Database Info

[CVE-2013-3741] LGInstallServices Silent Install + Privilege escalation XDA:DevCon

LGInstallServices.apk
Silent Install + Privilege escalation
CVE-2013-3741
LG Install Service has an unprotected bindable service that allows other appliations to install apps, uninstall apps, set app defualts, enable apps, disable apps, clear app dataand "install system package", which causes installed apps to behave as if they were installed on /system/app. Apps installed this way can use system only permissions.
LG provied a nice permission available to system apps
<!-- LGE_CHANGE_S, [IMS][[email protected]], 20121010, [LGE_IMS_FEATURE] for LGE IMS Client Solution -->
<permission name="android.permission.IMS" >
<group gid="system" />
<group gid="radio" />
<group gid="inet" />
<group gid="net_admin" />
<group gid="qcom_oncrpc" />
<group gid="audio" />
<group gid="camera" />
<group gid="media" />
</permission>
<!-- LGE_CHANGE_E, [IMS][[email protected]], 20121010 , [LGE_IMS_FEATURE] for LGE IMS Client Solution } -->
POC attached for LG Optimus G Running JellyBean. POC uses LG's IMS permission to gain system group and patched dalvik-cache of a system-uid app to execute code as system user. This POC uses a prepatched odex, due to time constraints of mine. Once it has patched the cache is uses "GiantPune"'s property_service symlink attack to write a patch to uevent_helper and gain root. Will upload source sometime after I get home. This is the first vuln I presented at XDA-DevCon today.

Thanks for posting this up! Can't wait to have some fun with it.

Is LGSlap.apk same as LGInstallServices.apk? No success with P769 V20h
[
jcase said:
LGInstallServices.apk
Click to expand...
Click to collapse
I tried LGSlap.apk (I do not see LGInstallServices.apk anywhere, is it the same thing?. On T-Mobile P769 V20h I did not get root (after multiple attempts). I have another post asking for a reference to other exploits you alluded to. Sorry for being repetitious, just not sure in which thread I should feedback on LGSlap.apk.
Here is the other post: http://forum.xda-developers.com/showthread.php?p=45778443&posted=1#post45778443

reikred said:
[
I tried LGSlap.apk (I do not see LGInstallServices.apk anywhere, is it the same thing?. On T-Mobile P769 V20h I did not get root (after multiple attempts). I have another post asking for a reference to other exploits you alluded to. Sorry for being repetitious, just not sure in which thread I should feedback on LGSlap.apk.
Here is the other post: http://forum.xda-developers.com/showthread.php?p=45778443&posted=1#post45778443
Click to expand...
Click to collapse
I have no idea what LGSlap is, not what that device is, The exploit is specific to the LG OG i was working on, however feel free to reverse engineer it, no obfuscation was applied. The vuln exists on many LG devices, but the patched optimized dex will need to be redone.

Stymied
jcase said:
I have no idea what LGSlap is, not what that device is, The exploit is specific to the LG OG i was working on, however feel free to reverse engineer it, no obfuscation was applied. The vuln exists on many LG devices, but the patched optimized dex will need to be redone.
Click to expand...
Click to collapse
Very sorry but I truly do not comprehend what you are saying here. I downloaded LGSlap.apk from your post 3 posts above what I am writing this moment. That post talked about LGInstallServices.apk, but the apk that was attached was named LGSlap.apk , and when loaded into the phone it showed up as LGPwn.pk (icon).
I understand that LGInstallServices.apk is for LG OG and not my P769, and that I should try to modify it to make it work. But as you see I'm not even sure I have the correct to apk to work on. I looked on your google+ and github as well.
Forgive me for being a java and Android noob. I have 25+ years of unix experience, but the mechanics of Java and Android Apps is still black magic to me. I'll try to improve.

reikred said:
Very sorry but I truly do not comprehend what you are saying here. I downloaded LGSlap.apk from your post 3 posts above what I am writing this moment. That post talked about LGInstallServices.apk, but the apk that was attached was named LGSlap.apk , and when loaded into the phone it showed up as LGPwn.pk (icon).
I understand that LGInstallServices.apk is for LG OG and not my P769, and that I should try to modify it to make it work. But as you see I'm not even sure I have the correct to apk to work on. I looked on your google+ and github as well.
Forgive me for being a java and Android noob. I have 25+ years of unix experience, but the mechanics of Java and Android Apps is still black magic to me. I'll try to improve.
Click to expand...
Click to collapse
The app shows up as "notmalware", LGPwn is another root for LG that I released, it exploits LGInstallServices that came pre installed on some LG phones

