Does anyone know if there is a hidden menu on the XDA that is similar to the Network Monitor that can be enabled on Nokia Phones?
For exampl on Nokia phones when activated you can:
Carrier number
MS RX Level in DBM
Received signal quality
MS TX power level
C1 (Path loss criterion, used for cell selection and reselection). The range is -99 to 99.
RTL (Radio link timeout).
Timeslot
Indication of the transmitter status
Information on the Network parameters.
TMSI (Temporary Mobile Subscriber Identity).
Cell identification (Cell ID, Number of cells being used).
MCC (Mobile country code)
MCN (Mobile network code)
LAC (Location area code)
Ciphering (On/Off)
Hopping (On/Off)
DTX (On/Off)
Discard cell barred information.
We have been looking into this. All we know is that this is not low-hangiong fruit on the XDA. The information seems to be available inside the modem chipset only, and it seems like it's not communicated to the PDA part, or we haven't found the way to ask for it yet.
Either way: this frustrates us more than it could possibly frustrate any of you, so stay tuned. (But don't hold your breath...)
thanks for letting me know
I was originally going to just pass this info along for Closeone to put in his thread but he talked me into writing this little how-to. Thanks Closeone!
DISCLAIMER: I am not responsible for anything that may happen with your phone using the method described herein. QPST and QXDM are very, very powerful and can break a phones carrier info if not used properly.
YOU HAVE BEEN WARNED!
This method only works if you use QPST to backup your carrier info BEFORE downgrading and/or using revolutionary to root/S-OFF AND you take special note of your MEID and ESN.
BACKGROUND:
I am a boost mobile user with a flashed HTC Evo 3D and although I did downgrade perfect to HBOOT 1.4 S-OFF using the tools and methods found here on XDA (Thanks Unknownforce and Closeone!), it also wiped my flash info. I learned all this by being especially paranoid after hearing the same garbage some others have heard about not being able to flash roms on a Carrier flashed phone. Of course I didn’t get my hands on the donor phone that was used so I reverse engineered the flashing process by doing online digging and research.
Ok so on with the show!
Things you’ll be needing:
HTC Diagnostic drivers
CDMA Workshop 2.7+
QPST 2.7 Build 355
QXDM 3.9.19
Android SDK
HxD Hex editor
APN Backup and Restore
------------------------------------------------------------------------------------
Using APN Backup and Restore, backup your APN. This is your MMS info.
While using QPST, QXDM or CDMA Workshop we will be keeping the Evo 3D in Diagnostics mode. To do this open your dialer and enter “##DIAG#” as if you were dialing a phone number.
On your phone in “About phone” and then “Phone Identity” copy your MEID!
In CDMA Workshop, "Security" tab, SPC (Also known as an MSL code) – type in your SPC (MSL) - send. Note that your MSL if using a pre-flashed phone is probably “000000”. You should get a message saying that the SPC code is correct and the phone is unlocked.” Once the phone is unlocked, click on the memory tab. go to NV Items read and save items: 465,466,1192,1194; they must be saved one at a time so for example the First NV Item: 465/ Last NV Item: 465 click OK and save it as 465 then move on to the next item and do the same. Remember to save it somewhere handy, as we will need the later on. Occasionally depending on the type of phone that was used for a donor there might not be anything in 1192 or 1194 that’s ok. While still in CDMA Workshop click the NAM Tab. Click “Read” this will display all your phones information inside of “NAM 1” Save the filename as NAM 1 and do the same for NAM 2.
Now close Cdma Workshop. Open up QPST Service Programming (IF YOU HAVE NOT ALREADY, TAKE NOTE OF YOUR “MEID” AND “ESN”) and enter your phones SPC. Click Read and SAVE. Now navigate to the “MIP” Tab, we need your phones NAI. Click on Profile 1 and copy down your “NAI”, Primary HA and secondary HA address, MN-HA SPI1, MN-AA SPI1 and then note if “Rev-Tunnel Preferred” is checked or not.
