[Verizon Samsung Galaxy S III] mybook4:
Good ideas. Thanks everyone for contributing!

It's possible (to trace the boot process), but I don't think it'll be easy. At this time, I am still unaware of where the actual NV Item 1877 is stored. I've searched the entire root file structure for a file named "1877" (which is the name of the file in EFS Explorer), but haven't found it. The Synergy Backup Script backs up the Modemst1, Modemst2, EFS, backup, and fsg partitions, but I wasn't able to find the NV items when opening those partitions in a hex editor. E:V:A pointed out in another post that the NV Items might be compressed or possibly even encrypted. So far, we can only access the items by setting the device to the modem mode and using an NV editor such as DFS.

If we were to know how the NV items were stored on the device, the following is a guess at how we might find the code responsible for reverting NV item 1877. This isn't very practical right now as we can try other things. I'm not a JTAG guy, and the following might not be able to be done.

If someone knows where item 1877 is stored, then maybe we could use JTAG to set a break point when that location is written to. We could then see what code is being executed at the time of the write. Depending on the location of the code writing the file (for example if it is in the modem or kernel partition), we might be able to modify that line and prevent 1877 from being reverted to the factory setting on reboot. There are partitions we can't modify as partitions prior to the kernel partition still check for proper samsung signature (aka, locked bootloader prior to the aboot partition).

All that seems WAY too intensive for a first stab. There are other things we can try before going down that route. Such as the following:

As skrypj pointed out in another post, it is possible to have GSM work on the i535 after flashing an AOSP based ROM (i747 CM10 ROM in this case). Since AOSP based ROMs/kernels differ from the TW stock ROMs/kernels, this could help us determine whether or not 1877 is being reverted by the stock rom/kernel or whether it's done at a lower level (bootloader or modem partition).

The first step is to see if we can get EDGE using the i747 CM10 ROM on the i535.

skrypj,

1) were you able to modify the i747 CM10 updater-script (so that it would flash on d2vzw), re-zip, and flash successfully? If not, PM me and I can modify and re-zip.

2) If you were able to flash the i747 CM10 on the i535, are you able to get EDGE with the AT&T SIM card installed? Note: you may have to use the phone info app or (*#*#4636#*#*) from the dialer to set preferred network type to GSM only, GSM auto (PRL), or WCDMA preferred. The APNs should be correct as this is an AT&T CM10 ROM, but I would use an app from the play store to view the APNs just to make sure they are right. Marcustaz, which app were you using to look at / edit APNs?

3) If the answers to the above are "yes", then send me a PM and I can help you use DFS to modify item 1877. We can then reboot and see if item 1877 is reverted on reboot. If it is reverted, chances are lower level code is changing the item (maybe the modem partition) and we have to keep looking for solutions. If it isn't reverted then I can help you use DFS to do an NV Item "dump". This will copy all of your NV Items to a file called an NVF file. I can then edit that file to add NV Items associated to 1900Mhz WCDMA and send it back to you. You could then write that file back to the i535, reboot, and test for WCDMA capabilities.

Marcustaz, so far we've used EFS Explorer and DFS to modify 1877. We should try using QPST and QXDM. Email me and we can try this out. We won't need the Straight Talk SIM for this.