yashsingh1/xdaforums huggingface dataset:
[Verizon Samsung Galaxy S III] mybook4:
Thank you for the clarification.

Back when the whole IMEI thing had everyone worried, I used QPST 2.7.323 (to my knowledge the most recent available version at the time) to back up all of my NVItems. I never wrote any NVItem data to my i535, only backed up. I had followed this thread:

http://xdaforums.com/showthread.php?p=29461812#post29461812

I never was required to input any sort of password to obtain the NVItems data.

I wasn't aware of "Samsung Test Mode". Good find and awesome thread you linked to!

During the IMEI issue/investigation, I used an NVBackup command to backup my nvitems. Through adb (I hate typing shell commands on an on-screen keyboard), I ran "sudo reboot nvbackup". This rebooted the phone and displayed a message (blue text above the samsung logo) that stated it was copying "modemst1 and modemst2" to "fsg and backup". I wonder if the touchwiz menu you mentioned does something similar. I imagine it would.

I worked with marcustaz to grab the NVItems from his i747. I provided some backup steps using QPST Configuration to back up the NVItems. Last I heard from marcustaz, he had successfully backed up his NVItems into a qcn file and censored out his IMEI. I'll be sure to post when I have more info from him (or maybe he will). As qcn data contains user-specific data, I'd like to make sure that marcustaz removes all the user-specific stuff before we dig into the file for comparison to the i535 NVItems. If marcustaz is ok with sharing the censored file, I think it'd be very beneficial to share with those who can/want to help.
[Verizon Samsung Galaxy S III] marcustaz:
Hey bro I emailed you the backup this morning. Did you get it?
[Verizon Samsung Galaxy S III] mybook4:
Just checked now. WOW, gmail said you were spam. It couldn't have been more WRONG! I'm taking a look now.
[Verizon Samsung Galaxy S III] marcustaz:
Doesn't suprise me I use a hotmail account as well lol... Got to get break free! :eek:
[Verizon Samsung Galaxy S III] mybook4:
I'm looking through the file now. At first glance, staring me in the face, are a bunch of NVItems that say WCDMA_1900. This is promising!
[Verizon Samsung Galaxy S III] marcustaz:
Let me know if you need anything else. I have DFS as well. Whatever you need. :thumbup:
[Verizon Samsung Galaxy S III] mybook4:
Ok, will let you know. Thanks again!

PS, you have a new PM

---------- Post added at 08:34 PM ---------- Previous post was at 08:33 PM ----------

Under Phone Model, Configuration Name, the Feature mask bit definitions are identical between the i747 and i535
[Verizon Samsung Galaxy S III] mybook4:
i747 has 1285 NVItems

i535 has 1030 NVItems

NV Items unique to the i535 (i747 does not list these items):

Coming soon...
[Verizon Samsung Galaxy S III] mybook4:
Items unique to the i747 (i535 does not list these items): PART 1

Coming soon...
[Verizon Samsung Galaxy S III] mybook4:
Items unique to the i747 (i535 does not list these items): PART 2

Coming soon...
[Verizon Samsung Galaxy S III] E:V:A:
You'll have a difference in number of NV-items because one of you is using a very outdated QPST build, you have to use the same and it has to be the latest available! (2.7.378) There's absolutely no telling on what they might have added or left out, even after reading the change log... Then, like Autoprime said, there will be differences that "should" be there and not modified.

Second, please put your dumps within "code" (#) tags and use font-size "2" or use a "pastie"-like link.

I suggest you edit those posts above, before someone starts quoting them and also make sure you use the same version of QPST.
[Verizon Samsung Galaxy S III] mybook4:
I'll run another QPST backup after work and will edit the previous entries.

Just wanted to grab some high level stuff before digging deeper.

I think our best bet is trying to do something similar to what you did before (use qpst's built in capabilities for adding a frequency band). We could then tweak the newly created entries to better match att things like TX power, etc.
[Verizon Samsung Galaxy S III] autoprime:
mybook, you used QPST Config > Software Download > Backup tab to save the *.QCN file? Using QPST build 378 I get hung up at 16% (Reading roaming lists) like many users report on the forums. I did notice though that it did get thru all of the NV items before the error. Either way my QCN file is broken and does not work.

Instead we have to use QPST EFS Explorer. Using EFS explorer I am able to pull 630 NV items.. much less than what VZW/ATT seems to have based on what you've posted above.

Looking forward to seeing a diff of the missing NV items on the VZW device.
[Verizon Samsung Galaxy S III] marcustaz:
i'm on 378 let me know if you need another dump.
[Verizon Samsung Galaxy S III] Yura80:
Hi guys,

I'm trying to do the same thing for HTC Rezound and already have results: it somewhat works on AT&T.

Take a look at this thread

Did someone already try this trick with S3?

Also I would really appreciate if you can make a RF NV dump with DFS CDMA Tool (not QPST!) from a Verizon and/or AT&T S3 (there are instructions here) and share the NVM file. It might be very helpful for the Rezound.
[Verizon Samsung Galaxy S III] E:V:A:
Here is the latest DFS: DFS 4.0.0.5.rar
[Verizon Samsung Galaxy S III] ac21365:
Wow, that's all you changed? While I'm a bit intimidated by CDMA Tool, if we could get some steps to try the AWS bands, I'd be willing to work with someone to do it over IM's or skype. I could also give 1900 a shot come Tuesday since I have my Fuze to use for phone stuff (while the S3 is down waiting on the co-worker has the AT&T sim I've mentioned earlier in this thread).

I eagerly await to see if anything comes of this. Great work Yura80 on the Rezound.

*edit* Also, I know you had signal issues with AT&T's WCDMA signal.. I have 2 T-Mobile and an AT&T tower I can get within about 50' of, so if we do try this, signal strength shouldn't be an issue as far as getting it to work goes (although I do understand we'll very likely need the same proper RF calibration the Rezound needs from an AT&T/T-Mobile phone to get things working perfectly)
[Verizon Samsung Galaxy S III] Yura80:
S3 may be already calibrated for all HSPA bands or at least for 850/1900, like Droid Bionic. You may just need to write the proper value into item 1877 and it'll work.

---------- Post added at 02:51 PM ---------- Previous post was at 02:35 PM ----------

BTW, does this discussion also refer to 850 MHz HSPA/UMTS band used by AT&T along with 1900 MHz?

Or S3 already works on 850 MHz and you just need 1900/1700?
[Verizon Samsung Galaxy S III] ac21365:
The only WCDMA band it operates on 'out of the box' is 2100. Nobody is sure whether we have the proper hardware for WCDMA 850/1700, but the assumption was that the hardware that runs 2100, might also be coaxed into operating on 1900.

If we get 850/1700 working as well, that would be icing on the cake.
[Verizon Samsung Galaxy S III] Yura80:
You DO have the proper hardware for WCDMA 850/1900 if GSM 850/1900 works. 1700 is questionable.

What I could achieve on my Rezound is 850 and 1900, but not 1700.
[Verizon Samsung Galaxy S III] newuser134:
Exactly what I was saying in the beginning posts of this thread, I can confirm 100% that gsm 850 AND 1900 both work, so now we have 2 people that agree if gsm works on one band, wcdma will also work on that band, it's just a question modulation / software, so the hardware is there. Yura80, thank you for this post confirming what I've been to confirm for a long time. I agree, the AWS 1700 is questionable, because we don't have a known gsm band to compare to, but we know 850 and 1900 both work on gsm "out of the box" right now. Mybook and E:V:A, you guys have been unbelievable when it comes to figuring out the code, specially mybook on the NV items, I believe with the incredible work you are doing, we are not that far from getting this to work soon.
[Verizon Samsung Galaxy S III] mybook4:
E:V:A and Autoprime are much more knowledgeable than I when it comes to this stuff. Although I'm hoping my contributions will help. Sometime this weekend I plan on doing the more thorough NVDump method I was informed of (I'm not near my pc right now).

