Database Info

[GUIDE] Bad WiMax MAC? Broken 4G after update? Fix HERE!

Well I know I'm not the only one who got a bad WiMax MAC address after trying to update my WiMax radio image. I should learn to not try and fix things if they aren't broken
If you've gotten the dreaded "00:16:08:00:24:05" MAC address like I did, this guide will help you fix it. You'll need fastboot set up, a NAND unlocked phone with Toast's part 2 method, your correct MAC address for WiMax, and the files below.
FILES:
New radio
New WiMax
You MUST download & flash these again even if you already have. I don't care if you think you already have the right ones, download these. If you don't, don't ask me for help if you use the wrong ones.
STEP 1: Fix MAC
First, get your right MAC address. It can be found under the battery by the WiMax tag, or on your box under the WiMax barcode. It should be 12 digits long, with no colons in it. If it were supposed to be "00:16:08:00:24:05" it would look like 001608002405 on the box. Write that address down with a colon between every two characters to get it in the right format.
Next, boot your phone into fastboot mode. If you don't know how to do this, hold down volume and press power to boot into the bootloader. After it brings up the menu where "FASTBOOT" is highlighted, press power. It should say "FASTBOOT USB" in red where it previously said "HBOOT" in green.
On your PC, open a shell. First off, lets see if you have a bad MAC, run
Code:
fastboot oem wimaxrmac
It should return something like
Code:
INFOcmd_wimaxrmac
INFODev MAC = *Your MAC address will be here*
OKAY
If it doesn't match the code you wrote down, then you have a bad MAC. If it does match the code you wrote, then skip to step 2.
To fix it, you need to run:
Code:
fastboot oem wimaxwmac *Address you wrote down here*
Like if you wanted it to be "00:16:08:00:24:05" then you would run:
Code:
fastboot oem wimaxwmac 00:16:08:00:24:05
It should return something like:
Code:
INFOcmd_wimaxwmac
IFNOWrite OK! MAC = *Address you entered here*
OKAY
Then just run
Code:
fastboot reboot
To reboot back into Android with your correct MAC address.
STEP 2: Flash the images again
Now push those files to your SD card & reboot into recovery.
Once you're in recovery, flash the "evo.2.05.00.06.10.zip" file. Reboot from the menu like it tells you. Once you're in Android, update your Profile & update your PRL.
Now reboot into recovery again, this time flash the "evo.wimax.25641_r01.zip" file. Reboot again from the menu, and guess what. Once again, update your Profile & PRL. Reboot one more time for good measure, and you should have working 4G. I haven't been able to confirm 4G myself, but others have reported it working with my method. My logcat no longer shows any 4G errors and neither does the kernel log, plus all the data now matches how it was before my update, so that leads me to believe it's working.
I wrecked my MAC with the update and fixed it like this, but I haven't had a chance to try out 4G yet since I won't be going into the city where I'll have coverage until Saturday.
Please post here if it works for you or if it isn't clear then just post & I'll try and clear it up.
Regards,
Jesse C.
EDIT: As a few posters had trouble, it came to my attention that you MUST have run Toast's root part 2 image to have access to fastboot oem commands.
EDIT 2: Now full 4G fix.

Thank you so much!
Sent from my PC36100 using XDA App

On it.....!!!!

It's possible this may only update the MAC and not the key, Joshua (unrevoked) told me and a few others that was their main issue.
Let's see what results show.

Hot damn!!!! It works!!!

Neotelos_com said:
It's possible this may only update the MAC and not the key, Joshua (unrevoked) told me and a few others that was their main issue.
Let's see what results show.
Click to expand...
Click to collapse
If it really is the key, we can modify that here too. If we can pull a copy off a working device, we can write it with fastboot too I'm pretty sure

Geniusdog254 said:
If it really is the key, we can modify that here too. If we can pull a copy off a working device, we can write it with fastboot too I'm pretty sure
Click to expand...
Click to collapse
My understanding is the key is specific to each MAC, either way someone reported it works.
We just need people to post their before and after MAC address to confirm.
It does seem there are two variations of the bad MAC from different roms (at least from reports I've heard).

Well i changes the mac....i dont know if 4G is working on it.....

ON XP opening a shell using CMD? I'm not sure how to communicate with my EVO. Been without 4G for a while, trying to get it back up and running.

( waiting for device )
*nevermind*
Sleep..needed badly

Travyevo said:
ON XP opening a shell using CMD? I'm not sure how to communicate with my EVO. Been without 4G for a while, trying to get it back up and running.
Click to expand...
Click to collapse
You need adb from the Android SDK.
You also need to set your phone for USB debugging.
If you look around there's hundreds of tips on doing all this.

asrebel said:
*nevermind*
Sleep..needed badly
Click to expand...
Click to collapse
are you in fastboot?

