Guide to Advanced Leo/MIUI Customization: System & Boot Images, APK Patching + Extras
Just got myself this device and have been playing with it since. As a result, I have accumulated a set of patches and optimizations I'd now like to share. As it's going to be quite a few of them, I'll split the stuff into a couple of posts.
For the benefit of future readers, I think it'd be better to have everything I am about to post in one place, and for this reason I'm starting a new thread, although some of those topics might have already been addressed in other places on this and other forums.
Most of the stuff below can easily be adopted to other Xiaomi/MIUI devices, or even the products of other manufacturers. Please feel free to do so, as well as to share any comments and further optimizations you made. All feedback is appreciated, especially if things can be made better as a result of it.
If at any point you find yourself missing any of the common tools, the archive attached to this post includes: apktool2, aapt[-miui], adb, diff & patch, signapk[w], [un]zip and zipalign.
Table of Contents
The Initial Steps: Preparing the Device & Choosing the ROM
Starting with a Clean Slate
Flashing TWRP Recovery
Choosing the ROM Base
Modifying the Data Partition Image
Removable Files
Modifiable Files & Configuration
Modifying the System Partition Image (Except Configuration)
Removable Files
Removable Apps
Removing Google Apps
Removing Other Garbage
Modifiable Files
Modifying the System Partition Image: Configuration Files
Configuration
/system/build.prop
/system/etc/gps.conf
/system/etc/init.qcom.post_boot.sh
/system/etc/install_app_filter.xml
/system/etc/mcd_default.conf
/system/etc/spn.conf
/system/etc/system_fonts.xml
Modifying the Boot Image
Purpose
Changes
Securing the ADB
Disabling the CD-ROM Emulation
Flashing
Patching and Recompiling the Application Packages
Purpose
Reference
Changes
Mi Talk SIM Card Activation Nag
Mi Voice Ad in Contacts
Data Roaming Lost Connection Notification
Modifying the Theme Settings
Gadgets & Translations
MIUI-Themed App Icons
MIUI Default Wallpapers
Per-Application Theming
Automating the Modifications
The Edify Script
The Update ZIP Archive
The Patch Builder Script
The Complete Patch
Automated Installation of Google Apps
Purpose
Choosing the Google Apps Distribution
Scripting the Google Apps Installation
Flashing
Summary
Bonus: Qualcomm NVRAM Settings & 2G/3G/4G LTE Band Config
Choosing Bands to Enable
Enabling the Extra Bands
Understanding the Values
The Initial Steps: Preparing the Device & Choosing the ROM
Starting with a Clean Slate
Download the latest Chinese Development ROM along with the userdata partition by clicking this direct download link. If the link does not work, go to this page and search for "小米Note 顶配 最新 开发版". Unpack, edit the file flash_all.bat to remove the fastboot reboot line at the end. Put device in fastboot mode, check that it is connected with fastboot devices and execute flash_all.bat.
This will completely wipe everything on your device, bringing it to a factory-like state (but with the latest developer version flashed). Later, if you make some extensive changes to the filesystem and want to roll back, this should do the trick.
Flashing TWRP Recovery
Attached to this post is the version I made for myself. It is TWRP 2.8.6.0 based on GanFan and Happy MIUI's Chinese version of June 13, 2015, an improvement upon the English version GanFan released earlier (May 27, 2015), which was the one posted before on XDA. The newer version was only posted in the Chinese forums. All credit for the underlying TWRP build is due to GanFan and Happy MIUI.
I have removed any customizations from the filesystem, bringing it back to stock TWRP, using TWRP for LG G3 Europe (d855) as a base, as it has the same screen resolution. I have then merged the TWRP Materialised Play theme directly into the image, along with the official "Light-Light Blue" splash screen (curtain). TWRP is version 2.8.6.0 but the integrated theme is 2.8.7.x, as it fixes some bugs and appears to work just fine.
To install: unzip first, fastboot erase recovery, then fastboot flash recovery <filename>. You can then do fastboot reboot while holding the Volume Up button to get into the recovery.
Changelog
2015-12-31: Updated to set the ro.product.device property to "leo" so that Edify scripts that check for compatibility will now work.
Outstanding Issues
Sometimes the screen might be difficult to unlock because the swipes need to be very precise for them to register. I recommend to disable the screen timeout in the TWRP settings once in the recovery mode.
Wiping all partitions by formatting them appears to be introducing some problem, probably due to fstab discrepancies. Consider changing the relevant setting to use rm -rf for wiping if you plan to use this function.
Choosing the ROM Base
There are a lot of MIUI releases, of which the notable include:
The Official China Developer ROM (click the second green button under the headline "开发版" to download). This is always the first version to get the new features. It also includes a lot of China-specific apps you might want to get rid of while not having any translations besides that of the few Asian countries where Xiaomi products are sold officially. Lastly, it is not de-odexed.
Xiaomi.eu's Unofficial International MIUI is de-odexed and includes translations to Western languages, along with minimal GApps and some configuration changes most of which are fine but some you might want to revert (more on this later).
MIUI Pro is an alternative quality de-odexed ROM to check out, being Russian-based it does not however include Western translations. It is closer to the stock ROM in some areas, while deviating more from it in some others.
I went through the most recent releases of each of the three ROMs comparing their differences before I made up my mind which one to choose as a base. Starting with the original MIUI and de-odexing it, perhaps also adding your own translations in the process, might be a lot of fun but it'll also take you some time, and will be mostly redoing the work that has already been done elsewhere, so for now I settled upon using Xiaomi.eu's release. I went through all the changes they're doing to the stock version and find most of them reasonable, while starting off their version saves me some work.
If you are inclined to start with the stock version, there's a certain tool called jBART (released by the author of MIUI Pro) that provides a GUI to do all this, making it much easier than it used to be (the tools used by Xiaomi.eu are not publicly available).
Having downloaded the ROM of your choice, you can now start making the changes as described below. It's a good idea to keep a record of all the changes you make against the original image so that you can re-create them in future versions or roll back if necessary. It'd be even better if after making the changes you go back to the clean slate and then re-apply them from your records, to make sure that nothing else was accidentally changed.
Modifying the Data Partition Image
Removable Files
The following directories can be removed recursively:
/data/evt-test/
/data/media/MIUI/
/data/miui/app/
/data/miui/cust/
/data/miui/gallery/
/data/miui/mms/
/data/miui/videoplugins/
/data/miui/yellowpage/
/data/qmi-framework-tests/
As well as the following files:
/data/miui/app/vanward_applist
/data/miui/cdrom_install.iso
/data/miui/cust_variant
Xiaomi.eu's version already removes most of the clutter here, so if you're using the stock ROM the above list will not be enough: you'll want to remove more files (which unfortunately change with every version of the stock ROM).
Modifiable Files & Configuration
Further, there are some potentially interesting files in /data/miui/ that you might want to create or edit:
/data/miui/resolves_miui.conf
In this file, Xiaomi has hard-coded the IP addresses of their servers; as I don't see any reason to bypass the regular resolver configuration in such a way, I bumped up the version number and emptied the file:
Code:
# /data/miui/resolves_miui.conf
# Hardcoded data for the DNS resolver
# version 999
# Syntax:
# <fqdn> <ip_address> <"v4"|"v6">
# No more than 4 addresses per FQDN.
# If more than one address specified, all of them must be of the same type ("v4" or "v6")
# Version number must be increased whenever the file is modified
/data/miui/cust_variant
Suppose that in this file you put:
Code:
cn
Then, you can have:
/data/miui/cust/cn/cust.prop
Some build.prop settings that can be customized at the time of first boot:
Code:
persist.sys.timezone=UTC
#ro.carrier.name=
ro.com.android.mobiledata=true
ro.miui.region=IN
ro.miui.mcc=9404
# 9404 in 9454 hk 9460 cn 9502 my
# 9510 id 9515 ph 9525 sg 9466 tw
ro.miui.mnc=9999
ro.miui.cust_variant=cn
#ro.miui.cta=1
ro.product.locale.language=en
ro.product.locale.region=US
The list of all keys that can be customized, which you can edit it too, is in the file /system/etc/cust/cust_prop_white_keys_list.
The two files contain a list of pre-installed crapware, so they can be emptied (unless you already deleted them following the instructions above):
/data/miui/cust/cn/ota_customized_applist
/data/miui/cust/cn/ota_recommended_applist
If you really want to pre-install some apps, put them in:
/data/miui/app/noncustomized/<AppName>/<AppName>.apk
/data/miui/cust/cn/wpa_supplicant_customization.conf
The above file used to work at some point in the past (with another device I have), offering a way to preset the Wi-Fi profiles. Unfortunately, it doesn't work now. The example below is just in case that the functionality starts working again some time in the future, but for now don't bother:
Code:
network={
ssid="<Wi-Fi ESSID Name>"
key_mgmt=WPA-PSK
psk="<PlainTextPassword>"
proto=RSN
group=CCMP TKIP
pairwise=CCMP TKIP
priority=1
}
Modifying the System Partition Image (Except Configuration)
Removable Files
Removable Apps
The following apps (directories) can be recursively removed:
/system/app/AnalyticsCore/
/system/app/BaiduNetworkLocation/
/system/app/BugReport/
/system/app/matcli/
/system/app/Metok/
/system/app/MiLinkService/
/system/app/NVItem/
/system/app/PicoTts/
/system/app/SecurityAdd/
/system/app/TrafficControl/
/system/app/VirtualSim/
/system/app/XiaomiVip/
/system/app/XMPass/
If you are using the stock version, you can also get rid of these (in Xiaomi.eu's version, these are already removed):
/system/app/BasicDreams/
/system/app/Galaxy4/
/system/app/GameCenter/
/system/app/GooglePinyinIME/
/system/app/HoloSpiralWallpaper/
/system/app/LiveWallpapers/
/system/app/MiuiSuperMarket/
/system/app/NoiseField/
/system/app/PaymentService/
/system/app/PhaseBeam/
/system/app/PhotoTable/
/system/app/SystemAdSolution/
/system/app/VisualizationWallpapers/
/system/app/VirtualSim/
/system/app/VoiceAssist/
/system/priv-app/MiGameCenterSDKService/
Contrary to some information posted elsewhere, do not remove /system/app/NetworkAssistant2/ or you will get a force-close going through some mobile network settings. Also, while /system/app/Whetstone/ can possibly be removed, removing its libraries in /system/lib/ and /system/lib64/ will cause problems.
Removing Google Apps
Xiaomi.eu already includes a minimal installation of Google Apps but I am flashing a larger Open GApps package later so that the 500+ MiB free space on the /system partition can be put to good use. To avoid any conflicts between the two versions, it's a good idea to get rid of all the pre-loaded Google files first:
/system/etc/permissions/com.google.android.dialer.support.xml
/system/etc/permissions/com.google.android.media.effects.xml
/system/etc/permissions/com.google.widevine.software.drm.xml
/system/etc/preferred-apps/google.xml
/system/etc/preferred-apps/
/system/etc/sysconfig/google.xml
/system/etc/sysconfig/google_build.xml
/system/etc/sysconfig/
/system/framework/com.google.android.dialer.support.jar
/system/framework/com.google.android.media.effects.jar
/system/framework/com.google.widevine.software.drm.jar
And the apps themselves (recursively):
/system/app/CloudPrint2/
/system/app/GoogleCalendarSyncAdapter/
/system/app/GoogleContactsSyncAdapter/
/system/priv-app/GoogleBackupTransport/
/system/priv-app/GoogleFeedback/
/system/priv-app/GoogleLoginService/
/system/priv-app/GoogleOneTimeInitializer/
/system/priv-app/GooglePartnerSetup/
/system/priv-app/GoogleServicesFramework/
/system/priv-app/Phonesky/
/system/priv-app/PrebuiltGmsCore/
Note that I am not deleting /system/etc/permissions/com.google.android.maps.xml and /system/framework/com.google.android.maps.jar as for some reason those files are present in the stock ROM too. I am also keeping the WebView (Chromium) component. The above list can be used with MIUI Pro as well but you also need to remove the camera library that is not part of Xiaomi.eu's distribution.
Removing Other Garbage
MIUI includes the CD-ROM emulation "feature," which we'll be getting completely rid of shortly:
/system/etc/fake_cdrom_install.iso
The following font files are only included with Xiaomi.eu for obscure reasons and are probably obsolete:
/system/fonts/AndroidEmoji.ttf
/system/fonts/DroidNaskh-Regular-SystemUI.ttf
/system/fonts/NotoSansHebrewUI-Bold.ttf
/system/fonts/NotoSansHebrewUI-Regular.ttf
With regard to the latter two files, only some scripts have an UI variant in the Noto Sans font, and Hebrew is not even one of them. These two font files are the same as their corresponding non-UI variants. For some reason, Xiaomi.eu also forgot to include Burmese fonts, which are part of the stock ROMs.
These files seem to serve no purpose either:
/system/bin/qmi-framework-tests/
/system/media/audio/create_symlink_for_audio-timestamp
Modifiable Files
Here are some items that can be updated on the System partition, except the configuration files, which will be discussed separately later:
/system/app/<AppName>/<AppName>.apk
/system/priv-app/<AppName>/<AppName>.apk
If you want to add any extra system apps.
