[Verizon Samsung Galaxy S III] mybook4:
rehpyc has been working on one. I've sent him some info that I discovered trying to find the right system call to switch between 3g and 4g.

Rather than simply be disappointed, would you like to help?

I'm trying to find where the settings (which can be accessed in the phone info -> Device Information area) are stored.

-Using dex2jar and jdgui, I decompiled the phone info app into java source (.java) files. It's a really small app that just calls the "TestingSettings" functionality of the SecSettings.apk

-We can access the "TestingSettings" by simply running "am start com.android.settings/.TestingSettings" in terminal. It essentially does the exact same thing as launching the Phone Info app.

-Using dex2jar and jdgui, I decompiled the SecSettings.apk into java source (.java) files. Digging through the files, I found that the RadioInfo class. This class contains a String array mPreferredNetworkLabels which lists all the settings in the spinner we choose the network type (CDMA Auto (PRL), LTE/CDMA/EvDo, etc). This class seems to provide functionality for listening to GUI changes on the "PreferredNetworkType" spinner. Not exactly sure what it does from there, but hopefully it can be traced down to some methods that either store the settings into a file or to a SQLite database.

In dex2jar -> JD gui for SecSettings.apk, Radioinfo class has

public RadioInfo()

{

String[] arrayOfString = new String[14];

arrayOfString[0] = "WCDMA preferred";

arrayOfString[1] = "GSM only";

arrayOfString[2] = "WCDMA only";

arrayOfString[3] = "GSM auto (PRL)";

arrayOfString[4] = "CDMA auto (PRL)";

arrayOfString[5] = "CDMA only";

arrayOfString[6] = "EvDo only";

arrayOfString[7] = "GSM/CDMA auto (PRL)";

arrayOfString[8] = "LTE/CDMA/EvDo";

arrayOfString[9] = "LTE/GSM/WCDMA";

arrayOfString[10] = "Global";

arrayOfString[11] = "LTE only";

arrayOfString[12] = "LTE/WCDMA";

arrayOfString[13] = "Unknown";

this.mPreferredNetworkLabels = arrayOfString;

}

RadioInfo.java sets the network type in the following code (lines 297-309):

AdapterView.OnItemSelectedListener mPreferredNetworkHandler = new AdapterView.OnItemSelectedListener()

{

public void onItemSelected(AdapterView paramAnonymousAdapterView, View paramAnonymousView, int paramAnonymousInt, long paramAnonymousLong)

{

Message localMessage = RadioInfo.this.mHandler.obtainMessage(1001);

if ((paramAnonymousInt >= 0) && (paramAnonymousInt <= -2 + RadioInfo.this.mPreferredNetworkLabels.length))

RadioInfo.this.phone.setPreferredNetworkType(paramAnonymousInt, localMessage);

}

public void onNothingSelected(AdapterView paramAnonymousAdapterView)

{

}

};

The key line is line 303:

RadioInfo.this.phone.setPreferredNetworkType(paramAnonymousInt, localMessage);

Some info about the setPreferredNetworkType() method:

void setPreferredNetworkType(int networkType, Message response);

Requests to set the preferred network type for searching and registering (CS/PS domain, RAT, and operation mode)

Parameters:

networkType one of NT_*_TYPE

response is callback message

The phone data member is a private data member set to null on line 422:

private Phone phone = null;

The phone data member is set to the Default Phone on RadioInfo object creation (onCreate) in line 916:

this.phone = PhoneFactory.getDefaultPhone();

Based on the above information, I believe we would need to create a toggle which would execute a small java program to access the setPreferredNetworkType() method from a Phone object instantiated from the PhoneFactory.getDefaultPhone() method. I believe Phone resides in com.android.internal.telephony, but in order to gain access to the internal android stuff we would need to do something like the following article provides:

https://devmaze.wordpress.com/2011/01/18/using-com-android-internal-part-1-introduction/

That's all the time I have for the moment...