Neotelos_com said:
My understanding is the key is specific to each MAC, either way someone reported it works.
We just need people to post their before and after MAC address to confirm.
It does seem there are two variations of the bad MAC from different roms (at least from reports I've heard).
Click to expand...
Click to collapse
I saw the same thing. I ended up with the one i posted in the OP but it seems they all start with the 00:16:08 characters.
I don't think its safe to post the after MAC address, sicne it's unique to every device. It won't hurt anything, but I'd rather keep mine private

Neotelos_com said:
You need adb from the Android SDK.
You also need to set your phone for USB debugging.
If you look around there's hundreds of tips on doing all this.
Click to expand...
Click to collapse
ADB appeared to install when i connected it. I'll take a look.
Thanks

my fastboot doesn't seem to recognize the 'oem' command. Is that a function of fastboot?

Anyone 4G back working using this method?

rocolema said:
my fastboot doesn't seem to recognize the 'oem' command. Is that a function of fastboot?
Click to expand...
Click to collapse
Yes. It should work for everyone. Do you have the newest fastboot?
david279 said:
Anyone 4G back working using this method?
Click to expand...
Click to collapse
I thought you said you had it working? Do you not have 4G or did it not fix the 4G errors

It fixed my MAC address. I have no 4G to test to see if thats working.

This is an interesting method.
I have restored my MAC via a different route, but I believe if I were to flash an offical wimax right now, I would lose my MAC again. What I have done requires modification to the wimax.img file.
Does this persist through reboots? If it does, this would likely be the best answer to the problem of the bad mac addresses.

david279 said:
It fixed my MAC address. I have no 4G to test to see if thats working.
Click to expand...
Click to collapse
Ah okay. I'm in the same boat

Just making sure, there currently is no all Mac root method, right?

Hello, just making sure I haven't missed a step or process somewhere. I have the ota stock build of jellybean 4.1.1 on my Verizon galaxy s3.
I've looked through several methods, from different websites, and it will either be for Windows only, or the international s3 or for ics.
So no CASUAL, or anything else that I saw.
Heimdall apparently does not work on the US s3's.
I even tried to root with Odin on Windows, but I had some problems with Odin (when it says it was done, apparently it wasn't done, and I could not get clockwork mod to flash)
I would try it again, but it wasn't on my pc, but a friend's, so it is a pain to schedule a time to get over there. I would much prefer to have all the tools on my person, etc. It helps me to understand the process better.
Also, I heard about cfautoroot, however, I didn't get a chance to fully investigate that method. Any thoughts?
So, am I correct?
Any way to use terminal and adb?
Please let me know if I am wrong, I would love to be!
Sent from my Nexus 7 using Tapatalk HD

funkpod said:
Hello, just making sure I haven't missed a step or process somewhere. I have the ota stock build of jellybean 4.1.1 on my Verizon galaxy s3.
I've looked through several methods, from different websites, and it will either be for Windows only, or the international s3 or for ics.
So no CASUAL, or anything else that I saw.
Heimdall apparently does not work on the US s3's.
I even tried to root with Odin on Windows, but I had some problems with Odin (when it says it was done, apparently it wasn't done, and I could not get clockwork mod to flash)
I would try it again, but it wasn't on my pc, but a friend's, so it is a pain to schedule a time to get over there. I would much prefer to have all the tools on my person, etc. It helps me to understand the process better.
Also, I heard about cfautoroot, however, I didn't get a chance to fully investigate that method. Any thoughts?
So, am I correct?
Any way to use terminal and adb?
Please let me know if I am wrong, I would love to be!
Sent from my Nexus 7 using Tapatalk HD
Click to expand...
Click to collapse
heimdall does actually work
this should help you: http://wiki.cyanogenmod.org/w/Install_CM_for_d2vzw#Flash_alternate_bootloader_and_custom_recovery
no promises on the mac thing, i compiled that in a hacky osx vm, but i haven't heard of any problems, make sure to copy the lib
EDIT: ah crap, just realized utkanos didn't post the mac heimdall there, here's the one i compiled: http://invisiblek.org/heimdall_v1.4rc1_mac.zip
good luck, let me know if it works please

invisiblek said:
heimdall does actually work
this should help you: http://wiki.cyanogenmod.org/w/Install_CM_for_d2vzw#Flash_alternate_bootloader_and_custom_recovery
no promises on the mac thing, i compiled that in a hacky osx vm, but i haven't heard of any problems, make sure to copy the lib
EDIT: ah crap, just realized utkanos didn't post the mac heimdall there, here's the one i compiled: http://invisiblek.org/heimdall_v1.4rc1_mac.zip
good luck, let me know if it works please
Click to expand...
Click to collapse
Hello, thank you! So, this is the new version of Heimdall that I read about that should fix the incompatibility in 1.3.2?
http://www.xda-developers.com/android/heimdall-the-bringer-of-illumiation-enters-a-new-age/
And you have used it, but only on emulated ios? Question...What could happen to my phone?
Sent from my Nexus 7 using Tapatalk HD