We are all working together to reach the goal. We have all contributed in some way. I'm in favor of leaving the bounty part out of this knowledge sharing effort. Just my two cents. I don't want to throw the whole thread off topic. Just sharing the thought. If I am able to get this thing done, it wouldn't be without the help of others, so I won't accept any money. Instead I would ask others to spend time helping out another research effort (similar to the rezound thread) or simply donating to one of the contributors who don't actually own or use our phone (but are nonetheless helping us).
[Verizon Samsung Galaxy S III] ac21365:
Curiosity got the best of me and I went in and looked at the hex value for that NV Item. As I figured, it's significantly different from the start, so I didn't fiddle with it.
[Verizon Samsung Galaxy S III] Yura80:
It is NOT significantly different. Go ahead and change it to 87 03 E8 04 00 00 02 00. Or you can try 87 03 E8 04 00 00 00 00 first.

Also, please do the RF NV dump for me.

---------- Post added at 03:18 PM ---------- Previous post was at 02:29 PM ----------

Here is the explanation of what the bits of this NV item mean:

Thus, the "magic value" for HSPA 850/1900 is 8703E804,and for 850/1900+1700 is 8703E806.

Credits for figuring this out go to the Droid Bionic forum
[Verizon Samsung Galaxy S III] shaananc:
I did write that NV Item but now no signal... ah well

and for reference the original was 87 68 01 87
[Verizon Samsung Galaxy S III] ac21365:
Awesome info!

Did your signal return when you changed back to the original values?
[Verizon Samsung Galaxy S III] shaananc:
Yes, I can get it to return without much problem.

It is possible I'm writing the values in incorrectly using RF NV Manager,

I've been writing in 3804 or 3806 into item 1877 and leaving 1878 as 87
[Verizon Samsung Galaxy S III] E:V:A:
Great job! But it's almost embarrassing that nobody (including me) made a proper search for this on XDA! Shame on us!

Anyway, 4 things:

1) Where did you get that document? (Is it available somewhere?)

2) What is the breakdown of the 8-bytes vs the bits shown? I.e. what bits correspond to what bytes?

87 03 E8 04 00 00 02 00
=
0x8703E804 = 10000111 00000011 11101000 00000100
0x00000200 = 00000000 00000000 00000010 00000000

3) Table 6-2 only lists 32 bits (4-bytes) of the full 64 bits, what are the other ones?

4) I'm surprised if none of the other NV-items are involved. What about the check-sum NV-items and the others as I indicated in my post #79 ??
[Verizon Samsung Galaxy S III] shaananc:
Further update: setting the item to 87 68 01 87 should've enabled a few more bands though it seems not the needed ones. I still have reception with this combination, am going to try adding a few more bits here and there and seeing by trial and error what works.

UPDATE: 87 68 09 87 still working, seems to be slightly faster on a speedtest. still not very significant.

UPDATE: 87 68 29 87 is a few more bits...

UPDATE: Top speeds so far are with 87 68 e9 87

It seems the 15th bit (band class 11) when enabled is knocking out the signal, I could enable all the other bits from my original nv combined with the one provided that was a candidate
[Verizon Samsung Galaxy S III] ac21365:
Doesn't appear that changing these values sticks after restart. For me it reverts back to the 87 01 68 00... upon restart.

Yep, followed your steps here: http://xdaforums.com/showthread.php?t=1914122 and I can't get any of the changed values to hold through a restart.. they always revert back to stock.
[Verizon Samsung Galaxy S III] shaananc:
Using the QPST Service Programming application there is a tab called UTMS which allows band selection much more easily than manually writing the NV Item, maybe we should take a look there?
[Verizon Samsung Galaxy S III] Yura80:
Guys, will someone finally upload the RF NV dump I've been asking for?

Pleeeease!

---------- Post added at 02:08 AM ---------- Previous post was at 02:02 AM ----------

Too bad. Probably, the firmware overwrites it on restart.

But, will it read back right after you write it? If you click "Write selected item", and then "Read range" and click the item again, is the value still there? That DFS NV tool is kind of buggy and sometimes it needs several attempts to actually write.

