Database Info

How To: Enable LTE without ROOT/FLASH (model: SM-N900W8)

It's been awhile since I was on the forum but thought I would create a quick post for those who wish to enable LTE on the Samsung Galaxy Note 3 (model: SM-N900W8) where LTE has been crippled. I have compiled the following steps and this should get you up and running without having to ROOT your device, install RECOVERY software or FLASH a new modem.
1) Obtain the device IMEI by pressing *#06# on your dial pad and record this number to reference later.
2) Type in *#272*[IMEI Number]# Where [IMEI Number] is the number you recorded in the step above.
3) You will be prompted with a 3 letter "Regional Settings" menu. Cross reference the 3 letter code with the carrier list at the following link: http://www.samsungis.com/Firmwares/SM-N900W8.html. You do so by hovering over the 3 letter code under the "Region" column. If the SIM you wish to use is from one of these carriers and the carrier supports LTE, we're on our way! The above steps are confirmation, do not modify anything yet!
4) Unlock your device using a preferred unlocking method. Myself, I use http://www.cellunlocker.net which charges $32.99 US for a Samsung Galaxy Note 3 unlock code. It's a reliable site with quick turn-around.
5) Once you receive your unlock code, put in the SIM from the carrier you wish to use and enter the unlock code when prompted.
6) Once unlocked, it may reboot and when at the main menu, follow step 2 and 3 above but this time, select your 3 letter carrier code for the carrier SIM you just inserted then click on OK or INSTALL.
The device will go through a boot up sequence but once complete, you will have LTE enabled. If you do not see this, go into your network settings and you should have the option to select GSM/WCDMA/LTE (auto connect).
Hope this helps those of you wishing to enable the crippled LTE band but do not wish to delve into all the technical jargon related to ROOTING, RECOVERY and FLASHING.

Thanks for this.

Thanks
Thank you for sharing this wonderful trick. I was looking for something like this for a long time.

Please be noted that the secret code *#272*[IMEI Number]# does not exist in many recent models.
You can use Phone INFO ★Samsung★ app > Menu > 'Secret Codes' to check if this code does exist.

THIS WILL ERASE YOUR PHONE...
But it works...

[How To] Write a PRL to V20

WARNING I AM NOT RESPONSIBLE FOR WHAT YOU DO TO YOUR DEVICE
MESSING WITH NV ITEMS CAN CAUSE SERIOUS DAMAGE TO YOUR HANDSET
USING THIS TOOL/INFO TO BREAK THE LAW IS NOT CONDONED
USING THIS TO VIOLATE YOUR CARRIERS TERMS IS NOT CONDONED
I WILL NOT HELP WITH WRITING ANYTHING TO YOUR DEVICE OTHER THEN A PRL
I DO NOT PROVIDE ANY LINKS TO THE PRL OR TOOLS USED. USE GOOGLE SEARCH BOLD ITEMS + XDA BELOW!
1. LG Drivers installed, Diag drivers specifically
2. MSL for your phone
3. QPST installed ( 2.7 or newer preferred )
4. SPRINT/VZW PRL file of your choice ( Sprint is on 54xxx) Universal sprint VZW is 00001 00002 etc, be careful as those can piss off your carrier!
Step 1 - Install your LG drivers and acquire your MSL from sprint.
Step 2 - Google and install QPST.
Step 3 - Find what PRL you want to use and put it in a folder on your computer.
Step 4 - Turn off USB debugging on your phone...go to settings > applications > development > uncheck USB debugging
Step 5 - Open the dialer on your phone and enter ##3424# Turn Diag ON
Step 6 - Connect your phone to the computer and select Charging only if prompted.
Step 7 - Open QPST Configuration wherever you installed it.
Step 8 - Click on "Add new port"
Step 9 - UN-Check "Select Serial and USB/Diagnostic Ports Only"
Step 10 - Select your phone on the list and hit OK.
Step 11 - Select your phone on the list.
Step 12 - Click on the "Start Clients" tab at the top and select "Service Programming"
Step 13 - Select your phone on the list and hit OK
Step 14 - Click on "Read from Phone' in the bottom left
Step 15 - Enter your MSL when prompted and hit OK
Step 16 - Click on the "Roam" tab then click "Browse" and navigate to your PRL file. After selecting your PRL click "Write to Phone".
Step 17 - Your phone will reboot at this point and you will see a couple popups on your computer that you can just hit OK to close. Let your phone reboot and don't close QPST until it is finished writing to your phone.
Step 18 - The PRL should be written to your phone now. You can verify it by going to settings > General > About Phone > Status
Once back on sprint prl, you should be able to UPDATE prl and get it to update to the one for your act/area!
Pleas feel free to post results or if you had to do something different!