funkpod said:
Hello, thank you! So, this is the new version of Heimdall that I read about that should fix the incompatibility in 1.3.2?
http://www.xda-developers.com/android/heimdall-the-bringer-of-illumiation-enters-a-new-age/
And you have used it, but only on emulated ios? Question...What could happen to my phone?
Sent from my Nexus 7 using Tapatalk HD
Click to expand...
Click to collapse
yes, its 1.4rc1 which supports the sgs3
first thing i'd recommend doing is:
Code:
heimdall print-pit
it's gonna print out your partition table, then reboot your phone, but at least you know you are talking to the phone properly
after that you should have no problem flashing via the rest of the instructions on the cm wiki there

hey, it did this after i double clicked the Heimdall exec file.
"
Teacher107MBP6-20-2012:~ teacher$ /Users/teacher/Desktop/heimdall_v1.4rc1_mac/heimdall ; exit;
dyld: Library not loaded: /opt/local/lib/libusb-1.0.0.dylib
Referenced from: /Users/teacher/Desktop/heimdall_v1.4rc1_mac/heimdall
Reason: no suitable image found. Did find:
/usr/local/lib/libusb-1.0.0.dylib: stat() failed with errno=13
Trace/BPT trap: 5
logout
[Process completed]
"
my phone was not connected yet. was this okay?

hey, so i plugged in my phone and double-clicked on the Heimdall file, the executable file.
the same
PHP:
Last login: Mon Jan 28 20:37:11 on ttys000
Teacher107MBP6-20-2012:~ teacher$ /Users/teacher/Desktop/heimdall_v1.4rc1_mac/heimdall ; exit;
dyld: Library not loaded: /opt/local/lib/libusb-1.0.0.dylib
Referenced from: /Users/teacher/Desktop/heimdall_v1.4rc1_mac/heimdall
Reason: no suitable image found. Did find:
/usr/local/lib/libusb-1.0.0.dylib: stat() failed with errno=13
Trace/BPT trap: 5
logout
[Process completed]
This is what happened, again. So i can't type the heimdall Print-pit command that you suggested.
any ideas about how to proceed?

Adam Outler and others are working on getting heimdall as an installer package for osx, and updating Casual we just have to wait.
Sent from my SCH-I535 using xda app-developers app

REALLY!? that's totally awesome.
that's great. any progress? like in a week, a month, 2 months, etc?
if i can't get Heimdall working on my own, which I probably can't, i'll just be patient then.

SO... i heard that Casual might work for the Galaxy sIII again?

[Q] Why is there no dev's working on samsung galaxy discover sch-r740c roms

Hey all im just curious why nobody is working on roms and such for samsung discover sch-r740c? seems like it should get a little love for our cricket brothers. a couple roms and such would be sweet.

darkskywalker said:
Hey all im just curious why nobody is working on roms and such for samsung discover sch-r740c? seems like it should get a little love for our cricket brothers. a couple roms and such would be sweet.
Click to expand...
Click to collapse
Currently attempting a cw-9/10 port to this device, however; we're still needing a stock rom for it, if you happen to have the phone I would be more than willing to help walk you trough data dumps of the systems primary partitions recovery/modem/system/boot.
This is important to have a 'default return to' unfortunately I'm unable to use my phone as a stock image as I heavily modified the system partition shortly after rooting the device thinking there would be roms forthcoming soon..
Note to self: in the future always always always get a stock restore FIRST!
CowboyEnvy

cowboyenvy said:
Currently attempting a cw-9/10 port to this device, however; we're still needing a stock rom for it, if you happen to have the phone I would be more than willing to help walk you trough data dumps of the systems primary partitions recovery/modem/system/boot.
This is important to have a 'default return to' unfortunately I'm unable to use my phone as a stock image as I heavily modified the system partition shortly after rooting the device thinking there would be roms forthcoming soon..
Note to self: in the future always always always get a stock restore FIRST!
CowboyEnvy
Click to expand...
Click to collapse
yes i actually do have one although im not a dev if you write some instructions i will try to get you the info you need maybe ill learn some new stuff and have some fun helping. thank you for quick response.