---------- Post added at 02:25 AM ---------- Previous post was at 02:08 AM ----------

My understanding is that 1877 item defines the bands supported by phone (i.e. set on factory and not supposed to be changed), and the UMTS page sets which of them the software should use (i.e. might be used by some band selection menu). My Rezound has all boxes checked there.
[Verizon Samsung Galaxy S III] ac21365:
Mind giving a bit more info? Using CDMA Tool 4.0.0.5, I can get the values to stick, but the radio shuts off until I restart, at which point the NV item value reverts back to stock. A little insight as to what you're doing to allow the items to survive a restart would be great.

And Yura80, sent you a PM. Also note, I have turned off the radio before writing the NV Item, but it still needs a restart.
[Verizon Samsung Galaxy S III] shaananc:
No guarantees it was actually running of the NV item I put in but I was using the field test menu to disable the radio then turn it on again after each try. Perhaps I wasn't actually changing the NV properly?
[Verizon Samsung Galaxy S III] Yura80:
I've finally got NV dump from Verizon S3.

Unfortunatelly, absolutely all NV_WCDMA_800_*, NV_WCDMA_1900_* and NV_WCDMA_BC4_* items are missing (never written).

This is different from Rezound, where about a half of 800/1900 items originally had some values.
[Verizon Samsung Galaxy S III] E:V:A:
How did you reach that conclusion? (What tools did you use?)

Because if you use QPST you're on thin ice, we should use latest possible QXDM. And if you look in there, you will find that WCDMA 800 items belong to the "Factory" category. This I take to mean that they are supposed to be supplied by factory image and not service provider dependent...

In any case, if you have these NV-items you should share them on some "pastie" link, so we all can follow and compare. I'm still waiting for someone to dump the difference and similarities in NV-items for the i747 vs i535. It's not that hard to do...

Also, I'd like to know if there are any other "NV" files laying around in the SGS3 filesystem? Someone could try something like:

find / -iname "*NV*"

and see what comes up...

Here are the NV-item categories:

[SIZE=2]5000^"Categories"^-1^100000
5001^"Obsolete"^-1^5000
5002^"Security"^-1^5000
5003^"System"^-1^5000
5004^"AMPS"^-1^5000
5005^"CDMA"^-1^5000
5006^"Data"^-1^5000
5007^"Debug"^-1^5000
5008^"Display"^-1^5000
5009^"Factory"^-1^5000
5010^"GPRS"^-1^5000
5011^"GPS"^-1^5000
5012^"GSM"^-1^5000
5013^"HDR"^-1^5000
5014^"RF CDMA"^-1^5000
5015^"RF DFM"^-1^5000
[COLOR=Red][B]5016^"RF PCS"^-1^5000[/B][/COLOR]
5017^"Sounds"^-1^5000
[COLOR=Red][B]5018^"WCDMA"^-1^5000[/B][/COLOR]
5019^"AAGPS"^-1^5000
5020^"MediaFLO"^-1^5000
5021^"WLAN"^-1^5000
5022^"DTV"^-1^5000
5023^"LTE"^-1^5000
100000^"Known NV Items"^-1^-1
100001^"SIRIUS GSM PA Ramp Low"^-1^5000
100004^"SIRIUS GSM Burst Ramp"^-1^5000
100005^"SIRIUS GSM RF Other"^-1^5000
100006^"SIRIUS WCDMA RF Other"^-1^5000
100007^"SIRIUS GSM PA Ramp High"^-1^5000
100008^"SIRIUS Factory"^-1^5000
100012^"ODM UI Settings"^-1^5000
100026^"VOIP"^-1^5000
100037^"QCAMERA"^-1^5000
100062^"B1"^-1^5023
100063^"B13"^-1^5023
100064^"B17"^-1^5023
100065^"B40"^-1^5023
100066^"B7"^-1^5023
100067^"SNS"^-1^5000
[/SIZE]

Here is the entire list of NV-items as used in QXDM 3.12.714.0.

Here are the accompanying descriptions.

However, since that version of QXDM is a bit outdated and not including the neither the MSM8660 nor MSM8960, it is very likely that there have been many more items added, edited or made obsolete for the MSM8960. The highest model number covered by that version is 4059 ("Gobi3000 UMTS"), whereas the QPST 2.7.378 has models up to 4074 ("QSC11x5 CDMA+GSM").

