LG's Engineering Mode (HiddenMenu.apk) - G2 General

This thread presents the information available within the Engineering Mode, which is a LG specific extension similar to Samsung's ServiceMode.
The thread is slip in six parts:
How to access the Engineering Mode
2G (GSM/GPRS/EDGE) radio information
3G (WCDMA/HSDPA/HSPA+) radio information
LTE radio information
Network Management / NAS (Non Access Stratum)
Understanding how the Engineering Mode works

How to access the Engineering Mode
The first thing to note is that the Engineering Mode view, provided by HiddenMenu.apk, relies on specific modifications LG added to the framework, more specifically the sending and receiving of RIL_OEM_HOOK_RAW.
Hence, contrary to the SamsungServiceMode.apk that can be install on CyanogenMod, here HiddemMenu will not work on a CyanogenMod ROM without re-implementing the functionnality LG added to the phone class.
First, to get into the application, enter 3845#*802# (that's for the international LG G2 version). Then select "WCDMA-Only", then "Modem Settings", then "Engineering Mode".

2G (GSM/GPRS/EDGE) radio information
You will note some of these screenshots have some blurry areas: this was done on purpose by myself, to anonymize the data. This menu presents information about the current 2G cell (ARFCN, C1, C2) as well as neighbours in GSM and GPRS/EDGE modes. We also get rx quality/tx power information, and various bits and pieces about AMR and GPRS.

3G (WCDMA/HSDPA/HSPA+) radio information
There are two menus, 3G and HSDPA. Various low-level information is shown, for example the PSC (Primary Scrambling Code) the antenna uses, as well as PSC for nearby antennas.

LTE radio information
This menu provides information when connected in 4G. It seems fairly less comprehensive that the 2G and 3G menus.

Network Management / NAS (Non Access Stratum)
This mode is fairly interesting, mostly due to its reporting of the current ciphering algorithm in use. However in packed switched mode (PS) this indicator seems limited to GPRS/EDGE (below, it appears the network uses GEA/3). In circuit switched mode it correctly reports the ciphering status as soon as a call is made or received; below, you can see the network uses A5/1 for GSM and UEA1 (Kasumi) for 3G calls. (for some reason in 3G the baseband only informs the "UEA" field. the "ciphering" field is unused).
Please note the NM menu seems limited to 2G/3G, when the phone is on LTE the fields have their default value.

Understanding how the Engineering Mode works
TBD - I might add information at some point here on how to use strace to peek at the QMI requests rild makes.
It's worth noting this application could be ported to the Nexus 4/5, since it appears from looking at the strings in the baseband LG also included these specific extensions.

Fantastic! Great Job. Can you also say something in OP what BP that phone is using? And if the APK relies on some specific libraries. Then perhaps we could pack up the APK with the libraries, to look at.
To everyone: Hey! Don't just do this blindly. You will ruin some essential functionality if you accidentally overwrite these files/libraries.

E:V:A said:
Fantastic! Great Job. Can you also say something in OP what BP that phone is using? And if the APK relies on some specific libraries. Then perhaps we could pack up the APK with the libraries, to look at.
To everyone: Hey! Don't just do this blindly. You will ruin some essential functionality if you accidentally overwrite these files/libraries.
Click to expand...
Click to collapse
Hi E:V:A,
AFAIK it is a MDM9x25.
Unfortunately LG Terms of use, which I agreed to, prohibit me from redistributing, disassembling or decompiling their binaries.
However there are two points to note:
HiddenMenu can be found in some stock ROM that have been made available on this site by various xda developers. Thanks guys!
Reverse-engineering is not a strict requirement. Instead I examine the side effects eg using strace. The samsung-ril developers used the same technique

please how to repiar my IMEI on lg g2 by useing engineering mode

Can this be used to sim unlock the sprint variant to work on ATT?

I think so although because the commitments make to the powers that be at LG strictly prohibit any type of such activities to be discussed lest the lg ivory towers no longer shield us from destruction

I finally got to the hidden menu, but I could not find the WCDMA only button.
Sent from my LG Optimus G Pro

Related

Wifi tools?

