Database Develop

[GUIDE] Changing your Bluetooth/Wi-Fi MAC Address

Hi guys
Well, I had an Atrix for a few days, but had some issues with AT&T and had to return it and deal with some customer service issues before I can re-purchase the device. I didn't let that slow me down though
While I had it, I made a few dumps of the NAND, and have been working on disassembling things. Thanks to the help from a number of great people on IRC (#xda-devs irc.freenode.net) I have been able to successfully change the Bluetooth and Wi-Fi MAC addresses, and discovered a way to write to the flash, bypassing the bootloader security.
The full writeup can be found at pocketnow.com
I will be posting more info about the bootloader bypass as soon as I get it 100% working, right now we are able to write data directly to the NAND, bypassing bootloader security, and also provide a false signature, allowing the device to boot. However there are some remaining issues (a custom kernel that was flashed to the device failed to boot properly) - stay tuned

You the man, thanks for the efforts !

Sweeeet!
Wonderful work!

Excellent, can't wait to see the end result. Hopefully custom kernels and ROMs will be coming soon.

Devs you guys are amazing! Thank you for the hard work that is put into all this! I know the challange is fun for you all, but it really helps us non dev ppl out a lot!
Sent from my MB860 using XDA App

nicely done Da-G.... great work as always glad to see you again and i hope to continue using your work as i did back in old winmo cooking !!!
quick question, is there really a reason why to change the bluetooth/wifi MAC drivers??? are there any benefits or basically just the same exact reasons when you do it on pc's

Main reason to change MAC address is to be able to join Wi-Fi networks that have whitelisting.
You could also use it to simplify device administration on your network.
Beyond that I can also imagine a few black-hat reasons to do it
Atrix is one of the few smartphones that can pull it off easily though, others I am aware of are the LG Optimus One and the SGS series (although it's not so easy on SGS)
There are plenty of other interesting datas in /pds, it is the device provisioning partition (NVRAM) and is equivalent to /efs on the i9000/Captivate (which is the last device I used, so easy for me to compare with)
Careful messing with it though, on the Captivate changing the wrong bit would kill your cellular radio until you restored an EFS backup, I suspect the same danger is here with the Atrix too! And we don't have a quick way to restore a PDS backup yet like with odin on SGS (although I am hot on the heels of a method to do so)

Omfg I'm excited! If this device gets real ROMs an even custom kernels, its going to be an even more amazing device
Sent from my MB860 using XDA Premium App

i'm exited about the bootloader bypass, i thought the firmware would do a complete checksum of it, so if it's partial then we should be able to find out exactly what gets checked.
i'm curious to see if you have been able to find something regarding sim unlock, just like the sgs was holding the lock very easily changeable with a simple hex editor. i bought the code already but maybe other people will get lucky

I've asked for a backup of /pds prior to and after locking over in the general forum, hopefully a few people can send those my way. I suspect a good hard look at that will reveal the location and provide an easy unlock method (I think I located it already, but as /pds is not restored via flashing the leaked SBF, i'm loathe to have someone else try it in fear of brickage)
I'll hammer it out once I get my device back in hand, whenever AT&T decides to allow me to purcahse

Da_G said:
I've asked for a backup of /pds prior and after locking over in the general forum, hopefully a few people can send those my way. I suspect a good hard look at that will reveal the location and provide an easy unlock method (I think I located it already, but as /pds is not restored via flashing the leaked SBF, i'm loathe to have someone else try it in fear of brickage)
I'll hammer it out once I get my device back in hand, whenever AT&T decides to allow me to purcahse
Click to expand...
Click to collapse
i will do it, but i am getting a permission denied.
Code:
C:\Users\fjleon\Desktop\android-sdk-windows\platform-tools>adb shell tar zcvpf /
sdcard-ext/pds-backup.tar.gz /pds/
tar: can't open '/sdcard-ext/pds-backup.tar.gz': Permission denied
i tried adb shell su and accepted super user on the phone, but i still cannot do it

wow bypass= custom roms...... this would be ingenious hope u get it working....
how does rsd lite 5 flashing work??? it seems to create an image and then re sign it.... would backtracking and try to use the same method work?

@franciscojavierleon:
Make sure you don't have usb internal/sd storage mounted when you issue the command, or the sd card will be unaccessible from device
@ahjdmarchi:
I didn't study the program too much yet. I'll look to that if the current method i'm working on proves to be a failure

Da_G said:
@franciscojavierleon:
Make sure you don't have usb internal/sd storage mounted when you issue the command, or the sd card will be unaccessible from device
@ahjdmarchi:
I didn't study the program too much yet. I'll look to that if the current method i'm working on proves to be a failure
Click to expand...
Click to collapse
heres a tattoo that i have on my chest
"failure is not an option" good luck brudda hope all turns well

Da_G said:
@franciscojavierleon:
Make sure you don't have usb internal/sd storage mounted when you issue the command, or the sd card will be unaccessible from device
Click to expand...
Click to collapse
i unmounted it and tried again and still get the same error. i killed root explorer first since i had it open and no dice

@franciscojavierleon:
Try this instead.
Code:
adb shell tar zcvpf /data/local/tmp/pds-backup.tar.gz /pds/
adb pull /data/local/tmp/pds-backup.tar.gz
adb shell rm /data/local/tmp/pds-backup.tar.gz

RadioComm
You really need to take a look at RadioComm if you haven't yet.
The BT MAC address can be edited directly in the NVM on all Motorola devices.
On CDMA chipset devices it is located in seem 01bf record 0001 bytes 0006 and there is also a module and special set of TCI commands for managing this called HOB restore.
There are also flags set in the firmware for whether the HOB is verified during the flash cycle or not.
just an FYI!

@cellzealot:
Checked out RadioComm already, but none of the commands work for Atrix. Have you tried it? Perhaps you have a more updated version?

Edited. Nevermind just saw you needed it before unlock as well. I've got my PDS folder from my unlocked phone if you need it (not sure)

i should get my unlock between today and tomorrow, so with my locked pds backup i will do a diff to see if anything gets changed at all.

