds promising but dangerous as well.
It's the same phone with the same chip and everything. It's not from a different phone with the same chip I'm talking about in my case…

China model of Redmi NOTE 4G is widely available on the net (FDD-LTE band 1, 3, TD-LTE band 41). And it's the ONLY model that people can buy at the moment. So people who bought that were pretty much stuck with HSPA+.

So. If any XDAer out there know how to transfer my HK model (FDD-LTE band 1, 2, 3, 4, 7) modem or baseband to the China model will be much appreciate! It's almost impossible to purchase the HK if u r not living in HK.

---------- Post added at 09:15 AM ---------- Previous post was at 08:55 AM ----------

Thanks for all your replies guys.

I remember last time I flashed this kind of thing is when I was still in uni and flashed BIOS on motherboard......over 15 years ago......

Flashing the modern or baseband sounds promising but dangerous as well.
I loved the Mi NOTE! I like the design dual glass and OIS camera. I'm hoping to purchase the Mi NOTE PRO when it come out next month. But having incompatibillties LTE band is the only problem keeping me back. I've been with Xiaomi phone since Mi2s. Now I'm using the HK model Redmi NOTE 4G because it's the ONLY Xiaomi phone right now that is 100% working with US LTE networks.

Xiaomi's 1st Global Mi phone code named "i" will be announce on the 23rd this month in India. Rumors said Xiaomi called this model the "Global Mi Phone" was because of the 4G LTE it supported. So if the Mi NOTE PRO has the same band as the regular Mi NOTE, guess my next Xiaomi phone will be the "i"…
 

skezza

Senior Member
Sep 29, 2007
1,474
191
0
Isn't it a case of Global Rom vs China ROM? The Global ROM flashes the global modem although, I've got a global ROM and i had 1, 3 and 41 myself.
 

blackysan

Member
Nov 3, 2013
16
0
0
Isn't it a case of Global Rom vs China ROM? The Global ROM flashes the global modem although, I've got a global ROM and i had 1, 3 and 41 myself.
nope. flashing the global rom will not change the modem of the phone. my HK model of Redmi NOTE 4G came with HK version of MIUI V5, then updated to Global version of MIUI 6 and now i'm using the Chinese version developer rom. and my 4G works on all 3 roms.

if that's the case, it might be the LTE antenna were different.....but we needs some expert to confirm this.
 

inkaine

Member
Apr 20, 2015
38
19
38
Xiaomi Redmi Note 4G LTE band unlock - Tutorial

Thank you very much for this wonderful detailed explaination, @GeorgeZZzz. Unlocking addtitional bands worked like a charm. Sadly as with each of you, there was no success on finding any LTE connection on band 20. I'm curious how bands 2, 4, 7 or 17 will work during my planned summer vacation in the US. :cowboy: Since after reading several of the previous unlock threads I fear it's all antenna related and not so much a snapdragon/software unlock issue. If that's truely the case we won't have any luck.

However during my unlock session in QXDM I had an interesting find:



Only an idea, but maybe the bands are additionally hardcoded into the firmware?

Anyways, it's nice playing around and thanks once again @GeorgeZZzz for making it easier with your "tutorial". :good:
 

Attachments

Last edited: