[WORK IN PROGRESS] Unlocking additional bands

XabdullahX · Oct 13, 2016

Hi
Sorry if this is in the wrong section, here goes

I've been trying to unlock additional bands, but can't seem to get it right. that's why i turned to xda, maybe we can figure this out together.

There have been successful attempts on unlocking additional bands for the snapdragon, but it's not quite the same procedure for the mediatek.

So far, i've figured that I can use Maui META to edit values in your NVRAM.. as mentioned, i've been looking, and here are some interesting values. Suggestions on what to change to what, are appreciated.
I am starting with trying to unlock band 3, hopefully, after that, we will be able to unlock more

Code:

NVRAM_EF_EL1_BAND_INDICATOR_LID: 
lte_band(15): none, 2, 4, 7, 12, 17, none...

[I]changed band 12 to none, and couldnt select it in mtk app anymore
added band 3 and lost all signal[/I]

NVRAM_EF_EL1_MPRADJTBL_LID: array, in array
brandIdx: LTE_Band2
mpr_QPSK1: 256
mpr_16QAM0: 256
mpr_16QAM1: 512
delta_Tc0: 0
deltaTc: 1

brandIdx: LTE_Band12
mpr_QPSK1: 256
mpr_16QAM0: 256
mpr_16QAM1: 512
delta_Tc0: 0
deltaTc: 1

NVRAM_EF_EL1_RF_IO_LID: array, in array
bandIdx: LTE_Band2
rxio: 3
rxdio: 3
txio: 3

LTE_Band12
rxio: 7
rxdio: 6
txio: 7

NVRAM_EF_EL1_RX_PDATABASE_LID, Array in array. Each band has an array
bandIdx: LTE_Band2
RxPdata:
	pr0:
		data_h: 0
		data_L: 0
	pr1:
		data_h: 0
		data_L: 640
	pr2:
		data_h: 0
		data_L: 640
	pr3:
		data_h: 0
		data_L: 0
	pr3b:
		data_h: 0
		data_L: 0
	pr3c:
		data_h: 0
		data_L: 0
		
		
bandIdx: LTE_Band12
RxPdata:
	pr0:
		data_h: 0
		data_L: 0
	pr1:
		data_h: 0
		data_L: 128
	pr2:
		data_h: 0
		data_L: 128
	pr3:
		data_h: 0
		data_L: 0
	pr3b:
		data_h: 0
		data_L: 0
	pr3c:
		data_h: 0
		data_L: 0
		
		
NVRAM_EF_EL1_SVLTE_BAND_INDICATOR_LID: array(15) of bands: none, 2, 4, 7, 12, 17, rest are none

[i]changed 12 to none, but could still select it in mtk app[/i]

NVRAM_EF_EL1_TX_PDATABASE_LID: Array, each band has an array:

bandIdx: LTE_Band2
TxPdata:
	pt0:
		data_h: 0
		data_L: 0
	pt1:
		data_h: 0
		data_L: 0
	pt2:
		data_h: 0
		data_L: 0
	pt3:
		data_h: 0
		data_L: 0

bandIdx: LTE_Band12
TxPdata:
	pt0:
		data_h: 0
		data_L: 0
	pt1:
		data_h: 0
		data_L: 0
	pt2:
		data_h: 0
		data_L: 0
	pt3:
		data_h: 0
		data_L: 0

NVRAM_EF_AS_BAND_SETTING_LID, arrays:
gsm_band(1)
umts_band(1)
lte_band(8): 74, 0, 1, 0...