[GUIDE][PARTIAL] Unlock Additional LTE bands on Chinese & US variants of OnePlus 3

[GUIDE][PARTIAL] Unlock Additional LTE bands on Chinese & US variants of OnePlus 3
[GUIDE] [How To] Unlock Additional LTE bands on Chinese & US variants of OnePlus 3 (Band 5 confirmed WORK)
UPDATE 9 : Please use this static nvbk patch for oreo instead, it give more stable results. Credit to : @qhsusb_bulk
UPDATE 8 : : PATCH for OREO is now available https://yadi.sk/d/bQhvMaY23REaXZ]here - credit to BlackzAfiqz
UPDATE 7 :
i gonna try to clean up this thread a bit and give a better instruction, since there are lot of changes since the initial post was created - all previous method and steps now moved to second post
So basically with latest situation, there r few steps you can try to unlock your band.
but before doing so, please READ few sidenotes/conclusion that we manage to gather so far :
1. This step was MADE for and TESTED on MARSHMALLOW, and MARSHMALLOW ONLY
2. The Rmt Storage Patch will still working up to an official N ROM version of 4.0.3
3. This step/trick WONT WORK on OB12 or 4.1.0 - doing so will result in UNUSABLE RADIO or BOOTLOOP - Updated, PATCH for 4.1.x is NOW AVAILABLE in courtesy of @SnowWolf75
4. We only able to (partially) unlock bands THAT ARE AVAILABLE in one or another OP3/OP3T models. If the band is NEVER APPEAR on any of the available models, then currently it's NOT DOABLE. Example : Band 13 is nowhere to be found on any model of OP3, so there will be no support for B13, since there's not enough resources to do so
5. Up to today, there are some SUCCESS STORIES while using the method. Some of them are :
Myself, & @baskaflyfer of course - CN MODEL - B5 B8 UNLOCKED - B3+B7 CA UNLOCKED
@allluke - US MODEL - B3 UNLOCKED post #640
B3 working IMEI intact. Thank you so much
Click to expand...
Click to collapse
@dapsyra - US MODEL - B3 UNLOCKED post #558
After following the guide, I was able to unlock band 3 in my US model OnePlus3 A3000. See attached images
I did all the steps. My IMEI is intact.
It takes some time for the signal to show up in Network Guru, so be patient.
In Network Guru->Band Locking->LTE, uncheck all the other LTE bands leaving only band 3 checked
Then go to RAT Locking and select LTE. Wait for the signal to show up.
If Network Guru goes to WCDMA, repeat last step.
Click to expand...
Click to collapse
@band3pls - US MODEL - B3 UNLOCKED post #846
I can confirm my LTE band 3 is working after flashing the new QCN, BUT after flashing the QCN you must reboot and then open QXDM and write 225 to NV item 1878, or else it won't work.
Here are my steps:
First I flashed this: (other/older QCN files posted by @otonieru will probably work too)
https://yadi.sk/d/dKAKorWd3FGTXB
Then I rebooted, and flashed this: (Baskaflyfer's QCN)
https://drive.google.com/file/d/0B1R...ew?usp=sharing
Then I rebooted again, and flashed this: (Baskflyfer's fbrx file)
https://drive.google.com/file/d/0B1R...ew?usp=sharing
Then I rebooted, wrote 225 in NV item 1878 in QXDM, and finally got LTE signal on band 3 working here in Pakistan on my A3000US.
Click to expand...
Click to collapse
@kaiserreich - US MODEL - B3 UNLOCKED post #921
I managed to get it to work.
Now I have EU bands on my A3000CN
1. flash rmt_storage via twrp. (first page)
2. restore europe qcn. (first page)
3.restore A3003_eu from post #334 (third step)
4.run qxdm -> nv browser -> find id 1878 and change it to 237 (write).
5.reboot your phone.
Thanks
Click to expand...
Click to collapse
Click to expand...
Click to collapse
So here's what you gonna need :
1. Qualcomm USB DIAG Driver - Find it from post#2
2. QPST & QXDM - sorry but i can't redistribute it here, please look for it yourself
3. Main QCN for base, here : https://yadi.sk/d/E0y_4Ka63GNUdt
4. Extra QCN for fbrx_cal :
A3000_cn
A3000_us
A3003_eu
A3010_cn_3T
5. Rmt Storage Patch - find it from post #2 - For OOS 4.1.x download it from Here
6. Network Signal Guru App from PlayStore
Additional file for OP3T users :
1. OP3T EU QCN - Here
2. OP3T fbrx - Here
Now do the PRE-STEP,
1. Boot into TWRP
2. Flash the RMT Storage Patch according to your OS version, 4.1.x use Snowwolf version, bellow that, use Baskaflyfer version
Next, step is :
1. Opening DIAG - Assuming you got your phone rooted, run this command from ADB
adb shell
su
setprop sys.usb.config diag,adb​
Click to expand...
Click to collapse
2. Now your devices wil either detected as unknown device (or Qualcomm Diag Port/USB Modem if you already have the diag driver) on Device Manager
3. Install the driver from requirement list number one, and you will have "HTC USB Modem" listed in your device manager (skip this step, if you already have your own qualcomm usb diag driver installed)-(remember to disable signature enforcement if you use WIN8/10)
4. Now fire up QPST and go to "Port" tab, and choose "Add New Port" ,
5. On "Serial/USB Port" tab, unchecked the option of "Show Serial & USB...bl bla bla" option, you will see your phone listed there as a "COM#" (# is a number depending on your PC) choose it, and click "OK"
6. Now choose "Start Clients" from the Menu tab above, and choose "Software Download"
7. Airplane Mode your Phone
8. Choose "Restore" Tab, and click browse for QCN file, and look for the QCN you have downloaded from requirement list Number 3 (if you need B3 on your US, use CN QCN, if you need B5 or B8 on your CN Model, use EU QCN. US QCN is still experimental)
9. Check "Allow phone/ESN mismatch"
10. Click "Start" and wait for the process to complete
11. After complete, wait 30 Seconds (for curing time), close QPST and reboot your phone
12. Once it fully boot, open back your CMD and re-run command from step number 1 to re-open your DIAG port
13. Use the "Software Download" function again, and restore the supporting QCN from requirement list Number 4 (choose one according to your needs)
14. Click "Start" and wait for the process to complete
15. After complete, wait 30 Seconds (for curing time), and reboot your phone
16. Once it fully boot, open back your CMD and re-run command from step number 1 to re-open your DIAG port, and make sure it detected on QPST
17. Now Open your "QXDM", choose options tab - "Communications", and choose the port according to your DIAG Port, and hit OK
18. Now choose "View" - "New" - "Common" - "NV Browser"
19. Go to NV ID 1878, and click "Read"
20. According to your needs, change the value. (If you need B3, B5, B8 on CN Model, use 237. If you need B3 on US Model, use 231 or 225)
21. Click "Write"
22. After complete, wait 30 Seconds (for curing time), close QXDM and reboot your phone
23. Run Network Signal Guru, choose "Clear Forcing" from the Tri-dot menu on top right
23. Continue with choosing "Band Locking" and choose only your new unlocked LTE Band. Hit OK, if warning about powercycle appear, just hit OK as well
24. Wait for a while until your phone picking up signal. To make it faster, you might want to lock your network mode to LTE ONLY through *#*#4636#*#* or through Network Signal Guru
That's it, if everything is well, you should have your new LTE BAND working now.