This is also another option, but i haven't found a way to get it to locate a prl and write it.
maybe some oter people can figure out how to get this to work from the handset?
Ive tried running in production mode, in dev mode, made changes from user to debug and dev in the build.prop
but its still a blank screen when you try it.
using quick setting app you can search ( SPRO ) and click the 1st entry. This isn't for new users so stay outta this stuff lol!
the full entry is com.lge.lgdmsclient.ui.test.SPROmadmHiddenMenuForSprint
in a nutshell it would be exploiting a prl write test to get it to actually write a dif. prl

Verified that Cmda Workshop Trail will write the prl also, it wasn't mentioned in op due to it is NOT FREE, and will require a purchase after 30 days.

You sir are a boss

verizon users are stuck as usual

[GUIDE] UNLOCK BOOTLOADER IN EU VARIANT

DESCRIPTION
Realme Like Few Other Companies Have Dishonest Rules For Unlocking The Bootloader In Different Regions(EU). Unlocking Bootloader On The EU Variants Is Not Allowed By Realme. But I Have Found A Way To Remove The Restriction And Pave The Way For Further Development.
This Will Not Unlock Your Bootloader But It Will Convert Your Device To Global Variant (EX) There By Allowing You To Apply For Bootloader Unlock. Tested On Realme 5 (EU) Variant
NOTES
I'm Not Responsible For Anything Whatsoever. If This Guide Leads You To A Bricked Device I'll Simply Laugh At You.
STEPS (FOLLOW VERY CAREFULLY)
1. Download the Oppo_Free_Unlock_v1.0.zip file from this link
2. Enable Developer Options, USB Debugging & Make Sure Device Is Detected
3. Now Connect Your Device To The Computer Using A Micro USB Cable
3. Open Control Panel - Device Manager and expand the Network Adapters category.
4. Disable all your ethernet adapters except the wifi adapter .
5. Click on the action tab, then choose add legacy hardware
7. Choose install the hardware that I manually select from a list (Advanced) and click next.
8. Click network adapters, then click next.
9. Select Microsoft and choose Microsoft KM-TEST Loopback Adapter, then click next.
10. Click next, then click finish.
11. In the device manager,browse the Network adapters and double click on Microsoft KM-TEST Loopback Adapter to open its properties.
12. Go to the Advanced tab and find the Network Address option
13. Click the blank chackbox and paste 704D7B61ABCD in the text box .
14. Close the properties window and close Device Manager.
15. Go to where you extracted the unlock tools. Open Sec5.exe.
16. Make sure your device is in MTP mode, and then press the Unlock button.
17. After about a second, a string of numbers and letters should show up in the left pane. A few seconds later, "OK" should start flashing in the right pane. Press "Stop unlocking" and close the window.
18. Open the phone app on your device and dial *#3954391#. Then dial *#391#. A screen should come up with a whole bunch of regions listed. Take a look which region is marked in green, this is your current region .Write it so that you can go back if you want .
19. Now you can choose any region you want, I tested two, "IN INDIA" AND "MULTILINGUAL VERSION EX"
20. Your phone should now reboot. Once it's rebooted, your region will have changed .
Every time you changed region and want to change it again you need to use the software.
CREDITS
@or965 (For The Orginal Trick)
@Hanif380 (For Testing)

Followed this guide and finally managed to get the android 10 update. For some reason my region was stuck on Android 9.
Thanks.

mizdrake7 said:
DESCRIPTION
Realme Like Few Other Companies Have Dishonest Rules For Unlocking The Bootloader In Different Regions(EU). Unlocking Bootloader On The EU Variants Is Not Allowed By Realme. But I Have Found A Way To Remove The Restriction And Pave The Way For Further Development.
This Will Not Unlock Your Bootloader But It Will Convert Your Device To Global Variant (EX) There By Allowing You To Apply For Bootloader Unlock. Tested On Realme 5 (EU) Variant
NOTES
I'm Not Responsible For Anything Whatsoever. If This Guide Leads You To A Bricked Device I'll Simply Laugh At You.
STEPS (FOLLOW VERY CAREFULLY)
1. Download the Oppo_Free_Unlock_v1.0.zip file from this link
2. Enable Developer Options, USB Debugging & Make Sure Device Is Detected
3. Now Connect Your Device To The Computer Using A Micro USB Cable
3. Open Control Panel - Device Manager and expand the Network Adapters category.
4. Disable all your ethernet adapters except the wifi adapter .
5. Click on the action tab, then choose add legacy hardware
7. Choose install the hardware that I manually select from a list (Advanced) and click next.
8. Click network adapters, then click next.
9. Select Microsoft and choose Microsoft KM-TEST Loopback Adapter, then click next.
10. Click next, then click finish.
11. In the device manager,browse the Network adapters and double click on Microsoft KM-TEST Loopback Adapter to open its properties.
12. Go to the Advanced tab and find the Network Address option
13. Click the blank chackbox and paste 704D7B61ABCD in the text box .
14. Close the properties window and close Device Manager.
15. Go to where you extracted the unlock tools. Open Sec5.exe.
16. Make sure your device is in MTP mode, and then press the Unlock button.
17. After about a second, a string of numbers and letters should show up in the left pane. A few seconds later, "OK" should start flashing in the right pane. Press "Stop unlocking" and close the window.
18. Open the phone app on your device and dial *#3954391#. Then dial *#391#. A screen should come up with a whole bunch of regions listed. Take a look which region is marked in green, this is your current region .Write it so that you can go back if you want .
19. Now you can choose any region you want, I tested two, "IN INDIA" AND "MULTILINGUAL VERSION EX"
20. Your phone should now reboot. Once it's rebooted, your region will have changed .
Every time you changed region and want to change it again you need to use the software.
CREDITS
@or965 (For The Orginal Trick)
@Hanif380 (For Testing)
Click to expand...
Click to collapse
I follow every step but i don t receive ok from Sec5