Things to note:
- stuff with parantheses means that it's an array of x size.
- ... means that the rest of the values are the same as the last mentioned value
- indetet items are content of variable
- cursive are notes
- !band2 and band12 are just examples of how the data looks like inside!, the rest of the supported bands are there. If you want more examples, do tell.
- all values are in decimal. feel free to convert to hex/binary
- I've tried changing all the places mentioned above, from channel2 to channel3.. didnt work

I've compiled a list of all values from section EL1 (which seems to be the interesting part):

Interesting reads:
http://forum.xda-developers.com/showpost.php?p=64675180&postcount=11
http://forum.xda-developers.com/mi-5/how-to/progress-trying-to-unlock-bands-t3337476
https://github.com/mtker/MT6735_Lon...D.LWTG.MP.V2/service/nvram/src/nvram_el1def.c
http://forum.xda-developers.com/mi-...how-to-unlock-lte-frequency-bands-mi-t3215880

XabdullahX · Oct 14, 2016

The conclusion so far:

these numbers you see in the nvram are not the bands, but the number of band that this band is mapped to.
for instance, every place you see that has *1STBAND", well.. thats in relation to band 2.
The real interesting parts, are now these keys:

NVRAM_EF_EL1_MIPI_PA_TPC_SECTION_DATA_1STBAND_LID

NVRAM_EF_EL1_MIPI_TX_DATA_1STBAND_LID - Upstream frequencies
NVRAM_EF_EL1_MIPI_RX_DATA_1STBAND_LID -Downstream frequencies

Declarations?
NVRAM_EF_EL1_RSSIGAINTBL_1STBAND_LID
NVRAM_EF_EL1_TXDAC_1STBAND_LID
NVRAM_EF_EL1_TXOCTLEV_1STBAND_LID

As you see all these contain frequency bands and more. I am guessing, in order to add new bands, we have to configure all these things ourselves.
Unless we get these values from another device.. this wont be possible as the amount of data needed is overwhelming.
For fun, I've tried changing every band2 to band3, and only changing all the frequencies to the correct one, but it doesn't work

KazuDante · Oct 13, 2016 at 5:59 PM

the blu studio one is the same soc as the r1 but different bands : heres a download link to the firmware maybye comparing the 2 and adding the difference would allow you to add more : the S0110EE has different bands including band 3 :http://www.mediafire.com/file/jaqey8yq0ompwo4/BLU_S0110EE_V11_REPAIR.rar

XabdullahX · Oct 14, 2016

KazuDante said:
the blu studio one is the same soc as the r1 but different bands : heres a download link to the firmware maybye comparing the 2 and adding the difference would allow you to add more : the S0110EE has different bands including band 3 :http://www.mediafire.com/file/jaqey8yq0ompwo4/BLU_S0110EE_V11_REPAIR.rar

Thanks for the suggestion. I probably can't use the firmware because it doesn't contain the nvram. But I will research that phone more

EDIT:
I might be able to retrieve the nvram.bin for one of these phones: http://www.gsmarena.com/results.php3?sFreeText=MT6735
but i don't know how to browse it's values. any suggestions?

juancollado2003 · Jul 10, 2017

for open the bands just need to do this:

1- Make a nandroid backup
2- Dont forget only you are responsable for your phone and no one else
3- Save your nandroid out of your phone
4- Extract and move this folder to R1 HD\Internal storage\TWRP\BACKUPS\VSJZLBNRY9DYBMR4\
5- Restore it from [URL="https://mega.nz/#!4J4H0KLR!eBV4X6-AhVcAxaJz_mbTceHNwxDHfbqUGFcvGDrTF4o" ]TWRP[/URL]

XabdullahX · Oct 16, 2016 at 3:19 PM

juancollado2003 said:
for open the bands just need to do this:

1- Make a nandroid backup
2- Dont forget only you are responsable for your phone and no one else
3- Save your nandroid out of your phone
4- Extract and move this folder to R1 HD\Internal storage\TWRP\BACKUPS\VSJZLBNRY9DYBMR4\
5- Restore it from TWRP

Why would that work? I just did it anyway, and it doesn't make a difference. Do you have it? Can you send me a screenshot of your activated LTE bands in mtk engineering app?

juancollado2003 · Oct 16, 2016

XabdullahX said:
Why would that work? I just did it anyway, and it doesn't make a difference. Do you have it? Can you send me a screenshot of your activated LTE bands in mtk engineering app?

