[Android Software Development] bigrushdog:
My apologies for not responding sooner. I forgot to subscribe ;( . I'd like to try and clear up my previous post as well as try to shed some light on this topic. First, I'm by no means a telephony expert. I've read some of your other threads and found them remarkable. I write Java and do feature development in a AOSP project. I currently am doing telephony work on Samsun Sprint CDMA devices including galaxy nexus, nexus s, and working on s3. As you know, those use the VIA chipset. However, working through the Android radio layer makes that irrelevant, for the most part. I've also worked with Autoprime on some telephony/modem/ril matters.

First some code and background on what I have done on Sprint Galaxy Nexus. These are some code fragments from my CDMATools app.

Manifest:

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="org.teameos.settings.device"
android:sharedUserId="android.uid.system"
android:versionCode="1"
android:versionName="1.0" >

Of importance if the android.uid.system uid. This allows the app to access the phone process, which is required for PhoneFactory.getDefaultPhone(); The following activity queries ril for a Master Subsidy Lock code (msl)

<activity
android:name=".MslActivity"
android:label="@string/msl_activity"
android:process="com.android.phone" >
<intent-filter>
<action android:name="android.intent.action.MAIN" />
<category android:name="android.intent.category.DEFAULT" />
</intent-filter>
</activity>

And the actual method which is used to query the radio...

private void checkMSLCode()
{
ByteArrayOutputStream bytearrayoutputstream;
DataOutputStream dataoutputstream;
bytearrayoutputstream = new ByteArrayOutputStream();
dataoutputstream = new DataOutputStream(bytearrayoutputstream);
try {
dataoutputstream.writeByte(main_cmd_hidden);
dataoutputstream.writeByte(OEM_SUB_CMD_GET_MSL);
dataoutputstream.writeShort(device_short);
if (isTuna) {
dataoutputstream.writeByte(OEM_SUB_RAW_MSL);
}
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
mPhone.invokeOemRilRequestRaw(bytearrayoutputstream.toByteArray(),
mHandler.obtainMessage(GET_MSL_DONE));
}

A snipit of the handler code to receive and process incoming messages from radio.

mHandler = new Handler() {
public void handleMessage(Message message) {
Log.i(LOG_TAG, "MSL response incoming!!");
AsyncResult asyncresult = (AsyncResult) message.obj;
if (asyncresult.exception != null)
{
Log.i(LOG_TAG, "AsyncResult Exception Occur!!!");

} else
if (asyncresult.result == null)
{
Log.i(LOG_TAG, "ar.result == NULL! - No answer for MSL response");
} else
{
byte abyte0[] = (byte[]) (byte[]) asyncresult.result;
String s = new String("");
for (int j = 0; j < 6; j++)
s = (new StringBuilder()).append(s).append((char) abyte0[j]).toString();
Intent intent = new Intent().setAction(getString(R.string.msl_action));
intent.putExtra(getString(R.string.msl_key), Integer.parseInt(s));
mContext.sendBroadcast(intent);
finish();
}
}

};

I have been able to get the raw commands from RE'ing various device proprietary apk's. Of importance to this topic is this checkMSLCode() function. This is the equivalent of raw AT commands, but being passed though the Android radio layer. From looking at the code for that AT command application you posted in the OP, it uses a similar structure. In fact, if time permits, i'm confident i can expand on it and make it somewhat more robust. One problem is see is finding an effective way to interpret the AT command responses from the radio. Requests often get a response in different forms, thus requiring a unique handler for each function. Of course, we could always do a Object.toString() to the log and try to decipher it. I hope this info sheds some light on the topic. I'll post when I come up with more.

Edit: also I should note, i build this apk inside of my AOSP repo, so it sees all the internal api automatically. I'm now looking at using reflection to do some telephony stuff, but it's proving rather tricky.