/system/fonts/
The fonts used in MIUI are generally based on outdated versions, and some of the fonts Xiaomi.eu uses are even older, apparently. The versions I am posting as an attachment are the latest at the time I was collecting them, which is roughly the time of this post. Alternatively, potentially newer versions can be downloaded from the following sources: Roboto, Noto (use unhinted, alternative link), Carrois Gothic, Coming Soon, Cutive Mono, Dancing Script, Naver fonts and others.
Note that Xiaomi.eu replaces the default MIUI fonts with Roboto, which is a good idea, as it solves some problems. The collection I posted in the attachment does the same.
/system/media/audio/alarms/
/system/media/audio/notifications/
/system/media/audio/ringtones/
If you want to add some extra audio files, this is the place (use the Ogg Vorbis format). Of course, you can just as well put them on the User Data partition.
/system/media/lockscreen/
/system/media/wallpaper/
Ditto, graphics files in the JPG format.
/system/media/theme/
This is a very interesting place to have a closer look, so I'll write about it in more detail later, with the exception of briefly mentioning the following:
/system/media/theme/miui_mod_icons/
The customized, MIUI-themed icons for all applications are stored here. The stock ROM barely includes any icons, while the collection shipped with MIUI Pro is much larger than that of Xiaomi.eu, so you may want to combine the two in your device's ROM (even more interestingly, many icons for popular apps overlap, and you will have two completely different versions to choose from for each of them).
/system/usr/icu/icudt53l.dat
The International Components for Unicode data. A newer version is available included in the attachment, or download it directly from source (making sure it's in the same format). It appears that the data downloaded directly from ICU does not include some charsets, pending further investigation please do not use this version. It should be safe to use the Google Source version but since newer Android releases switched to a different ICU format, the last version available there is not necessarily better than the one provided by Xiaomi.
/system/usr/share/zoneinfo/tzdata
The timezone data included with the latest MIUI is version 2015a, while the newest (as of now) is 2015g, as several countries made adjustments to their timezones last year. If you want to be up to date, download the newest version from the attachment or get it from the source.
Modifying the System Partition Image: Configuration Files
The configuration files discussed below, along with unified diffs against the original files, are included as attachments to this post. Note that they were made against the version 5.12.31 of China Developer ROM, so some of the changes might eventually get outdated. For this reason, I suggest you always apply the patches against the newest config files, and not reuse the old patched ones.
Configuration
/system/build.prop
Even if you're using Xiaomi.eu's ROM as your base, I suggest to start with the stock version of this file, as it's less cluttered, and just make the following edits:
ro.product.locale.language=en
ro.product.locale.region=US
Switch the default language to English.
ro.com.android.dateformat=yyyy-MM-dd
Change the date format to ISO standard.
persist.sys.mitalk.enable=false
Mi Talk is an online service I have no need for. Do you?
Further, we make the following additions:
drm.service.enabled=true
ro.com.google.gmsversion=5.1_r1
This is used for Google Apps.
persist.adb.notify=0
Disable the persistent notification when the device is in USB Debugging mode.
ro.adb.secure=1
Only allow ADB connections from hosts with pre-approved fingerprints. Important for security: otherwise, anything connected to your phone through USB will be able to get superuser access (and yes, that includes even something that might look just like an ordinary charger).
ro.product.mod_device=leo_mam_global
Adding the _global suffix sets the IS_INTERNATIONAL_VERSION flag inside some of the APKs, which is what you usually want, unless you are located in China (but then, removing some of the items listed above apparently breaks the China version, you'd need to investigate this on your own). Further, in Xiaomi.eu's version this has been modified to _mam_global inside the Settings app, so without this suffix you will experience force-closes when trying to open Additional settings (with other ROMs, you can probably just use _global as the suffix).
ro.setupwizard.mode=OPTIONAL
This setting would skip the setup wizard on first boot but then it stopped working at some point. I keep it here just in case someone searches for it or it starts working again but for now, don't bother.
You can also set the properties below to distinguish your build. It serves only cosmetic purpose but shows up in the Settings and is available to user-space apps:
ro.build.display.id=LMY47V-Custom
ro.build.date=Fri Jan 1 00:00:00 UTC 2016
ro.build.date.utc=1451606400
/system/etc/gps.conf
Again, I suggest starting with the stock version, and then making the following changes:
XTRA_SERVER_1=http://xtrapath1.izatcloud.net/xtra2.bin
XTRA_SERVER_2=http://xtrapath2.izatcloud.net/xtra2.bin
XTRA_SERVER_3=http://xtrapath3.izatcloud.net/xtra2.bin
Without it, you can see an occasional complaint in the logs that XTRA servers are not set, so perhaps this has the potential to improve fix time.
NTP_SERVER=pool.ntp.org
One is enough. And with the NTP.org pool you will get a server topologically very close to you. It already works very well just by analyzing your IP address. There is no need to constrain it to something like myvillage.mycountry.continent.ntp.org, especially on a mobile device, which is, by definition, mobile (unless you never travel outside your village). Seriously, too many people get this completely wrong. There is no benefit to be gained from setting it to anything else.
SUPL_HOST=supl.google.com
SUPL_PORT=7276
Even if it's unset in gps.conf, it might be set at runtime by an app. However, the above settings are correct, and there is no harm in setting to those values (other than Google knowing your location).
A_GLONASS_POS_PROTOCOL_SELECT = 0x7
Now this is something I was unable to find any documentation for so I might be completely wrong but according to the comments in the file, it should enable all the "assisted" GLONASS modes. I figured even if it does not, again there is no harm in trying, as it would not affect the other GPS options anyway. If anyone can shed more light on this, comments are welcome.
/system/etc/init.qcom.post_boot.sh
Only if you're using Xiaomi.eu's version, revert this file to the stock version to remove the additions they made at the end of this file.
/system/etc/install_app_filter.xml
Only if you're using the stock version, you can get rid of all the crap inside, as it doesn't serve any purpose but it's probably still parsed at every boot. Xiaomi.eu already has this file emptied. Make the contents look like this:
Code:
<?xml version="1.0" encoding="UTF-8"?>
<app_list>
<add_apps>
</add_apps>
<ignore_apps>
</ignore_apps>
</app_list>
/system/etc/mcd_default.conf
Add your browser to the list of browser apps, so that it can be allowed to consume more resources (as browsers typically do). The entries for Chrome and Sleipnir, my favorite browser, look like this:
Code:
{"uid": "*", "name": "com.android.chrome*" },
{"uid": "*", "name": "jp.co.fenrir.android.sleipnir*" },
Other than that, I also remove here the privileged entry for com.miui.whetstone. Since Whetstone cannot be removed completely, I decided to leave the APKs for it for the moment as well. If anyone has any comments on Whetstone, please feel free to share.
/system/etc/spn-conf.xml
This file has the names of known mobile networks. (You might also be interested in /system/etc/apns-conf.xml, which has the APN settings.) You can edit the name of your network here, and it will be displayed by the phone accordingly. The version supplied with the stock ROM seems outdated but Xiaomi.eu's version appears to be even more out of date, so I replace it with the stock version. Unfortunately, I don't have a good source for an up-to-date version of this file: Google's Android source code only includes a couple of entries, and not the worldwide list. CyanogenMod's version also doesn't seem very good. If you know a good source for the spn-conf.xml updates, please share.
/system/etc/system_fonts.xml
Xiaomi.eu has replaced the MIUI font entries here with Roboto but this is redundant because they also replaced the MIUI font files so that the MIUI font is in fact the Roboto font anyway. Besides, the font configuration is spread around several other files (/system/etc/fallback_fonts.xml, /system/etc/fonts.xml), so making such change in one place only seems to make even less sense. Revert to stock.
Modifying the Boot Image
Attached to this post is a diff that includes all of the discussed changes, along with the modified files (except the file where you are supposed to put your own ADB key).
Purpose
Simply put, the boot image consists of the kernel and a small filesystem image that is mounted as the root (/) filesystem. There are some files of interest there but since this filesystem becomes read-only once booted, the only way to make any changes to it is to unpack it, modify, and repack before flashing. There are essentially three reasons to do this:
To enable ADB fingerprint check (disabling the insecure ADB), and to add our ADB key to the database.
To remove the fake CD-ROM emulation.
While we are at it, for cosmetic reasons we also change the default timezone from Asia/Shanghai.
There are numerous ways to unpack and repack boot images but if you're on Windows, the most straightforward method is to do it with the Android Image Kitchen.
Changes
Securing the ADB
/bin/adb_keys
Paste your public ADB key into this file. On Windows, you can find your ADB key in %USERPROFILE%\.android\adbkey.pub.
/default.prop
To enable the secure ADB, we edit the following line:
ro.adb.secure=1
Then, to change the timezone:
persist.sys.timezone=UTC
Disabling the CD-ROM Emulation
The remainder of the changes deals with getting rid of the emulated CD drive:
/init.qcom.usb.cdrom.rc
Delete this file completely.
/init.qcom.usb.rc
Remove the lines that say:
import init.qcom.usb.cdrom.rc
write /sys/class/android_usb/android0/f_mass_storage/lun/ro 1 (2x)
trigger set_cdrom_install_file (2x)
/init.qcom.usb.sh
Remove the following section:
Code:
#
# Add support for exposing lun0 as cdrom in mass-storage
#
cdromname="/system/etc/cdrom_install.iso"
case "$target" in
"msm8226" | "msm8610" | "msm8916")
case $soc_hwplatform in
"QRD")
echo "mounting usbcdrom lun"
echo $cdromname > /sys/class/android_usb/android0/f_mass_storage/rom/file
chmod 0444 /sys/class/android_usb/android0/f_mass_storage/rom/file
;;
esac
;;
esac
/init.rc
Remove the line that says:
write /sys/class/android_usb/android0/f_mass_storage/lun/file /system/etc/fake_cdrom_install.iso
Better yet, just use the attached diff for all of the above. I am also including an image obtained by applying the diff against the original stock image (version 5.12.31) although it's better if you do the patching yourself.
Flashing
Put your device into fastboot mode, and execute: fastboot erase boot, fastboot flash boot boot-patched.img, fastboot reboot. Note: do not mistake this for fastboot bootloader, which is a completely different partition and one you wouldn't want to overwrite.
Another way to flash the boot image will be discussed in the section related to automating the patches.
Patching and Recompiling the Application Packages
Attached to this post are diffs for each of the APKs, along with their recompiled patched versions. The recompiled versions are based on Xiaomi.eu's ROM version 5.12.31.
Purpose
Nearly everything can be customized by modifying the code inside the APK. Resources can also be changed to translate or modify text or images displayed in a particular place. This is a last resort for stuff that cannot be adjusted through the Settings interface or by editing the configuration files. As of now, with Leo/MIUI I do it for three reasons:
Remove the Mi Talk notification asking me to "activate" my SIM card, without confirming my phone number and sending the text message to Xiaomi.
Remove the Mi Voice (built-in VOIP) group from the Contacts
Remove the notification saying that I have "lost connectivity because I left my home network", which was nearly always on because I put a foreign SIM card in the second slot, even though the first card is selected for data. This last diff might also be useful to non-MIUI users.
Reference
What follows is a quick summary how to do the modifications described below. I will not be explaining everything in detail but it should be enough to get you started.
APK Tool Wrapper
apktool2.bat
Code:
@echo off
setlocal
set PATH=%CD%;%PATH%;
java -jar \path\to\apktool-2.x.x.jar %1 %2 %3 %4 %5 %6 %7 %8 %9
Initial Framework Installation
apktool2 if -t miui system/framework/framework-res.apk
apktool2 if -t miui system/framework/framework-ext-res/framework-ext-res.apk
apktool2 if -t miui system/app/miui/miui.apk
apktool2 if -t miui system/app/miuisystem/miuisystem.apk
This only needs to be done once, the first time you are modifying any MIUI APK.
Decompiling with APK Tool
apktool2 d -b -o <AppName> -r -t miui <AppName>.apk
Decompiling with -b skips the generation of comments such as line numbers, which should make the diffs easier to apply even against future versions. Also, since in the situations below I'm only modifying the code, the -r flag skips decompiling the resources.
Applying a Diff Patch
patch --binary --no-backup-if-mismatch -E -i <DiffFileName>.diff -p0
Generating a Diff Patch
To generate your own patches, the syntax is:
diff -uN <FileName>.orig <FileName> > <FileName>.diff
For a single file.
diff -urN <DirName>.orig <DirName> > <DirName>.diff
For a recursive patch comparing directories.
Before making any changes, copy the original file or directory to <FileName>.orig or <DirName>.orig
Recompiling with APK Tool
apktool2 b -a aapt-miui.exe -c -o <AppName>.apk.unaligned <AppName>
The special version of AAPT for MIUI is available from Xiaomi with the drivers package, although based on my experience, the regular AAPT works just as well. Using the -c flag just copies over the old signature, so we don't need to sign the app again, note however that this will not work if you make any changes to AndroidManifest.xml.
zipalign -f 4 <AppName>.unaligned.apk <AppName>.apk
Aligns the APK file.
Changes
Mi Talk SIM Card Activation Nag
/system/app/XiaomiServiceFramework/XiaomiServiceFramework.apk
The following patch removes the Mi Talk notification asking to "activate" the SIM card. Normally to get rid of this message you'd need to send a text message to Xiaomi every time you change the SIM card. The patch doesn't interfere with the Mi Talk functionality so if you decide to register for it later, it will still be possible. This just removes the notification nag.