[HOW-TO] Remove the superuser indicator in CM13/CM14.x/LOS 15.x

Hello,
I noticed that many of you don't like the CyanogenMod superuser indicator ('#') in the status bar and that some of you even flash SuperSU or Xposed, just to get rid of it. Well, that's not necessary, because there is a much easier way. So here is the "right way" to remove the # in CM13/14.x/Lineage 15.x (probably not working in CM12.x):
Edit: @Dyt199412syam found an easier way to do this, please take a look: https://forum.xda-developers.com/showpost.php?p=73916650&postcount=35
==== Original post ====
1. Go to Settings > status bar > icons
2. Uncheck and re-check one of the items (to make sure the required settings entry is created)
3. Backup the file /data/system/users/0/settings_secure.xml
4. Open /data/system/users/0/settings_secure.xml with a text editor (as root)
5. Search for "icon_blacklist"
6. you will find something like this:
Code:
<settings id="269" name="icon_blacklist" value="" package="com.android.systemui" />
(ID may vary)
7. Add "su" between the quotation marks after value, so it looks like this:
Code:
<settings id="269" name="icon_blacklist" value="su" package="com.android.systemui" />
If value is not empty, just append ",su" (with a seperating comma):
Code:
<settings id="269" name="icon_blacklist" value="other,icons,su" package="com.android.systemui" />
8. Double check the XML syntax (a mistake here might cause a bootloop)
9. Save and reboot
For ROM builders:
If you want to implement an option to hide superuser icon in your ROM, please do not use a hacky, unclean way to do so. The right way is the following:
Open frameworks/base/packages/SystemUI/res/xml/tuner_prefs.xml.
- Search for
Code:
<com.android.systemui.tuner.StatusBarSwitch
android:key="alarm_clock"
android:title="@string/status_bar_alarm" />
and below insert
Code:
<com.android.systemui.tuner.StatusBarSwitch
android:key="su"
android:title="@string/status_bar_su" />
- Add
Code:
<string name="status_bar_su">Superuser</string>
to strings.xml
Or simply apply this patch to frameworks/base.

Working fine! Thanks!
Send with my Moto G4 Plus (XT1642) on CyanogenMod 14.1, Android 7.1, using Tapatalk!

Excellent... Works perfectly on Xeperience 7.1.1 for Moto G 2
Enviado desde mi Moto G 2014 mediante Tapatalk

Works on my LG D724 running CM14.1! Thanks for this!

It works great on CyanogenMod 14.1
Sent from my Moto G 2014 using XDA-Developers mobile app

Thanks!!! Working great on Lineage OS 14.1 using in my Xperia Z2!!!

This works fine on cyanogenmod 14 (lineageOs), droid turbo. Thanks!

Couldn't find "icon_blacklist" on the file, using official LOS 14.1for my device LG v500, can I manually add the line?
Any help?

aaswar said:
Couldn't find "icon_blacklist" on the file, using official LOS 14.1for my device LG v500, can I manually add the line?
Any help?
Click to expand...
Click to collapse
Have you tried to uncheck / check one of the items in Settings/Status Bar/Icons? icon_blacklist should be created after this.

MaxMustermann2.0 said:
Have you tried to uncheck / check one of the items in Settings/Status Bar/Icons? icon_blacklist should be created after this.
Click to expand...
Click to collapse
Thanks a lot, appreciated.

Works fine on Lineage, thanks??

Love you, works fine without having to install xposed mods.

Thank you very much

Which text editor do I use? Im use one without option to "Double check XML syntax" and cause a bootloop on my device

Onedmunds said:
Which text editor do I use? Im use one without option to "Double check XML syntax" and cause a bootloop on my device
Click to expand...
Click to collapse
Double check your XML syntax just means that you shall pay attention that the number of opening and closing brackets (<>) matches and that you don't forget a quotation mark or sth like that.

delete

Thanks to OP this worked on Lineage OS 14.1 on Mi 5

Hello everybody,
Probably, or also surely, caused by the Nova Launcher, always the root # symbol is displayed in the status bar.
This help here would work for me on the S5 and OP3. The Moto G4 does not work that way. After I changed the concerned and then restart the smartphone, suddenly all settings are set to the factory setting .... I copy the previously saved original file over it again, it remains nevertheless there by ... everything on factory setting...
Does anyone know another way that symbol is going to hide?
This Way here does not seem to work with the G4.
Or someone know, maybe what is the Problem?
Thanks in advance

Gustl6500 said:
Hello everybody,
Probably, or also surely, caused by the Nova Launcher, always the root # symbol is displayed in the status bar.
This help here would work for me on the S5 and OP3. The Moto G4 does not work that way. After I changed the concerned and then restart the smartphone, suddenly all settings are set to the factory setting .... I copy the previously saved original file over it again, it remains nevertheless there by ... everything on factory setting...
Does anyone know another way that symbol is going to hide?
This Way here does not seem to work with the G4.
Or someone know, maybe what is the Problem?
Thanks in advance
Click to expand...
Click to collapse
Works fine with Nova Launcher. It is probably the editor or explorer you are using. Are you sure that it has enough permissions to overwrite the file?
Try another editor or root explorer.

tested on seraph unofficial lineage OS on my OP2.
working like a charm, thanks a lot to @MaxMustermann2.0
used MiXplorer to find and edit settings_secure.xml file, and edited it via inbuilt text editor.