Ok now Close QPST Service Programming and open up QXDM. In the command input windows type. Password 000000 (or whatever MSL you have) hit enter. Now type “Requestnvitemread ds_mip_ss_user_prof” without quotes . This will find your Ha Shared and AAA Passwords for profile 0. HA Shared which should be “736563726574” if youre on boost like me. For your AAA Provisioning password open up Nvitem 466 and read your 32 digit password after the “10”, save and return back to Qxdm. Now enter “Requestnvitemread ds_mip_ss_user_prof 1” for Profile 1, once again you HA Shared will be “736563726574” if youre on boost then scroll down for your AAA Password, this password will be 6 digits long located starting after the line “mn_aaa_shared_secret_length = 0x06”.
Ok good, that’s all the info you need to keep safe. Now the procedure for recovering the flash using this info! It’s actually quite simple, we’re just going to take the steps above and now load and apply them instead of saving them.
Throw that sucker into diagnostics mode like earlier and now plug it into your computers USB and fire up CDMA Workshop and enter your SPC/MSL. Remember The NAM info we saved? Click the NAM tab then load the saved file (NAM1 for NAM1, NAM2 for NAM2 DO NOT WRITE THEM TO THE WRONG PLACE!).
Next open QPST, enter your security info (SPC/MSL) and then read from the phone. After it loads your phones info click load, find the QPST saved file we created earlier and click write. Your phone will reboot after which open QPST back up and click read again. Make sure all the info is correct compared to what I mentioned to write down. If all is correct onto the next step!
Most likely all your info is correct except for the MEID/ESN.
Now, due to the respected rules and regulations of this forum and the powers that control/own it I cannot go into detail as to the process of correcting your MEID/ESN. If you need any assistance in this matter please PM me and I will set you on the right path. I really don't mind especially since it's a crucial part should your flash die. I will NOT answer posts to this question you MUST PM me. Sorry for the inconvenience!
Now you can restore your APN using APN Backup and Restore after which you should reboot your phone. Once it’s up and running connect to any WIFI and then update your Profile and then your PRL. I’m not sure if doing it in that order or even being connected to wifi is necessary but that’s what I did and it worked for me. You should now be back to full flash and 1.4 HBOOT!
I hope this helps because it was a complete nightmare during the 6 straight hours it took to solve this issue and I’d hate for anyone else to go through all that.
Very nice! Thank you!
I don't have a flashed phone so only part of this is what I need. Well its sorta flashed, half virgin mobile and half sprint. just wondering if I can just do the paragraph about getting the AAA key?
wikdNoob said:
Very nice! Thank you!
I don't have a flashed phone so only part of this is what I need. Well its sorta flashed, half virgin mobile and half sprint. just wondering if I can just do the paragraph about getting the AAA key?
Click to expand...
Click to collapse
No sir. If all you need is the AAA and HA then that paragraph should do the trick.
joe, do you think any of this would fix issues with the Virgin Mobile firmware flashers? Sorry to "hijack" sorta.
jlechner said:
joe, do you think any of this would fix issues with the Virgin Mobile firmware flashers? Sorry to "hijack" sorta.
Click to expand...
Click to collapse
I believe the Virgin Mobile issue pertains more specifically to the HTC firmware not really carrier information. The only good QPST or QXDM would do is copy or change carrier info not how the phone actually functions.
Sorry.
-Joe
I'm on Boost right now and I paid some to flash me to Boost. My question is, what steps I need to take if I want my phone back to sprint?
Lol yea I had to flash back to cricket after downgrading
Sent from my PG86100 using xda premium
shook187 said:
I'm on Boost right now and I paid some to flash me to Boost. My question is, what steps I need to take if I want my phone back to sprint?
Click to expand...
Click to collapse
If you want to revert back to sprint do a hard reset. I believe it's ##msl# and then do reset.
Sent from my PG86100 using Tapatalk 2
joefanelli said:
If you want to revert back to sprint do a hard reset. I believe it's ##msl# and then do reset.
Sent from my PG86100 using Tapatalk 2
Click to expand...
Click to collapse
I think the hard reset is actually ##rtn#
Need a little help here please. In the memory tab, i click read on the nv items area then a box pops up that says nv-items backup. there is a range dec and a range hex. each has a start and end box, which do i put 465 in? tia
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Sorry, I'll answer asap. I'm having computer trouble but it should be fixed later today.
Sent from my PG86100 using Tapatalk 2
joefanelli said:
In CDMA workshop 2.7.0 are you going to the memory tab then pressing the read button in the NV Items box? Upon doing so you should be presented with a dialog box with two separate boxes asking for a range. Within those boxes enter 465,466,1192,1194; they must be saved one at a time so for example the First NV Item: 465/ Last NV Item: 465 click OK and when the save box pops up save it as 465 then move on to the next item and do the same.
Did you click the drop down menu to the left of the command box and select "Command Output"? You should then enter in the command input "Password 000000" and the output should say something like "Password accepted at the bottom of the output". If it does not then double check your SPC by using MSL reader from Google Play and try that"
I hope this helps and sorry again for the delay, this past month has proven to be quite taxing.
-Joe
Click to expand...
Click to collapse
Don't worry about delay man, its all good. I'm subscribed to this thread so ill get the notification when you get back. No rush, really....
I figured out my problem with qxdm, I was using the wrong version, and it says the version that I need right in the op, sorry bout that. I got the readnvitems command to work and I looked at the bottom set of diag rx items and all of the outputs under AAA, 0-15 just say 0x00. Why is it all zeroed out? And the HA secret and AAA in profile 1 is all zeroes.
About cdmaws... I'm gonna make sure I have the right version of that tonight. I probably don't.
OK, thread restored and moved to the correct section as this is not development.
That is a strange situation sir! Now that my thread is back I'll try and play around with QXDM and see why it would come up all zero's.
joefanelli said:
That is a strange situation sir! Now that my thread is back I'll try and play around with QXDM and see why it would come up all zero's.
Click to expand...
Click to collapse
Strange indeed. Like I said, I did the command for profile 0 and it showed about 6 numbers, like 2 numbers on line zero, 2 numbers on line 1, and 2 numbers on line 2. All the rest are zeros and the AAA area was just all zeroes. Tried the command for profile 1 and all the HA area and all the AAA area was just zeros. I'll edit with a pic of it in a little bit. I know I shouldn't give out my AAA pass but I don't think it'll be of use to anyone since its all zeros, lol.
Also, not sure if you know anything about this but in qpst software download, I go to the backup option and and enter my msl and select start. It goes through some motions and then fails saying this "the nv item requested is not the nv item recieved". I wonder what that's all about. I'm thinking it has something to do with the virgin mobile firmware I flashed but it could just be that I don't fully know what I'm doing.
wikdNoob said:
Strange indeed. Like I said, I did the command for profile 0 and it showed about 6 numbers, like 2 numbers on line zero, 2 numbers on line 1, and 2 numbers on line 2. All the rest are zeros and the AAA area was just all zeroes. Tried the command for profile 1 and all the HA area and all the AAA area was just zeros. I'll edit with a pic of it in a little bit. I know I shouldn't give out my AAA pass but I don't think it'll be of use to anyone since its all zeros, lol.
Also, not sure if you know anything about this but in qpst software download, I go to the backup option and and enter my msl and select start. It goes through some motions and then fails saying this "the nv item requested is not the nv item recieved". I wonder what that's all about. I'm thinking it has something to do with the virgin mobile firmware I flashed but it could just be that I don't fully know what I'm doing.
Click to expand...