The patch:
Code:
diff -urN XiaomiServiceFramework.orig/smali/com/xiaomi/activate/ActivateProgressController.smali XiaomiServiceFramework/smali/com/xiaomi/activate/ActivateProgressController.smali
--- XiaomiServiceFramework.orig/smali/com/xiaomi/activate/ActivateProgressController.smali Sat Jan 02 19:25:42 2016
+++ XiaomiServiceFramework/smali/com/xiaomi/activate/ActivateProgressController.smali Sat Jan 02 20:03:19 2016
@@ -168,20 +168,6 @@
.locals 2
.param p1 # Landroid/content/Context;
- const-string v1, "notification"
-
- invoke-virtual {p1, v1}, Landroid/content/Context;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;
-
- move-result-object v0
-
- check-cast v0, Landroid/app/NotificationManager;
-
- const/4 v1, 0x5
-
- invoke-virtual {v0, v1}, Landroid/app/NotificationManager;->cancel(I)V
-
- invoke-static {}, Lcom/xiaomi/activate/ActivatePopupActivity;->dismiss()V
-
return-void
.end method
@@ -858,64 +844,6 @@
.method private notifyUnactivatedSimCards(Landroid/content/Context;)V
.locals 7
.param p1 # Landroid/content/Context;
-
- const/4 v6, 0x1
-
- const-string v3, "notification"
-
- invoke-virtual {p1, v3}, Landroid/content/Context;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;
-
- move-result-object v1
-
- check-cast v1, Landroid/app/NotificationManager;
-
- new-instance v0, Landroid/app/Notification$Builder;
-
- invoke-direct {v0, p1}, Landroid/app/Notification$Builder;-><init>(Landroid/content/Context;)V
-
- const v3, 0x7f07002c
-
- invoke-virtual {p1, v3}, Landroid/content/Context;->getString(I)Ljava/lang/String;
-
- move-result-object v3
-
- invoke-virtual {v0, v3}, Landroid/app/Notification$Builder;->setContentTitle(Ljava/lang/CharSequence;)Landroid/app/Notification$Builder;
-
- invoke-static {}, Lcom/xiaomi/activate/ActivateExternal;->getSysInteface()Lcom/xiaomi/activate/SysInterface;
-
- move-result-object v3
-
- invoke-interface {v3}, Lcom/xiaomi/activate/SysInterface;->getAppIconRes()I
-
- move-result v3
-
- invoke-virtual {v0, v3}, Landroid/app/Notification$Builder;->setSmallIcon(I)Landroid/app/Notification$Builder;
-
- invoke-virtual {v0, v6}, Landroid/app/Notification$Builder;->setAutoCancel(Z)Landroid/app/Notification$Builder;
-
- invoke-static {}, Ljava/lang/System;->currentTimeMillis()J
-
- move-result-wide v4
-
- invoke-virtual {v0, v4, v5}, Landroid/app/Notification$Builder;->setWhen(J)Landroid/app/Notification$Builder;
-
- const/4 v3, -0x1
-
- const/4 v4, 0x0
-
- invoke-static {p1, v3, v6, v4}, Lcom/xiaomi/activate/ActivateProgressController;->getActivatePopupPendingIntent(Landroid/content/Context;IILjava/lang/String;)Landroid/app/PendingIntent;
-
- move-result-object v2
-
- invoke-virtual {v0, v2}, Landroid/app/Notification$Builder;->setContentIntent(Landroid/app/PendingIntent;)Landroid/app/Notification$Builder;
-
- const/4 v3, 0x5
-
- invoke-virtual {v0}, Landroid/app/Notification$Builder;->build()Landroid/app/Notification;
-
- move-result-object v4
-
- invoke-virtual {v1, v3, v4}, Landroid/app/NotificationManager;->notify(ILandroid/app/Notification;)V
invoke-direct {p0}, Lcom/xiaomi/activate/ActivateProgressController;->setNotifiedEverFlagTrue()V
Apply with:
adb pull /system/app/XiaomiServiceFramework/XiaomiServiceFramework.apk
apktool2 d -b -o XiaomiServiceFramework -r -t miui XiaomiServiceFramework.apk
patch --binary --no-backup-if-mismatch -E -i system_app_XiaomiServiceFramework.diff -p0
apktool2 b -a aapt-miui.exe -c -o XiaomiServiceFramework.apk.unaligned XiaomiServiceFramework
zipalign -f 4 XiaomiServiceFramework.apk.unaligned XiaomiServiceFramework.apk
adb root
adb shell mount -o remount,rw /system
adb push XiaomiServiceFramework.apk /system/app/XiaomiServiceFramework/
Mi Voice Ad in Contacts
/system/priv-app/Contacts/Contacts.apk
MIUI Contacts now include a "Mi Voice" entry, which is essentially just an ad encouraging you to sign up for Xiaomi's proprietary VoIP service. The contact cannot be deleted or hidden from within the Settings, at least without activating it first, which involves sending a text message (again). This patch will get rid of it. It does not impact any of the other functionality of Mi Voice, so if you decide to register with it later, it should still work. Just do it from the Settings menu instead.
The patch:
Code:
diff -urN Contacts.orig/smali/com/android/contacts/list/ProfileAndContactsLoader.smali Contacts/smali/com/android/contacts/list/ProfileAndContactsLoader.smali
--- Contacts.orig/smali/com/android/contacts/list/ProfileAndContactsLoader.smali Tue Jan 05 17:53:40 2016
+++ Contacts/smali/com/android/contacts/list/ProfileAndContactsLoader.smali Tue Jan 05 17:57:12 2016
@@ -190,19 +190,6 @@
invoke-virtual {v8, v9}, Landroid/database/MatrixCursor;->addRow([Ljava/lang/Object;)V
:cond_3
- iget-boolean v0, p0, Lcom/android/contacts/list/ProfileAndContactsLoader;->mLoadVoipGroup:Z
-
- if-eqz v0, :cond_4
-
- const-string v0, "lookup_voip_group"
-
- const v1, 0x7f0c03ff
-
- invoke-direct {p0, v0, v1}, Lcom/android/contacts/list/ProfileAndContactsLoader;->loadGroupItem(Ljava/lang/String;I)[Ljava/lang/Object;
-
- move-result-object v9
-
- invoke-virtual {v8, v9}, Landroid/database/MatrixCursor;->addRow([Ljava/lang/Object;)V
:cond_4
iget-boolean v0, p0, Lcom/android/contacts/list/ProfileAndContactsLoader;->mLoadFollowedYellowPage:Z
Apply with:
adb pull /system/priv-app/Contacts/Contacts.apk
apktool2 d -b -o Contacts -r -t miui Contacts.apk
patch --binary --no-backup-if-mismatch -E -i system_priv-app_Contacts.diff -p0
apktool2 b -a aapt-miui.exe -c -o Contacts.apk.unaligned Contacts
zipalign -f 4 Contacts.apk.unaligned Contacts.apk
adb root
adb shell mount -o remount,rw /system
adb push Contacts.apk /system/priv-app/Contacts/
Data Roaming Lost Connection Notification
/system/priv-app/TeleService/TeleService.apk
This patch will remove the notification saying that "You have lost data connectivity because you left your home network". This is not a MIUI-specific message but I believe this notification being active all the time is due to a some glitch in the way MIUI handles the two SIM cards: in my setup, I have a local and a foreign SIM card inserted in my phone, however it is the former one that is selected for mobile data, and the data connection is working just fine, so by all means this notification should not pop up in such circumstances.
Anyway, as this message is annoying and useless in stock Android too, this diff might also be useful to non-MIUI users: feel free to adapt it to your needs of course.
The patch:
Code:
diff -urN TeleService.orig/smali/com/android/phone/NotificationMgr.smali TeleService/smali/com/android/phone/NotificationMgr.smali
--- TeleService.orig/smali/com/android/phone/NotificationMgr.smali Mon Jan 04 00:42:16 2016
+++ TeleService/smali/com/android/phone/NotificationMgr.smali Mon Jan 04 00:51:47 2016
@@ -637,27 +637,6 @@
# virtual methods
-.method hideDataDisconnectedRoaming()V
- .locals 2
-
- sget-boolean v0, Lcom/android/phone/NotificationMgr;->DBG:Z
-
- if-eqz v0, :cond_0
-
- const-string v0, "hideDataDisconnectedRoaming()..."
-
- invoke-direct {p0, v0}, Lcom/android/phone/NotificationMgr;->log(Ljava/lang/String;)V
-
- :cond_0
- iget-object v0, p0, Lcom/android/phone/NotificationMgr;->mNotificationManager:Landroid/app/NotificationManager;
-
- const/4 v1, 0x5
-
- invoke-virtual {v0, v1}, Landroid/app/NotificationManager;->cancel(I)V
-
- return-void
-.end method
-
.method public postTransientNotification(ILjava/lang/CharSequence;)V
.locals 2
.param p1 # I
@@ -686,167 +665,6 @@
invoke-virtual {v0}, Landroid/widget/Toast;->show()V
- return-void
-.end method
-
-.method showDataDisconnectedRoaming()V
- .locals 13
-
- const/4 v10, 0x0
-
- const/4 v12, 0x0
-
- sget-boolean v9, Lcom/android/phone/NotificationMgr;->DBG:Z
-
- if-eqz v9, :cond_0
-
- const-string v9, "showDataDisconnectedRoaming()..."