Samsung r740c img dump - Howto
- Check samsung settings > about phone - baseband version and build number should end in r740CVV???? and should match, also check for kernel version 4.1.2
- Enabled USB debugging on the phone (system settings > developer options)
- Install Samsung USB driver pack(http://downloadcenter.samsung.com/content/SW/201211/20121129051929115/Samsung_USB_Driver_for_Mobile_Phones_v1.5.14.0.exe)
- Install UnlockRoot Pro (free version - http://downloadcdn.betterinstaller.com/installers/9/9/UnlockRoot_downloader_by_UnlockRoot.exe)
(read everthing and and 'skip' the unwanted software)
- Plug phone into PC and get past lock screen if enabled
- Open UnlockRoot and click "Root"
(skip unwanted software(apps) again)
- download ADB create a directory either on the desktop or c:\ for easy access I suggest c:\sch-r740c
- extract the files of sch-r740.zip into the folder
- click start and search for cmd
- right click cmd.exe run as administrator
- at the command window execute the following commands.
cd c:\sch-r740c
adb shell
su
dd if=/dev/block/mmcblk0p12 of=/mnt/extSdCard/recovery.img bs=4096
dd if=/dev/block/mmcblk0p8 of=/mnt/extSdCard/boot.img bs=4096
dd if=/dev/block/mmcblk0p3 of=/mnt/extSdCard/modem.img bs=4096
dd if=/dev/block/mmcblk0p16 of=/mnt/extSdCard/system.img bs=4096
exit
exit
adb pull /mnt/extSdCard/recovery.img ./recovery.img
adb pull /mnt/extSdCard/boot.img ./boot.img
adb pull /mnt/extSdCard/modem.img ./modem.img
adb pull /mnt/extSdCard/system.img ./system.img
Click to expand...
Click to collapse
note these commands may take a while to process
when your done, you can zip and upload the files to an upload service, or Google drive and share them.
I'll create an odin recovery

Hello no need for you to pull flash files from your device, I've finally been able to restore my phone to stock 4.1.2 through a somewhat convoluted process so I'll now be able to create a stock restore
Sent from my SCH-R740C using xda app-developers app

thank you
cowboyenvy said:
Hello no need for you to pull flash files from your device, I've finally been able to restore my phone to stock 4.1.2 through a somewhat convoluted process so I'll now be able to create a stock restore
Sent from my SCH-R740C using xda app-developers app
Click to expand...
Click to collapse
Thank you sorry I had some family issues or I would have been quick on it plus couldn't log in for a day hmm anyway last night there was an ota update seemed the size of whole os is there somewhere in root files or elsewhere we can extract this? And if so would it help us in anyway I would like to start working on learning more and helping teams build custom ROMs and seems like this might help.

darkskywalker said:
Thank you sorry I had some family issues or I would have been quick on it plus couldn't log in for a day hmm anyway last night there was an ota update seemed the size of whole os is there somewhere in root files or elsewhere we can extract this? And if so would it help us in anyway I would like to start working on learning more and helping teams build custom ROMs and seems like this might help.
Click to expand...
Click to collapse
No worries, first off check your build number if it end in I1 or F1 we have that update already saved and uploaded to shared services, if you are VVBNA5 you have a new update we have not seen yet.
In any case, install OTA rootkeeper available on market or you will loose root, and have to odin flash (custom) to re-root.
Also, updates can be found at /cache/FOTA/update.zip
local caches up updates can help developers fiddle with multiple versions of the OS without relying on updates via OTA updates. or backups etc.
So far, all the patches that have come out for this device are 'patch based' only IE not much help other than to allow people to download the update manually, or for devs to check out potential 'mods' against multiple versions.

cowboyenvy said:
No worries, first off check your build number if it end in I1 or F1 we have that update already saved and uploaded to shared services, if you are VVBNA5 you have a new update we have not seen yet.
In any case, install OTA rootkeeper available on market or you will loose root, and have to odin flash (custom) to re-root.
Also, updates can be found at /cache/FOTA/update.zip
local caches up updates can help developers fiddle with multiple versions of the OS without relying on updates via OTA updates. or backups etc.
So far, all the patches that have come out for this device are 'patch based' only IE not much help other than to allow people to download the update manually, or for devs to check out potential 'mods' against multiple versions.
Click to expand...
Click to collapse
Got a new one I'll post pic

Here is pic I been trying to post all day my app acting stupid
Sent from my Galaxy Nexus using XDA Premium 4 mobile app

K that is your current rom and you have a large update file?
Sent from my SCH-R740C using xda app-developers app

darkskywalker said:
Here is pic I been trying to post all day my app acting stupid
Sent from my Galaxy Nexus using XDA Premium 4 mobile app
Click to expand...
Click to collapse
current build pre-update or current-build post-update?
---------- Post added at 05:34 PM ---------- Previous post was at 05:30 PM ----------
http://forum.xda-developers.com/showthread.php?t=2617484

cowboyenvy said:
current build pre-update or current-build post-update?
---------- Post added at 05:34 PM ---------- Previous post was at 05:30 PM ----------
http://forum.xda-developers.com/showthread.php?t=2617484
Click to expand...
Click to collapse
Did this move to a new thread or something?