Maybe what I'm looking for doesn't exist or maybe it does, I don't know.
I've been on the hunt for a decent app that is like a tech's "dream come true" when it comes to Wifi tools and functionality. I'm not an IT professional or anything, but looking for more than an average "oh look, here's a wifi network" app.
A few apps that I've come across and tried...
Wifi Analyzer
Two of the things I like most about it - the AP list and the signal meter. It also lets me grab a snapshot so I can look at it later.
Wi-Fi Analytics (amped|wireless)
The ap list (WiFi Scanner as it's referred to) is nice but cluttered. Between Wifi Analyzer and this, I'd say both are somewhat the same, though I think Analyzer is better.
Fing
Still playing with it, though it doesn't seem to offer much (unless making an account gives more functions).
Wolf WiFi Pro
Only having used the demo, maybe it has what I'm looking for. The demo alone, though, was a let down.
Of the different apps I've tried (listed or not), some offer similar features such as detecting how many networks are using the same channels, graphs to show signals, etc. That's nice, but seems common enough that it's tossed in there just to say it's a feature, as opposed to being a provided tool in addition to something that other apps don't offer.
What I'm looking for is more or less this... An app that will provide a compact listing of found networks. Constant scanning or manual scanning. Option to log details about the results (date, time, gps location). Function to use found results to generate a 'map' of found networks and if the same network is found in multiple logs, use the different locations to try to form a better fix on where that network is originating from. Once a network is detected, optionally be able to keep a record of it even if it's not being picked up anymore (along with date/time of first finding and date/time and gps location of strongest signal). When viewing the list of found WLAN's, tapping on one won't prompt to connect to it, but instead bring up a page of tools. Miniature signal meter (like Wifi Analyzer does it, rather nice), button to click to connect, button to add notes about the discovered AP, along with information such as security, mac ID (which most seem to provide) and anything else that is possible to show. I dare say, ability to detect what devices (computers or otherwise) are attempting to connect (or are connected) to the AP as well (useful if I want to see if someone is somehow connecting to my network even if it's not showing up in any logs).
Is there anything even remotely close to what I'm describing? Are there any recommend Wifi tool like apps that I just haven't come across yet? When looking on Google's Play store, most of the apps seem to be like practice apps that more or less do the same thing as using the built in Wifi connection manager.
Using a T989 with Jellybean (rooted, stock OS or whatever).
You might find something here that is describing your needs. But what your describing my be a little too advanced for android.
http://forum.xda-developers.com/showthread.php?t=2170460
Don't forget to hit the thanks button
eugeneeaster18 said:
You might find something here that is describing your needs. But what your describing my be a little too advanced for android.
http://forum.xda-developers.com/showthread.php?t=2170460
Don't forget to hit the thanks button
Click to expand...
Click to collapse
Thanks, but already saw that topic. I read that and a couple of others before making this one in case what I was asking for was more or less already answered. What I'm describing may sound complex but I'm sure it's really just a matter of designing it to act in certain ways vs the "easy route." ie, it's easy to make it so tapping on a found network will ask if you want to join the network. Heck, if that's what I wanted, then I could just use the built in manager. Using one of the tools, I did discover that the wireless I'm running was on the same channel as a couple of others nearby. So I changed the routers two use a couple of different channels that were showing as empty.
Just comes down to wanting the best from each app that happens to have a good feature or two and packing it all together in one solid app.