VoLTE & VoWifi Option in Z5

I have a Xperia Z5 UK model E6653. But it does not have Volte enabled? Any idea on how to enable it?
I have tried the following:
1. Tried installing EE firmware to check if VoLTE is getting enabled
2. Ran the code *#*#4636#*#* and check for VoLTE provisioning flag. The flag is present but I am unable to toggle it. It displays Turn Off VoLTE provisioning flag.
Any help would be appreciated. Please note that I am currently with Virgin 4G plan.

livelyyoungman said:
I have a Xperia Z5 UK model E6653. But it does not have Volte enabled? Any idea on how to enable it?
Click to expand...
Click to collapse
The patch has not been tested in the call to HD since my carrier does not support VoLTE.
The patch activates flags VoLTE.
And yet, you need to find the settings of the access point to the IMS operator, and enter them in the APN.
Install the patch via twrp recovery.
Firmware 32.3.A.0.376.

samavar89 said:
The patch has not been tested in the call to HD since my carrier does not support VoLTE.
The patch activates flags VoLTE.
And yet, you need to find the settings of the access point to the IMS operator, and enter them in the APN.
Install the patch via twrp recovery.
Firmware 32.3.A.0.376.
Click to expand...
Click to collapse
Works great on e6683. 376fw
No reebot on sim on/off
But receive weak network indoors
Voice calling not working on volte

rajdeep312 said:
Voice calling not working on volte
Click to expand...
Click to collapse
Thank you for the test, I will continue to test.

You can try to change the modem in accordance with its operator.
For this you need to modify the line ro.build.type=user to ro.build.type=userdebug in /system/build.prop and reboot the device.
Then you need to install QuickShortcutMaker and click on the Customization Selector and make a shortcut for the Modem Switcher.
After opening the Modem Switcher, select the modem in accordance with its operator.
And most importantly, you need the original keys TA (maybe). Them in - you can invest using the Trim Area Of Proof Of Concept. Continue to test.
Beta 2.3 will activate VoLTE and Wi-Fi Calling.

not working in my z5 dual
livelyyoungman said:
I have a Xperia Z5 UK model E6653. But it does not have Volte enabled? Any idea on how to enable it?
I have tried the following:
1. Tried installing EE firmware to check if VoLTE is getting enabled
2. Ran the code *#*#4636#*#* and check for VoLTE provisioning flag. The flag is present but I am unable to toggle it. It displays Turn Off VoLTE provisioning flag.
Any help would be appreciated. Please note that I am currently with Virgin 4G plan.
Click to expand...
Click to collapse
I flashed it, but volte option is not available in my z5.. M using jio sim
---------- Post added at 03:15 AM ---------- Previous post was at 03:12 AM ----------
livelyyoungman said:
I have a Xperia Z5 UK model E6653. But it does not have Volte enabled? Any idea on how to enable it?
I have tried the following:
1. Tried installing EE firmware to check if VoLTE is getting enabled
2. Ran the code *#*#4636#*#* and check for VoLTE provisioning flag. The flag is present but I am unable to toggle it. It displays Turn Off VoLTE provisioning flag.
Any help would be appreciated. Please note that I am currently with Virgin 4G plan.
Click to expand...
Click to collapse
I flashed it, but volte option is not available in my z5 dual 6683..m using jio sim card

samavar89 said:
You can try to change the modem in accordance with its operator.
For this you need to modify the line ro.build.type=user to ro.build.type=userdebug in /system/build.prop and reboot the device.
Then you need to install QuickShortcutMaker and click on the Customization Selector and make a shortcut for the Modem Switcher.
After opening the Modem Switcher, select the modem in accordance with its operator.
And most importantly, you need stock keys TA. Them in - you can invest using the Trim Area Of Proof Of Concept. Continue to test.
Click to expand...
Click to collapse
Volte on working on beta 2 version

rajdeep312 said:
Volte on working on beta 2 version
Click to expand...
Click to collapse
After some time, I'll test the patch on a suitable operator.