-
- invoke-direct {p0, v9}, Lcom/android/phone/NotificationMgr;->log(Ljava/lang/String;)V
-
- :cond_0
- new-instance v4, Landroid/content/Intent;
-
- iget-object v9, p0, Lcom/android/phone/NotificationMgr;->mContext:Landroid/content/Context;
-
- const-class v11, Lcom/android/phone/settings/MobileNetworkSettings;
-
- invoke-direct {v4, v9, v11}, Landroid/content/Intent;-><init>(Landroid/content/Context;Ljava/lang/Class;)V
-
- iget-object v9, p0, Lcom/android/phone/NotificationMgr;->mContext:Landroid/content/Context;
-
- invoke-static {v9, v12, v4, v12}, Landroid/app/PendingIntent;->getActivity(Landroid/content/Context;ILandroid/content/Intent;I)Landroid/app/PendingIntent;
-
- move-result-object v1
-
- iget-object v9, p0, Lcom/android/phone/NotificationMgr;->mContext:Landroid/content/Context;
-
- const v11, 0x7f090221
-
- invoke-virtual {v9, v11}, Landroid/content/Context;->getText(I)Ljava/lang/CharSequence;
-
- move-result-object v2
-
- new-instance v9, Landroid/app/Notification$Builder;
-
- iget-object v11, p0, Lcom/android/phone/NotificationMgr;->mContext:Landroid/content/Context;
-
- invoke-direct {v9, v11}, Landroid/app/Notification$Builder;-><init>(Landroid/content/Context;)V
-
- const v11, 0x108008a
-
- invoke-virtual {v9, v11}, Landroid/app/Notification$Builder;->setSmallIcon(I)Landroid/app/Notification$Builder;
-
- move-result-object v9
-
- iget-object v11, p0, Lcom/android/phone/NotificationMgr;->mContext:Landroid/content/Context;
-
- const v12, 0x7f09021e
-
- invoke-virtual {v11, v12}, Landroid/content/Context;->getText(I)Ljava/lang/CharSequence;
-
- move-result-object v11
-
- invoke-virtual {v9, v11}, Landroid/app/Notification$Builder;->setContentTitle(Ljava/lang/CharSequence;)Landroid/app/Notification$Builder;
-
- move-result-object v9
-
- iget-object v11, p0, Lcom/android/phone/NotificationMgr;->mContext:Landroid/content/Context;
-
- invoke-virtual {v11}, Landroid/content/Context;->getResources()Landroid/content/res/Resources;
-
- move-result-object v11
-
- const v12, 0x7f070027
-
- invoke-virtual {v11, v12}, Landroid/content/res/Resources;->getColor(I)I
-
- move-result v11
-
- invoke-virtual {v9, v11}, Landroid/app/Notification$Builder;->setColor(I)Landroid/app/Notification$Builder;
-
- move-result-object v9
-
- invoke-virtual {v9, v2}, Landroid/app/Notification$Builder;->setContentText(Ljava/lang/CharSequence;)Landroid/app/Notification$Builder;
-
- move-result-object v0
-
- iget-object v9, p0, Lcom/android/phone/NotificationMgr;->mUserManager:Landroid/os/UserManager;
-
- const/4 v11, 0x1
-
- invoke-virtual {v9, v11}, Landroid/os/UserManager;->getUsers(Z)Ljava/util/List;
-
- move-result-object v8
-
- const/4 v3, 0x0
-
- :goto_0
- invoke-interface {v8}, Ljava/util/List;->size()I
-
- move-result v9
-
- if-ge v3, v9, :cond_3
-
- invoke-interface {v8, v3}, Ljava/util/List;->get(I)Ljava/lang/Object;
-
- move-result-object v6
-
- check-cast v6, Landroid/content/pm/UserInfo;
-
- invoke-virtual {v6}, Landroid/content/pm/UserInfo;->isManagedProfile()Z
-
- move-result v9
-
- if-eqz v9, :cond_1
-
- :goto_1
- add-int/lit8 v3, v3, 0x1
-
- goto :goto_0
-
- :cond_1
- invoke-virtual {v6}, Landroid/content/pm/UserInfo;->getUserHandle()Landroid/os/UserHandle;
-
- move-result-object v7
-
- invoke-virtual {v7}, Landroid/os/UserHandle;->isOwner()Z
-
- move-result v9
-
- if-eqz v9, :cond_2
-
- move-object v9, v1
-
- :goto_2
- invoke-virtual {v0, v9}, Landroid/app/Notification$Builder;->setContentIntent(Landroid/app/PendingIntent;)Landroid/app/Notification$Builder;
-
- new-instance v9, Landroid/app/Notification$BigTextStyle;
-
- invoke-direct {v9, v0}, Landroid/app/Notification$BigTextStyle;-><init>(Landroid/app/Notification$Builder;)V
-
- invoke-virtual {v9, v2}, Landroid/app/Notification$BigTextStyle;->bigText(Ljava/lang/CharSequence;)Landroid/app/Notification$BigTextStyle;
-
- move-result-object v9
-
- invoke-virtual {v9}, Landroid/app/Notification$BigTextStyle;->build()Landroid/app/Notification;
-
- move-result-object v5
-
- iget-object v9, p0, Lcom/android/phone/NotificationMgr;->mNotificationManager:Landroid/app/NotificationManager;
-
- const/4 v11, 0x5
-
- invoke-virtual {v9, v10, v11, v5, v7}, Landroid/app/NotificationManager;->notifyAsUser(Ljava/lang/String;ILandroid/app/Notification;Landroid/os/UserHandle;)V
-
- goto :goto_1
-
- :cond_2
- move-object v9, v10
-
- goto :goto_2
-
- :cond_3
return-void
.end method
diff -urN TeleService.orig/smali/com/android/phone/PhoneGlobals$1.smali TeleService/smali/com/android/phone/PhoneGlobals$1.smali
--- TeleService.orig/smali/com/android/phone/PhoneGlobals$1.smali Mon Jan 04 00:42:16 2016
+++ TeleService/smali/com/android/phone/PhoneGlobals$1.smali Mon Jan 04 00:51:37 2016
@@ -112,20 +112,10 @@
goto :goto_0
:sswitch_3
- iget-object v4, p0, Lcom/android/phone/PhoneGlobals$1;->this$0:Lcom/android/phone/PhoneGlobals;
- iget-object v4, v4, Lcom/android/phone/PhoneGlobals;->notificationMgr:Lcom/android/phone/NotificationMgr;
-
- invoke-virtual {v4}, Lcom/android/phone/NotificationMgr;->showDataDisconnectedRoaming()V
-
goto :goto_0
:sswitch_4
- iget-object v4, p0, Lcom/android/phone/PhoneGlobals$1;->this$0:Lcom/android/phone/PhoneGlobals;
-
- iget-object v4, v4, Lcom/android/phone/PhoneGlobals;->notificationMgr:Lcom/android/phone/NotificationMgr;
-
- invoke-virtual {v4}, Lcom/android/phone/NotificationMgr;->hideDataDisconnectedRoaming()V
goto :goto_0
Apply with:
adb pull /system/priv-app/TeleService/TeleService.apk
apktool2 d -b -o TeleService -r -t miui TeleService.apk
patch --binary --no-backup-if-mismatch -E -i system_priv-app_TeleService.diff -p0
apktool2 b -a aapt-miui.exe -c -o TeleService.apk.unaligned TeleService
zipalign -f 4 TeleService.apk.unaligned TeleService.apk
adb root
adb shell mount -o remount,rw /system
adb push TeleService.apk /system/priv-app/TeleService/
Modifying the Theme Settings
MIUI allows a lot of theme customization. Fortunately, this part is relatively well-documented elsewhere, and I'm not writing this to repeat something that is already well-known but rather to contribute something new. Thus, unlike the other sections, here I will just briefly go through some of the possibilities.
Note that the *.mrc and *.mtz files, as well as most of the files with no extension, are in fact ZIP archives that can be unpacked and repacked again. The *.mrm files are directly editable text files. If you make some edits to a gadget, you might need to update its size and change the hash value in the corresponding .mrm file. The latter is just the MD5 sum of the file.
Themes are part of the System partition image, which was already discussed above; its only split into a separate section for the sake of organization.
Gadgets & Translations
/system/media/theme/.data/meta/
/system/media/theme/default/gadgets/
/system/media/theme/default/keyguardmusicview
/system/media/theme/default/powermenu
These files are responsible for the gadget layout as well as some of the translations. The layout seems to change relatively often with the stock China Developer ROM, which however does not include translations to Western languages. On the other hand, Xiaomi.eu's rom, while including the translations, seems to be based on an outdated layout in some places. Further, MIUI Pro includes some gadgets not available in any of the two, most likely coming from an earlier stock version.
The version posted as an attachment below, which I prepared for my own use, is a hybrid made in the following way:
Start with the China Developer ROM.
Port the translations from Xiaomi.eu, while keeping the stock translations for the other (Asian) languages as well, which Xiaomi.eu seems to delete.
Port some of the Xiaomi.eu's changes, where it makes sense to do so (the China version is supposed to show the Air Quality Index but this only works within China, and is reported as 0 for international locations, so it's been hidden).
Port some of the enhancements from MIUI Pro (two additional Music widgets and some modifications of default icons for Google services).
The result is yours to download and modify further.
MIUI-Themed App Icons
/system/media/theme/miui_mod_icons/<AppPackageName>.png
Icons put in this directory will replace the default app icons. The format is 192x192 px PNG-24. To find out the app package name, run:
adb shell pm list packages
The stock ROM includes just a couple of themed icons. Xiaomi.eu and MIUI Pro both have a considerable collection, although the latter is about three times larger than the former. I have merged the icons from all the three sources and they are available for download below, along with a dozen or so icons I designed myself for some niché apps I use.
The selection is somehow arbitrary, as the icons overlap for about 100 apps between Xiaomi.eu and MIUI Pro, so if you don't like the choice I made, download each of the ROMs and go through the icons yourself, choosing the ones according to your preference.
Note that after you change the icons, you need to re-apply the default theme (using the Themes app). It is not necessary to reboot your device.
MIUI Default Wallpapers
/system/media/theme/lock_wallpaper
If you want to change the default lockscreen and desktop wallpapers, notice that they are set to the following files:
/system/media/lockscreen/lockscreen_000.jpg
/system/media/wallpaper/wallpaper_000.jpg
Alternatively, you can change these paths in:
/system/media/theme/.data/meta/lockscreen/default.mrm
/system/media/theme/.data/meta/wallpaper/default.mrm
Per-Application Theming
/system/media/theme/<AppPackageName>
This is a really great feature of MIUI that gives endless possibilities of adjusting the appearance of an application. The file (no extension) is in fact a ZIP archive whose structure mimics that of the corresponding APK, and any files present in this archive (such as resources) will replace those placed inside the original APK. Also, the special file called theme_values.xml can be used to replace any strings inside.
One most straightforward way to employ the above is to rename an application. Generally, the application names are hard-coded inside the APK under the constant app_name. Thus, the theme_values.xml inside the <AppPackageName> could look like that:
Code:
<?xml version="1.0" encoding="utf-8" ?>
<MIUI_Theme_Values>
<string name="app_name">New Name</string>
</MIUI_Theme_Values>
For some APKs, the variable that stores the name might be different, in which case you can take a look inside with APK Tool, using the method described in the previous post. To conclude with an example, the attached file changes the names of "SIM Toolkit" and "SIM Toolkit2" into "SIM1 Toolkit" and "SIM2 Toolkit" respectively. In this case, the relevant theme_values.xml are:
Code:
<?xml version="1.0" encoding="utf-8" ?>
<MIUI_Theme_Values>
<string name="app_name">SIM1 Toolkit</string>
<string name="app_name2">SIM2 Toolkit</string>
<string name="app_name3">SIM3 Toolkit</string>
</MIUI_Theme_Values>
Automating the Modifications
Doing all the modifications as described above might soon get tedious. What if there was a way to automate them? Well, there actually is. With the help of an Edify ("Update") script, the whole process becomes much faster.
The Edify Script
Code:
# Xiaomi Note Pro (Leo) Customization Script
# Aqq123 @ XDA, http://forum.xda-developers.com/showthread.php?t=3286972
# MIUI7 5.12.31, Xiaomi.eu Image
### Edify Scripting Reference ###
# abort("msg");
# delete("/path");
# delete_recursive("/path");
# format("fstype", "parttype", "/dev");
# getprop("sys.prop.name");
# get_device_compatible("device_name");
# mount("fstype", "parttype", "/dev", "/mntpt", "mntopts");
# package_extract_dir("dir_in_zip", "/dst_dir");
# package_extract_file("/src", "/dst");
# run_program("/path", "--param1", "--param2", "--param3");
# set_metadata("/path", "uid", uid, "gid", gid, "mode", 0644,
# "capabilities", 0, "selabel", "u:object_r:system_file:s0");
# set_metadata_recursive("/path", "uid", uid, "gid", gid, "dmode", 0755, "fmode", 0644,
# "capabilities", 0, "selabel", "u:object_r:system_file:s0");
# symlink(dst, src[, src2, ...]);
# ui_print("msg");
# umount("/mntpt");
######
# Compatibility Check
ui_print("Checking compatibility...");
get_device_compatible("leo") == "OK" || abort("The update is not intended for this device.");
set_progress(0.000000);
show_progress(1.34, 100);
# Mount Filesystems
ui_print("Mounting filesystems...");
mount("ext4", "EMMC", "/dev/block/bootdevice/by-name/system", "/system", "barrier=1,commit=1,data=ordered,errors=panic,max_batch_time=0,nodelalloc");
# || abort("System: Failed to mount partition!");
#mount("ext4", "EMMC", "/dev/block/bootdevice/by-name/cache", "/cache", "");
# || abort("Cache: Failed to mount partition!");
mount("ext4", "EMMC", "/dev/block/bootdevice/by-name/userdata", "/data", "");