Telephony Question

I'm setting up my newly purchased S9+ and I'm wondering about the "APN protocol" settings which, by default, is set to IPv4. I found some discussion on that in other threads and I tested both settings: IPv4 - only and IPv4/IPv6. Not knowing much about it I might be biased(placebo effect) but I thing I'm getting just a little bit stronger signals(wifi & cell) around a different places at home as shown by 'Network Cell Info Lite' app when I set it to ipv4/ipv6. Looking for a good explanation to a question: is there any merit in that, setting it for ipv4/6?
I am wondering the exact same thing ...
I noticed on Tmobile Community ...some recommend IVp4/IVp6 ....some say IVp6.
I am trying to test dual stacking on Metro PCS /Tmobile but only amateur trial and error .
I wonder IF it gives a slightly 'wider ' footprint on Web.
I wonder IF it gives a 'wider ' bandwidth in transmission and reception for the Device -and consumes slightly more power ?
Meaning - is it like a transceiver transmitting and receiving on two channels at once [or wider bandwith on one channel ] ?
I am not a Dev....so keep answer simple or include a summary -,thanks .?
robertkoa said:
I am wondering the exact same thing ...
I noticed on Tmobile Community ...some recommend IVp4/IVp6 ....some say IVp6.
I am trying to test dual stacking on Metro PCS /Tmobile but only amateur trial and error .
I wonder IF it gives a slightly 'wider ' footprint on Web.
I wonder IF it gives a 'wider ' bandwidth in transmission and reception for the Device -and consumes slightly more power ?
Meaning - is it like a transceiver transmitting and receiving on two channels at once [or wider bandwith on one channel ] ?
I am not a Dev....so keep answer simple or include a summary -,thanks .
Click to expand...
Click to collapse
I found an answer, my phone is set on IPv6 connection through the router settings. I don't have the S9+ anymore so, the details to enable IPv6 are here:
https://forum.xda-developers.com/oneplus-6/help/oneplus-6-dhcpv6-support-wifi-t3831639#post77392832
Odd, IPV4 vs IPV6 should make no difference on your signal strength. It's just the IP Address version being used.

LG Rebel (Tracfone) LGL44VL

Hello,
just got a LG Rebel from Tracfone.
noticed it does not have Wifi Hotspot in the android settings menu.
does anyone who uses this phone able to use the mobil data on this phone as a wifi hotspot?
Thanks!
You can just install any app. Many apps exist in case of phones which do not have the item in the menu. Also, the correct name for this function is called tethering. If it says "mobile hotspot" instead, that probably means it is something installed by the phone service (such as Verizon), an extra software which will be slow and annoying. Android's tethering option is under "extra" or "dot dot dot" etc., underneath the WiFi area in the WiFi settings section from the main settings menu.
Also this website is meant for people who have advanced knowledge, I noticed that basic questions such as this one often get ignored. Some forums are meant for more basic questions, including the manufacturer (LG) or the service official forums, if they are used by the public (of course some manufacturers or service providers will not have good forums or may not be used by anyone).

Simultaneous Wi-Fi and Mobile Data (Cellular)

I want the application I am developing to use the Wi-Fi and Mobile Data (cellular) interfaces simultaneously on my Android 11 Galaxy Tab S7 5G device. The setting "Mobile data always active" does indeed allow fast interface-changeover. However, both interfaces are never data-accessible simultaneously. Using a third-party channel-bonding VPN service, called Speedify, this is possible on this Galaxy Tab S7 5G tablet. Speedify uses something mysterious called channel bonding with their VPN service to accomplish this. Also, a Google Pixel running Android 11 is also able to use both interfaces simultaneously, without any third-party utility help. In addition, the Garmin ActiveCaptain App also, somehow, gives this tablet the ability to communicate on both interfaces, simultaneously. How can my application use both interfaces on a Galaxy Tab S7 5G without using the Speedify App (not possible because of security and business reasons)?
Did you get anywhere with this?
How have you verified the Garmin app has this functionality? And when are both interfaces used? I wonder if only one channel has a typical data connection, and the other is for some other purpose (location, or something).
I think Speedify gets around the usual OS limitations by creating a single virtual device that all requests go through, then they decide which network to send packets on. It is neat to hear this can work on a mobile device though! I had assumed their service was for people on more typical PC like hardware.
In a way I'm not surprised Google's own phone has managed some tricks others haven't. Though I'd hope it wasn't an Android 11 only feature (meaning 12+ don't/won't have it).
This assumption of only cell or wifi being active might be baked in at an OS level to force better battery life. Personally I like flexibility and choice, but I can imagine less knowledgeable users getting angry at their terrible battery life (after they enable a feature they don't understand).
Maybe this is worth filing a bug with Android and seeing what they say? Or asking Samsung directly?
I was bummed when I figured out I couldn't just pay two ISP's for internet service and load balance across both easily. That my consumer router's optional 2nd WAN port was only a failover option (use one or the other).
As you alluded, for Samsung phones and tablets running Android 11 or Android 12, the ultimate solution is to route both WiFi and Mobile Data (cellular) data through a virtual interface e.g. tun0, via a VPN tunnel interface. I believe this will "shield" the Samsung one-or-the other route-switching that prevents simultaneous operation over both WiFi and Mobile Data. I am assembling just such a VPN now. I could certainly use any tips or suggestions from others that have already been down this road.