Here is a list of some Qualcomm Model Numbers:

[SIZE=2]4074 QSC11x5 CDMA+GSM
4073 QSC11x5 CDMA
4072 APQ8064
4071 7627A-WinMob
4070 MDM9615
[COLOR=Red]4069 SURF8960[/COLOR]
4068 7627A-ANDROID (renamed from: SURF7627A)
4067 SURF7227A
4066 SURF7625A
4065 SURF7225A
4064
4063
4062 APQ8060
[COLOR=Red]4061 MSM8660 [/COLOR]
4060 MSM8260
4059 Gobi3000 UMTS
4058 SURF6210
4057 SURF6610
4056 SURF6215
4055 SURF6615
4054 <Reserved>
4053 MDM6600-SURF
4052 MDM8220
4051 MDM9200
4050 MDM9600
[/SIZE]
[Verizon Samsung Galaxy S III] mybook4:
I've been really busy lately (wedding and job interview). Tomorrow and Thursday I should be able to find the time to dump i535 NV Items and compare to an i747 dump (if marcustaz still has his i747).

How exactly should we obtain the NV Items for comparison? QPST? QXDM? DFS? It is mentioned that we should use QXDM, but it also mentioned that it is possibly too outdated. I am very willing to help, but I would like to solidify a method (since it needs to be repeated on both the i535 and the i747). Guidance is greatly appreciated.

I have an i747 QPST 2.7.378 NV Item QCN backup and can create an i535 QPST 2.7.378 NV Item QCN backup easily, but is that what we want (as 2.7.378 lists support for the SURF8960, not the MSM8960)?

If not QPST, then QXDM? I did a "search all forums" search on XDA for QXDM 3.12.714.0 and found nothing but this thread. Are there any tutorials/guides/etc associated?

I imagine we want to use DFS to write back any changes made to i535 NV Item related EFS files (if/when we get that far), but for now should we be using DFS to obtain NV Items for both the i535 and i747 for comparison?
[Verizon Samsung Galaxy S III] marcustaz:
I still have the i747 and I am here to help :thumbup:
[Verizon Samsung Galaxy S III] E:V:A:
Added link to QXDM 3.12.714...
[Verizon Samsung Galaxy S III] mybook4:
From my device. I took out all the obviously non pertinent stuff (files associated to some of my apps).

Noticed the following:

/efs/FactoryApp/test_nv
/efs/FactoryApp/hist_nv

http://dl.dropbox.com/u/56104625/NVItem Research/findnv.txt

---------- Post added at 10:12 PM ---------- Previous post was at 10:07 PM ----------

I will try QXDM next. Is there a guide of some kind I should follow?

I did grab a censored i535 QPST 2.7.378 dump.

Part 1 of 2 (NV Items below 3500) http://pastebin.com/HM6Dg6Ej

Part 2 of 2 (NV Items above 3500) http://pastebin.com/tuihVmK9

And the censored i747 QPST 2.7.378 dump (thanks marcustaz).

Part 1 of 3 (NV Items below 2000) http://pastebin.com/y7FWJRKN

Part 2 of 3 (NV Items below 4500) http://pastebin.com/FcW9a60h

Part 3 of 3 (NV Items above 4500) http://pastebin.com/H5nF4Fjj

Made a list of QPST specified NV Items that were in the i535 dump but NOT the i747 dump.

http://pastebin.com/zgEfmn0Q

Made a list of QPST specified NV Items that were in the i747 dump but NOT the i535 dump.

http://pastebin.com/x5pwMjBA

Made a list of QPST specified NV Items that were in both the i535 and i747 dumps.

http://pastebin.com/Txruuuws

Made a list of QPST specified NV Items that were in both the i535 and i747 dumps but have different data.

http://pastebin.com/BUwcYu8v

Seems to be a lot of WCDMA 1900 and 800 related items. Hopefully it helps.
[Verizon Samsung Galaxy S III] Yura80:
Just a quick look at the NVF dump in DFS.

Yes, it makes sense, because RF calibration is not provider dependent. However, the manufacturer may not calibrate the device for RF bands it's not supposed to be used on.