samavar89 said:
Thank you for the test, I'm glad the beta is working! After some time, I'll test the patch on a suitable operator.
Click to expand...
Click to collapse
Sorry but volte not working only calling possible on specific app

rajdeep312 said:
Sorry but volte not working only calling possible on specific app
Click to expand...
Click to collapse
The operator gave You the opportunity to make a VoLTE call?

samavar89 said:
The operator gave You the opportunity to make a VoLTE call?
Click to expand...
Click to collapse
Yes but in india fw volte calls works from stock dialer
But after flashed your patched volte showing in settings but unable to call from stock dialer

I downgraded to MM 6.0 from 7.0 because i dont like 7.0 using Flashtool. Now the problem is I dont find any VoLTE option under More Network Settings. So I couldnt call from my Jio. Please anybody help me.
Xperia Z5 Dual E6683

sulthanbatcha said:
I downgraded to MM 6.0 from 7.0 because i dont like 7.0 using Flashtool. Now the problem is I dont find any VoLTE option under More Network Settings. So I couldnt call from my Jio. Please anybody help me.
Click to expand...
Click to collapse
You can try to install the patch for the firmware 32.2.A.5.11, but I can't guarantee stable work.
You need to change the modem in accordance with its operator, and add the profile to the IMS APN.
Then you need to install QuickShortcutMaker and click on the Customization Selector and make a shortcut for the Modem Switcher. After opening the Modem Switcher, select the modem in accordance with its operator.

Who installed these patches, please write if it works with your carrier.

A few days ago, wanted to test the patch, but failed. Operator is not connected IMS me as the phone has not been tested on their support for VoLTE.
After installation, you need to choose a modem in accordance with its operator.
You need to install QuickShortcutMaker, then open it to make a shortcut using the app then go to Customisation Selector \ Modem Switcher. Open Modem Switcher and select modem according to your network operator. If the selection of the modem's cellular network is not, then restart the phone.
You also need to restore the access point default to the new profile activated! ( Settings>More>Mobile network>APN>Reset to default )
If VoLTE does not work and You know that your operator you hooked VoLTE, then you need to change the APN in the profile apns-conf.xml (patch_ims_for_xperia_z5_beta_Nougat_Roms.zip\oem\android-config\apns-conf.xml). You need to find the profile of the IMS of the operator and to add to the "type" parameter "xcap". You should get something like this:
Code:
<apn carrier="Test IMS"
mcc="001"
mnc="01"
apn="ims"
type="ims,xcap"
protocol="IPV4V6"
roaming_protocol="IPV4V6"
/>
And most importantly, you need the original keys TA.
IMS description
RCS description

If VoLTE doesn't work, you will have to edit the "nv item" or "amss_fsg_***.mbn" (\system\etc\customization\modem\).
Maintain feedback to know if the patch is working.

Updated patch VoLTE.
info
new patch

grayleshy said:
Updated patch VoLTE.
info
- fix apns-conf.xml
Click to expand...
Click to collapse
Hi @grayleshy,
I would like to ask this patch will work with all bands and all operators?
My operator Turkcell in Turkey, it supports VoLTE&VoWifi but not Z5.
Only:
- iPhone 6, 6 Plus, 6S, 6S Plus, 7, 7 Plus, SE
- Samsung S6, S6 Edge, S7, S7 Edge
- LG K10 (2017 model), G4, G5, V20
If not work, how can we add this for Turkey operators (Turkcell, Vodafone, Turk Telekom)?

sceryavuz said:
I would like to ask this patch will work with all bands and all operators?
Click to expand...
Click to collapse
This patch activates only support of VoLTE and Wi-Fi Calling.
sceryavuz said:
If not work, how can we add this for Turkey operators (Turkcell, Vodafone, Turk Telekom)?
Click to expand...
Click to collapse
For start on these operators it is necessary to make the following:
1. It is necessary to edit an APN profile (patch_ims_for_xperia_z5_beta_Nougat_Roms.zip\oem\ android-config\apns-conf.xml ; patch_ims_for_xperia_z5_beta_Nougat_Roms.zip\data\customization\ota-config\apns-conf.xml)
Find mcc="286" and change the profile Turkcell IMS at:
Code:
<apn carrier="Turkcell IMS"
mcc="286"
mnc="01"
apn="ims"
type="ims,xcap"
protocol="IPV4V6"
/>
Add:
Code:
<apn carrier="Vodafone IMS"
mcc="286"
mnc="02"
apn="ims"
type="ims,xcap"
protocol="IPV4V6"
/>
<apn carrier="AVEA IMS"
mcc="286"
mnc="03"
apn="ims"
type="ims,xcap"
protocol="IPV4V6"
/>
XCAP - The software of the smartphone sees access point of ims and requests a configuration according to the xcap protocol. In reply, from server side, xhml the response which loads in a software arrives and makes authorization on the ims domain with the subsequent activation of a functionality on the device.​After a flashing of the changed apn, it is necessary to make so: Settings>More>Mobile network>APN>Reset to default.
2. If the operator does not support protocol xcap, you will have to edit the "nv item" (easier) or configurators amss_fsg_***.mbn.