I gonna try to clean up the first post,
so i move all previous update to 2nd post :
[GUIDE] [How To] Unlock Additional LTE bands on Chinese & US variants of OnePlus 3 (Band 5 confirmed WORK)
UPDATE 6 : Based on guidance from Baska, i re-tweak the QCN for more proper IMEI removal, please try again accordingly based on your needs :
WARNING : NOT COMPATIBLE WITH 4.1.0
Based on guidance from @baskaflyfer few posts back
here i upload the new version set of modified QCNs : https://yadi.sk/d/E0y_4Ka63GNUdt
you guys can try again to flash it on your OP3 (still no OP3T at the moment)
Step required would be :
1. Have your Rmt Storage Patched - if havent, flash the storage patch
2. Flash One of the QCN from the zip file, depending on your need, If you are loking for B3, u can try CN or EU model. If you need B5, then use US or EU model, and if you need B4, try to use US model
3. Use QXDM to edit the NV Value of NV item 1878 based on your needs, in my case, to be able to use B3, B5 and B40 i need to use EU QCN and set the id to 237, if you look for B3 on your US Model, u might want to try 225, 231 or 237. Meanwhile if you need B4, you might want to try 232
4. Open Network Signal Guru, and lock the LTE band to the only band you want to test, and wait. It takes quite sometime to get reception. Also make sure you are in area where the band you look for has strong reception.
Click to expand...
Click to collapse
UPDATE 5 : I managed to create EASY WAY to unlock necessary Bands, - you can skip all the steps in this post, except for the flashing RMT Storage Patch step. Thats the MAIN REQUIREMENT
for the one who need band 3 on the US Model, flash this QCN : https://yadi.sk/d/4Y2lpk5Y3EqYZn
for the one who need band 4, 12, 17 & 30 on CN/EU model, flash this : https://yadi.sk/d/5c8r8Xle3Eqmo8
for the one who need band 5, 8 & 20 on CN/US model, flash this : https://yadi.sk/d/lGURsV523EqqM5
Click to expand...
Click to collapse
UPDATE 4 : Thx to Baskaflyfer for his work in separating QCN, now we managed to Unlock Band 5 & 8 and Keep Our IMEI Intact - New QCN for Band 5 & 8 ADDED to Download Section
Update 1 : I reupload the QCN with safety precaution so that you can input your own IMEI to prevent accidental IMEI overwritten
- this solution is no longer working for OnePlus
Update 2 : I found that in order to use Band 3, we need to use A3000CN QCN as base. Meanwhile, if we want to use band 5, 8 and possibly 20, we need to use A3003 base. So please download according to your needs
Update 3 :
Ok,
It seems that Oneplus is using an encryption when storing the IMEI in QCN,
Thus the normal editing method for qualcomm chipset wont work,
This is means that we cant use a full QCN as based,
because even when it successfully unlocked the band, the IMEI mashup will become a problem in a long term use
Instead, we need to take only several parts of the QCN itself to be written later
For now, i will take down the DL link for the QCN first, as it may exposed my or others IMEI accidentally.
Sorry for this, but we gonna need to find a better solution
Good things we can learned is : at least we know that its not entirely impossible
Salam from Indonesia
Click to expand...
Click to collapse
I had confirmed Band 3, 5, 8 and 40 are all workings in my A3000
Another GOOD NEWS is :
@allluke & @koko21341 confirmed that Band 3 is UNLOCKED and USABLE in their US variants
So after trying so many ways (Thx to @baskaflyfer who manage to bring back my courage to tinker on this), simple and hard one to unlock additional LTE Bands on our beloved A3000 to match the one from A3003
also credit to @devilsshadow & @Albirew who bring the initial & original way of unlocking extra bands for us all
and extra thanks to :
Thanks to @BlackSoulxxx for his original work with the Qualcomm baseband software and for the modified OnePlus Drivers
Thanks to @olokos for his original tutorial
Thanks to @fards for finding the diagnostics command that made all this possible
also thanks to this japanese guy here : https://logicalmemo.net/2016/10/19/post-300/ that enlighten all of us regarding the static_nvbk.bin modification so that we can begin to tinker with the NV value on our OP3
I finally (kinda) found a way to unlock more bands
WARNING : Do THIS WITH YOUR OWN RISK, I am not responsible for any harm that can happen during the process of unlocking the LTE BANDS, ALWAYS MAKE BACKUP FIRST
First, what you gonna need to have are :
1. Qualcomm Diag Driver - Here - i mod the HTC driver, you can use your own driver if you have one
2. Marshmallow ROM with DIAG capability (example : mine done on @arter97 CM13, but OOS is perfectly fine)
3. QPST - please find it yourself, i got mine from company, and i wont share link to cracked version here
4. DFS Tool - Here
5. PC (Win 7 64 preferable) with ADB n fastboot driver installed - Minimal ADB Download Here
6. Dedicated QCN for Each Needed Band, Currently we only managed to Get Working QCN for Band 5 & 8 -
Band 5 & 8 QCN - Download Here
7. HEX Editor to insert your own IMEI - Here
8. Unlocked BL & Rooted device with TWRP Recovery Installed - I assume every of OP3 users know how to do this, or kind enough to find the way by themself