BTW, some 800/1900 items are in the Factory category and others are in WCDMA. In my Rezound most of the Factory items have values, and in i535 all of them are not set. This may mean that i535's radio code was compiled without any support for these bands. Or may not.

I'm pretty sure that WCDMA 800/1900 RF items are the same. Maybe something new has been added (i.e. to support higher data rates), but basic stuff remains the same.

I'm attaching NVF dumps for Bionic (complete RF calibration for 800/900/1700/1900/2100 wcdma bands), Rezound (calibratred for 900/2100 and some 800/1900 items) and Verizon S3 / i535 (2100 only). Use DFS to open them. For item number to name resolution use qxdm, or this link.
[Verizon Samsung Galaxy S III] E:V:A:
I agree with this.

You seem to be missing a lot of NV-items after ~4000...

@ALL: Things to do.

a) Someone need to compare NV-items (dumps) between QPST, QXDM and DFS for the same device, preferably for the i747 as it seem to have more items that we are interested in. We need this to verify that we're not missing any items, due to software. Please post results in Pastebin links as they allow for larger files, and will remain even after your dropbox links are removed...

b) Next, I suggest to have a closer look at the lower range (0-1000) items to look for some "settings" items, that may influence the selection and HW or what not. I tried to use the DiffNow service on the full NV dumps above. It works but almost crashed Firefox...when using too many tabs. Also note their 1MB file limit.

c) We need to better understand some of these NV items. Can someone post a link to the document used to grab that image of NV-descriptions a few pages back? We are mostly concerned with lower range settings, not the calibration items.

d)

Eventually

some brave soul should:

- 0. Back-up original NV items to a safe place!

- 1. Replace only relevant differences of the i535 vs. i747 NVs.

- or 2. Add only items found in i747 but not already in i535, to i535 NVs

- or 3. Replace all relevant i535 NVs with those of i747

("Relevant" is key word here. Don't do this yet!)
[Verizon Samsung Galaxy S III] preusstang:
Not sure if you guys would be interested or not but I found a user on rootzwiki who has a dev edition i535 and said he is willing to do an NV dump to help our cause. I'm curious if anything other than the boot loader has been modified..

http://rootzwiki.com/topic/35020-dump-i535oyalg1-dev-edition-verizon-sgs3/page__st__40
[Verizon Samsung Galaxy S III] E:V:A:
Can you post part of the content of these:

[FONT=Verdana]/persist/.bt_nv.bin
/efs/FactoryApp/test_nv
/efs/FactoryApp/hist_nv[/FONT]

(you might need to use hexdump in case they are binaries...)
[Verizon Samsung Galaxy S III] E:V:A:
Being able to read Chinese wouldn't hurt...

And if somebody could figure out how to download this QRCT...
[Verizon Samsung Galaxy S III] mybook4:
i535 /persist/.bt_nv.bin

http://pastebin.com/jj1s00YD

i535 /efs/FactoryApp/test_nv

http://pastebin.com/u669gc9f

i535 /efs/FactoryApp/hist_nv was empty

Also,

I updated the QPST NV Item dump links. They are now pastebin links (although due to size limitations, I had to split into multiple parts).
[Verizon Samsung Galaxy S III] mybook4:
I briefly looked through the QXDM user's guide. I can read individual NV Items in the NV Browser, but is there a safe and efficient way of reading all items at once? Does the verizon galaxy s series "password" autoprime mentioned need to be entered before reading NV Items? If so, how would one input this password in QXDM?

Using DFS, is it better to get the EFS file or the NV Items? Both?

Do we also want to use QPST EFS Explorer 378 to copy/backup all EFS files?

Sorry for all the questions, I realize that, like you said, "we need data to verify we're not missing any items due to software", but I don't want to waste time with anything that isn't needed. I want to make sure that I am getting the right/pertinent data using the right method. We could use the same data collection method on the i747 to ensure we have an "apples to apples" comparison with the i747.
[Verizon Samsung Galaxy S III] E:V:A:
Sorry, but someone else would have to answer those questions, because I don't own any of these devices. Not even anything close (w. Snapdragon S4)...
[Verizon Samsung Galaxy S III] mybook4:
Updated post 152 to show data differences between QPST dumps of i535 and i747.