Will open 3g bands, I did it on many blu phones

XabdullahX · Oct 16, 2016

juancollado2003 said:
Will open 3g bands, I did it on many blu phones

It doesn't seem to work for me.
do i have to wipe factory settings after restore?

And how exactly did you retrieve/make those files?

My screens dont exactly look like that. I dont have WCDMA-GSM-900, but i have WCDMA-AWS-1700 and WCDMA-CLR-850 (this is after restore)

juancollado2003 · Oct 16, 2016 at 6:50 PM

XabdullahX said:
It doesn't seem to work for me.
do i have to wipe factory settings after restore?

And how exactly did you retrieve/make those files?

My screens dont exactly look like that. I dont have WCDMA-GSM-900, but i have WCDMA-AWS-1700 and WCDMA-CLR-850 (this is after restore)

How did you restore it?

XabdullahX · Oct 16, 2016 at 8:18 PM

juancollado2003 said:
How did you restore it?

in twrp, i chose the folder, then clicked on it, and it had a checkmark in nvdata, clicked restore, and when it was done, i clicked reboot device.

juancollado2003 · Oct 16, 2016 at 8:52 PM

XabdullahX said:
in twrp, i chose the folder, then clicked on it, and it had a checkmark in nvdata, clicked restore, and when it was done, i clicked reboot device.

I don't really understand why is not working on yours, flash with sptool instead

FerociousAndroid · Oct 26, 2016

How do you access that screen after restoring the TWRP file?

juancollado2003 said:
Will open 3g bands, I did it on many blu phones

PS
I'm using Rom v12.

juancollado2003 · Oct 26, 2016 at 4:05 AM

FerociousAndroid said:
How do you access that screen after restoring the TWRP file?

PS
I'm using Rom v12.

Download the app mtk engineering mode

FerociousAndroid · Oct 27, 2016

Thanks, will give it a try later!
https://play.google.com/store/apps/details?id=com.Go.EngModeMtkShortcut

juancollado2003 said:
Download the app mtk engineering mode

FerociousAndroid · Oct 27, 2016

I have not applied your Nvdata file but I did install "Engineer Mode MTK Shortcut". What additional Bands does your file offer? Does not look any different from my phone running Stock ROM v12.

http://forum.xda-developers.com/r1-hd/how-to/guide-convert-to-prime-rollback-ota-t3432499

juancollado2003 · Oct 27, 2016 at 3:48 AM

FerociousAndroid said:
I have not applied your Nvdata file but I did install "Engineer Mode MTK Shortcut". What additional Bands does your file offer? Does not look any different from my phone running Stock ROM v12.

http://forum.xda-developers.com/r1-hd/how-to/guide-convert-to-prime-rollback-ota-t3432499

Wcdma 900 for example

kevev · Oct 31, 2016 at 8:35 PM

Band 12

Can we also get band 12 working automatically so that we don't need to use the MTK Engineering app to enable this band after every boot? Would this be an easy change? This would be totally awesome for US T-Mobile/MetroPCS users as this band provides much better coverage. Thank You in advance!

Autolounge · Nov 18, 2016 at 6:47 AM

http://www.tmonews.com/2016/11/blu-r1-hd-update-adds-support-t-mobile-volte-band-12-lte/

RubnLee · Jun 28, 2017 at 7:20 PM

Can anyone help me?

I have a BLU R1 HD 16gb version, rooted stock rom I need to open the band wcdma 900, is that possible?
Already tried with the backup vía TWRP

juancollado2003 · Jun 28, 2017 at 7:37 PM

RubnLee said:
I have a BLU R1 HD 16gb version, rooted stock rom I need to open the band wcdma 900, is that possible?
Already tried with the backup vía TWRP

I should work already, how you did it?

Enviado desde mi Life One X mediante Tapatalk

[WORK IN PROGRESS] Unlocking additional bands

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Attachments

Senior Member

Senior Member

Senior Member

Member

Senior Member