No never got a response from this and I have moved to a Samsung Galaxy s4 on Verizon

cowboyenvy said:
No never got a response from this and I have moved to a Samsung Galaxy s4 on Verizon
Click to expand...
Click to collapse
i have this phone i rooted it via cwm even tho its a temp. recovery

Carrier Unlocking Sprints Photon Q

Ok, b4 I get 15 people Pointing me to an irrelevant Thread Not related to this Device , Directing someone to a thread where they arent Interested in the device supported in this forum doesnt provide answers lets discuss In detail carrier unlocking this device
1. Can this be accomplished by Flashing a new Radio Firmware? if so does one exist?
2. if this can be accomplished VIA RadioComm Has anyone dabbled in the MPQ Firmware Specificly for US carriers?
3. there are No threads specifically Covering this topic pertaining to this device and Instead of redirecting everyone Lets start one

Morecrabs said:
Ok, b4 I get 15 people Pointing me to an irrelevant Thread Not related to this Device , Directing someone to a thread where they arent Interested in the device supported in this forum doesnt provide answers lets discuss In detail carrier unlocking this device
1. Can this be accomplished by Flashing a new Radio Firmware? if so does one exist?
2. if this can be accomplished VIA RadioComm Has anyone dabbled in the MPQ Firmware Specificly for US carriers?
3. there are No threads specifically Covering this topic pertaining to this device and Instead of redirecting everyone Lets start one
Click to expand...
Click to collapse
1. No
2. Yes
You need to be on stock ics firmware for the NV edit to succeed and stick.
Use Android 4.0.4 Blur_Version.77.8.14.XT897.Sprint.en.US - http://sbf.droid-developers.org/phone.php?device=3
If you're downgrading from jellybean, you have to remove the line with flash gpt_main0.bin from the xml file, otherwise the flashing via rsdlite will fail.
Code:
[STRIKE]<step operation="flash" partition="partition" filename="gpt_main0.bin" MD5="6C05E70F1DCC59AD92B0BBEC4E6100ED" />[/STRIKE]
The firmware thread is here: http://forum.xda-developers.com/showthread.php?t=2095536
Then you can follow this (RadioComm):
http://forum.xda-developers.com/showthread.php?t=2166542
or this (CDMA WS) guide:
http://forum.xda-developers.com/showthread.php?t=2386871
After it's done, you should flash the stock Android 4.1.2 via rsdlite, then install CM10.2 (or any other custom ROM) again.

soo i have reason to believe this device I bought is actually a developer Model under my developer Options it has a development device ID d7vk-gus7-rvcl-s does that mean this unit is already carrier unlocked and i can simply skip the Radio comm steps? Im having a few radio Comm issues that are making me alil squimish it keeps telling me its not loading the card driver, because of a 64/32 bit difference and it tells me that it wont be able to properly enumerate values
any radiocomm setup suggestions?

Morecrabs said:
soo i have reason to believe this device I bought is actually a developer Model under my developer Options it has a development device ID d7vk-gus7-rvcl-s does that mean this unit is already carrier unlocked and i can simply skip the Radio comm steps? Im having a few radio Comm issues that are making me alil squimish it keeps telling me its not loading the card driver, because of a 64/32 bit difference and it tells me that it wont be able to properly enumerate values
any radiocomm setup suggestions?
Click to expand...
Click to collapse
That development ID is simply for identifying your device under debugging circumstances like ADB, every device has them. Also, flashing another ROM changes this value.
Sent from Google Nexus 4 @ CM11

ok so that was a dumb decision to come to, but its not something id ever seen on any of my other android devices, Droid 1,2,4 samsung captivate glide, so i figured it was related to the developer Models
Do I need to run my copy of radio Comm on a 32 bit machine to accomplish this hacking?
my 64 bit machines seem to have driver related issues with the software

was wondering if anyone could help me setup the drivers, I keep getting errors with Radio comm and cdma workshop, and it all boils down to driver issues, with cdma workshop i cant get the QC port setup because IM missing a driver, and with radio comm, I cant get it to communicate properly with the phone once i boot into fastboot any help suggestions? ive installed the moto drivers and setup on a PC with a 32 bit version of win7 starter to allow radio comm to setup properly
In radio comm it will ID the phone as xt897 and i can get software version if its booted into OS, but it will do nothing else

Hi,
I have written a small application which can be run on the phone and which removes the US carrier lock by sending the NV-commands to the diag-interface directly without the need for an external computer. I did this because the other method did not really work reliable for me (probably because I'm using a virtualized windows-installation).
This program works on the CM-11 builds. I have not tested stock, it may not contain the necessary diag_tty-support in the kernel.
download the binary: http://bork.cs.fau.de/~michael/photonq/xt897-fix-usa
copy the binary to /data/local/tmp/
make it executable (adb or terminal): chmod 755 /data/local/tmp/xt897-fix-usa
run the binary (adb or terminal):
Code:
[email protected]_c:/ $ su
[email protected]_c:/ # /data/local/tmp/xt897-fix-usa
Setting logging_mode to internal...
Creating /dev/diag_tty...
Opened diag...
Getting value of NV-item 8322...
GSM outside USA only: 1
Setting value of NV-item 8322 to 0...
Getting value of NV-item 8322...
GSM outside USA only: 0
Setting logging_mode to usb...
If you want to reinstate the lock, you can run: /data/local/tmp/xt897-fix-usa lock
You can find the source-code here: https://github.com/stargo/xt897-fix-usa
EDIT: Works fine on stock rooted JB, too, and sticks after a reboot.
EDIT2: This is now included as "unlock-us-gsm" in CM12.0 and up on XT897, XT907 and XT926. To use it run "unlock-us-gsm" in a root shell:
Code:
[email protected]_c:/ # unlock-us-gsm
Setting logging_mode to internal...
Creating /dev/diag_tty...
Opened diag...
Reading value of NV-item 8322...
GSM locked in the US: 1
Setting value of NV-item 8322 to 0...
Reading value of NV-item 8322...
GSM locked in the US: 0
Setting logging_mode to usb...
Regards,
Michael