9. Network Signal Guru App from PlayStore
10. Rmt Storage Patch Zip (credit to @baskaflyfer) - Here *for Nougat Users & Op3T users, use this one instead : Rmt Storage Patch 4.x --> This (probably) wont work on firmware newer than OB9, latest tested is on 4.0.3
Ok, here we Go !
1. First, copy the rmt storage patch zip from list number 9 above to your internal storage of OP3
2. Boot into TWRP, do BACKUP for your EFS partition, then continue with flashing that zip
3. Reboot into system, and you should get warning about EFS Partition mismatch, ignore or closed that warning (i choose to ignore it forever, so it wont annoy me upon reboot)
4. Now open up your CMD and run this ADB command :
adb devices
adb shell
su (you will get pop up on your phone to give root authorization for ADB, authorize it)
setprop sys.usb.config diag,adb (this will open your OP3 diagnostic port)
Click to expand...
Click to collapse
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
5. Now your devices wil either detected as unknown device (or Qualcomm Diag Port/USB Modem if you already have the diag driver) on Device Manager
6. Install the driver from requirement list number one, and you will have "HTC USB Modem" listed in your device manager (skip this step, if you already have your own qualcomm usb diag driver instaled)
7. Now fire up QPST and go to "Port" tab, and choose "Add New Port" ,
8. On "Serial/USB Port" tab, unchecked the option of "Show Serial & USB...bl bla bla" option, you will see your phone listed there as a "COM#" (# is a number depending on your PC) choose it, and click "OK"
9. Now choose "Start Clients" from the Menu tab above, and choose "Software Download"
10. Airplane Mode your Phone
11. Now open the HEX Editor, and open either the A3003 or A3000CN QCN file (depends on which bands you want to unlock) you have downloaded, and find this entry AA AA AA AA AA AA AA AA and replace it with your own 16 digit of IMEI in a HEX format (use online IMEI to HEX converter if you don't know how to do so or use this App : https://drive.google.com/file/d/0B09fj-nvjJeodlVaZHdVb29RaHc/view?usp=sharing ) and SAVE AS the file somewhere you can easily find. - this info is obsolete now
For the 2nd IMEI number you can search for 88 00 01 00 26 02 00 00 then the hex after is the IMEI, so you can just replace that with your 2nd IMEI number - Thx to @DarkN3ss61 for the findings
WARNING : WHEN INPUTTING YOUR IMEI, PLEASE MAKE SURE YOU INPUT THE HEX VALUE OF YOUR IMEI, NOT THE IMEI NUMBER ITSELF, ELSE YOU MIGHT INJECTING A RANDOM IMEI TO YOUR DEVICES
12. Choose "Restore" Tab, and click browse for QCN file, and look for the QCN you have downloaded from requirement list Number 6
13. Check "Allow phone/ESN mismatch"
14. Click "Start" and wait for the process to complete
15. After complete, wait 30 Seconds (for curing time), close QPST and reboot your phone
16. Once it fully boot, open back your CMD and re-run command from step number 4 to re-open your DIAG port
17. After the port opened and detected, open your DFS Tool (downloaded from requirement list number 4)
18 . If it ask for login just close the window
19. You will see your device listed in "Port" tab, double click it to trigger connection
20. Once you see "Device in diagnostic Mode" in DFS log windows, go to "Bands" tab
21. Choose "LTE" Tab
22. Choose "LTE BC Config" on the right side
23. Click "Read" and see, confirm first that u have all the A3003 LTE bands activated, IF NOT, REPEAT STEP 1 to 14
24. If you can confirm that the default Band of A3003 already Opened/activated, now add more bands as you desired - by put a checkmark on it (remember that even if it enabled, your phone need hardware capability to connect - i only managed to try on band 5 & 8, my country has no others band, so please try it yourself and tell us here the result)
25. Once you done, click "WRITE"
26. Wait for the countdown process done, and check the log whether "Operation Completed" or not
27. Once everything is done. Wait again for 30 Seconds, and reboot your phone
28. After it fully booted, turn OFF the AIRPLANE Mode, and wait for the reception - it can take up to few minutes for the radio to get reception
29. Now, open up "Network Signal Guru" that you have downloaded from PlayStore, if it ask for Root Access, Grant it
30. Click the "Magic Wand" at the top bar, and choose "Band Locking"
31. Choose "LTE"
32. Now see, whether Bands you added is there or not. If NOT, CLICK AGAIN on the "Magic Wands" icon, and click "Clear All" and confirm the dialog that appear
33. After step 32, you should see that all Bands were added now !
NOW! Go out and try yourself whether you can manage to get a reception using your new bands.
TIPS : If you are sure that your area has certain bands, you can use "Network Signal Guru" Band Locking menu to disable some bands and only enable the one you want to test to check whether you can get reception or not. I used to disable all except band 5 & 26 to confirm whether the UNLOCK process is WORK or not. And IT WORK (see screenshot on 2nd post)
Screenshot :