# || abort("Data: Failed to mount partition!");
# Note: Do not use "|| abort(...)" with TWRP as partitions are already mounted.
########
# BOOT #
########
# Extract
ui_print("Boot: Extracting items...");
package_extract_file("boot-patched.img", "/dev/block/bootdevice/by-name/boot") || abort("Boot: Extraction failed!");
##########
# SYSTEM #
##########
# Delete
ui_print("System: Deleting items...");
# Apps
delete_recursive("/system/app/AnalyticsCore/");
delete_recursive("/system/app/BaiduNetworkLocation/");
delete_recursive("/system/app/BugReport/");
delete_recursive("/system/app/matcli/");
delete_recursive("/system/app/Metok/");
delete_recursive("/system/app/MiLinkService/");
delete_recursive("/system/app/NVItem/");
delete_recursive("/system/app/PicoTts/");
delete_recursive("/system/app/SecurityAdd/");
delete_recursive("/system/app/TrafficControl/");
delete_recursive("/system/app/VirtualSim/");
delete_recursive("/system/app/XiaomiVip/");
delete_recursive("/system/app/XMPass/");
# Apps Already Removed in Xiaomi.eu
#delete_recursive("/system/app/BasicDreams/");
#delete_recursive("/system/app/Galaxy4/");
#delete_recursive("/system/app/GameCenter/");
#delete_recursive("/system/app/GooglePinyinIME/");
#delete_recursive("/system/app/HoloSpiralWallpaper/");
#delete_recursive("/system/app/LiveWallpapers/");
#delete_recursive("/system/app/MiuiSuperMarket/");
#delete_recursive("/system/app/NoiseField/");
#delete_recursive("/system/app/PaymentService/");
#delete_recursive("/system/app/PhaseBeam/");
#delete_recursive("/system/app/PhotoTable/");
#delete_recursive("/system/app/SystemAdSolution/");
#delete_recursive("/system/app/VisualizationWallpapers/");
#delete_recursive("/system/app/VirtualSim/");
#delete_recursive("/system/app/VoiceAssist/");
#delete_recursive("/system/priv-app/MiGameCenterSDKService/");
# Other Garbage
delete_recursive("/system/bin/qmi-framework-tests/");
delete("/system/etc/fake_cdrom_install.iso");
delete("/system/media/audio/create_symlink_for_audio-timestamp");
# Google Apps
delete("/system/etc/permissions/com.google.android.dialer.support.xml");
#delete("/system/etc/permissions/com.google.android.maps.xml"); # Careful! Also present in stock
delete("/system/etc/permissions/com.google.android.media.effects.xml");
delete("/system/etc/permissions/com.google.widevine.software.drm.xml");
delete("/system/etc/preferred-apps/google.xml");
delete("/system/etc/preferred-apps/");
delete("/system/etc/sysconfig/google.xml");
delete("/system/etc/sysconfig/google_build.xml");
delete("/system/etc/sysconfig/");
delete("/system/framework/com.google.android.dialer.support.jar");
#delete("/system/framework/com.google.android.maps.jar"); # Careful! Also present in stock
delete("/system/framework/com.google.android.media.effects.jar");
delete("/system/framework/com.google.widevine.software.drm.jar");
delete_recursive("/system/app/CloudPrint2/");
delete_recursive("/system/app/GoogleCalendarSyncAdapter/");
delete_recursive("/system/app/GoogleContactsSyncAdapter/");
delete_recursive("/system/priv-app/GoogleBackupTransport/");
delete_recursive("/system/priv-app/GoogleFeedback/");
delete_recursive("/system/priv-app/GoogleLoginService/");
delete_recursive("/system/priv-app/GoogleOneTimeInitializer/");
delete_recursive("/system/priv-app/GooglePartnerSetup/");
delete_recursive("/system/priv-app/GoogleServicesFramework/");
delete_recursive("/system/priv-app/Phonesky/");
delete_recursive("/system/priv-app/PrebuiltGmsCore/");
# Fonts
delete("/system/fonts/AndroidEmoji.ttf");
delete("/system/fonts/DroidNaskh-Regular-SystemUI.ttf");
delete("/system/fonts/NotoSansHebrewUI-Bold.ttf"); # Just a copy, there is UI variant for Hebrew
delete("/system/fonts/NotoSansHebrewUI-Regular.ttf"); # Just a copy, there is no UI variant for Hebrew
# Default Audio Resources (Only Remove If Replacing Your Own)
#delete_recursive("/system/media/audio/alarms/");
#delete_recursive("/system/media/audio/notifications/");
#delete_recursive("/system/media/audio/ringtones/");
# Default Visual Resources (Only Remove If Replacing Your Own)
#delete_recursive("/system/media/lockscreen/");
delete_recursive("/system/media/theme/miui_mod_icons/");
#delete_recursive("/system/media/wallpaper/");
# Extract
ui_print("System: Extracting items...");
package_extract_dir("system", "/system") || abort("System: Extraction failed!");
# Set Metadata
ui_print("System: Setting permissions...");
set_metadata_recursive("/system/app/",
"uid", 0, "gid", 0, "dmode", 0755, "fmode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/build.prop", "uid", 0, "gid", 0, "mode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/etc/gps.conf", "uid", 0, "gid", 0, "mode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/etc/init.qcom.post_boot.sh", "uid", 0, "gid", 0, "mode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/etc/mcd_default.conf", "uid", 0, "gid", 0, "mode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/etc/spn-conf.xml", "uid", 0, "gid", 0, "mode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata("/system/etc/system_fonts.xml", "uid", 0, "gid", 0, "mode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata_recursive("/system/fonts/",
"uid", 0, "gid", 0, "dmode", 0755, "fmode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata_recursive("/system/media/",
"uid", 0, "gid", 0, "dmode", 0755, "fmode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata_recursive("/system/priv-app/",
"uid", 0, "gid", 0, "dmode", 0755, "fmode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
set_metadata_recursive("/system/usr/",
"uid", 0, "gid", 0, "dmode", 0755, "fmode", 0644,
"capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
########
# DATA #
########
# Delete
ui_print("Data: Deleting items...");
delete_recursive("/data/evt-test/");
delete_recursive("/data/media/MIUI/");
delete_recursive("/data/miui/app/");
delete_recursive("/data/miui/cust/");
delete_recursive("/data/miui/gallery/");
delete_recursive("/data/miui/mms/");
delete_recursive("/data/miui/videoplugins/");
delete_recursive("/data/miui/yellowpage/");
delete_recursive("/data/qmi-framework-tests/");
# Already Removed in Xiaomi.eu
#delete("/data/miui/app/vanward_applist");
#delete("/data/miui/cdrom_install.iso");
#delete("/data/miui/cust_variant");
# MIUI Update Binary
ui_print("Data: Executing MIUI Update Binary...");
package_extract_file("META-INF/com/miui/miui_update", "/cache/miui_update");
set_metadata("/cache/miui_update", "uid", 0, "gid", 0, "mode", 0555, "capabilities", 0x0);
run_program("/cache/miui_update");
delete("/cache/miui_update");
# Extract
ui_print("Data: Extracting items...");
package_extract_dir("data", "/data") || abort("Data: Extraction failed!");
# Set Metadata
ui_print("Data: Setting permissions...");
set_metadata_recursive("/data/miui", "uid", 1000, "gid", 1000, "dmode", 0755, "fmode", 0644,
"capabilities", 0x0);
#########
# CACHE #
#########
# Wipe Cache
#ui_print("Wiping cache...");
#delete_recursive("/cache/");
# Wipe Dalvik Cache
ui_print("Wiping Dalvik cache...");
delete_recursive("/data/dalvik-cache/");
# Unmount
ui_print("Unmounting filesystems...");
unmount("/system");
#unmount("/cache");
unmount("/data");
# Finish
set_progress(1.000000);
ui_print("Finished.");
When reusing the above script, please retain the attribution notice:
Code:
Aqq123 @ XDA, http://forum.xda-developers.com/showthread.php?t=3286972
Thank you!
The Update ZIP Archive
Next, we'll create a collection of all the changed files we want installed on top of the original installation. The collection will have the following structure:
./data/
Everything in here will be unpacked into the /data partition.
./system/
Everything in here will be unpacked into the /system partition.
./boot-patched.img
The modified boot image that will be flashed into the boot partition.
./META-INF/com/android/metadata
./META-INF/com/android/otacert
Essentially redundant files that I'm keeping out of sentiment.
./META-INF/com/google/android/update-binary
./META-INF/com/miui/miui_update
Helper binaries that are taken from the latest version of the China Developer ROM installer.
./META-INF/com/google/android/updater-script
This is where we put the above Edify script. Note that the script is "updater", whereas the binary is "update."
All the stuff needs to be collected together and packed as one ZIP archive, which then becomes a flashable ZIP from inside the TWRP recovery or with adb sideload aqq123patch.zip, immediately after flashing the full MIUI image.
The Patch Builder Script
To automate things further, here is a simple batch script called build_patch.bat that rebuilds the patch file:
Code:
@echo off
if exist aqq123patch_leo*.zip del /f /q aqq123patch_leo*.zip
zip -r aqq123patch_leo.zip . -x *.bat *.zip
rem To generate a signed version, using signapk and your own key
rem change the above name to aqq123patch_leo_unsigned.zip
rem and uncomment the following two lines:
rem call signapkw aqq123patch_leo_unsigned.zip aqq123patch_leo.zip
rem del /f /q aqq123patch_leo_unsigned.zip
The script, also included in the attached archive, allows you to generate a signed archive as well, which is what I do, however you would need to have the signapkw.bat wrapper set up with your own key. For example:
Code:
@echo off
set PATH_SAVE=%PATH%
set PATH=%CD%;%PATH%;
java -jar "signapk.jar" -w "signapk.x509.pem" "signapk.pk8" %1 %2 %3 %4 %5 %6 %7 %8 %9
set PATH=%PATH_SAVE%
set PATH_SAVE=
The Complete Patch
For your convenience, all the stuff is attached to this post as a single archive. Note however that due to the 20 MiB attachment size constraint, I needed to leave out a couple of larger files, which you need to manually download from the attachments to previous posts and put into the appropriate directories. These are:
boot-patched.img
The modified boot partition image.
system/app/XiaomiServiceFramework/XiaomiServiceFramework.apk
system/priv-app/Contacts/Contacts.apk
system/priv-app/TeleService/TeleService.apk
The patched APKs.
system/fonts/*
system/usr/icu/icudt53l.dat
system/usr/share/zoneinfo/tzdata
Updated fonts, Unicode database and timezone data.
system/media/theme/miui_mod_icons/*
The merged collection of MIUI-themed app icons from MIUI Pro, Xiaomi.eu and the stock MIUI along with some obscure icons I designed on my own.
You are of course free to leave out any files you don't want included or put some more of your own. For example, I also install my own set of ringtones and wallpapers while removing the default ones this way. Note the following though:
If you don't want to flash the boot-patched.img, you need to edit the Edify script above (which I encourage you to do anyway).
If you put anything into other directories than the ones that are mentioned throughout this guide, you might need to adjust the metadata (ownership, permissions and SELinux labels).
If making the above changes, you might also want tocopy the ./file_contexts from the stock installer ZIP. I am not including it here, as with the way I use this script, it's not necessary (although you will see a warning about it in TWRP, just ignore it).
Automated Installation of Google Apps
Purpose
Xiaomi.eu's ROM already includes a minimal distribution of Google Apps. It's very good decision to only include the basic stuff so that the users can then decide what to install, which is simple enough with the Play Store.
This setup works perfectly for most users, so what I'm doing here is by no means necessary. It however allows you to use some of the remaining space on your /system partition that would otherwise be left empty. It also lets you have a more fine-grained control over what's installed. Finally, if as your base you chose another ROM that does not include Google Apps, you probably want to figure out a way to install them and what follows is likely the best one.
Choosing the Google Apps Distribution
Open GApps is arguably the best distribution of Google Apps. It comes in several different sizes. I suggest going with the largest Super version and then automatically trimming what is installed with an automated install script. Download the relevant version here.
You could just flash the downloaded ZIP although the installation will most likely fail due to lack of space. Also, no-one really needs to have all the Google Apps.
Scripting the Google Apps Installation
Open GApps setup can be customized with an answer file. I encourage you to read the full documentation but just to get you started, create a file gapps-config-leo.txt and use the following content (also attached) as a template:
Code:
# gapps-config-leo.txt
# Aqq123 @ XDA, http://forum.xda-developers.com/showthread.php?t=3286972
#forceclean # Allow Camera installation on upgrade
#forcedpi480 # Set DPI to 160, 240, 320, 480, 560, 640
NoDebug # Disable the generation of open_gapps_debug_logs.tar.gz
#Override # Allow removing all keyboards, launchers and SMS apps
#Test # Only simulate and generate open_gapps_log.txt
# Version to be installed
SuperGApps
#StockGApps
#FullGApps
#MiniGApps
#MicroGApps
#NanoGApps
#PicoGApps
# Whether to exclude or include listed apps
Exclude
#Include
# Google App List
AndroidForWork # Super
AndroidPay # Super
#Books # Super/Stock/Full
CalendarGoogle # Super/Stock/Full/Mini/Micro
#CalSync # Super/Stock/Full/Mini/Micro/Nano/Pico
CalculatorGoogle# Super/Stock/Full/Mini
CameraGoogle # Super/Stock
Chrome # Super/Stock/Full
ClockGoogle # Super/Stock/Full/Mini (Desk Clock)
CloudPrint # Super/Stock/Full
ContactsGoogle # Super/Stock
DialerGoogle # Super/Stock [Apparently already excluded]
DMAgent # Super (Google Apps Device Policy)
Docs # Super/Stock/Full
#Drive # Super/Stock/Full
Ears # Super/Stock/Full (Sound Search)
#Earth # Super
#ExchangeGoogle # Super/Stock/Full/Mini/Micro
FaceDetect # Super/Stock/Full/Mini/Micro/Nano
FaceUnlock # Super/Stock/Full/Mini/Micro/Nano
Fitness # Super/Stock/Full
GCS # Super [Removes ProjectFi]
#Gmail # Super/Stock/Full/Mini/Micro
GoogleNow # Super/Stock/Full/Mini/Micro [Removed by Search]
GooglePlus # Super/Stock/Full/Mini
#GoogleTTS # Super/Stock/Full/Mini/Micro
Hangouts # Super/Stock/Full/Mini
Indic # Super
Japanese # Super
Keep # Super/Stock/Full
#KeyboardGoogle # Super/Stock
Korean # Super
#Maps # Super/Stock/Full/Mini
Messenger # Super/Stock [Not installable on tablets]
Movies # Super/Stock/Full
Music # Super/Stock/Full
NewsStand # Super/Stock/Full
#NewsWidget # Super/Stock/Full
#Photos # Super/Stock/Full/Mini
Pinyin # Super
PlayGames # Super/Stock/Full
ProjectFi # Super [Removed by GCS]
Sheets # Super/Stock/Full
Slides # Super/Stock/Full
Search # Super/Stock/Full/Mini/Micro/Nano [Removes GoogleNow]
#Speech # Super/Stock/Full/Mini/Micro/Nano [Required for "OK Google"]
#Street # Super
TagGoogle # Super/Stock/Full/Mini <No hardware support for NFC>
Talkback # Super/Stock/Full
#Translate # Translate
#WebviewGoogle # Super/Stock [Already present in MIUI, Old version possibly broken]
YouTube # Super/Stock/Full/Mini
Zhuyin # Super
# Stock/AOSP App List
# Generally Not Applicable to MIUI
#BasicDreams
+Browser
#CalendarStock
#CameraStock
#ClockStock
#CMAccount
#CMAudioFX
#CMEleven # (CM Music)
#CMFileManager
#CMUpdater
#CMSetupWizard
#CMWallpapers
#DashClock
+Email
#ExchangeStock
#FMRadio
+Gallery
#Galaxy
#HoloSpiral
KeyboardStock
+Launcher
#LiveWallpapers
#LockClock
+MMS
#NoiseField
#Phasebeam
#PhotoPhase
#PhotoTable
PicoTTS
#SimToolKit
#Studio
#SykoPath
#TagStock
#Terminal
#Themes
#VisualizationWallpapers
#WhisperPush
# Universal App Removal
#(DocumentsUi)
#(DownloadProviderUi)
#(DownloadsUi)
This file (written by me, please retain the attribution notice when sharing) includes an example setup but also lists all the possible options and is extensively commented, so hopefully it'll make for a good start.