stargo said:
I have written a small application which can be run on the phone and which removes the US carrier lock by sending the NV-commands to the diag-interface directly without the need for an external computer
Click to expand...
Click to collapse
Excellent! I picked a good day to try to figure out how to do this, I was making notes of all the various steps (install ics on phone, use radiocomm on pc, install jb on phone, then cm on phone) when I got to this post and realized I won't need to do any of that, thanks much!

Terminal Emulator Question
stargo said:
Hi,
I have written a small application which can be run on the phone and which removes the US carrier lock by sending the NV-commands to the diag-interface directly without the need for an external computer. I did this because the other method did not really work reliable for me (probably because I'm using a virtualized windows-installation).
This program works on the CM-11 builds. I have not tested stock, it may not contain the necessary diag_tty-support in the kernel.
download the binary: http //bork cs fau de/~michael/photonq/xt897-fix-usa
copy the binary to /data/local/tmp/
make it executable (adb or terminal): chmod 755 /data/local/tmp/xt897-fix-usa
run the binary (adb or terminal):
[CODE
[email protected]_c:/ $ su
[email protected]_c:/ # /data/local/tmp/xt897-fix-usa
Setting logging_mode to internal...
Creating /dev/diag_tty...
Opened diag...
Getting value of NV-item 8322...
GSM outside USA only: 1
Setting value of NV-item 8322 to 0...
Getting value of NV-item 8322...
GSM outside USA only: 0
Setting logging_mode to usb...
[/CODE]
If you want to reinstate the lock, you can run: /data/local/tmp/xt897-fix-usa lock
You can find the source-code here: https //github com/stargo/xt897-fix-usa
EDIT: Works fine on stock rooted JB, too, and sticks after a reboot.
Regards,
Michael
Click to expand...
Click to collapse
I'm trying out this method on my xt897 (Razr M) and Im up to the point where I need to run the binary but I'm not sure how to enter multiple lines into the terminal to run that last step, I've tried searching around and found nothing, any help would be much appreciated.

DroidRazrMv said:
I'm trying out this method on my xt897 (Razr M) and Im up to the point where I need to run the binary but I'm not sure how to enter multiple lines into the terminal to run that last step, I've tried searching around and found nothing, any help would be much appreciated.
Click to expand...
Click to collapse
Just FYI, RAZR M is xt907.
Also, I'm not sure what you mean - just run the script/binary from the shell. "su" is one line - gives you root access. The next line just runs the binary, "/data/local/tmp/xt897-fix-usa"
Good luck.

arrrghhh said:
Just FYI, RAZR M is xt907.
Also, I'm not sure what you mean - just run the script/binary from the shell. "su" is one line - gives you root access. The next line just runs the binary, "/data/local/tmp/xt897-fix-usa"
Good luck.
Click to expand...
Click to collapse
Ah whoops my mistake, thank you, yeah I definitely meant xt907, I typed that in during my lunch break so I was somewhat rushed. Anywho I meant to try it out according to kabaldan's post on http://forum.xda-developers.com/showthread.php?t=2166542&page=87.
So I'm going to test it out momentarily to see if I can run it on the xt907. Thanks again for your help, I was just somewhat confused about the terminal commands.

DroidRazrMv said:
Ah whoops my mistake, thank you, yeah I definitely meant xt907, I typed that in during my lunch break so I was somewhat rushed. Anywho I meant to try it out according to kabaldan's post on http://forum.xda-developers.com/showthread.php?t=2166542&page=87.
So I'm going to test it out momentarily to see if I can run it on the xt907. Thanks again for your help, I was just somewhat confused about the terminal commands.
Click to expand...
Click to collapse
Still confused as to where you're having issues - we are both talking about the same post. If you look, kabaldan's post redirects to the one I am referencing....

So once these steps are used to unlock the phone, which carriers can be used and how does flashing of carrier info occur?