How To Guide How to enable VOLTE and VoWifi on Realme GT Neo 2 (and probably other Realme devices) when the toggles are not available in SIM info & settings

This post records how I combine many tutorials online and finally enable VOLTE and VoWifi on my Realme GT Neo 2 while the toggles are not available at the beginning.
TLDR: Most Realme devices support VOLTE and VoWifi, but the toggles may not be available in countries where Realme is not sold officially. However, they could be enabled by editing the build.prop file. Root and Magisk are necessary. Using Magisk, services like Google Pay can still work properly (price is potentially less security).
As we all know, most Realme devices support VOLTE and VoWifi, and usually you can find and activate them easily in Settings->Mobile network->SIM-> SIM info & settings. There are many tutorials on the website. However, in countries where Realme is not sold officially, you may not find these 2 toggles. I'm not sure about the exact reason but some are saying that local operators have strict whitelist policy (like ATT and TMobile), and of course a device sold only overseas won't be on it.
My situation​I bought a Chinese version Realme GT Neo 2 and the bands are compatible with Tmobile 4G (link). After getting the phone, I refer to this post to flash the global version firmware. My operator is Mint, a mvno of Tmobile and I cannot find VOLTE or VoWifi toggles. After reading this post and using an app called ForceLTE, I'm able to use 4G data. But whenever I make a phone call, the signal jumps back to 3G and data becomes H+(HSDPA). Recently Mint sent me a message, saying that they are retiring 3G soon and my device is not compatible. After a certain date, my phone will not be able to make/receive phone calls if still relying on 3G.
IMEM check fails on Tmobile, Mint, and ATT websites.
On Xiaomi devices there's a code used to activate VOLTE directly, on Oneplus devices you can use log app, but no similar way can be found for Realme devices.
This method I find could be applied to other Realme devices in other countries when the toggles are not available in SIM info & settings.
Disclaimer​Please try the posts I mentioned first.
This method requires root. Take your own risk for any of your behaviors.
I'm not responsible for any of your losses (including, but not limited to device, finance, data, personal info)
Device info​Realme GT Neo 2 chinese version
Global version firmware (RMX3370_11_C.02) via TWRP
Bootloader locked after flashing the firmware
Steps​1. Unlock the bootloader (refer to this post). Attention: unlock will get all data wiped!
2. Install TWRP (refer to this post) and Magisk (refer to this post).
Attention: even after you flash TWRP.img to the recovery partition, if you keep using stock firmware (no matter what region/version), recovery will go back to stock one after the first time you boot to the system. You'll have to install Magisk (or use 3rd party firmware) to keep TWRP
3. Install MagiskHide props config (refer to this post) to allow us to edit the build.prop file. It is in system partition (ext4, read-only), and can no longer be edited directly (even if you try to remount it in TWRP or ZArchiver with -rw).
4. Install a terminal emulator from google playstore. Android is a linux system, imagine this app as a window you can open on your PC with linux to input commands.
5. In the emulator,
5.1 type "su" and enter
5.2 type "props" and enter
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
5.3 type "5" and enter (Add/edit custom props)
5.4 type "n" and enter (New custom prop)
5.5 type "persist.dbg.ims_volte_enable" and enter (the prop we want to add)
5.6 type "1" and enter (enter your desired option)
5.7 type "y" and enter (Enter y(es), n(o), e(xit) or an option from above)
5.8 type "n" and enter (do you want to reboot now)
5.9 repeat step 5.3-5.8 for the following props:
persist.dbg.ims_volte_enable, type "1" in step 5.6
persist.dbg.volte_avail_ovr, type "1" in step 5.6
persist.dbg.vt_avail_ovr, type "1" in step 5.6
persist.dbg.wfc_avail_ovr, type "1" in step 5.6
persist.radio.rat_on, type "combine" in step 5.6
persist.radio.data_ltd_sys_ind, type "1" in step 5.6
persist.radio.data_con_rprt, type "1" in step 5.6
persist.radio.calls.on.ims, type "1" in step 5.6
In step 5.8 after you finish entering the last prop, type "y" and enter (reboot now)
6. After reboot, check whether 2 toggles are there in Settings->Mobile network->SIM-> SIM info & settings
7. If you still want to properly use apps like Google Pay after root, refer to this post
Test if VOLTE and 4G network work​1. In settings->Notifications & status bar->Status icons, make sure you turn on VoLTE, VoWiFi and Mobile network
2. If you are connected to a wifi and VoWifi works, you should see a small wifi sign above telephone sign in status bar, like this
In addition, for Tmobile, in Settings->Mobile network->SIM1, the Carrier is shown as T-Mobile Wi-Fi Calling (for mvno like mint, don't forget to turn it on on mint website->personal settings first).
3. Disconnect the wifi, you should see "4G" above the network sign, as well as VoLTE sign in the status bar. Turn on data, make a phone call (such as voicemail), minimize the window, check if "4G" sign is still there. Finally, with the call going on, try openning a website like Google. If "4G" sign is there during the whole process, congratulations!
Let me know if this works for you, or if you have any questions/suggestions. Thanks!