Thanks for your work!
Any chance of adding band 66?
Sent from my ONEPLUS A3000 using Tapatalk

Crahzee said:
Thanks for your work!
Any chance of adding band 66?
Sent from my ONEPLUS A3000 using Tapatalk
Click to expand...
Click to collapse
Logically speaking, step above only can opened up to band 44 on our phone
Rest of the bands would need latest QXDM from Qualcomm, which unfortunately i dont have in my belonging (license is expensive, as u know)

Can anyone confirm this worked for unlocking band 3 on the US model?

DarkN3ss61 said:
Can anyone confirm this worked for unlocking band 3 on the US model?
Click to expand...
Click to collapse
I think if moderator can bring this up, more US model users can try to see whether it can open the band 3 or not.
i have one friend who bought OP3 from US and brought it here to my country (which using band 3 as major LTE bands), i'll try to persuade him to try

Will this method work for adding bands 2 and 4 for A3003?

meqwerty said:
Well this method work for adding bands 2 and 4 for A3003?
Click to expand...
Click to collapse
Please try and help us to builds more results databases

otonieru said:
Please try and help us to builds more results databases
Click to expand...
Click to collapse
Good job,
but
What can I say, I began my work from this by adding LTE Bands. Here will not work B3 and B20, but will work LTE CA B7+B7 ( hw id are different ). At the moment I stopped on this.
Now I don't have time to explain everything.

baskaflyfer said:
Good job,
but
What can I say, I began my work from this by adding LTE Bands. Here will not work B3 and B20, but will work LTE CA B7+B7 ( hw id are different ). At the moment I stopped on this.
Now I don't have time to explain everything.
Click to expand...
Click to collapse
I think the key is in flashing clean the QCN of 3003 so we can get the proper config for LTE band,
And using DFS Tool,
Because somehow QXDM cant "bruteforce write" some NV,
Engineer guy from my company said its due to older version of QXDM (we need to buy new one - my company, i mean)
You might want to try again using DFS
After all, its your persistence that encourage me to keep trying

otonieru said:
I think the key is in flashing clean the QCN of 3003 so we can get the proper config for LTE band,
And using DFS Tool,
Because somehow QXDM cant "bruteforce write" some NV,
Engineer guy from my company said its due to older version of QXDM (we need to buy new one - my company, i mean)
You might want to try again using DFS
After all, its your persistence that encourage me to keep trying
Click to expand...
Click to collapse
Okay, i'll try it
And you are right about QXDM, I noticed that it didn't always writes the some NV

otonieru said:
Please try and help us to builds more results databases
Click to expand...
Click to collapse
i would, but the place i live has no band 2/4 to test it with. it'd be nice if we can find a generic way to unlock all bands for all models.

meqwerty said:
i would, but the place i live has no band 2/4 to test it with. it'd be nice if we can find a generic way to unlock all bands for all models.
Click to expand...
Click to collapse
Basically you can tick all the bands available in DFS Tool to unlock all band,
It might not work though, since not every band is preconfigured in the radio of the phone,
Thats why i only unlock bands which avail in A3003 model, so that i can get the radio config for that band using the QCN dump.
Theoritically, the one that should work well after unlocked is band 3, 5, 8, 20 and 40

Can anyone confirm it gives you a option to unlock band 13 before i do this

gillim74 said:
Can anyone confirm it gives you a option to unlock band 13 before i do this
Click to expand...
Click to collapse
Unlock Option is available for Band 1 - 44

otonieru said:
Unlock Option is available for Band 1 - 44
Click to expand...
Click to collapse
Ok thanks for your response

Yes! If I can get Band 20 in USA, We can get these phones working on Verizon! Right?

Stupifier said:
Yes! If I can get Band 20 in USA, We can get these phones working on Verizon! Right?
Click to expand...
Click to collapse
Theoritically, as long as the config for antenna is also there,
Baska used to be able to find band 20 during his experience, so i can say that its achieveable,
Thing i notice is, the phone wont pick up the unlocked band, if you also playing around with the GSM and WCDMA band,
Before, i already managed to unlocked the band, but it wont pick up reception, that is when i still combine it with the NV value mod for GSM and WCDMA
I decided to revert everything back and using A3003 NV value as a base, and then do the unlocking from there,
And, voila, we got lucky !

Stupifier said:
Yes! If I can get Band 20 in USA, We can get these phones working on Verizon! Right?
Click to expand...
Click to collapse
Verizon is band 13 isnt it
---------- Post added at 09:44 PM ---------- Previous post was at 09:43 PM ----------
https://www.frequencycheck.com/carriers/verizon-wireless-united-states

gillim74 said:
Verizon is band 13 isnt it
---------- Post added at 09:44 PM ---------- Previous post was at 09:43 PM ----------
https://www.frequencycheck.com/carriers/verizon-wireless-united-states
Click to expand...
Click to collapse
Crap....yes! you are correct! I dunno why I had Band 20 floating around in my head this whole time. Yes, Band 13 is for USA Verizon (not Band 20).

[GUIDE] Enable VoLTE/VoWiFi on LineageOS 17.1 for EU carriers Oneplus 6T

[GUIDE] Enable VoLTE + VoWiFi for German and other EU carriers on the Oneplus 6T running LineageOS 17.1
Requirements:
- Phone must be rooted
- A computer running Windows to connect your phone with (Also tested Windows 7 running in Virtualbox)
- Qualcomm USB Driver (Downloadlink)
- Qualcomm PST Tool (Downloadlink)
- ADB
IMPORTANT: This can break your phone! Make a backup of your EFS Partition! This can be done with TRWP.
1)
Download and install Qualcomm USB Driver and PST Tool on your computer. Make sure, you have the adb tool as well.
2)
On your phone activate the hidden developer settings:
Settings -> About -> Build-Number (press it multiple times)
then
Settings -> System -> Devloperoptions
Activate:
Android-Debugging
Local Shell
Connect your phone to your computer.
3)
Open a shell on your computer and type:
Code:
adb shell
Watch your phone to accept the incoming connection from your computer.
Type:
Code:
su
and watch your phone again to accept root access.
Activate the Diagnostic Mode by typing:
Code:
setprop sys.usb.config diag,serial_cdev,serial_tty,rmnet_ipa,mass_storage,adb
Your phone will disconnect from adb, but thats ok.
4)
On your computer open "PDC" from the installed QPST application as admin.
In the device list, select your phone.
In the upcoming list look for "Oversea-Commercial_DS", right click it and deactivate Sub0 and Sub1
Click "Oversea-Commercial_DS" again and press the Remove button.
Close the PDC Tool and open it again.
Select your phone again
Look for Telefonica_UK_Commercial, right click and SetSelectedConfig for both Sub0 and Sub1
Click on Telefonica_UK_Commercial again and click the Activate button
Close the application
5)
Unplug your phone and reboot it.
Make sure you have activated VoLTE/VoWiFI in your settings.
6)
No VoLTE/VoWIFI icon is shown in the status bar. You can check the IMS status as followed:
Open the dialer and enter the code: *#*#4636#*#*
This will open the Testing menu. Select the first entry "Phone information".
In the option "Select phone index" you can choose your sim card you want to get information about.
Then, press the three dotted menu in the upper right and select "IMS Service Status"
If it says "IMS Registration: Registered" everything is working fine. Depending on whether you are on WiFi or LTE, "Voice over LTE" or "Voice over WiFi" will be shown as "Available as well.
Enjoy!