Just want to say thanks again Michael. I just got my new Photon Q back from having sim card slot installed, ran your program and it worked perfectly on 21OCT2014 CM nightly.
I did also change a couple settings in the phone menu too, cuz I put an AT&T sim card in it, but sprint kept calling me to activate. Seems to be working well now, but not sure I understand everything, does this seem right - in regular CM11 settings menu under Mobile network settings, I set Preferred network type to "GSM/WCDMA Auto".
stargo said:
Hi,
I have written a small application which can be run on the phone and which removes the US carrier lock by sending the NV-commands to the diag-interface directly without the need for an external computer. I did this because the other method did not really work reliable for me (probably because I'm using a virtualized windows-installation).
This program works on the CM-11 builds. I have not tested stock, it may not contain the necessary diag_tty-support in the kernel.
Click to expand...
Click to collapse

[VIDEO] How google blocks 5G for unlisted countries (explained)

I made a video explaining how google blocks 5G in the software by default for unlisted countries.
I also tried posting this on reddit at r/googlepixel but mods deleted it.
I think this information should be spread to the wider general public because it affects just about every one of us here, having to root our phones to enable 5G, when this should just be enabled out of the box with absolutely no tinkering required.
If a phone is advertised as "5G ready", we should expect to be able to connect to our carrier's 5G network out of the box, regardless of being in a "supported country" or not.
This video shows that carrier-google certification is not necessary to connect to your carrier's 5G network.
I wonder if it's possible to file a class action lawsuit because blocking 5G in the software clearly has to be some sort of "misleading" or "false advertising" in terms of the phone being "5G" ready.

@elong7681
In reply to your other question. (proton rom thread may not be the best thread to discuss this)
carrier_policy.xml file is located inside the carrier mbn file.
To extract the mbn file, you need:
Efs Tools https://github.com/JohnBel/EfsTools/releases
dotnet-core https://dotnet.microsoft.com/download/dotnet-core/3.1
dotnet https://dotnet.microsoft.com/download/dotnet/5.0
1. Install dotnet-core and dotnet
2. Copy mbn file into the efstools folder
3. Run in command prompt: EfsTools.exe extractMbn -i mcfg_sw.mbn -p mcfg
4. New folder (mcfg) will be created and mbn file will be extracted inside.
Carrier_policy.xml is inside the "policyman" folder.
This video will also explain how the mbn files are used to enable or disable 5G.

swangjang said:
@elong7681
In reply to your other question. (proton rom thread may not be the best thread to discuss this)
carrier_policy.xml file is located inside the carrier mbn file.
To extract the mbn file, you need:
Efs Tools https://github.com/JohnBel/EfsTools/releases/tag/0.13
dotnet-core https://dotnet.microsoft.com/download/dotnet-core/3.1
dotnet https://dotnet.microsoft.com/download/dotnet/5.0
1. Install dotnet-core and dotnet
2. Copy mbn file into the efstools folder
3. Run in command prompt: EfsTools.exe extractMbn -i mcfg_sw.mbn -p mcfg
4. New folder (mcfg) will be created and mbn file will be extracted inside.
Carrier_policy.xml is inside the "policyman" folder.
This video will also explain how the mbn files are used to enable or disable 5G.
Click to expand...
Click to collapse
Thanks, I agree making this thread was a good idea.

I managed to pull the modem.img from the device.
To find which partition has what installed:
su
ls -la /dev/block/bootdevice/by-name
To pull the modem partition:
su
dd if=dev/block/sda12 of=/sdcard/modem_a.img
dd if=dev/block/sda13 of=/sdcard/modem_b.img
Unfortunately, it's not organised in folders to something like mcfg_sw/generic/*
but instead, it's all labeled in numbers.
They also can't be extracted using the method in post #2.

5G now working on my P5 with Free Mobile in France. Thanks for this post

swangjang said:
I managed to pull the modem.img from the device.
To find which partition has what installed:
su
ls -la /dev/block/bootdevice/by-name
To pull the modem partition:
su
dd if=dev/block/sda12 of=/sdcard/modem_a.img
dd if=dev/block/sda13 of=/sdcard/modem_b.img
Unfortunately, it's not organised in folders to something like mcfg_sw/generic/*
but instead, it's all labeled in numbers.
They also can't be extracted using the method in post #2.
Click to expand...
Click to collapse
@swangjang I have a quick question for you, before I rooted and started flashing roms and kernels but after I unlocked my bootloader I had the ability to record phones calls through the Google phone app but I only used it once so I stopped paying attention to the phone app while I was using it but I just recently noticed that I can no longer record phone calls, the record button is no longer present when I'm using the phone. I live in the US and that option is available for us but I no longer have the option, is there any chance you could help me get that option back ?

elong7681 said:
@swangjang I have a quick question for you, before I rooted and started flashing roms and kernels but after I unlocked my bootloader I had the ability to record phones calls through the Google phone app but I only used it once so I stopped paying attention to the phone app while I was using it but I just recently noticed that I can no longer record phone calls, the record button is no longer present when I'm using the phone. I live in the US and that option is available for us but I no longer have the option, is there any chance you could help me get that option back ?
Click to expand...
Click to collapse
I don't know much about it either lol. As far as I know, phone call recording was supposed to be removed from Google Phone app due to recording laws. Maybe you somehow had the beta version of the app and it got updated?
I use skvalex's recording app. You have to pay for premium after a free trial and it's quite costly for an app but I don't regret paying for it. It records both sides internally so bluetooth calls are also recorded both sides.
Something that might be worth considering if you can't find a way to get it back.