Worked for me thanks. Couldn't get volte registered on network. But I now have my toggles.

andrew202 said:
Worked for me thanks. Couldn't get volte registered on network. But I now have my toggles.
Click to expand...
Click to collapse
Hi, thanks for the reply and it's good to hear that. I just updated the steps to check VoWifi and VoLTE, do they work for you? If not, try this post (developer options + ForceLTE) and reboot.

darkhunter9 said:
Hi, thanks for the reply and it's good to hear that. I just updated the steps to check VoWifi and VoLTE, do they work for you? If not, try this post (developer options + ForceLTE) and reboot.
Click to expand...
Click to collapse
No my ims status is not registered. I spoke with my isp telus. Basically device not on list I won't get volte to work. So guessing the only option is some sort of spoofing.

andrew202 said:
No my ims status is not registered. I spoke with my isp telus. Basically device not on list I won't get volte to work. So guessing the only option is some sort of spoofing.
Click to expand...
Click to collapse
Please do not give up hope. Using MagiskHide props you can even change your device name (RMX3370). Probably one plus device would be a good choice to fake.

GOOD JOB! I have a rmx3366, Realme GT Explorer Master Edition with the original chinese version firmware(RMX3366_11_A.16), realme UI v2.0. Do you think I can follow your steps without flashing the global version firmware?
I will be ready to go with Tmobile 2g for voice/text otherwise.

piapiapia said:
GOOD JOB! I have a rmx3366, Realme GT Explorer Master Edition with the original chinese version firmware(RMX3366_11_A.16), realme UI v2.0. Do you think I can follow your steps without flashing the global version firmware?
I will be ready to go with Tmobile 2g for voice/text otherwise.
Click to expand...
Click to collapse
Yes I believe the method should work for most Realme devices, even with UI 2.0.
If you have your bootloader unlocked, feel free to give it a try without flashing global firmware. All properties you set in MagiskHide props config are reversible. Start from step 2.
If your bootloader is still locked, the unlocking process will wipe all data anyway (for personal info security). For a better chance, I suggest to flash the global firmware. I'm not sure whether Chinese version firmware has any restriction (software side) on specific 4G bands used by carrier in US/other countries.

darkhunter9 said:
Yes I believe the method should work for most Realme devices, even with UI 2.0.
If you have your bootloader unlocked, feel free to give it a try without flashing global firmware. All properties you set in MagiskHide props config are reversible. Start from step 2.
If your bootloader is still locked, the unlocking process will wipe all data anyway (for personal info security). For a better chance, I suggest to flash the global firmware. I'm not sure whether Chinese version firmware has any restriction (software side) on specific 4G bands used by carrier in US/other countries.
Click to expand...
Click to collapse
It is helpful! Thank you! My phone does not have a global version, but it works well with Tmobile so far except the volte part. I will try on the Chinese stock firmware.

piapiapia said:
It is helpful! Thank you! My phone does not have a global version, but it works well with Tmobile so far except the volte part. I will try on the Chinese stock firmware.
Click to expand...
Click to collapse
Did a little bit search and it seems what you said is a sad truth. Good luck bro!

help me i have followed you but its not successful

Phan Đức Nam said:
help me i have followed you but its not successful
Click to expand...
Click to collapse
Sorry can you please provide some more info or description?