Flashing
Once you're ready, put the text file in the same directory as the Open GApps package you are about to flash (say, the root of your User Data partition available through MTP) and install the Open GApps ZIP file through the recovery.
A note about installing GApps: while the patch described in the previous can be installed over the original MIUI system before booting it for the first time (this is in fact the preferred way, as it avoids potential interference with the newly created files on the data partition), before installing Google Apps boot the system at least once. If you install the Google Apps in one go, the Google Setup Wizard will run instead of the MIUI one, with potential side effects difficult to predict (there is obviously some way around this but I didn't investigate it further).
Summary
This summarizes the complete installation procedure spanning all the posts:
Start by wiping everything and flashing the latest factory image:
tar xzvf *_images_*.tgz --strip=1
flash_all (remove fastboot reboot before executing)
Flash TWRP recovery:
fastboot erase recovery
fastboot flash recovery twrp-2.8.6.0-leo-ganfan-20150613-en-custom-materialised-play-light_lightblue-theme-v287x.img
fastboot reboot (hold the Volume Up button to get into the recovery)
In the recovery, open the ADB Sideload mode and:
adb sideload xiaomi.eu_multi_*.zip
adb sideload aqq123patch.zip
adb reboot
Once the device has finished booting, reboot into recovery. Copy open_gapps-arm64-5.1-super-*.zip and your gapps-config-leo.txt over MTP and install from recovery. Reboot when prompted.
And your customized MIUI is ready to use. Congratulations!
Bonus: Qualcomm NVRAM Settings & 2G/3G/4G LTE Band Config
A lot has been written about this topic but the relevant bits are scattered and there is a lot of misunderstanding. My goal here is to provide a summary of all the relevant information as it relates to this device. As in the place where I am at the moment there are no networks operating on any of the extra bands I attempted to enable, I can't confirm if I managed to do so. Still, there is probably no harm in trying, as long as you know what you're doing, and how to undo any changes.
Choosing Bands to Enable
Before we start, it's best to figure out what exactly we're trying to do, in terms of the desired result.
Factory-Enabled Bands
First of all, these are the bands that are already supported. It's important to start from this because there are people claiming they "unlocked" some of them. Well, they didn't, really; they were already enabled. This situation is aggravated by the lack of any way to list all the operational bands on the phone (if you know of a way to do so, please share!).
The information below comes from Xiaomi's website but I expanded it to include other common designations for bands, along with the frequencies and a general indication of the world region they are used in:
4G
FDD-LTE
1 (2100 MHz; Europe & Asia Misc)
3 (1800 MHz; Europe & Asia)
7 (2600 MHz; Europe & Asia)
TDD-LTE
38 (2600 MHz; Europe Misc)
39 (1900 MHz; China)
40 (2300 MHz; China, Asia Misc)
41 (2500 MHz; China)
3G
TD-SCDMA
34 / A (2010-2025 MHz; China)
39 / F (1880-1920 MHz; China)
WCDMA
1 / I (2100 MHz; Europe & Asia)
2 / II (1900 MHz; US: AT&T, T-Mobile)
5 / V (850 MHz; US: AT&T)
8 / VIII (900 MHz; Europe & Asia)
CDMA2000
BC0 (800 MHz)
BC1 (1900 MHz)
2G
GSM/CDMA1X
2 (1900 MHz; Americas)
3 (1800 MHz; Europe & Asia)
5 (850 MHz; Americas)
8 (900 MHz; Europe & Asia)
BC0 (800 MHz)
BC1 (1900 MHz)
The above list is for Xiaomi Note Pro 2015022 (All-Network) version. Some versions do not support CDMA1X and CDMA2000.
Irrelevant Bands
On the other hand, for a multitude of reasons, the following LTE bands enjoy very limited use or are not used at all or even allocated, so enabling them would not really change anything for anyone (this is somewhat arbitrary, people located in Japan might disagree to some extent): 6, 9-11, 13-16, 18, 19, 21-27, 29-37, 42-44
Potentially Interesting Bands
The above investigation leaves us with a list of bands that would be potentially interesting to enable. Classifying them by the region:
Europe: 4G FDD LTE Band 20 (800 MHz)
Asia: 4G FDD LTE Bands 5 (850 MHz, also US regional), 8 (900 MHz) and 28 (700 MHz)
America:
3G UMTS Band 4 (1700 MHz, T-Mobile)
4G FDD LTE Bands 2 (1900 MHz), 4 (1700 MHz), 12 (700 MHz, T-Mobile), 17 (700 MHz, AT&T)
Wikipedia has more information on: LTE bands, LTE network list, LTE network list in Europe, UMTS bands, UMTS network list.
Enabling the Extra Bands
Now that we know what we're trying to enable, here's how.
Qualcomm Diagnostics Setup
Connect the phone to computer with USB cable.
On Windows 8.1, boot the computer into the Disable Driver Signature Enforcement mode.
On the phone keypad type *#*#717717#*#* to enable the diagnostics mode.
Open the Device Manager (Win+X, M).
Locate the device with Vendor ID: 05C6 and Product ID: 9025, where the instance path contains MI_00 (USB\VID_05C6&PID_9025&MI_00\...) and force the installation of the Qualcomm HS-USB Diagnostics 9025 driver onto it.
Both the driver version 2.0.8.1 from some Sony phone, which can be found in many places on the Internet, and the driver version 2.1.0.5 included with the official Xiaomi drivers seem to work for me. If you have problems installing the driver, you can also try editing the *.inf files and changing "NTia64" and "NTamd64" to "NTia64.6.3" and "NTamd64.6.3" respectively. You then also need to delete the accompanying *.cat files as their signatures will no longer match.
To edit the NVRAM settings I used the following Qualcomm software versions:
Qualcomm Product Support Tools (QPST) 2.7.411
Qualcomm Extensible Diagnostic Monitor (QXDM) 3.12.714
Other versions will probably work just as fine. Open QPST Configuration first. Make sure there is an active phone there, and leave it running. Then, open QXDM as well and in Options → Communications check the box next to the matching device and choose the matching COM port from the pull-down list below. Click OK and choose the NV Browser view. To paraphrase MIUI, you're ready to rock!
NVRAM Values
These are the changes I have made to enable all the "potentially interesting" bands listed above:
Code:
ID Desc Original Value Modified Value
01877 rf_bc_config 562950035735431 562950069289863
00441 band_pref 0xFFFF 0xFFFF (Same)
00946 band_pref_16_31 0xBFFF 0xBFFF (Same)
02954 band_pref_32_63 131072 131072 (Same)
06828 lte_bc_config 2061584302149 2061719111903
If you want to know why the above numbers are what they are, read on. Otherwise, feel free to try the above settings.
Understanding the Values
Generally these numbers are just a series of binary flags. You can think of them as a large congregation of on/off switches, next to one another, each corresponding to a particular, specific band. Thus, to see what's going on and make our changes, we convert them to the binary representation. After we're done, we convert them back to the form that is acceptable as input by QXDM (which is decimal again, for the particular registers we're modifying).
2G & 3G Configuration
The 2G and 3G configuration is determined by four values. First, take the three band_pref* values:
Code:
band_pref [= band_pref_0_15] (16-bit):
0xFFFF 1111111111111111
band_pref_16_31 (16-bit):
0xBFFF 1011111111111111
band_pref_32_63 (32-bit):
000131072 00000000000000100000000000000000
The three are juxtaposed to form a 64-bit quad-word (the split is probably to maintain some compatibility with legacy architectures, there is no logical reason for this). Then, the result of bitwise conjunction of rf_bc_config (configured bands), also a 64-bit quad-word, and the three juxtaposed band_pref* values (preferred bands) determine which bands are available.
Code:
rf_bc_config (64-bit):
0000562950035735431 0000000000000010000000000000000000000100111010000000001110000111
0000562950069289863 0000000000000010000000000000000000000110111010000000001110000111
0000000000000010000000000000000010111111111111111111111111111111
band_pref_32_63 band_pref_16_31 band_pref_0_15
The difference between the two values is apparently that rf_bc_config are the pre-configured bands, whereas the band_pref values can be modified at run-time, for example through the *#*#INFO#*#* (or *#*#4636#*#*) menu.
For our purposes, we notice that we need a band to be both "configured" and "preferred" to be available, which means the corresponding bit should be a 1 in each of the above values.
The meaning of the particular bits is as such (note that they are counted from right to left, that is bit 0 is the rightmost bit):
Code:
Def Chngd
Bit Cf Pr Cf Pr Description
#00 1 1 . . CDMA Band Class 0: A-System US Cellular (800MHz)
#01 1 1 . . CDMA Band Class 0: B-System
#02 1 1 . . CDMA Band Class 1: All Blocks US PCS (1800-2000 MHz)
#03 0 1 . . CDMA Band Class 2: Placeholder TACS Band (872-960 MHz)
#04 0 1 . . CDMA Band Class 3: A-System Japan Cellular JTACS Band (832-925 MHz)
#05 0 1 . . CDMA Band Class 4: All Blocks Korean PCS Band (1750-1870 MHz)
#06 0 1 . . CDMA Band Class 5: All Blocks NMT Band (450 MHz)
#07 1 1 . . GSM DCS 1800 Band Europe (1800 MHz)
#08 1 1 . . GSM Extended (E-GSM) Band, Includes RF Band 9 GSM (900 MHz)
#09 1 1 . . GSM Primary (P-GSM) Band Europe (900 MHz)
#10 0 1 . . CDMA Band Class 6 IMT-2000 (2000 MHz)
#11 0 1 . . CDMA Band Class 7 (Upper 700 MHz)
#12 0 1 . . CDMA Band Class 8 (1800 MHz)
#13 0 1 . . CDMA Band Class 9 (900 MHz)
#14 0 1 . . CDMA Band Class 10 (Secondary 800 MHz)
#15 0 1 . . CDMA Band Class 11 European PAMR (400 MHz)
#16 0 1 . . <Unused> GSM 450 Rural Parts
#17 0 1 . . <Unused> GSM 480
#18 0 1 . . <Unused> GSM 750
#19 1 1 . . GSM Band US (850 MHz)
#20 0 1 . . RGSM GSM Railways, Includes RF Bands 8 & 9 (900 MHz)
#21 1 1 . . GSM PCS 1900 Band US (1900 MHz)
#22 1 1 . . WCDMA Band I - Europe, Asia (Japan), New Zealand (2100 MHz)
#23 1 1 . . WCDMA Band II - PCS North America (1900 MHz)
#24 0 1 . . WCDMA Band III - DCS Europe, Asia (1800 MHz)
#25 0 1 1 . WCDMA Band IV - US T-Mobile (AWS) (1700 MHz)
#26 1 1 . . WCDMA Band V - North America, Australia, New Zealand, Philippines (850 MHz)
#27 0 1 . . WCDMA Band VI - Japan (800 MHz)
#28 0 1 . . CDMA Band Class 12 PAMR (800 MHz)
#29 0 1 . . CDMA Band Class 14 US PCS (1900 MHz)
#30 0 0 . . <Reserved>
#31 0 1 . . CDMA Band Class 15 Advanced Wireless Services (AWS)
#32 0 0 . . <Reserved> WLAN US (2400 MHz)
#33 0 0 . . <Reserved> WLAN ETSI (2400 MHz)
#34 0 0 . . <Reserved> WLAN FR (2400 MHz)
#35 0 0 . . <Reserved> WLAN ES (2400 MHz)
#36 0 0 . . <Reserved> WLAN JP (2400 MHz)
#37 0 0 . . <Reserved> WLAN US (5000 MHz)
#38 0 0 . . <Reserved> WLAN EU (5000 MHz)
#39 0 0 . . <Reserved> WLAN FR (5000 MHz)
#40 0 0 . . <Reserved> WLAN ES (5000 MHz)
#41 0 0 . . <Reserved> WLAN JP (5000 MHz)
#42 0 0 . . <Reserved>
#43 0 0 . . <Reserved>
#44 0 0 . . <Reserved>
#45 0 0 . . <Reserved>
#46 0 0 . . <Reserved>
#47 0 0 . . <Reserved>
#48 0 0 . . WCDMA Band VII - Europe (2600 MHz)
#49 1 1 . . WCDMA Band VIII - Europe, Asia, Australia, New Zealand (900 MHz)
#50 0 0 . . WDCMA Band IX - Japan (1700 MHz)
#51 0 0 . . AWS+ Band X US (1700 MHz)
#52 0 0 . . 1500 Band XI Japan (1500 MHz)
#53 0 0 . . 700ac Band XII USA
#54 0 0 . . 700 C Band XIII USA
#55 0 0 . . 700PS Band XIV USA
#56 0 0 . . CDMA Band Class 16 US (2500 MHz)
#57 0 0 . . <Reserved>
#58 0 0 . . <Reserved>
#59 0 0 . . <Reserved>
#60 0 0 . . WCDMA Japan (800 MHz)
#61 0 0 . . <Reserved>
#62 0 0 . . <Reserved>
#63 0 0 . . <Reserved>
Some of the bands listed above are purely theoretical, as they have never been used. From the above breakdown, it's quite obvious that to enable WCDMA Band IV, which is what I'm after here, it's enough to toggle just one bit, and the band_pref* values do not need to be modified at all.