Great work. I'm on Linux. What is this qpst and psd tools for exactly and is there a way to do the changes from Linux?

Termehansen said:
Great work. I'm on Linux. What is this qpst and psd tools for exactly and is there a way to do the changes from Linux?
Click to expand...
Click to collapse
I'm on Linux too. Qpst is a USB Modem driver and PSD is a Tool to access and alter the modem firmware on the phone.
Unfortunately these will only run on Windows. I used VirtualBox and run Windows 7 (I bought a cheap license key some time ago) on it.

So none of these tools could be helpful?
https://github.com/openpst

Termehansen said:
So none of these tools could be helpful?
https://github.com/openpst
Click to expand...
Click to collapse
Interesting, I didn't know these tools. Maybe it could work.

Thank you for the guide. Still, I think you have a typo:
Sayonara123 said:
Code:
setprop sys.usb.config diag,serial_cdev,serial_tty,rmnet_ipa,mass_storage ,adb
Click to expand...
Click to collapse
There's a space preceding ',adb', and with blindly using this command something went wrong on my Windows PC. Had to restart. 'setprop' also supports only 2 arguments.
Another thing:
Sayonara123 said:
Remark:
I did not test it, yet. But you may have to repeat the procedure after every LineageOS update.
Click to expand...
Click to collapse
You should put that on top, maybe make it bold and set a bigger font. It looked like a tested and working method, I just blindly followed the instructions without questioning (also a mistake on my part).
Anyway, I followed the steps successfully but cannot see if VoLTE/VoWifi is functional as there is not indicator in LineageOS 17.1. If anyone knows a way, feel free to tell.
Thanks again.

Thank you for your reply.
martin.42 said:
Thank you for the guide. Still, I think you have a typo:
Click to expand...
Click to collapse
You are right, It's a typo, I didn't notice. Fixed it.
Another thing:
Click to expand...
Click to collapse
The whole procedure was tested on my own phone. There was just one unclear thing, whether these changes survive an update of the LineageOS system. It does! So I removed this obsolet remark.
Anyway, I followed the steps successfully but cannot see if VoLTE/VoWifi is functional as there is not indicator in LineageOS 17.1. .
Click to expand...
Click to collapse
Yes, it's a pitty there's no indicator in the status bar. I've found another way to check functionality and added it to the guide.
Hope this make things more clearly.
Thx

Tried it on stock oos 10.3.6, and windows 10. Have swedish carrier Tre (Hallon).
Works great! Thanks for your guide! ?

Procedure fails on OP6 with LineageOS20, phone is not visible in PDC.

Bell, Telus, Koodo and Freedom Mobile Volte and Vowifi Calling Working *Update Android 11 Require Root*

Finally
I can confirm it worked on my Oneplus 7 Pro both Volte and Vowifi calling it also can work on oneplus 6, and 6T since I don't have a device so I can't test it.
some people are unable to activated so this method require additional step for them.
Install QPST: https://mega.nz/file/zQt3ESDA#dd69iA2r9xZaYwWvYrCvVHl-OmjucIWI4ETFBTO5bM8 (This tool only work on Oneplus 6,6t, 7 series. Oneplus has blocked this tool on oneplus 5 series)
Next steps:
find PDC tool from installed QPST and open
select device from drop-down menu, if it is empty, you will have to reinstall/choose another driver
now right-click on overseas commerical ds and select Deactivated - Sub0
now right-click on Commerical-TMO and select SetSelectedConfig - Sub0
and now button Activate
Restart your phone than apply following step:
Oneplus Usb driver (Dont install it if you already installed this before)
https://mega.nz/file/GYkxjByK#M6CZA9c9JQaX27j3dLzXRjBrclSVSB9cJs00B5BXdAI
After unzipping pixel3.zip you need to go to: Pixel3\mcfg_sw\generic\Pixel\NA\Freedom\VoLTE and copy mcfg_sw.mbn file to folder where you will have your EfsTools saved. It will ask you to overwrite one that is in that folder. Press yes.
Now follow these steps:
This method doesn't required root.
0. Make sure that you just enabled the VoWiFi and VoLTE in your carrier first !!!
1. Download and install the oneplus LogKit and Engineering mode apk:
3. Type *#800# --> oneplus Logkit --> Function Switch --> enable VoLTE and VoWifi switch
4. Open Settings --> WiFi & Intenet --> SIM & netwok --> enable VoLTE and VoWifi switch
5. Connect your phone to PC
6. Type *#801# in Phone app and enable Full-port switch (if your computer unable to recognize COM PORT try installing qualcomm driver: https://mega.nz/file/jV9ByarL#lbryKSC6uk9D-GTErtJ0SHyVOfWKA2TIl-psXmhj4YU)
7. Download and unzip the EfsTools with config files includes. (Make sure copy mcfg_sw.mbn file from pixel3.zip freedom folder replace the file if already exit.)
8. Open CMD as Administrator on the PC, navigate to the folder where you extract the files (eg. cd c:\EfsTools-0.10-modded-1.2-win32)
9. Now execute the following commands:
EfsTools.exe efsInfo
If your Freedom sim in Slot 1 use this command:
1. EfsTools.exe writeFile -i mcfg_autoselect_by_uim -o /nv/item_files/mcfg/mcfg_autoselect_by_uim
2. EfsTools.exe uploadDirectory -i mcfg_sw.mbn -o / -v
If your Freedom sim in Slot 2 use this command:
1. EfsTools.exe writeFile -i mcfg_autoselect_by_uim -o /nv/item_files/mcfg/mcfg_autoselect_by_uim -s 1
2. EfsTools.exe uploadDirectory -i mcfg_sw.mbn -o / -s 1
Thats it. Commands with "1" on at the end are for the second SIM card.
You must register here in order to wifi calling work: https://vowifi.authenticateme.ca/
Credit goes to @popos1 and @astracd. Original Post: https://forums.oneplus.com/threads/freedom-mobile-wifi-calling-working.1284987/
You need These file:
Pixel 3 mbn file:
https://forum.xda-developers.com/showpost.php?p=78563337&postcount=4 (Recommend for oneplus 6 series)
Pixel 4 mbn file:
https://forum.xda-developers.com/pixel-4/help/mbn-files-pixel-4-request-t4050247 (Recommend for Oneplus 7 series)
Thanks for @asasanc
Oneplus logkit:
https://mega.nz/file/rZlADYzD#Pg8vLZI4tZ16VXe-v-JfPLCiCab9fTTWwFcPBI04oho
Efstool:
https://mega.nz/file/fQcnQAZT#i0dRA6PvsuK4_PmLHPVXSwhOZroSsR6P1CuUDHwHW8g
Enigneering Mode apk:
https://www.apkmirror.com/apk/onepl...-0-171117173719-25c8842-android-apk-download/
Join Telegram group:
https://t.me/joinchat/QOPwqkqivRqnI4YIW2bojA
Edit:
Alot of people have confirm this method working on Oneplus 6,6t, 7,7 pro, 7t, and 8. For some people VoLTE works right away but for some it take few day to provision as per freedom it could take somewhere 72-120 HR to provision.
Edit 2:
Pixel 2 mbn for oneplus 5. This is recommended for Oneplus 5 only.
https://mega.nz/file/HUsHVYqS#n7pDP-mEMIY5MXffqViAVoqPgF_Au3hzzm6s5dgBZu0
Update: 3/25/2021
This new method requires Root on Android 11.​Please note Engineering won't work on Android 11. you need to follow the following steps to open the ports.
you need Adb tool Platform-tool.
https://dl.google.com/android/repository/platform-tools-latest-windows.zip
1. Extract the Folder
2. Open the Platform Tool folder then hold the Shift key and right-click on empty space to open the Command Prompt in the same folder.
3. Then Type "ADB shell"
4. Then type "su" (This will ask root access on your phone)
5. Then type this command to open the port.
"setprop sys.usb.config diag,serial_cdev,rmnet,adb"
Then you have will access to EFStool and PDC tool to Flash mbn file using the above method