darkhunter9 said:
Xin lỗi, bạn có thể vui lòng cung cấp thêm một số thông tin hoặc mô tả được không?
Click to expand...
Click to collapse
my neo2 bought in china, i have moved my rom to russia (a.02) and some other versions are not working

Phan Đức Nam said:
my neo2 bought in china, i have moved my rom to russia (a.02) and some other versions are not working
Click to expand...
Click to collapse
Did you do step 5? I didn't see "(active)" behind your "5 - Add/edit custom props". So basically, these props are not added to magisk successfully. In addition, in your screenshot I see 5G signal available. If that's the case there's really no need to worry about 4G VOLTE.

darkhunter9 said:
Did you do step 5? I didn't see "(active)" behind your "5 - Add/edit custom props". So basically, these props are not added to magisk successfully. In addition, in your screenshot I see 5G signal available. If that's the case there's really no need to worry about 4G VOLTE.
Click to expand...
Click to collapse
I did step 5 it didn't work so it failed, my 5G icon is Theme only

Phan Đức Nam said:
I did step 5 it didn't work so it failed, my 5G icon is Theme only
Click to expand...
Click to collapse
Maybe check firmware starting with C and RUI3 then. Sorry I cannot provide a solid solution.

darkhunter9 said:
Maybe check firmware starting with C and RUI3 then. Sorry I cannot provide a solid solution.
Click to expand...
Click to collapse
I am in RUI 3 C.06 RU region but still not working

Phan Đức Nam said:
I am in RUI 3 C.06 RU region but still not working
Click to expand...
Click to collapse
As I said, somehow these custom props are not added to your Magisk successfully, as 5 is not active in your screenshot.

I haven't done any of the steps, but the weird thing is, is VoLTE enabled by default?
I use Google Phone instead of built-in call app, and it shows HD next to the numbers. Does it mean VoLTE is enabled?
My model is RMX3370, Chinese version, running Realme UI 3.0, RMX3370_11_C.08

JohnVo said:
I haven't done any of the steps, but the weird thing is, is VoLTE enabled by default?
I use Google Phone instead of built-in call app, and it shows HD next to the numbers. Does it mean VoLTE is enabled?
My model is RMX3370, Chinese version, running Realme UI 3.0, RMX3370_11_C.08
View attachment 5666647
Click to expand...
Click to collapse
Not necessarily. The best way to check is if you are on a call check if you can still access the internet using mobile data. Without VoLTE, the modem shifts to 3G/2G, and you can't use mobile data simultaneously.

Hey XDA,
I felt obliged to contribute since the following steps worked for me and I got VoLTE and WiFi Calling switches in settings in my Realme GT Neo 2 global version RMX3370 that is on Freedom Mobile in Canada.
All factory, no root required, no bootloader unlock required.
May work on other Realme models.
Source: https://realme-gadgetlife.net/how-to-enable-volte/ (in Japanese, I used Google Translate). I can't remember where I found this link, all credits go to where they are due.
Steps, check pictures in the above link:
1. Enable Developers Options and USB Debugging (search online if needed)
2. Connect your phone to a Windows laptop
3. On the phone choose connection type Transfer files / Android Auto
(first time you will be prompted on your phone if you want to allow USB connection from this PC, choose Yes)
4. On the laptop install platform tools, open a command prompt and change directory to where they are installed
5. Enter command "adb devices"
6. The output should say:
List of devices attached
<your realme serial number> device
7. Enter command: "adb reboot fastboot"
8. The phone will enter the fastboot mode and display language selector. No need to do anything on the phone.
9. Enter command: "fastboot reboot recovery"
10. Nothing changes on the phone, no need to touch it this time either
11. Enter command: "adb devices"
12. The output will be:
List of devices attached
<your realme serial number> recovery
Here I installed realme Software&Driver Update tool from
Software Update - realme (India)
Update the latest software version on your realme phone.
www.realme.com
This may help if you're having issues at this step.
13. Enter the commands listed below ONE BY ONE. For some reason they didn't work when I entered them all together.
adb shell setprop persist.data.iwlan.enable true
adb shell setprop persist.dbg.ims_volte_enable 1
adb shell setprop persist.dbg.volte_avail_ovr 1
adb shell setprop persist.dbg.vt_avail_ovr 1
adb shell setprop persist.dbg.wfc_avail_ovr 1
adb shell setprop persist.radio.rat_on combine
adb shell setprop persist.radio.data_ltd_sys_ind 1
adb shell setprop persist.radio.data_con_rprt 1
adb shell setprop persist.radio.calls.on.ims 1
adb shell setprop persist.data.iwlan 1
adb shell setprop persist.data.iwlan.ipsec.ap 1
adb shell setprop persist.radio.volte.dan_support true
adb shell setprop persist.radio.VT_ENABLE 1
adb shell setprop persist.sys.cust.lte_config true
adb shell setprop persist.rcs.supported 1
adb reboot
14. The phone reboots and the VoLTE and WiFi Calling switches are there in Settings - Mobile Networks - <SIM> !
Note that I am not saying that your phone will display VoLTE or VoWiFi in the notification area but at least the switches (options) become available in settings
Thanks to the authors of the page above!

