[Samsung Epic 4G Touch] autoprime:
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Everything between the lines was originally in the OP as part of the unsolved, [Q] Enabling USB Modem(Diag) Mode on Samsung CDMA Devices w/ AOSP thread.

Currently on the Epic 4G Touch SPH-D710 we are not able to put the phone into USB Modem/Diag mode while using an AOSP rom. This is normally toggled through the PhoneUtil apk with *#*#8778#*#*. To this date, the fix has been to restore back to a stock Touchwiz rom or to boot a Touchwiz rom off the SD card. To my knowledge, outside of the Nexus S 4G(SPH-D720), no CDMA Samsung AOSP roms have USB Modem mode working. This thread is being created to help solve this issue.. for ALL SAMSUNG CDMA DEVICES. Modem/Diag Mode works on HTC, Motorola, LG.. it should work for Samsung devices too ;)

USB Modem/Diag Mode establishes a serial-over-usb connection which allows us to use special Qualcomm tools like QPST and QXDM to talk to our phones. We can access the hidden EFS partition including the non-volatile memory to edit all sorts of values.. we also use this for updating PRL's.. etc etc. It has it's value.. although Samsung and the carriers don't want us in there ;)

I see USB Modem mode in AOSP being possible in two ways.

1. Since the Nexus S 4G(SPH-D720) on Sprint is on AOSP and has working USB Modem/Diag mode.. figure out how the NS4G achieves this mode.

2. Use a hardware jig of some sort to boot into USB Modem/Diag mode.

1. For the software side of things here's some highlights I've come across..

a. Logcat of Nexus S 4G(SPH-D720) while toggling USB Modem/USB modes - http://pastebin.com/TfcSHzYB

b. In terminal emulator/ADB we have "radiooptions" command with some interesting output. QXDM Enable/Disable is what interests me in there. QXDM enable would seem to allow the phone to interface with QXDM.. QXDM requires a USB Modem(Diag) Connection to talk to the phone. Attempting the "radiooptions 3" command does nothing(even on the NS4G). Only command that does seem to work is Radio_Off which requires a reboot to get working again.

0 - RADIO_RESET
1 - RADIO_OFF
2 - UNSOL_NETWORK_STATE_CHANGE
[B] 3 - QXDM_ENABLE
4 - QXDM_DISABLE[/B]
5 - RADIO_ON
6 - SETUP_PDP apn
7 - DEACTIVE_PDP
8 - DIAL_CALL number
9 - ANSWER_CALL
10 - END_CALL

c. Use manual commands to enable/disable the USB Modem/Diag mode as TheBeano has shown us here in his Fun with resistors (home/car dock mode + more) thread.

You can see what the current state is with this command:

cat /sys/class/sec/switch/usb_sel

You can change the state with:

echo PDA> /sys/class/sec/switch/usb_sel
or
echo MODEM> /sys/class/sec/switch/usb_sel

Currently on the E4GT SPH-D710 enabling MODEM and then connecting the device to Windows results in no connection/USB detection at all. Phone is detected in PDA mode only. In addition, using the PhoneUtil menu(*#*#8778#*#*) and setting the USB mode to "Modem" has no effect at all.

2. As for the hardware side of things, I've been reading through XDA and came across some interesting threads in the SGS2 I9100 forums. A post by E:V:A specifically that mentions putting the phone into different modes by using resistors.. which I suppose would be the same thing as the jig's people have been using to reset their ODIN flash counts.. only using different resistors: Kernel serial console on I9100.

301K looks to be what we use for the standard jigs. that is documented here: [GUIDE] How to Make a USB Jig and Get Rid of Yellow Triangle+ODIN Counter reset. I wonder if there is a mode we can force which establishes USB Modem mode ON and then use serial-over-usb.. like how it works when we set Diag mode in touchwiz roms. AdamOutler has thread dealing with the E4GT pinouts etc.. not sure if this would help at all: Processor datasheets required(E4GT SPH-D710)

xOM_0=pin E3
xOM_1=pin D2
xOM_2=pin C3
xOM_3=pin E4
xOM_4=pin F2
xOM_5=pin A3
xOM_6=pin F3

I have no idea if anything I've said helps... just putting some ideas out there and hopefully get some people who DO actually know this more advanced stuff to join in ;) I have HTC phones, LG phones, multiple Samsung devices.. Epic(SPH-D700), NS4G(SPH-D720), E4GT(SPH-D710). I can provide any logs needed for those devices.

Random references to Diag mode and AOSP on CDMA devices:

Cannot enter Sprint ## CDMA codes on dialer, need DIAG mode! (HTC AOSP DIAG)

Updating PRL on CM7 (Samsung CDMA AOSP)

Epic Dialer Codes working on CM7

DIAG ##3424# using an AOSP ROM CM7 (Various CDMA HTC methods mentioned)

QPST DIAG Mode CM7 Aka ##3424 (HTC Droid Incredible ADR6300)

Fun with resistors [home/car dock mode + more] (Manually enable/disable UART)

-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

It seems the more we compare notes.. the more we see how different the I9100 and SPH-D710 really are. Without getting into technical specifics I can give you a reason why some things are so different... which is how CDMA and GSM differs really. Looking at "security" alone.. GSM uses a SIM card to authenticate on the network.. outside of the IMEI(which seems to be rather accessible on your devices) the SIM card contains most of info the network is looking for. On our devices CDMA devices, ALL of the authentication info is stored on the device itself. Carriers/Manufacturers do NOT want use touching the hidden EFS partition.. where all of our authentication values reside.. ESN/MEID, EVDO username/passwords, PRL.. etc etc. So now, the main key to accessing this hidden partition... USB Modem(Diag) Mode!

I have taken some screenshots of Windows Device Manager. Far left is my Device Manager with no phone plugged in. Middle is phone plugged in but USB Mode is set to "PDA". Right side is phone plugged in and USB Mode set to "MODEM".

You can see the difference in the device manager... USB Modem mode giving us a serial diagnostic COM port. This COM port is ONLY available when the phone is set in this specific mode. ONLY when the diagnostic COM port is available can we use Qualcomm software to view the hidden EFS partition of our devices and start to tweak things. For the above image I used a Nexus S 4 G(SPH-D720) which naturally runs on AOSP and has this USB Modem mode working. This mode also work on Touchwiz roms. It does NOT work on AOSP in any other Samsung CDMA phone(the purpose of this thread).

I hope this sort of explains why our phone may be "locked down" a bit more due to how CDMA works... and also explains how I am sure that we need this USB Modem mode toggled.. and that I am positive Windows is set up properly etc etc. The issue is that we can not force the phone, while using an AOSP rom, into this diagnostic serial mode.