I haven't found the "one" best mock location fake gps app - but I found a few good ones (I use Lexa the most but others are better but they have ads)

I haven't found the "one" best mock location fake gps app - but I found a few good ones that have ads.
But if I had to pick just one as the "best", I'd pick Lexa simply because it works without ads.
*Fake GPS Location* by Lexa​Free, no ads, requires gsf, rated 4.6, 456K reviews, 10M+ Downloads​<https://play.google.com/store/apps/details?id=com.lexa.fakegps>​​
Note that these mock location apps are set inside the operating system, such that EVERY app gets their information from them, and that these mock location apps can randomly move along roadways by a given distance per a given time period, and they can start at the last location, and they can randomize the amount of movement per second, and they can spoof the altitude, and some can set a specific exact location by the keyboard instead of only graphically, etc. They can even send the location to another phone or get the location from another phone if you want that.
Click to expand...
Click to collapse
But others (with ads) do a better job of random location following roadways with random movement time periods.
Others (with ads) can also shift the GPS location from one phone to another (either way) - but what use is that for you?
Also others (with ads) can spoof both the wi-fi provider & the GPS provider - but what use is that for you?
Which fake GPS mock location app do you feel is best and why?
GPS position falsification is currently not very effective when RIL is enabled on the phone. Apps can easily orient the phone in space based on the signal strength to the network operator's mast.
ze7zez said:
GPS position falsification is currently not very effective when RIL is enabled on the phone. Apps can easily orient the phone in space based on the signal strength to the network operator's mast.
Click to expand...
Click to collapse
For privacy reasons... I have every setting for location accuracy turned off, and I also have every unused radio on the phone turned off (e.g., NFC, bluetooth, gps, wi-fi, etc.) and my phone's wi-fi does NOT reconnect (auto-connect is turned off) as my home AP SSID is hidden (for privacy, not for security!) and it has a "_nomap" appended to keep out of the well-behaved databases such as Google/Mozilla, but not Wigle/Netstumbler/Kismet,etc, which aren't well behaved, and I randomize the phone's Wi-Fi MAC upon every connection - which is a new feature of Android 12 in Developer options, etc., ....
... But I had to look up what RIL stands for, so I thank you for bringing up that unknown-to-me Radio Interface Layer detail...
RIL references:
https://wladimir-tm4pda.github.io/porting/telephony.html
https://source.android.com/devices/tech/connect/ril
Specifically
Radio Interface Layer: It is the bridge between Android phone framework services and the hardware. In other words, it is the protocol stack for Telephone. The RIL consist of two primary components.​
RIL Daemon
Vendor RIL
RIL Daemon​​RILD will be initialized during the Android system start up. It will read the system property to find which library has to be used for Vendor RIL, provide the appropriate input for vendor RIL and finally calls RIL_Init function of Vendor RIL to map all the Vendor RIL functions to the upper layer. Each vendor RIL has RIL_Init function.​Vendor RIL​​It is a library specific to each modem. In other words, we can call it as a driver to function the modem. The RIL daemon will call the RIL_Init function with the device location (eg: /dev/ttyS0). It will initiate the modem and returns theRIL_RadioFunctions structure contains the handles of radio functions​
After skimming that RIL information, I'm not sure exactly what you're trying to tell me, but I guess you're saying that we can be geolocated when we make phone calls and even when we don't, in that the cell towers can be triangulated if the phone is in calling mode... which I understand full well.
But, in terms of privacy, how many apps that need to be fooled by their GPS location have access to that cell tower radio location information?
You understood correctly. A phone in call mode, as you wrote, can be easily located while moving.
The google map tricked out by "Fake GPS Location", does quite well while driving a car, as I recently verified in the field.
I don't analyze the app for route tracking.
ze7zez said:
You understood correctly. A phone in call mode, as you wrote, can be easily located while moving.
Click to expand...
Click to collapse
I agree with you that any phone, if it's going to be used for two (or three) things, will be easily tracked by those with the resources to do so
Make/receive phone calls
Send/receive sms/mms texts (mms requiring data)
Wi-Fi connections (aka "the Internet")
However, in all cases above, the geolocation isn't as accurate as with GPS (if you are judicious about your location settings), and, more to the point, the applications themselves don't have access to the cell tower information (although they do have access to your IP address, which can be roughly geolocated).
We have to assess our threat level where I'm not using fake location apps to hide from a well-funded TLA adversary; I'm using the fake location to simply hide from the likes of Google and other nefarious outfits that put the tracking APIs inside the code (which is why almost none of my apps require GSF).
ze7zez said:
The google map tricked out by "Fake GPS Location", does quite well while driving a car, as I recently verified in the field.
Click to expand...
Click to collapse
If what you're saying is that the mock location apps "fool" the likes of Google Maps, I fully agree with you. If... If... if...
If you don't allow Google Maps to run a more detailed analysis that is.
As an example, I recently ran a test inside of a local town where I had the fake location set to miles away, and Google Maps was telling me I was where the fake location said I was... but...
But... then Google Maps asked me to snap a photo so that it could better figure out where I was, and BINGO! It figured out where I was based on the video that I allowed (for test purposes) to show the storefronts.
When I tested it again without allowing the video to see anything of value (e.g., I panned to the mountains above), Google Maps could NOT geolocate me.
Likewise when you don't let Google Maps geolocate by WI-Fi address (although for all I know the camera mechanism sneakily allowed that as I'm well aware there are TWO APIs for turning on your GPS radio, one of which (from Google) is downright nefarious)...
ACTION: "android.lintent.action.MAIN"
PACKAGE: "com.google.android.gms"
CLASS: "com.google.android.gms.location.settings.LocationAccuracyActivity"
Click to expand...
Click to collapse
vs
Notice it's similar but different from the Android setting for accuracy.
ACTION: "android.intent.action.MAIN"
PACKAGE: "com.android.settings"
CLASS: "com.android.settings.Settings$ScanningSettingsActivity"
Click to expand...
Click to collapse
Notice that, for this very reason, you NEVER want to turn on your GPS radio from ANY Google app prompt!
ze7zez said:
I don't analyze the app for route tracking.
Click to expand...
Click to collapse
If you need to navigate and if you don't want to be tracked by Google, I found a little trick that works kind of nicely with the simple interfaces of the offline mapping programs.
Set your position as your destination in the mock location app
Use any offline map to set your current position as a waypoint
Then use the offline map app to route to your destination
Another "trick" that keeps you out of Google maps' databases is that you can easily get traffic using a web shortcut of the area you are currently traveling in - where you don't need to know your exact location in order to check out the traffic in front of you.
Yet another trick for traffic is that PLENTY of web sites provide Google traffic updates without logging into Google web servers (afaik), such as sigalert apps, 511 apps, and many local DOT apps such as caltrans (for California).
Overall, in summary, the mock location apps work to prevent apps that use your GPS location from tracking you - but as @ze7zez warned, it will only work for GPS and not for cell tower tracking.
GalaxyA325G said:
(...) the applications themselves don't have access to the cell tower information (...)
Click to expand...
Click to collapse
This is not true.
Go into your phone's service mode and see for yourself what the phone knows about the mast connection.
Here's a cheesy Cell Diagnostic app that I wrote myself:
Note that the only permissions that it uses is android.permission.READ_PHONE_STATE and android.permission.ACCESS_COARSE_LOCATION
It refuses to give you this information if you have "Location" turned off.
ze7zez said:
This is not true.