How To Guide How to Enable All Bands Through Service Menu on US/CA S22 series (including Sub-6 and mmWave)

What is this?
This is a guide on how to enable all LTE and 5G bands on the US or Canadian S22 series phones by going through the service menu. This guide is mostly based on this S20U guide by mellojosh, but has been adapted for the S22U phone with more information added.
Which bands can be enabled this way?
All bands the phone supports in hardware can be enabled through the service menu. For the S22 Ultra, that includes all Sub-6 bands like n78, and mmWave bands, as well as 5G SA bands, as shown in this screenshot below.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Which phones does this method support?
This method has been confirmed to work on:
Samsung S22 Ultra (S908U, S908U1, S908W).
Galaxy Z Fold 4. Thanks @Abaddon.
This method works on both Android 12 (One UI 4.1) or Android 13 (One UI 5.0 beta).
This method requires your device be on the US firmware (XAA or other US CSC), so as long as you can Odin flash XAA firmware on your device (such as Canadian variant), you should be able to do this.
If you get this method working on your phone that isn't in the known list, post it here and I will add it to the list above.
How To Guide
You will need a Windows computer (or VM) and the Samsung USB Driver installed to do the following steps. Install the USB driver from here before proceeding if you do not have it installed.
A. Flash US Firmware
First, your device must be on US firmware (XAA or other CSC). You can skip this step and go to B if your device is already on US firmware.
If you're not on a US firmware because you have another Snapdragon variant (like Canadian), follow the steps below to flash XAA firmware. Note this will WIPE and FACTORY RESET your device. ALL DATA WILL BE LOST. So backup if you need to.
Download Odin 3.14.4 or latest version.
Download US XAA U1 firmware for your device from SamMobile.com or SamFw.com. For example, for the S22 Ultra, download the XAA firmware for S908U1. Extract the contents of the firmware to somewhere on your computer. You should have 5 files (BL, AP, CP, CSC, HOME_CSC). We won't use HOME_CSC.
Restart your phone and go into download mode. On the S22 Ultra, hold all three power and up + down volume at the same time until the phone starts, then press the up volume key to get into download mode.
Open Odin and connect your phone to your computer with a USB. Odin should say your phone was added.
Click each of the BL, AP, CP, CSC buttons and select the corresponding files from the firmware zip you extracted. For CSC, use the file that starts with CSC and not HOME_CSC (we won't be using HOME_CSC). Do not load anything into USERDATA.
Click start and let it flash the firmware (see the picture below). If it flashed correctly, your phone will be on XAA firmware after it restarts and you will have to set it up again from scratch.
Set up your phone and verify it is on XAA firmware by going to Settings -> About Phone -> Software information -> check that it says XAA/XAA,XAA/OOO under "Software provider software version". OOO here will be your phone's original CSC like XAC which you cannot change and do not need to.
B. Unlock Service Menu Secret Codes
The next step is we need to unlock access to the service menu. Usually this is locked by default, but it might already be unlocked for you.
First check if you can access the service menu by trying each of these ways:
Open dialer and enter *#27663368378# to try to get directly into the service mode main menu. The menu should open after you press the last # character, you shouldn't have to press call.
Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
If either of the above ways works for you to get to the service mode main menu, then you can skip the below steps to unlock the menu and go directly to instructions C.
If you cannot access the menu with the above codes, then follow these instructions to unlock the secret codes.
Enable USB Debugging in Developer menu.
Download SamFW FRP tool 3.1 or latest version from here.
Open SamFW FRP tool and connect your phone to the computer with a USB.
Using SamFW FRP tool, go to MTP tab and click on "Enable Secret Code for Verizon". See the picture below. Note it works on any US CSC even though it says "for Verizon".
If in the program output you see it's getting stuck on "Waiting for DIAG", then dial *#0808# on your phone to open USB settings and select "DM + MODEM + ADB" then press OK. The program should then complete the step and then get stuck on "Disabling DIAG". When it does, using the *#0808# menu again, select "MTP + ADB" this time and press OK. Now the program should complete the step and say that secret codes was unlocked.
Now you should be able to use *#73# for RF test, *#27663368378#* to go directly to service menu. Test it to make sure the codes work and the service menu is opening.
C. METHOD 1: Use the Service Menu to Unlock All Bands