Hi @grayleshy
Thanks for your reply.
I tried XCAP for 2 zips, but not work. I tried to change amss_fsg_***.mbn, not for Turkcell. I don't know what "nv item" is. Found this thread, but don't know what should I do with this.

Magisk module need help testing for China and Korea users.

The firmware does not contain carrier files for China and Korea carriers.
I made a magisk module that installs these carrier files systemlessly.
I don't live in China or Korea so I have no way to test this.
If you're living in China or Korea, please help me test the module to see if it works.
Thanks.

Hi swangjang, thank you for sharing your module! I used QPST to replace the modified xml files to enable 5G, and now I installed your module. The 5G runs well, but I can't tell if it is enabled by your module.
For VoLTE, the switcher appeared in the option, but it dosen't work. When I made a phone call, the network drop to 3G. (My carrier is China unicom)

q.snake said:
Hi swangjang, thank you for sharing your module! I used QPST to replace the modified xml files to enable 5G, and now I installed your module. The 5G runs well, but I can't tell if it is enabled by your module.
For VoLTE, the switcher appeared in the option, but it dosen't work. When I made a phone call, the network drop to 3G. (My carrier is China unicom)
Click to expand...
Click to collapse
Thank you for testing.
I think due to dm-verity, the module files don't actually get placed in the system. I'll need to wait until we get TWRP to disable verity.
Can you try and change sim cards to force the phone to reload the mbn file?

swangjang said:
Thank you for testing.
I think due to dm-verity, the module files don't actually get placed in the system. I'll need to wait until we get TWRP to disable verity.
Can you try and change sim cards to force the phone to reload the mbn file?
Click to expand...
Click to collapse
I'll test it later.

q.snake said:
I'll test it later.
Click to expand...
Click to collapse
Tbh, I don't think it will work.
I plan to install a custom rom (custom roms don't have dm-verity) in the weekend and see if the module works on there. As long as dm-verity is enabled, I don't think any /system modifcation by magisk will work.

swangjang said:
The firmware does not contain carrier files for China and Korea carriers.
I made a magisk module that installs these carrier files systemlessly.
I don't live in China or Korea so I have no way to test this.
If you're living in China or Korea, please help me test the module to see if it works.
Thanks.
Click to expand...
Click to collapse
Hi, I live in south korea and I have UK version of Pixel 5(GTT9Q).
I'll try this module tonight and see if it works.
May I ask you where did you get mbn files for korean carrier? In my experience, KT and LGU need some efs modification especially for google pixel series, so directly injecting mbn from other device won't work well.

cdexswzaq said:
Hi, I live in south korea and I have UK version of Pixel 5(GTT9Q).
I'll try this module tonight and see if it works.
May I ask you where did you get mbn files for korean carrier? In my experience, KT and LGU need some efs modification especially for google pixel series, so directly injecting mbn from other device won't work well.
Click to expand...
Click to collapse
That attached module is very outdated. Please download from here:
GitHub - swangjang/Pixel-Redbull-Carrier-Patch: This is a Magisk module (in testing) for Pixel 4a (5G) and Pixel 5 that enables 5G for Unlisted Countries, VoLTE switches in the settings and add support for more countries/carriers.
This is a Magisk module (in testing) for Pixel 4a (5G) and Pixel 5 that enables 5G for Unlisted Countries, VoLTE switches in the settings and add support for more countries/carriers. - GitHub - swa...
github.com
I got the mbn files from Xiaomi Redmi K30. The K30 uses the same chipset as Pixel 5.