4G LTE Configuration
The LTE configuration settings are much simpler, controlled by just a single variable, lte_bc_config. The variable is a quad-word (64-bit) again but only the first 44 bits appear to be relevant. Each bit corresponds to a single LTE band, starting with the rightmost bit being responsible for band 1. Overall:
Code:
lte_bc_config (64-bit, of which 44 bits relevant): Bands Active:
2061584302149 00011110000000000000000000000000000001000101 1.3...7. 38-41
2061719111903 00011110000000001000000010010000100011011111 12345.78 12 17 20 28 38-41
2061584892127 00011110000000000000000010010000000011011111 12345.78 17 20 38-41
You can then see that the modified value enables LTE bands 2, 4, 5, 8, 12, 17, 20, 28 in addition to the ones that were already enabled. (Whether it works is another story, as I said I'm unable to verify it at the moment.)
The third line is what is necessary to enable LTE bands 2, 4, 5, 8, 17, 20, while not trying to enable bands 12 and 28, which are unlikely to work due to the lack of hardware support.
Hello
Is it possible to modify prop to set camera jpg quality to 100%? I saw that on a mi3 or mi4.
EMJI79 said:
Is it possible to modify prop to set camera jpg quality to 100%. I saw that on a mi3 or mi4.
Click to expand...
Click to collapse
Hi,
I don't know anything about it but please feel free to share your results in this thread.
Updates 1 & 2 to the Guide
Update 1 to Post #7
Patching and Recompiling the Application Packages
Remove Find Device Activation Nag
/system/app/CloudService/CloudService.apk
This patch removes the notification to activate Find Device with Mi Cloud showing up all the time (as long as you are logged in with your Mi Account, most likely). Otherwise, there is no way to switch it off through the Settings.
The patch:
Code:
diff -urN CloudService.orig/smali/com/miui/cloudservice/finddevice/FindDeviceGuideService.smali CloudService/smali/com/miui/cloudservice/finddevice/FindDeviceGuideService.smali
--- CloudService.orig/smali/com/miui/cloudservice/finddevice/FindDeviceGuideService.smali Thu Jan 07 22:20:30 2016
+++ CloudService/smali/com/miui/cloudservice/finddevice/FindDeviceGuideService.smali Thu Jan 07 22:41:09 2016
@@ -134,62 +134,6 @@
.method private a(Landroid/content/Context;Landroid/graphics/Bitmap;Ljava/lang/String;Ljava/lang/String;Landroid/app/PendingIntent;)V
.locals 5
- const/4 v4, 0x1
-
- new-instance v0, Landroid/app/Notification$Builder;
-
- invoke-direct {v0, p1}, Landroid/app/Notification$Builder;-><init>(Landroid/content/Context;)V
-
- invoke-virtual {v0, p5}, Landroid/app/Notification$Builder;->setContentIntent(Landroid/app/PendingIntent;)Landroid/app/Notification$Builder;
-
- const/4 v1, -0x1
-
- invoke-virtual {v0, v1}, Landroid/app/Notification$Builder;->setSmallIcon(I)Landroid/app/Notification$Builder;
-
- invoke-virtual {v0, p2}, Landroid/app/Notification$Builder;->setLargeIcon(Landroid/graphics/Bitmap;)Landroid/app/Notification$Builder;
-
- invoke-virtual {v0, p4}, Landroid/app/Notification$Builder;->setContentText(Ljava/lang/CharSequence;)Landroid/app/Notification$Builder;
-
- invoke-virtual {v0, p3}, Landroid/app/Notification$Builder;->setContentTitle(Ljava/lang/CharSequence;)Landroid/app/Notification$Builder;
-
- invoke-virtual {v0, v4}, Landroid/app/Notification$Builder;->setAutoCancel(Z)Landroid/app/Notification$Builder;
-
- const-wide/16 v2, 0x0
-
- invoke-virtual {v0, v2, v3}, Landroid/app/Notification$Builder;->setWhen(J)Landroid/app/Notification$Builder;
-
- invoke-virtual {v0}, Landroid/app/Notification$Builder;->build()Landroid/app/Notification;
-
- move-result-object v1
-
- iget v0, v1, Landroid/app/Notification;->defaults:I
-
- or-int/lit8 v0, v0, -0x1
-
- iput v0, v1, Landroid/app/Notification;->defaults:I
-
- new-instance v0, Landroid/app/MiuiNotification;
-
- invoke-direct {v0}, Landroid/app/MiuiNotification;-><init>()V
-
- invoke-virtual {v0, v4}, Landroid/app/MiuiNotification;->setCustomizedIcon(Z)Landroid/app/MiuiNotification;
-
- iput-object v0, v1, Landroid/app/Notification;->extraNotification:Landroid/app/MiuiNotification;
-
- const-string v0, "notification"
-
- invoke-virtual {p1, v0}, Landroid/content/Context;->getSystemService(Ljava/lang/String;)Ljava/lang/Object;
-
- move-result-object v0
-
- check-cast v0, Landroid/app/NotificationManager;
-
- const-string v2, "micloud_find_device_guide"
-
- const/16 v3, 0x6e
-
- invoke-virtual {v0, v2, v3, v1}, Landroid/app/NotificationManager;->notify(Ljava/lang/String;ILandroid/app/Notification;)V
-
return-void
.end method
Apply with:
adb pull /system/app/CloudService/CloudService.apk
apktool2 d -b -o CloudService -r -t miui CloudService.apk
patch --binary --no-backup-if-mismatch -E -i system_app_CloudService.diff -p0
apktool2 b -a aapt-miui.exe -c -o CloudService.apk.raw CloudService
zipalign -f 4 CloudService.apk.raw CloudService.apk
adb root
adb shell mount -o remount,rw /system
adb push CloudService.apk /system/app/CloudService/
Remove Update Availability Notification
/system/app/Updater/Updater.apk
The Updater app, which apparently cannot be uninstalled (at least not without clearing the /data partition) checks for OTA updates and once it finds an update available, it will permanently display a notification asking to download it. The following patch disables all notifications from the Updater app.
The patch:
Code:
diff -urN Updater.orig/smali/com/android/updater/a/j.smali Updater/smali/com/android/updater/a/j.smali
--- Updater.orig/smali/com/android/updater/a/j.smali Wed Jan 13 06:44:02 2016
+++ Updater/smali/com/android/updater/a/j.smali Wed Jan 13 06:53:16 2016
@@ -2051,8 +2051,6 @@
move-result-object v1
- invoke-virtual {v0, p2, v1}, Landroid/app/NotificationManager;->notify(ILandroid/app/Notification;)V
-
return-void
.end method
@@ -2151,8 +2149,6 @@
invoke-virtual {v4, v5}, Landroid/app/MiuiNotification;->setEnableFloat(Z)Landroid/app/MiuiNotification;
- invoke-virtual {v2, p2, v3}, Landroid/app/NotificationManager;->notify(ILandroid/app/Notification;)V
-
return-void
.end method
@@ -2330,7 +2326,6 @@
invoke-virtual {v4, v5}, Landroid/app/MiuiNotification;->setMessageCount(I)V
:cond_0
- invoke-virtual {v2, p2, v3}, Landroid/app/NotificationManager;->notify(ILandroid/app/Notification;)V
return-void
Apply with:
adb pull /system/app/Updater/Updater.apk
apktool2 d -b -o Updater -r -t miui Updater.apk
patch --binary --no-backup-if-mismatch -E -i system_app_Updater.diff -p0
apktool2 b -a aapt-miui.exe -c -o Updater.apk.raw Updater
zipalign -f 4 Updater.apk.raw Updater.apk
adb root
adb shell mount -o remount,rw /system
adb push Updater.apk /system/app/Updater/
Update 2 to Post #11
Bonus: Qualcomm NVRAM Settings & 2G/3G/4G LTE Band Config
RF Hardware Capability Analysis
While I still can't confirm whether the method described above unlocked any of the bands for me, if we knew what RF hardware is inside the device, this could tell us which bands can potentially be unlocked, and which are not supported by the hardware. Unfortunately, none of the teardowns I could find, including Leiphone/iGao7.com, Xiujj.cn (video) or 91 Chai (video) reaches far enough to show the power amplifier chip. However, the information posted here says that the amplifier used is Avago ACPM-7620, while a Xiaomi Note teardown shows that the chip used there was Avago ACPM-7600. The specifications for those chips tell us that the following bands are supported:
ACPM-7600: 4G LTE & 3G (UMTS) Bands 1, 2, 3, 4, 5, 8, 25, 26
ACPM-7620: As above, and additionally LTE Bands 17 and 20
Comparing this to the list of "interesting" bands I posted above, it would seem that bands 12 and 28 (both 700 MHz) are most likely not supported by the hardware, so making them work is probably out of the question, while the other bands could theoretically be enabled, subject to modem firmware (17 and 20 on the condition that the amplifier used is indeed ACPM-7620).
If anyone sees (or does) a teardown deep enough to clarify what the power amplifier chip is, please share this information. Thank you.
Any more results from testing?
Hi really great article. Saved me actually as while I was messing about with various options managed to completely c*ck up my 2g settings.
Looking through the article re LTE 4g bands makes sense. However I have put the below into effect on my Note Pro
2061584892127 00011110000000000000000010010000000011011111 12345.78 17 20 38-41[/code]
But am still unable to get band 20 800Mhz working. I would be interested to know if you ever got further to the testing phase and find out if you had any joy with any other bands?
All the Best
Aqq123 said:
A lot has been written about this topic but the relevant bits are scattered and there is a lot of misunderstanding. My goal here is to provide a summary of all the relevant information as it relates to this device. As in the place where I am at the moment there are no networks operating on any of the extra bands I attempted to enable, I can't confirm if I managed to do so. Still, there is probably no harm in trying, as long as you know what you're doing, and how to undo any changes.
Choosing Bands to Enable
Before we start, it's best to figure out what exactly we're trying to do, in terms of the desired result.
Factory-Enabled Bands
First of all, these are the bands that are already supported. It's important to start from this because there are people claiming they "unlocked" some of them. Well, they didn't, really; they were already enabled. This situation is aggravated by the lack of any way to list all the operational bands on the phone (if you know of a way to do so, please share!).
The information below comes from Xiaomi's website but I expanded it to include other common designations for bands, along with the frequencies and a general indication of the world region they are used in:
4G
FDD-LTE
1 (2100 MHz; Europe & Asia Misc)
3 (1800 MHz; Europe & Asia)
7 (2600 MHz; Europe & Asia)
TDD-LTE
38 (2600 MHz; Europe Misc)
39 (1900 MHz; China)
40 (2300 MHz; China, Asia Misc)
41 (2500 MHz; China)
3G
TD-SCDMA
34 / A (2010-2025 MHz; China)
39 / F (1880-1920 MHz; China)
WCDMA
1 / I (2100 MHz; Europe & Asia)
2 / II (1900 MHz; US: AT&T, T-Mobile)
5 / V (850 MHz; US: AT&T)
8 / VIII (900 MHz; Europe & Asia)
CDMA2000
BC0 (800 MHz)
BC1 (1900 MHz)
2G
GSM/CDMA1X
2 (1900 MHz; Americas)
3 (1800 MHz; Europe & Asia)
5 (850 MHz; Americas)
8 (900 MHz; Europe & Asia)
BC0 (800 MHz)
BC1 (1900 MHz)
The above list is for Xiaomi Note Pro 2015022 (All-Network) version. Some versions do not support CDMA1X and CDMA2000.
Irrelevant Bands
On the other hand, for a multitude of reasons, the following LTE bands enjoy very limited use or are not used at all or even allocated, so enabling them would not really change anything for anyone (this is somewhat arbitrary, people located in Japan might disagree to some extent): 6, 9-11, 13-16, 18, 19, 21-27, 29-37, 42-44
Potentially Interesting Bands
The above investigation leaves us with a list of bands that would be potentially interesting to enable. Classifying them by the region:
Europe: 4G FDD LTE Band 20 (800 MHz)
Asia: 4G FDD LTE Bands 5 (850 MHz, also US regional), 8 (900 MHz) and 28 (700 MHz)
America:
3G UMTS Band 4 (1700 MHz, T-Mobile)
4G FDD LTE Bands 2 (1900 MHz), 4 (1700 MHz), 12 (700 MHz, T-Mobile), 17 (700 MHz, AT&T)
Wikipedia has more information on: LTE bands, LTE network list, LTE network list in Europe, UMTS bands, UMTS network list.
Enabling the Extra Bands
Now that we know what we're trying to enable, here's how.
Qualcomm Diagnostics Setup
Connect the phone to computer with USB cable.
On Windows 8.1, boot the computer into the Disable Driver Signature Enforcement mode.
On the phone keypad type *#*#717717#*#* to enable the diagnostics mode.
Open the Device Manager (Win+X, M).
Locate the device with Vendor ID: 05C6 and Product ID: 9025, where the instance path contains MI_00 (USB\VID_05C6&PID_9025&MI_00\...) and force the installation of the Qualcomm HS-USB Diagnostics 9025 driver onto it.