can any other users confirm this is working? I wonder if this will allow the oneplus to connect to band 13 then as well? Because freedom was keeping band 13 for phones compatible with VOLTE on their network.

It works for me - wifi calling on OnePlus 6T McLaren. But not volte. I'm unsure if there is volte in my area. My wife have s9 bought from freedom and it doesn't switch to volte (wifi calling works)

astracd said:
It works for me - wifi calling on OnePlus 6T McLaren. But not volte. I'm unsure if there is volte in my area. My wife have s9 bought from freedom and it doesn't switch to volte (wifi calling works)
Click to expand...
Click to collapse
does this trick only work on stock roms, or would it work on a custom rom as well?

What do you mean by Step 0?
Edit: Did some Googling and found that you have to enable it on a webpage. Use this link to do so: https://vowifi.authenticateme.ca
I can't seem to get past the command: EfsTools.exe efsInfo
Keep getting the follow: Critical Error. The Operation has timed out.
And yes I am in an elevated command prompt.
Checking device manager shows me that when I have Serial and Full-port Switch ON, I have three devices (CDev Serial, OnePlus, OnePlus) that there are no drivers installed for. Not sure where to get these as searching automatically for an updated driver returns nothing...

omvir said:
can any other users confirm this is working? I wonder if this will allow the oneplus to connect to band 13 then as well? Because freedom was keeping band 13 for phones compatible with VOLTE on their network.
Click to expand...
Click to collapse
Yes it does connect to band 13.

CrazedBoredom said:
What do you mean by Step 0?
Edit: Did some Googling and found that you have to enable it on a webpage. Use this link to do so: https://vowifi.authenticateme.ca
I can't seem to get past the command: EfsTools.exe efsInfo
Keep getting the follow: Critical Error. The Operation has timed out.
And yes I am in an elevated command prompt.
Checking device manager shows me that when I have Serial and Full-port Switch ON, I have three devices (CDev Serial, OnePlus, OnePlus) that there are no drivers installed for. Not sure where to get these as searching automatically for an updated driver returns nothing...
Click to expand...
Click to collapse
here you can download this oneplus driver . but can get this driver as well when you connect your phone to computer.
https://mega.nz/file/GYkxjByK#M6CZA9c9JQaX27j3dLzXRjBrclSVSB9cJs00B5BXdAI

nabbasi said:
here you can download this oneplus driver . but can get this driver as well when you connect your phone to computer.
https://mega.nz/file/GYkxjByK#M6CZA9c9JQaX27j3dLzXRjBrclSVSB9cJs00B5BXdAI
Click to expand...
Click to collapse
I've installed the one from my phone and still no dice. Still no drivers for the three devices. =\

This is awesome news. Thanks for sharing brother!

CrazedBoredom said:
I've installed the one from my phone and still no dice. Still no drivers for the three devices. =\
Click to expand...
Click to collapse
.
Did you run CMD as administrator if not try with that.

nabbasi said:
.
Did you run CMD as administrator if not try with that.
Click to expand...
Click to collapse
Yep, no dice.

astracd said:
It works for me - wifi calling on OnePlus 6T McLaren. But not volte. I'm unsure if there is volte in my area. My wife have s9 bought from freedom and it doesn't switch to volte (wifi calling works)
Click to expand...
Click to collapse
I have op6t and am trying to do this but i am stuck on step 6 (6. Type *#801# in Phone app and enable Serial and Full-port switch).
everytime i try to do that , nothing happens. I am rooted on stock oxygen 10.3.5 if that matters.