Click to collapse
In CDMA Workshop after entering your SPC in the Security tab go to the memory tab and read NV Item 1192 in both fields (this holds the AAA key) then name it accordingly. Open the text file that was just created and then count thirty two digits (or sixteen pairs) after the 10. Ie if the string is "10 23 45 67 89 01 23 45 67 89 03 45 67 89 01 23 44 00 00 00 00 00 00 00 00..." then "23 45 67 89 01 23 45 67 89 03 45 67 89 01 23 44" would be the AAA key. Your HA shared key is "73 65 63 72 65 74" which is the same for all boost phones. Remember to enter the digits without spaces!
Enter both the HA and AAA keys you now have into their respective fields for BOTH profiles (0 and 1). I know it seems weird but from what I can tell and have been reading, as long as your profile 0 AAA key is correct updating your profile in the phone will get boost to fill in the AAA for profile 1. I think it's because 0 is the more important profile, being the carrier profile and not the phone profile.
Please let me know how this goes and if I can be of further assistance.
joefanelli said:
That is a strange situation sir! Now that my thread is back I'll try and play around with QXDM and see why it would come up all zero's.
Click to expand...
Click to collapse
It isn't an issue with qxmd. I had something similar with my evo 3d as i had flashed it to boost as well. I pulled the nv items with efs explorer and opened then up with tiny hex. The values on the aaa and ha keys were all zeroes as well. I found it odd but didn't make much of it. I used dft to input the values i already had and they worked. Is your unit refurbished? That may be the reason why.
egzthunder1 said:
It isn't an issue with qxmd. I had something similar with my evo 3d as i had flashed it to boost as well. I pulled the nv items with efs explorer and opened then up with tiny hex. The values on the aaa and ha keys were all zeroes as well. I found it odd but didn't make much of it. I used dft to input the values i already had and they worked. Is your unit refurbished? That may be the reason why.
Click to expand...
Click to collapse
What weird is that my evo 3d has never been flashed to any carrier. I've always had sprint. So I can't imagine why is have all zeros for my ha and AAA keys on profile 1 and all zeros on just the AAA key for profile 0. I do have some keys in the ha section when I look in qxdm profile 0. I'm gonna look at it with cdmaws when I get home this evening to see if its all zeros.
I don't know if this is a refurb, I got it off eBay. Is their any way for me to tell?
I can update profile just fine, I wish I would have checked this stuff before flashing that VM fw so I'd know if that was the cause.
Your HA shared key should be the same as everyone elses from what I experienced (73 65 63 72 65 74). As for the AAA I really hope CDMAWS provides the same result as what I'm experiencing by using the 1192 NV Item.
egzthunder1 said:
It isn't an issue with qxmd. I had something similar with my evo 3d as i had flashed it to boost as well. I pulled the nv items with efs explorer and opened then up with tiny hex. The values on the aaa and ha keys were all zeroes as well. I found it odd but didn't make much of it. I used dft to input the values i already had and they worked. Is your unit refurbished? That may be the reason why.
Click to expand...
Click to collapse
I just checked an E3D that I flashed for a client (purchased originally brand new then given to his son for use on boost) and it too has zero's when pulling the info through any other means than CDMAWS's NV Item read. Truthfully I'm flabbergasted as to the cause but CDMAWS seems to work. If anyone has any insight as to why that's the case please post it.