Enter the service menu using either way.
Open dialer and enter *#27663368378# to get directly into the service mode main menu.
Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
Use the service mode to set the following options. Note you can go back between screens with three dots -> back for quicker navigation, but I am just starting each option below from the main menu so it's easy to read.
Enable all LTE and 5G bands.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> SYSTEM -> Next page 4 times -> SET LTE BAND CONFIG -> SET DEFAULT LTE BAND.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NR5G PRUNE STATUS -> REMOVE NR5G PRUNE.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> GCF -> REMOVE ONLY NR WHITELIST.
Optional if you need to enable mmWave bands: Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Sub6/mmWave -> ALL ENABLE.
Optional if you have issues going from LTE to LTE+ (carrier aggregation not working properly): Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> DISABLE CA COMBO CHECK -> DISABLE ON.
Enable 5G NR features (DSS & CDRX) if needed. These options might already be enabled for you by default.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> NR CDRX CONTROL -> NR CDRX ENABLE. NR CDRX is 5G power saving mode.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page 2 times -> NR DSS CONTROL -> NR DSS ENABLE. NR DSS is 5G Dynamic Spectrum Sharing.
Enable 5G SA if you're lucky enough to have a carrier with standalone 5G networks. This option might be enabled by default already.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NR5G SA/NSA Mode Control -> SA/NSA ENABLE.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NR5G SA/NSA Mode Control -> Remove SA permit list.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Next Page -> NR5G NRDC -> NRDC ENABLE. NRDC is for dual connectivity with Sub6 + mmWave bands in parallel. Only applies to 5G SA networks and only if your carrier uses it.
Restart your phone, then dial *#73# to get into RF Test Mode. Click Band Selection -> Sim 1 or Sim 2 (whichever you use). On this screen if you scroll down, you'll see a list of enabled NR5G bands. Make sure all bands are enabled. See my picture below.
NOTE: Band selection won't be reset with a reboot, but might be reset after a CSC update (or a software update that includes a CSC update). You will have to re-do the service menu settings every update or re-flash of a CSC.
NOTE: If you use an eSIM or a dual-SIM phone with a 2nd SIM, you need to change the NR5G stack before changing the NR5G related options above. Change the NR5G stack to Stack 2 with the following setting first.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NR5G STACK SELECTION -> Select STACK 2.
OPTIONAL: Now that all bands are enabled and usable, you can use the Band Selection menu under *#73# to selectively disable certain bands if you need to. This is not covered here but that menu is self-explanatory.
If this method isn't working, try METHOD 2 below. You do not need to try METHOD 2 if this method ended up working for you.
D. METHOD 2: Unlock all bands via Protocol Simulation menu.
If METHOD 1 above didn't work or not all bands were unlocked, you can try to unlock all bands by simulating a change in your CSC to GCF (Global Certification Forum). This won't actually change your CSC to GCF, but will change the options in the service menu as if you were on GCF CSC, which should give you access to all SA and NSA bands. Credits to @wr3cckl3ss1 for figuring out this method.
To do this method, first enter the service mode main menu using either of the following ways.
Open dialer and enter *#27663368378# to get directly into the service mode main menu.
Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
Using the service menu, change the following options
Go to: Service Mode Main Menu -> PROTOCOL STATE -> PROTOCOL SIMULATION -> IMEI PRE CFG SIMULATION.
In this menu, click [1] AP, then click GCF (last option). Then click [2] NET1 and change it to GCF as well. Do the same for [3] NET2. All GCF.
Press [4] Write. Then restart phone.
Check if all SA bands were unlocked. If not, repeat the band unlocking instructions from METHOD 1 above and then restart the phone and check again.
Enjoy your unlocked LTE and 5G bands!
FYI, I have personally tested this on a Canadian S908W on XAA firmware to enable 5G in Canada. In fact, I was even able to update to One UI 5.0 using the adb sideload method since I was on XAA firmware, and then I repeated the steps above to enable all 5G bands on the beta (service menu was still unlocked). So now I have 5G on One UI 5.0 beta in Canada! The trifecta!
CREDITS
@mellojosh for his guide on service menu band options on the S20U1.
@wr3cckl3ss1 for his guide on selecting bands from the dialer for the S22 series phones, and for instructions on protocol simulation.
@bigdave79 for reminding me about needing the Samsung USB Driver for this to work.

