[Android Software Development] E:V:A:
So I have not yet had time to modify OP app or using bigrushdog's CDMAtools. But I will soon. In the meantime I just post the internals for the _OEM_HOOK_ statements.

The code base is here:

https://android.googlesource.com/platform/frameworks/base.git/

So from the JellyBean RIL.java:

[SIZE=2]public void invokeOemRilRequestRaw(byte[] data, Message response) {
RILRequest rr = RILRequest.obtain(RIL_REQUEST_OEM_HOOK_RAW, response);
if (RILJ_LOGD) riljLog(rr.serialString() + "> " + requestToString(rr.mRequest)
+ "[" + IccUtils.bytesToHexString(data)
+ "]");
rr.mp.writeByteArray(data);
send(rr);
}
public void invokeOemRilRequestStrings(String[] strings, Message response) {
RILRequest rr = RILRequest.obtain(RIL_REQUEST_OEM_HOOK_STRINGS, response);
if (RILJ_LOGD) riljLog(rr.serialString() + "> " + requestToString(rr.mRequest));
rr.mp.writeStringArray(strings);
send(rr);
}[/SIZE]

And the expected response can be found in the ril.h:

[SIZE=2]#define [B]RIL_REQUEST_DATA_REGISTRATION_STATE[/B] 21

/**
* RIL_REQUEST_DATA_REGISTRATION_STATE
*
* Request current DATA registration state
*
* "data" is NULL
* "response" is a "char **"
* ((const char **)response)[0] is registration state 0-5 from TS 27.007 10.1.20 AT+CGREG
* ((const char **)response)[1] is LAC if registered or NULL if not
* ((const char **)response)[2] is CID if registered or NULL if not
* ((const char **)response)[3] indicates the available data radio technology,
* valid values as defined by RIL_RadioTechnology.
* ((const char **)response)[4] if registration state is 3 (Registration
* denied) this is an enumerated reason why
* registration was denied. See 3GPP TS 24.008,
* Annex G.6 "Additonal cause codes for GMM".
* 7 == GPRS services not allowed
* 8 == GPRS services and non-GPRS services not allowed
* 9 == MS identity cannot be derived by the network
* 10 == Implicitly detached
* 14 == GPRS services not allowed in this PLMN
* 16 == MSC temporarily not reachable
* 40 == No PDP context activated
* ((const char **)response)[5] The maximum number of simultaneous Data Calls that can be
* established using RIL_REQUEST_SETUP_DATA_CALL.
*
* [/SIZE]The values at offsets 6..10 are [COLOR=Blue][B]optional LTE[/B][/COLOR] location information in decimal.[SIZE=2]
* If a value is unknown that value may be NULL. If all values are NULL,
* none need to be present.
* ((const char **)response)[6] is TAC, a 16-bit Tracking Area Code.
* ((const char **)response)[7] is CID, a 0-503 Physical Cell Identifier.
* ((const char **)response)[8] is ECI, a 28-bit E-UTRAN Cell Identifier.
* ((const char **)response)[9] is CSGID, a 27-bit Closed Subscriber Group Identity.
* [COLOR=Red]((const char **)response)[10] is TADV, a 6-bit timing advance value.[/COLOR]
*
* LAC and CID are in hexadecimal format.
* valid LAC are 0x0000 - 0xffff
* valid CID are 0x00000000 - 0x0fffffff
*
* Please note that registration state 4 ("unknown") is treated
* as "out of service" in the Android telephony system
*
* Valid errors:
* SUCCESS
* RADIO_NOT_AVAILABLE
* GENERIC_FAILURE
*/

#define [B]RIL_REQUEST_OEM_HOOK_RAW[/B] 59

/**
* RIL_REQUEST_OEM_HOOK_RAW
*
* This request reserved for OEM-specific uses. It passes raw byte arrays
* back and forth.
*
* It can be invoked on the Java side from
* com.android.internal.telephony.Phone.invokeOemRilRequestRaw()
*
* "data" is a char * of bytes copied from the byte[] data argument in java
* "response" is a char * of bytes that will returned via the
* caller's "response" Message here:
* (byte[])(((AsyncResult)response.obj).result)
*
* An error response here will result in
* (((AsyncResult)response.obj).result) == null and
* (((AsyncResult)response.obj).exception) being an instance of
* com.android.internal.telephony.gsm.CommandException
*
* Valid errors:
* All
*/

#define [B]RIL_REQUEST_OEM_HOOK_STRINGS[/B] 60

/**
* RIL_REQUEST_OEM_HOOK_STRINGS
*
* This request reserved for OEM-specific uses. It passes strings
* back and forth.
*
* It can be invoked on the Java side from
* com.android.internal.telephony.Phone.invokeOemRilRequestStrings()
*
* "data" is a const char **, representing an array of null-terminated UTF-8
* strings copied from the "String[] strings" argument to
* invokeOemRilRequestStrings()
*
* "response" is a const char **, representing an array of null-terminated UTF-8
* stings that will be returned via the caller's response message here:
*
* (String[])(((AsyncResult)response.obj).result)
*
* An error response here will result in
* (((AsyncResult)response.obj).result) == null and
* (((AsyncResult)response.obj).exception) being an instance of
* com.android.internal.telephony.gsm.CommandException
*
* Valid errors:
* All
*/

[SIZE=2]#define [COLOR=Purple][B]RIL_REQUEST_RADIO_POWER[/B][/COLOR] 23

/**
* RIL_REQUEST_RADIO_POWER
*
* Toggle radio on and off (for "airplane" mode)
* If the radio is is turned off/on the radio modem subsystem
* is expected return to an initialized state. For instance,
* any voice and data calls will be terminated and all associated
* lists emptied.
*
* "data" is int *
* ((int *)data)[0] is > 0 for "Radio On"
* ((int *)data)[0] is == 0 for "Radio Off"
*
* "response" is NULL
*
* Turn radio on if "on" > 0
* Turn radio off if "on" == 0
*
* Valid errors:
* SUCCESS
* RADIO_NOT_AVAILABLE
* GENERIC_FAILURE
*/
[/SIZE]
[/SIZE]

The last one seem to imply that there could be other "bytes" to be read from that data[] array... Some suggestions have been the Transmitted power... But this was assuming a Qualcomm based modem, so there is no telling if there is another standard there. We don't know...