I've recently noticed that, in India, for Android phones with Tata Docomo, The internet goes on and off. They have a very awkward service. Well, I've found a fix for that. What I did was open up the Access Point Names from Settings and kept staring at it for half an hour. Then suddenly, the access point switched automatically to Tata Docomo Dive-In. The solution is pretty simple, it's layed out here in neat little steps:
Step I: Go to the Play Store and Download an app called APN Global(Don't worry, you can uninstall it after using)
Step II: Open the app and choose Delete APN and Select Delete all APNs
Step III: Go to Access Point Names in Settings and Add a new APN, the config is as follows:
Name = TATA DOCOMO INTERNET
APN = TATA.DOCOMO.INTERNET
For 3G:
Name = TATA DOCOMO INTERNEThvc
APN = TATA.DOCOMO.INTERNEThvc
----------------------------------------Common Settings for 2G and 3G--------------------------------------
Authentication Type = None
APN Type = internet
Every state has a different MNC Code, here's a list:47 West Bengal
46 Uttar Pradesh (West)
45 Uttar Pradesh (East)
44 Tamil Nadu
43 Rajasthan
42 Punjab
41 Orissa
40 North East
39 Mumbai
38 Madhya Pradesh
37 Maharashtra and Goa
36 Kolkata
35 Kerala
34 Karnataka
33 Jammu and Kashmir
32 Himachal Pradesh
31 Haryana
30 Gujarat
29 Delhi
28 Chennai
27 Bihar
26 Assam
25 Andhra Pradesh
Don't do anything to the other fields. Save the settings.
That's it.
Getting RF variables from your Android modem can be extremely useful for a whole range of reasons, but the Google API developer (mofo's) refuse to document and support all but the most fundamental ones, like CID/LAC etc. among hundred more.
However, if you manage to get access to your phones ServiceMenu (SM), which are getting increasingly disabled and hidden, you may be lucky enough to find a whole bunch of useful internal functions and settings. Such as detailed RF/Network info, audio/vidoeo settingsetc etc...
What's the damn question?
On many Samsung phones, the ServiceMenu contain something like the following (depending on modem version):
Code:
[SIZE=2]MAIN MENU
[1] DEBUG SCREEN
[1] [B]BASIC INFORMATION[/B]
UMTS : HOME(CS+PS)
RRC State: IDLE
WCDMA 2100 Band 1
Reg PLMN 240-2, IsPCS? 0
FREQ DL:10737
FREQ UL:9787
CELL_ID:0xhhhhhh
LAC: 0xhhhh
PSC:hhh
RSCP:-94, ECIO:-5
[2] [B]MM INFORMATION[/B]
MM state: IDLE
Reg state: INDEP_REGISTRATION
IMSI attatch status: 1
LU Rej: Norm=0, Period=13
[COLOR=Red][B]T1312=11, Count=9[/B][/COLOR]
T32(10,11,12,13)=0010
T32(20,30,40)=000
Att Rej Cause=0
RAU Rej Cause=9
[3] [B]RR INFORMATION[/B]
[4] [B]NEIGHBOUR CELL[/B]
[5] [B]GPRS INFORMATION[/B]
[6] SIM INFORMATION
[7] HANDOVER
[8] PHONE CONTROL
[9] ANTENNA/ADC
[/SIZE]
(The SM is normally accessed through *#0011# or *#197328640# from dial-pad.)
I have highlighted a the Mobility Management (MM) Timer, called: T1312.
However, there is no such timer in any of the documentation I have seen, so my suspicion is that the timer name is a typo. But then again I have only looked at ~4 documents out of several thousands from 3GPP.
What is this timer T1312 actually supposed to be representing?
Where can I find its documentation?
Yes, XDA is proably not the right place to post this question, but I'm just too lazy to sign up on another GSM just to ask this question. So among all the 5.6 Million XDA users, perhaps someone should be RF/GSM engineer enough to help me find an answer.
PS. It's good for people/developers to know that the real meat of the SM application is located inside your modem binary! The app you can see, is just a wrapper.
References:
3GPP TS 24.008 V12.5.0 (2014-03): (678 pages)
"Mobile Radio Interface Layer 3 specification, Core Network Protocols".
It's possible this timer is Intel/Infineon XMM 6x60 specific, not present in Qualcomm modem based ServiceMode applications.
No, it's actually Samsungs fcuked up way to show the details of the T3212 timer.
Code:
T1312=11, Count=9
Means that it has started 9 times and is set to: 11 deci-hours.
Which is 11/10 * 60 = 66 minutes before timeout.