Just tested module in south korea, but it doesn't works.
It seems that magisk module is doing it's job. I run root explorer and confirmed that mbm_sw.txt and other additonal korea and china mbn successfully loaded.
But when I run efs explorer, Banner shows "SW_DEFAULT" instead of "LGU".
Maybe Pixel 5 can't load LGU mbn because of some other reason.

cdexswzaq said:
Just tested module in south korea, but it doesn't works.
It seems that magisk module is doing it's job. I run root explorer and confirmed that mbm_sw.txt and other additonal korea and china mbn successfully loaded.
But when I run efs explorer, Banner shows "SW_DEFAULT" instead of "LGU".
Maybe Pixel 5 can't load LGU mbn because of some other reason.
Click to expand...
Click to collapse
Thank you for testing. Did you install the A or B? could you try the other one as well to see if it works? Please make sure to uninstall first.
Also maybe take out sim card and insert again?

swangjang said:
Thank you for testing. Did you install the A or B? could you try the other one as well to see if it works? Please make sure to uninstall first.
Also maybe take out sim card and insert again?
Click to expand...
Click to collapse
I used A. and took out & changed sim card several times.
I'll check B tonight.

cdexswzaq said:
I used A. and took out & changed sim card several times.
I'll check B tonight.
Click to expand...
Click to collapse
I read on a Korean forum that you may need to visit your carrier customer centre to register your device
???ۺ????丮 [??????, ???÷???, ????? ?ؿ??? Ŀ?´?Ƽ] : ???̹? ī??
cafe.naver.com
Under section 3. part (4), "VoLTE calls can be made only by registering OMD (Open Model Device) as a VoLTE capable model name with each mobile operator".
Also, after installing the module, maybe reboot the device once?

swangjang said:
Thank you for testing.
I think due to dm-verity, the module files don't actually get placed in the system. I'll need to wait until we get TWRP to disable verity.
Can you try and change sim cards to force the phone to reload the mbn file?
Click to expand...
Click to collapse
Hi, I changed the SIM card of another carrier but the 5G is still enabled, even after I installed magisk completely and restore the original files with QPST, the 5G is still there...
I doubt that the new firewares (Feb and Mar updates) canceled the carrier limitation for 5G.

cdexswzaq said:
I used A. and took out & changed sim card several times.
I'll check B tonight.
Click to expand...
Click to collapse
Hi, I made more variations of the module using different mbn files for Korean carriers. Could you please them one at a time. It would be greatly appreciated.

I tried this with korean LGU, SKT simcard, but efs explorer shows SW_DEFAULT or Wildcard banner randomly.
I did sim tray out and in several times, and did WI-FI, Mobile Bluetooth reset on android settings-system menu.
And I also tried Taiwanese Chunghwa Telecom sim card which i got during taiwan travel, (Chunghwa Telecom is one of supported carrier for pixel 5) And It reports CHT banner correctly.
I don't know why, but it seems that pixel 5 refuses to load korean mbns for some reason.

cdexswzaq said:
I tried this with korean LGU, SKT simcard, but efs explorer shows SW_DEFAULT or Wildcard banner randomly.
I did sim tray out and in several times, and did WI-FI, Mobile Bluetooth reset on android settings-system menu.
And I also tried Taiwanese Chunghwa Telecom sim card which i got during taiwan travel, (Chunghwa Telecom is one of supported carrier for pixel 5) And It reports CHT banner correctly.
I don't know why, but it seems that pixel 5 refuses to load korean mbns for some reason.
Click to expand...
Click to collapse
Thank you.
So "pr-red", "nokia" and "mi9t" all not working for korean sim?

swangjang said:
Thank you.
So "pr-red", "nokia" and "mi9t" all not working for korean sim?
Click to expand...
Click to collapse
Yes, I tried all of 6 mbns, but no luck. All recognized as SW_DEFAULT or Wildcard banner.
I'm trying to figure out why only pixel rejects those mbns. Maybe there's some hidden policy to reject unsupported country's sim?

cdexswzaq said:
Yes, I tried all of 6 mbns, but no luck. All recognized as SW_DEFAULT or Wildcard banner.
I'm trying to figure out why only pixel rejects those mbns. Maybe there's some hidden policy to reject unsupported country's sim?
Click to expand...
Click to collapse
I don't think there would be something that will reject it. Other people reported they got VoLTE working for their 'unofficial' carrier.

[CLOSED][GUIDE] Enable VoLTE and VoWiFi on Pixel 5

Mod edit: Thread closed due to the below linked subject matter related thread! Oswald Boelcke, Senior Moderator
Hello everyone,
here's a magisk module which enables VoLTE & VoWiFi & 5G:
[MOD]MagiskModule - VoLTE & VoWifi & 5G in unsupported countries | Pixel 4a 5G & 5 & 5a
Introduction I would like to share a magisk module, which: - enables 5G, - enables VoLTE, - enables VoWiFi, - loads MBNs properly after loosing connection with network provider, - does not enforce 5G. Module is created by me, latest release...
forum.xda-developers.com
Old post(original)
Spoiler: OLD THREAD
I wanted to share my knowledge in single thread how to enable VoLTE and VoWiFi in unsupported countries
Requirements:
- Windows,
- ROOT via MAGISK,
- Around 30 minutes of free time.
Full guide is here.
GitHub - stanislawrogasik/Pixel5-VoLTE-VoWiFi
Contribute to stanislawrogasik/Pixel5-VoLTE-VoWiFi development by creating an account on GitHub.
github.com
YouTube video presenting how to do it:
I attach required files(as repo zip) with full README.