Go into your phone's service mode and see for yourself what the phone knows about the mast connection.
Click to expand...
Click to collapse
As always, you're correct... but.... you're being too narrow I think... in that debugging apps which we use when we need to are different from the run-of-the-mill apps we use all day every day...
There are only "some" apps, which I'm well aware of, that have your telephony information, such as this one which requires you to provide that permission first...
Once you manually provide that permission, yes, of course, the app has you dead in its sights... but most apps (that don't need it) don't ask for THAT much permission... (nor would you let them if they did).
Renate said:
Here's a cheesy Cell Diagnostic app that I wrote myself:
Note that the only permissions that it uses is android.permission.READ_PHONE_STATE and android.permission.ACCESS_COARSE_LOCATION
It refuses to give you this information if you have "Location" turned off.
Click to expand...
Click to collapse
You bring up a good point that a few Android releases ago Google cheated like hell by forcing apps to request "Location" being turned on in order for the app to display unrelated things such as "Wi-Fi signal strength"...
Which is ANOTHER good reason for being able to set the mock location... because the Wi-Fi Signal Strength of all nearby access points has nothing (per se) to do with your current GPS location.
EDIT: BTW, as a related aside, I post a billion screenshots to the Internet, where some of them contain GPS location - which - if spoofed - means I don't need to redact it in those screenshots. For other information though, such as the cell tower information, I never know how much to redact (for privacy) where you didn't redact anything on your screenshot.
Can you let me know which are the cellular tower information pointers that we should redact for privacy when posting screenshots?
https://forum.xda-developers.com/attachments/cell1-png.5676683/
The CDMA system has a place for actual Lat/Long. But, these cells are set up by various people and the amount of information in them is variable.
I've rarely seen lat/long on a CDMA signal
The LTE stuff only references cell number. You need a database to reference it to location.
I have a few cell numbers hard-coded to named location.
I can't even find my current tower on https://www.opencellid.org/
Renate said:
The CDMA system has a place for actual Lat/Long. But, these cells are set up by various people and the amount of information in them is variable.
Click to expand...
Click to collapse
I'm aware there are open signal public OSM cell-tower-location databases (which essentially suck - but which are good enough to track your general location) and then there are the "real" databases (which the carriers and the FCC kind of sort of keep to themselves.
Renate said:
I've rarely seen lat/long on a CDMA signal
The LTE stuff only references cell number. You need a database to reference it to location.
Click to expand...
Click to collapse
The reason open signal public OSM databases only "essentially" suck is because they're averages from lots of people, so, for example, a tower might be on the wrong side of the railroad tracks or in the middle of a river on those open signal public OSM maps when it's not really the case - but they're still good enough to geolocate you to a general area were I to publish the unique number in the screenshots.
Renate said:
I have a few cell numbers hard-coded to named location.
I can't even find my current tower on https://www.opencellid.org/
Click to expand...
Click to collapse
My tower is almost always my own femtocell or my cellular repeater (both of which I have but usually the femtocell wins out), which is unique to me (which is why I'm worried about privacy).
Unless you're in my driveway, only I would be using that femtocell (I don't know how far out they go, but it's not more than a few hundred feet at the most, isn't it?).
Hi, I'm a new member of the forum and this is my first post.
I've read this thread and it's an interesting discussion about layers in global positioning. But I have a simpler question out of curiosity;
is there perhaps a way to work around this plugin (https://github.com/wongpiwat/trust-location) without root / only with developer option, since I haven't found any fake gps app that could fool/bypass this part.
Or do I have to use a custom ROM to accomplish it?

Categories

Resources