Both the driver version 2.0.8.1 from some Sony phone, which can be found in many places on the Internet, and the driver version 2.1.0.5 included with the official Xiaomi drivers seem to work for me. If you have problems installing the driver, you can also try editing the *.inf files and changing "NTia64" and "NTamd64" to "NTia64.6.3" and "NTamd64.6.3" respectively. You then also need to delete the accompanying *.cat files as their signatures will no longer match.
To edit the NVRAM settings I used the following Qualcomm software versions:
Qualcomm Product Support Tools (QPST) 2.7.411
Qualcomm Extensible Diagnostic Monitor (QXDM) 3.12.714
Other versions will probably work just as fine. Open QPST Configuration first. Make sure there is an active phone there, and leave it running. Then, open QXDM as well and in Options → Communications check the box next to the matching device and choose the matching COM port from the pull-down list below. Click OK and choose the NV Browser view. To paraphrase MIUI, you're ready to rock!
NVRAM Values
These are the changes I have made to enable all the "potentially interesting" bands listed above:
Code:
ID Desc Original Value Modified Value
01877 rf_bc_config 562950035735431 562950069289863
00441 band_pref 0xFFFF 0xFFFF (Same)
00946 band_pref_16_31 0xBFFF 0xBFFF (Same)
02954 band_pref_32_63 131072 131072 (Same)
06828 lte_bc_config 2061584302149 2061719111903
If you want to know why the above numbers are what they are, read on. Otherwise, feel free to try the above settings.
Understanding the Values
Generally these numbers are just a series of binary flags. You can think of them as a large congregation of on/off switches, next to one another, each corresponding to a particular, specific band. Thus, to see what's going on and make our changes, we convert them to the binary representation. After we're done, we convert them back to the form that is acceptable as input by QXDM (which is decimal again, for the particular registers we're modifying).
2G & 3G Configuration
The 2G and 3G configuration is determined by four values. First, take the three band_pref* values:
Code:
band_pref [= band_pref_0_15] (16-bit):
0xFFFF 1111111111111111
band_pref_16_31 (16-bit):
0xBFFF 1011111111111111
band_pref_32_63 (32-bit):
000131072 00000000000000100000000000000000
The three are juxtaposed to form a 64-bit quad-word (the split is probably to maintain some compatibility with legacy architectures, there is no logical reason for this). Then, the result of bitwise conjunction of rf_bc_config (configured bands), also a 64-bit quad-word, and the three juxtaposed band_pref* values (preferred bands) determine which bands are available.
Code:
rf_bc_config (64-bit):
0000562950035735431 0000000000000010000000000000000000000100111010000000001110000111
0000562950069289863 0000000000000010000000000000000000000110111010000000001110000111
0000000000000010000000000000000010111111111111111111111111111111
band_pref_32_63 band_pref_16_31 band_pref_0_15
The difference between the two values is apparently that rf_bc_config are the pre-configured bands, whereas the band_pref values can be modified at run-time, for example through the *#*#INFO#*#* (or *#*#4636#*#*) menu.
For our purposes, we notice that we need a band to be both "configured" and "preferred" to be available, which means the corresponding bit should be a 1 in each of the above values.
The meaning of the particular bits is as such (note that they are counted from right to left, that is bit 0 is the rightmost bit):
Code:
Def Chngd
Bit Cf Pr Cf Pr Description
#00 1 1 . . CDMA Band Class 0: A-System US Cellular (800MHz)
#01 1 1 . . CDMA Band Class 0: B-System
#02 1 1 . . CDMA Band Class 1: All Blocks US PCS (1800-2000 MHz)
#03 0 1 . . CDMA Band Class 2: Placeholder TACS Band (872-960 MHz)
#04 0 1 . . CDMA Band Class 3: A-System Japan Cellular JTACS Band (832-925 MHz)
#05 0 1 . . CDMA Band Class 4: All Blocks Korean PCS Band (1750-1870 MHz)
#06 0 1 . . CDMA Band Class 5: All Blocks NMT Band (450 MHz)
#07 1 1 . . GSM DCS 1800 Band Europe (1800 MHz)
#08 1 1 . . GSM Extended (E-GSM) Band, Includes RF Band 9 GSM (900 MHz)
#09 1 1 . . GSM Primary (P-GSM) Band Europe (900 MHz)
#10 0 1 . . CDMA Band Class 6 IMT-2000 (2000 MHz)
#11 0 1 . . CDMA Band Class 7 (Upper 700 MHz)
#12 0 1 . . CDMA Band Class 8 (1800 MHz)
#13 0 1 . . CDMA Band Class 9 (900 MHz)
#14 0 1 . . CDMA Band Class 10 (Secondary 800 MHz)
#15 0 1 . . CDMA Band Class 11 European PAMR (400 MHz)
#16 0 1 . . <Unused> GSM 450 Rural Parts
#17 0 1 . . <Unused> GSM 480
#18 0 1 . . <Unused> GSM 750
#19 1 1 . . GSM Band US (850 MHz)
#20 0 1 . . RGSM GSM Railways, Includes RF Bands 8 & 9 (900 MHz)
#21 1 1 . . GSM PCS 1900 Band US (1900 MHz)
#22 1 1 . . WCDMA Band I - Europe, Asia (Japan), New Zealand (2100 MHz)
#23 1 1 . . WCDMA Band II - PCS North America (1900 MHz)
#24 0 1 . . WCDMA Band III - DCS Europe, Asia (1800 MHz)
#25 0 1 1 . WCDMA Band IV - US T-Mobile (AWS) (1700 MHz)
#26 1 1 . . WCDMA Band V - North America, Australia, New Zealand, Philippines (850 MHz)
#27 0 1 . . WCDMA Band VI - Japan (800 MHz)
#28 0 1 . . CDMA Band Class 12 PAMR (800 MHz)
#29 0 1 . . CDMA Band Class 14 US PCS (1900 MHz)
#30 0 0 . . <Reserved>
#31 0 1 . . CDMA Band Class 15 Advanced Wireless Services (AWS)
#32 0 0 . . <Reserved> WLAN US (2400 MHz)
#33 0 0 . . <Reserved> WLAN ETSI (2400 MHz)
#34 0 0 . . <Reserved> WLAN FR (2400 MHz)
#35 0 0 . . <Reserved> WLAN ES (2400 MHz)
#36 0 0 . . <Reserved> WLAN JP (2400 MHz)
#37 0 0 . . <Reserved> WLAN US (5000 MHz)
#38 0 0 . . <Reserved> WLAN EU (5000 MHz)
#39 0 0 . . <Reserved> WLAN FR (5000 MHz)
#40 0 0 . . <Reserved> WLAN ES (5000 MHz)
#41 0 0 . . <Reserved> WLAN JP (5000 MHz)
#42 0 0 . . <Reserved>
#43 0 0 . . <Reserved>
#44 0 0 . . <Reserved>
#45 0 0 . . <Reserved>
#46 0 0 . . <Reserved>
#47 0 0 . . <Reserved>
#48 0 0 . . WCDMA Band VII - Europe (2600 MHz)
#49 1 1 . . WCDMA Band VIII - Europe, Asia, Australia, New Zealand (900 MHz)
#50 0 0 . . WDCMA Band IX - Japan (1700 MHz)
#51 0 0 . . AWS+ Band X US (1700 MHz)
#52 0 0 . . 1500 Band XI Japan (1500 MHz)
#53 0 0 . . 700ac Band XII USA
#54 0 0 . . 700 C Band XIII USA
#55 0 0 . . 700PS Band XIV USA
#56 0 0 . . CDMA Band Class 16 US (2500 MHz)
#57 0 0 . . <Reserved>
#58 0 0 . . <Reserved>
#59 0 0 . . <Reserved>
#60 0 0 . . WCDMA Japan (800 MHz)
#61 0 0 . . <Reserved>
#62 0 0 . . <Reserved>
#63 0 0 . . <Reserved>
Some of the bands listed above are purely theoretical, as they have never been used. From the above breakdown, it's quite obvious that to enable WCDMA Band IV, which is what I'm after here, it's enough to toggle just one bit, and the band_pref* values do not need to be modified at all.
4G LTE Configuration
The LTE configuration settings are much simpler, controlled by just a single variable, lte_bc_config. The variable is a quad-word (64-bit) again but only the first 44 bits appear to be relevant. Each bit corresponds to a single LTE band, starting with the rightmost bit being responsible for band 1. Overall:
Code:
lte_bc_config (64-bit, of which 44 bits relevant): Bands Active:
2061584302149 00011110000000000000000000000000000001000101 1.3...7. 38-41
2061719111903 00011110000000001000000010010000100011011111 12345.78 12 17 20 28 38-41
2061584892127 00011110000000000000000010010000000011011111 12345.78 17 20 38-41
You can then see that the modified value enables LTE bands 2, 4, 5, 8, 12, 17, 20, 28 in addition to the ones that were already enabled. (Whether it works is another story, as I said I'm unable to verify it at the moment.)
The third line is what is necessary to enable LTE bands 2, 4, 5, 8, 17, 20, while not trying to enable bands 12 and 28, which are unlikely to work due to the lack of hardware support.
Click to expand...
Click to collapse
Aqq123 said:
...
NVRAM Values
These are the changes I have made to enable all the "potentially interesting" bands listed above:
Code:
ID Desc Original Value Modified Value
01877 rf_bc_config 562950035735431 562950069289863
00441 band_pref 0xFFFF 0xFFFF (Same)
00946 band_pref_16_31 0xBFFF 0xBFFF (Same)
02954 band_pref_32_63 131072 131072 (Same)
06828 lte_bc_config 2061584302149 2061719111903
If you want to know why the above numbers are what they are, read on. Otherwise, feel free to try the above settings.
Understanding the Values
Generally these numbers are just a series of binary flags. You can think of them as a large congregation of on/off switches, next to one another, each corresponding to a particular, specific band. Thus, to see what's going on and make our changes, we convert them to the binary representation. After we're done, we convert them back to the form that is acceptable as input by QXDM (which is decimal again, for the particular registers we're modifying).
2G & 3G Configuration
The 2G and 3G configuration is determined by four values. First, take the three band_pref* values:
Code:
band_pref [= band_pref_0_15] (16-bit):
0xFFFF 1111111111111111
band_pref_16_31 (16-bit):
0xBFFF 1011111111111111
band_pref_32_63 (32-bit):
000131072 00000000000000100000000000000000
The three are juxtaposed to form a 64-bit quad-word (the split is probably to maintain some compatibility with legacy architectures, there is no logical reason for this). Then, the result of bitwise conjunction of rf_bc_config (configured bands), also a 64-bit quad-word, and the three juxtaposed band_pref* values (preferred bands) determine which bands are available.
Code:
rf_bc_config (64-bit):
0000562950035735431 0000000000000010000000000000000000000100111010000000001110000111
0000562950069289863 0000000000000010000000000000000000000110111010000000001110000111
0000000000000010000000000000000010111111111111111111111111111111
band_pref_32_63 band_pref_16_31 band_pref_0_15
The difference between the two values is apparently that rf_bc_config are the pre-configured bands, whereas the band_pref values can be modified at run-time, for example through the *#*#INFO#*#* (or *#*#4636#*#*) menu.
...
.
Click to expand...
Click to collapse
Thank you very much. I just got a Xiaomi Mi 5 did a stupid move. I set the band_pref to "USA" or 0x0 from *#*#4636#*#*. And so disabled my first sim card slot. Yeah, that was stupid.
But after only spending one whole day searching the internet for Qualcomm drivers, I got it fixed. Thanks to your topic.
You are great, thank you very much.
TheUltrametricSpace said:
Thank you very much. I just got a Xiaomi Mi 5 did a stupid move. I set the band_pref to "USA" or 0x0 from *#*#4636#*#*. And so disabled my first sim card slot. Yeah, that was stupid.
But after only spending one whole day searching the internet for Qualcomm drivers, I got it fixed. Thanks to your topic.
You are great, thank you very much.
Click to expand...
Click to collapse
So did you get the Band20 working on the Mi5?
CodeX86 said:
So did you get the Band20 working on the Mi5?
Click to expand...
Click to collapse
No, NVRAM values alone do not unlock additional LTE frequencies.
TheUltrametricSpace said:
No, NVRAM values alone do not unlock additional LTE frequencies.
Click to expand...
Click to collapse
I'm aware that the hardware needs to support it. I just thought to have read that the Mi5 would be capable of doing so. That's why I asked.
Sent from my HUAWEI RIO-L01 using XDA-Developers mobile app
CodeX86 said:
I'm aware that the hardware needs to support it. I just thought to have read that the Mi5 would be capable of doing so. That's why I asked.
Sent from my HUAWEI RIO-L01 using XDA-Developers mobile app
Click to expand...
Click to collapse
We wrote it down in other topics, the hardware is capable. It's only about the configuration of the hardware.
But that's the big issue here; if the configuration of stuff like the PMA has to be modified; assuming we get access to it and somehow manage it; then an RF engineer has to do it, a random person isn't good enough for this task.
Manipulation at this level without testing and a lot of knowledge will bring big time negative side-effects; trial and error won't help. (But that's the absolute worst-case scenario.)
Maybe it's somewhere in the kernel, dunno.
Yet we can surely say that NVRAM values alone are not enough and the hardware is able to support additional bands at least in theory! (talking about the mi5, the note pro is outdated.)