Vortuks said:
Hello everyone,
I wanted to share my knowledge in single thread how to enable VoLTE and VoWiFi in unsupported countries
Requirements:
- Windows,
- ROOT via MAGISK,
- Around 30 minutes of free time.
Full guide is here.
GitHub - stanislawrogasik/Pixel5-VoLTE-VoWiFi
Contribute to stanislawrogasik/Pixel5-VoLTE-VoWiFi development by creating an account on GitHub.
github.com
YouTube video presenting how to do it:
I attach required files(as repo zip) with full README.
Click to expand...
Click to collapse
First of all, thank you for the time and effort you put into creating this guide. It is really appreciated.
I have a few questions I need to ask, if I may:
1. What is the difference between your method and that other method on 4a 5G forum that says to just flash the magisk module? As I am currently running the second method I must say I do get 5g icon/speed and also volte/vowifi works ok where I live (Romania, Bucharest). However, I am aware I might be missing some features like 4G Carrier Aggregation (I think that is 4g+) and proper band allocation for 5G. Will your method unlock these too? Granted that I will need to use the correct mbn for my operator.
2. I read on your github description that the magisk module you mention changes some build.prop values. If I want to add/change more values besides the ones you mention, how can I achieve that? I have no technical knowledge on how to modify an existing magisk module..
3. If I am going to use your method, will it be required to repeat the qpst/efs steps each and every time I perform an OTA update?
4. Based of your method, how can I also unlock 5G access ? What additional files I need to edit in order to achieve this?
Hopefully you can provide some answers, for which I would be very grateful.

mightyvenom said:
First of all, thank you for the time and effort you put into creating this guide. It is really appreciated.
I have a few questions I need to ask, if I may:
1. What is the difference between your method and that other method on 4a 5G forum that says to just flash the magisk module? As I am currently running the second method I must say I do get 5g icon/speed and also volte/vowifi works ok where I live (Romania, Bucharest). However, I am aware I might be missing some features like 4G Carrier Aggregation (I think that is 4g+) and proper band allocation for 5G. Will your method unlock these too? Granted that I will need to use the correct mbn for my operator.
2. I read on your github description that the magisk module you mention changes some build.prop values. If I want to add/change more values besides the ones you mention, how can I achieve that? I have no technical knowledge on how to modify an existing magisk module..
3. If I am going to use your method, will it be required to repeat the qpst/efs steps each and every time I perform an OTA update?
4. Based of your method, how can I also unlock 5G access ? What additional files I need to edit in order to achieve this?
Hopefully you can provide some answers, for which I would be very grateful.
Click to expand...
Click to collapse
About the guide - no problem. I just want to share knowledge
1.) The difference is that I'm modyfing(in fact reseting) only the necesary props and adding selected MBN to the modem partition. Module mentioned "overwrites" the system MBN's, while I'm adding a new one directly to the modem. Also, this module modifies a lot of props and resets them to specified values - I'm doing only the necessary ones.
Currently my method doesn't unlock 5G - but also on the same page(4a 5G) they've used the same method.
I've just copied all the details into single guide, so everyone, who wants to have a working VoLTE and VoWiFi can use my guide without searching whole forum for posts etc.
I've tried to use this Magisk module, but it didn't work with my country(Poland) with my operator(Orange) - so I'm using this method. It should work on pretty much every Android version, while I can't guarantee that the mentioned module will.
2.) If you want to edit more props, you can add them to my module or create your own.
Developer Guides
The Magic Mask for Android
topjohnwu.github.io
Topjohnwu have a great guide how to do it and how to build your own magisk module.
3.) Yes, you need to do it after OTA, because OTA is updating modem partition and overwriting changes.
4.) I don't have access to 5G right now, but @Kars88 wrote it perfectly:
Module to enable 5G/VoLTE/VoWIFI on Pixel4a 5G/Pixel5
Update (9 Oct 2022): Upload module here. Update (7 Apr 2021): If you are looking for the manual way to add 5G support besides the magisk module way or the module does not work for you. Please refer to #54 for the detailed steps. Thanks again to...
forum.xda-developers.com
EDIT:
Btw. @mightyvenom Thanks for reminding me about that module, probably I'll create my own based on the one that you've mentioned - I just saw some new flags, that may be helpful with my research