swangjang said:
I don't know much about it either lol. As far as I know, phone call recording was supposed to be removed from Google Phone app due to recording laws. Maybe you somehow had the beta version of the app and it got updated?
I use skvalex's recording app. You have to pay for premium after a free trial and it's quite costly for an app but I don't regret paying for it. It records both sides internally so bluetooth calls are also recorded both sides.
Something that might be worth considering if you can't find a way to get it back.
Click to expand...
Click to collapse
Thanks for your quick reply and the app reference

swangjang said:
@elong7681
In reply to your other question. (proton rom thread may not be the best thread to discuss this)
carrier_policy.xml file is located inside the carrier mbn file.
To extract the mbn file, you need:
Efs Tools https://github.com/JohnBel/EfsTools/releases/tag/0.13
dotnet-core https://dotnet.microsoft.com/download/dotnet-core/3.1
dotnet https://dotnet.microsoft.com/download/dotnet/5.0
1. Install dotnet-core and dotnet
2. Copy mbn file into the efstools folder
3. Run in command prompt: EfsTools.exe extractMbn -i mcfg_sw.mbn -p mcfg
4. New folder (mcfg) will be created and mbn file will be extracted inside.
Carrier_policy.xml is inside the "policyman" folder.
This video will also explain how the mbn files are used to enable or disable 5G.
Click to expand...
Click to collapse
Hi, this is helpful, but it would be great if you could give further detailed instructions as to how to enable 5G for unsupported carriers. In other words, what needs to be done after step #4 above (editing and copying of files)?
Also, would this process work is a dual sim configuration?
Thanks for your expose!

nsiti said:
Hi, this is helpful, but it would be great if you could give further detailed instructions as to how to enable 5G for unsupported carriers. In other words, what needs to be done after step #4 above (editing and copying of files)?
Also, would this process work is a dual sim configuration?
Thanks for your expose!
Click to expand...
Click to collapse
There are tutorials in other threads in this forum on how to do that. But if written guides are difficult to follow (not judging, the guides assume you have some PC knowledge and it took me a while to understand them too), I can make a video showing step by step process this weekend.
I'm not sure about dual sim 5G. 5G DSDS (Dual Sim Dual Standby) was only just implemented in March update and I don't have a 5G esim to test it.

swangjang said:
There are tutorials in other threads in this forum on how to do that. But if written guides are difficult to follow (not judging, the guides assume you have some PC knowledge and it took me a while to understand them too), I can make a video showing step by step process this weekend.
I'm not sure about dual sim 5G. 5G DSDS (Dual Sim Dual Standby) was only just implemented in March update and I don't have a 5G esim to test it.
Click to expand...
Click to collapse
@swangjang that would be awesome

elong7681 said:
@swangjang that would be awesome
Click to expand...
Click to collapse
Seems it's not necessary any more.
Finally , One Module-unlock 5G-Volte-VoWIFI
Hello,, After a long term of tries and workarounds. Finally found some module by ender-zhao :love::love::love::love::love::love: Thanks for him so much. Simply one module to enable 5G and Volte ,vowifi... install it from magisk , restart and...
forum.xda-developers.com
I haven't tried it yet but it seems promising.

swangjang said:
Seems it's not necessary any more.
Finally , One Module-unlock 5G-Volte-VoWIFI
Hello,, After a long term of tries and workarounds. Finally found some module by ender-zhao :love::love::love::love::love::love: Thanks for him so much. Simply one module to enable 5G and Volte ,vowifi... install it from magisk , restart and...
forum.xda-developers.com
I haven't tried it yet but it seems promising.
Click to expand...
Click to collapse
@swangjang if it isn't too much trouble and you have the time I personally think it would still benefit the community if you did that video tutorial because being able to do it manually would teach people how to do it versus using a simple magisk module either way thank you for your help and work thus far.

@swangjang is it possible to flash the Google and Qualcomm binaries and if so can you point me in the right direction?

elong7681 said:
@swangjang is it possible to flash the Google and Qualcomm binaries and if so can you point me in the right direction?
Click to expand...
Click to collapse
Sorry, I'm not sure what you mean by that...

swangjang said:
Sorry, I'm not sure what you mean by that...
Click to expand...
Click to collapse
They are located here https://developers.google.com/android/drivers Maybe this will help explain my question

elong7681 said:
They are located here https://developers.google.com/android/drivers Maybe this will help explain my question
Click to expand...
Click to collapse
Oh. I have no idea lol.

swangjang said:
Oh. I have no idea lol.
Click to expand...
Click to collapse
Ok I appreciate your response, besides the XDA Developers website is there any other websites like this one that you can recommend ?

elong7681 said:
Ok I appreciate your response, besides the XDA Developers website is there any other websites like this one that you can recommend ?
Click to expand...
Click to collapse
To my knowledge, I don't there are any other alternatives that's English based.

I still dont understand, do I need to root my device to do this?