darkknight200 said:
I have op6t and am trying to do this but i am stuck on step 6 (6. Type *#801# in Phone app and enable Serial and Full-port switch).
everytime i try to do that , nothing happens. I am rooted on stock oxygen 10.3.5 if that matters.
Click to expand...
Click to collapse
I have google dialer. So each time I run codes need to disable it and enable OP dialer as default dialer. So that could be one of reasons that doesn't work for you.
Second reason that it can be
You also need to get dialer that works as latest version doesn't work. I will try to find a post where they had dialer that works. I believe it was in one of OP5 topics for enabling the volte/vowifi.
Third reason
You would need to install engineering mode
I will try to attach the app

astracd said:
I have google dialer. So each time I run codes need to disable it and enable OP dialer as default dialer. So that could be one of reasons that doesn't work for you.
Second reason that it can be
You also need to get dialer that works as latest version doesn't work. I will try to find a post where they had dialer that works. I believe it was in one of OP5 topics for enabling the volte/vowifi.
Third reason
You would need to install engineering mode
I will try to attach the app
Click to expand...
Click to collapse
ya i managed to install the engineering mode apk from https://www.apkmirror.com/apk/onepl...-0-171117173719-25c8842-android-apk-download/ and can dial in the op dialer fine now.
when i try to enable serial it crashes but full port switch is able to turn on though.

darkknight200 said:
ya i managed to install the engineering mode apk from https://www.apkmirror.com/apk/onepl...-0-171117173719-25c8842-android-apk-download/ and can dial in the op dialer fine now.
when i try to enable serial it crashes but full port switch is able to turn on though.
Click to expand...
Click to collapse
Full port is enough. You don't need serial. :good:

astracd said:
Full port is enough. You don't need serial. :good:
Click to expand...
Click to collapse
ok now i am trying the commands in full admin but i keep getting the error message in the screenshot attatched
edit also when I have the serial port enabled, i chekd device manager and it gave me this in the 2nd screenshot. In normal mode without serial port enable, my phone shows up as normal function phone storage device.

darkknight200 said:
ok now i am trying the commands in full admin but i keep getting the error message in the screenshot attatched
edit also when I have the serial port enabled, i chekd device manager and it gave me this in the 2nd screenshot. In normal mode without serial port enable, my phone shows up as normal function phone storage device.
Click to expand...
Click to collapse
Did you open CMD as administrator?
And when you connect phone to laptop did laptop made connection sound ?

astracd said:
Did you open CMD as administrator?
And when you connect phone to laptop did laptop made connection sound ?
Click to expand...
Click to collapse
Yes to both

Other things I can think of right now change charging to drive for your usb connection.
Sometimes windows acting weird when the addresses are long. C:\xxxxxxxxx
I had saved mine in C:\efstools
I renamed folder didn't use full name
I don't think this will help, but worth to try. I will think more about it.

astracd said:
Other things I can think of right now change charging to drive for your usb connection.
Sometimes windows acting weird when the addresses are long. C:\xxxxxxxxx
I had saved mine in C:\efstools
I renamed folder didn't use full name
I don't think this will help, but worth to try. I will think more about it.
Click to expand...
Click to collapse
stil no luck with renaming them and using different state from charging to file transfer mode

[GUIDE] VoLTE & VoWIFI for Xiaomi 10T/10T Pro 5G custom roms

Hi all,
I would like to write a short instruction about getting VoLTE and VoWIFI to work on a Xiaomi device. I'm using a Xiaomi 10T 5G with Evolution X, but it has mainly to do with the modem in your device, so it might work for other devices and ROMs as well. If you use a different ROM, the way DIAG mode is enabled might be different for you.
Code:
/*
* I am not responsible for bricked devices or any damage you made
* to your device. You have been warned
* Your are making changes to your modem's firmware. Make sure you
* have a backup!
*/
You have to enable VoLTE and VoWIFI in your device settings.
To check if it works:
- dial *#*#4636#*#*
- chose phone information
- chose in the menu IMS-servicestatus
You will have VoLTE and VoWIFI if it says registered and availabe.
If not, you can continue with the instructions below:
You will need a few things for this, like:
- Qualcomm USB Drivers
- QPST
- Root or another way to enable diag mode
- ADB
- Xiaomi firmware zip file
You can find many tutorials on XDA about these things, so I'm not going into detail about how to set this all up.
If you have the above installed and working:
Open a command prompt
Code:
adb shell
Code:
setprop sys.usb.config diag,serial_cdev,rmnet,adb
After you install QPST search in winodws for PDC (a yelllow and white icon) and open it.
Select 'Qualcomm HS-USB WWAN adapter'. (if this doesn't work, check if you've installed the Qualcomm USB Drivers correctly)
You'll now see a list of all modem configuration files. Check if your carrier is in the list. If so, right click on it, select SUB0 and SUB1, and click 'activate'. Check if VoLTE and VoWIFI works, if yes, reboot and check again.
If you do not see your carrier in the list, download the firmware for your device.
Extract the zip file
Navigate to \firmware-update\NON-HLOS.bin and extract this file
Navigate to \firmware-update\NON-HLOS\image\modem_pr\mcfg\configs\mcfg_sw\generic\ and search for the .mbn file for your carrier. Mine was in fw_apollo_miui_APOLLOGlobal_V14.0.1.0.SJDMIXM_2e94304468_12.0\firmware-update\NON-HLOS\image\modem_pr\mcfg\configs\mcfg_sw\generic\AF\Vodafone\Commercial\EG
Go back to PDC and chose 'load'
Select the .mbn file you've found above
PDC will reload the list and you'll now see the profile for your carrier.
Right click on it, select SUB0 and SUB1, and click 'activate'. Check if VoLTE and VoWIFI works, if yes, reboot and check again.
Now go back to adb and write
Code:
setprop sys.usb.config mtp,adb
to go back to default usb settings.
This should do the trick. You'll now have VoLTE and VoWIFI working.
It took me days to come down to this, with a lot of Google-Fu and very helpfull XDA topics. So I hope it might help you as well.
This has been tested for Vodafone Egypt, mbn for Vodafone EG has been attached (extracted from latest global firmware V14.0.1.0.SJDMIXM), just load and activate.
reference: https://forum.xda-developers.com/t/guide-volte-vowifi-xiaomi-phone.4573331/