Vortuks said:
About the guide - no problem. I just want to share knowledge
1.) The difference is that I'm modyfing(in fact reseting) only the necesary props and adding selected MBN to the modem partition. Module mentioned "overwrites" the system MBN's, while I'm adding a new one directly to the modem. Also, this module modifies a lot of props and resets them to specified values - I'm doing only the necessary ones.
Currently my method doesn't unlock 5G - but also on the same page(4a 5G) they've used the same method.
I've just copied all the details into single guide, so everyone, who wants to have a working VoLTE and VoWiFi can use my guide without searching whole forum for posts etc.
I've tried to use this Magisk module, but it didn't work with my country(Poland) with my operator(Orange) - so I'm using this method. It should work on pretty much every Android version, while I can't guarantee that the mentioned module will.
2.) If you want to edit more props, you can add them to my module or create your own.
Developer Guides
The Magic Mask for Android
topjohnwu.github.io
Topjohnwu have a great guide how to do it and how to build your own magisk module.
3.) Yes, you need to do it after OTA, because OTA is updating modem partition and overwriting changes.
4.) I don't have access to 5G right now, but @Kars88 wrote it perfectly:
Module to enable 5G/VoLTE/VoWIFI on Pixel4a 5G/Pixel5
Update (9 Oct 2022): Upload module here. Update (7 Apr 2021): If you are looking for the manual way to add 5G support besides the magisk module way or the module does not work for you. Please refer to #54 for the detailed steps. Thanks again to...
forum.xda-developers.com
EDIT:
Btw. @mightyvenom Thanks for reminding me about that module, probably I'll create my own based on the one that you've mentioned - I just saw some new flags, that may be helpful with my research
Click to expand...
Click to collapse
Thanks for your answers. I will try your method and compare the results with the initial solution I have found.
Let us know if you make any progress in changing the magisk module from the Pixel 4a 5G forum. I am particularly interested to achieve 4G CA more than 5G to be honest, maybe this is doable.

mightyvenom said:
Thanks for your answers. I will try your method and compare the results with the initial solution I have found.
Let us know if you make any progress in changing the magisk module from the Pixel 4a 5G forum. I am particularly interested to achieve 4G CA more than 5G to be honest, maybe this is doable.
Click to expand...
Click to collapse
@mightyvenom
It should enable CA(I guess), because you're essentially loading a proper MBN for your network provider - those files contains data about CA. At least in Poland it works.
nothing done on my side yet, when 2022.12 update will be out I'll try to create a proper Magisk module and share results.

@mightyvenom
if you want, you may test out this module.
It it unfinished, todo:
- fix path for MBNs,
- new github repo,
- test for 5G(need to retweak system.prop).
I've added two props:
persist.vendor.radio.mbn_load_flag=3
persist.vendor.radio.mbn_wait_s=60
I've flashed November Full IMAGE(without deleting data), applied Magisk, applied this module and I got VoLTE&VoWiFi (in IMS it is registered).
If you didn't the method with flashing through efsTools.exe it should enable you a VoLTE/WiFi.

I read here https://support.google.com/pixelphone/answer/12240791?hl=en that they have added volte support. But it seems like many people still do not have VoLTE. I am so confused.

I'm not sure, that done right, after your last post, but after placing latest module to magisk - nothing has changed. I see an option to enable volte/vowifi, but still no success with calling. After making a call it still switch to 3g/hsdpa. I'm on pixel 5 and tmobile (pl).
Is there still needed to create an mbn file with efstool?
Edit
I've solved with this thread https://forum.xda-developers.com/t/module-to-enable-5g-volte-vowifi-on-pixel4a-5g-pixel5.4207725/ just to let you know, for me works only applying magisk module . Really not sure why, because I haven't apply mbn file. But as you can see here - I can call over LTE and my phone is registered https://101010.pl/@inzaghi89/109661148495494919

I appreciate the work you've put in, but I'm finding the instructions a little unclear. Could someone please give another description of the process to follow? Thanks in advance.

Mctrixy said:
I appreciate the work you've put in, but I'm finding the instructions a little unclear. Could someone please give another description of the process to follow? Thanks in advance.
Click to expand...
Click to collapse
Go to this post:
[MOD]MagiskModule - VoLTE & VoWifi & 5G in unsupported countries | Pixel 4a 5G & 5 & 5a
Introduction I would like to share a magisk module, which: - enables 5G, - enables VoLTE, - enables VoWiFi, - loads MBNs properly after loosing connection with network provider, - does not enforce 5G. Module is created by me, latest release...
forum.xda-developers.com
It should work for you as this is Magisk Module only

its not working on my P5a using indonesian carrier telkomsel.