Excellent job sir.

i'm on android 13 beta2 on unlocked s22 ultra.
after i click on "DM + MODEM + ADB" then ok,
it' still stuck at Waiting for DIAG....

Great effort man, Thank you.
but this will not work on variants like S908N Korea or the S9080 China correct ?

netnerd said:
i'm on android 13 beta2 on unlocked s22 ultra.
after i click on "DM + MODEM + ADB" then ok,
it' still stuck at Waiting for DIAG....
Click to expand...
Click to collapse
Which CSC are you using and which model (S908U1)?
When I tested this, I unlocked the secret codes first on Android 12, then upgraded to Android 13 and secret codes still worked. I'm not sure if you can unlock it directly on Android 13.
Are you willing to downgrade to Android 12 first to try?

Mem_0 said:
Great effort man, Thank you.
but this will not work on variants like S908N Korea or the S9080 China correct ?
Click to expand...
Click to collapse
Can you flash US firmware on the Korean and Chinese variants with Odin (normal or patched)? If you can get on US firmware, then it might work. I do not think it will work on other firmwares.

peacey8 said:
Can you flash US firmware on the Korean and Chinese variants with Odin (normal or patched)? If you can get on US firmware, then it might work. I do not think it will work on other firmwares.
Click to expand...
Click to collapse
I don't think that's possible as the pit files are different.

peacey8 said:
Can you flash US firmware on the Korean and Chinese variants with Odin (normal or patched)? If you can get on US firmware, then it might work. I do not think it will work on other firmwares.
Click to expand...
Click to collapse
till now there is no way to flash US on a Korean

Mem_0 said:
till now there is no way to flash US on a Korean
Click to expand...
Click to collapse
peacey8 said:
Can you flash US firmware on the Korean and Chinese variants with Odin (normal or patched)? If you can get on US firmware, then it might work. I do not think it will work on other firmwares.
Click to expand...
Click to collapse
The only Snapdragon variant that has the same pit file as S908U/S908U1....is the S908N. But to no avail. It fails.

wr3cckl3ss1 said:
The only Snapdragon variant that has the same pit file as S908U/S908U1....is the S908N. But to no avail. It fails.
Click to expand...
Click to collapse
why does it fail ? bec of different pit files ?

The pit files are what partition the device. And....
S908U/S908U1/S908N have B0Q_USA_SINGLEW
S908E - B0Q_GBL_OPEXX
S908W- B0Q_CAN_SINGLEX
And even if you were to get it to flash. That still won't unlock the bootloader. Just an FYI.

I have made a lot of research and failure tries trying to change the CSC of the S908N I have from KTC to KOO, but every time it fails using Samkey or even Samfw, after further looking they said that Samsung had blocked the Korean variants starting from S21 I guess.
wr3cckl3ss1 said:
The pit files are what partition the device. And....
S908U/S908U1/S908N have B0Q_USA_SINGLEW
S908E - B0Q_GBL_OPEXX
S908W- B0Q_CAN_SINGLEX
And even if you were to get it to flash. That still won't unlock the bootloader. Just an FYI.
Click to expand...
Click to collapse
I don't want to unlock the bootloader at the moment, I just want to change csc at first to KOO instead of KTC and after that maybe install international software.

peacey8 said:
Which CSC are you using and which model (S908U1)?
When I tested this, I unlocked the secret codes first on Android 12, then upgraded to Android 13 and secret codes still worked. I'm not sure if you can unlock it directly on Android 13.
Are you willing to downgrade to Android 12 first to try?
Click to expand...
Click to collapse
yes, I'm on s908U1 with FKR/FKR, TMB/XAA (Visible wireless on sim, tmobile on esim).
if i downgrade to Android 12, will it wipe my data? i really don't wanna wipe my phone

netnerd said:
yes, I'm on s908U1 with FKR/FKR, TMB/XAA (Visible wireless on sim, tmobile on esim).
if i downgrade to Android 12, will it wipe my data? i really don't wanna wipe my phone
Click to expand...
Click to collapse
Yes it might wipe your phone, I'm not sure. I wouldn't risk it without backing up first.
I haven't tested this on FKR. So if it doesn't work for you on Android 12, use SamFW FRP Tool to change your CSC to XAA when you're on Android 12. Then it should definitely work.

Thanks for this.
Question: if I'm on att or TMOB, does this unlock more useable bands for me?

netnerd said:
i'm on android 13 beta2 on unlocked s22 ultra.
after i click on "DM + MODEM + ADB" then ok,
it' still stuck at Waiting for DIAG....
Click to expand...
Click to collapse
I'm having the same issue and I'm on Android 12.
EDIT: I'm an idiot. I did not have the Samsung Android USB drivers installed. Tried it again and now it works!

ekerbuddyeker said:
Thanks for this.
Question: if I'm on att or TMOB, does this unlock more useable bands for me?
Click to expand...
Click to collapse
The phone already comes with all almost all the bands already. This guide just shows you how to enable them all.

Has anyone had any luck, I followed all the step to the T, but it still stuck on "waiting for DIA".

Running androind 12 / SM-S908U1
canada S22U

formula666 said:
Has anyone had any luck, I followed all the step to the T, but it still stuck on "waiting for DIA".
Click to expand...
Click to collapse
Install Samsung Android USB drivers from here.