yashsingh1/xdaforums huggingface dataset:
[One (M7) General] J_M_V_S:
ON:

echo 1 > /sys/devices/virtual/android_usb/android0/f_diag/on

OFF:

echo 0 > /sys/devices/virtual/android_usb/android0/f_diag/on
[One (M7) General] stevedebi:
I've moved on to the M8, but I believe that has already been tried. I'm starting to think there is something different in the hardware, and HTC isn't providing any information that might help. I know that others have tried it based on the Samsung experiences.

Wishing folks luck, and I'll keep listening in on the progress.
[One (M7) General] andr240:
In DIAG mode and now QPST sees it. Have two ports:

COM8 APQ8064

COM9 SURF9615

Both labeled "HTC Diagnostic Interface" in device manager except the COM9 one has " - 9K" appended to the name. Which one do i select and how exactly do i do the backup?

UPDATE - I think i got it. Doing a backup as we speak where it's outputting a .qcn file.

"Status: Backing up NV memory from Phone"
[One (M7) General] tjsooley:
another way to get into diag mode is

adb shell

su

setprop sys.usb.diag.config diagon

---------- Post added at 07:53 PM ---------- Previous post was at 07:50 PM ----------

The one with the 9k
[One (M7) General] andr240:
Once this process is done, is it the "backup.qcn" file that i should upload? Also, somewhere i had read that i should XXX out my IMEI in the file. Where in the file is my IMEI? Figure i'd ask before i tinker
[One (M7) General] andr240:
Inside the attached zip file is my qcn backup done through RF_NV_MANAGER and then zeroing out my IMEI. The full backup file that I created through Software Download, i haven't been able to remove my IMEI. Hope this file helps for now
[One (M7) General] tjsooley:
It is the qcn. I would also like to know where imei is. I will upload att too
[One (M7) General] andr240:
I did two backups. One through "Software Download" and the second through "RF_NV_MANAGER". Respectively, the first one outputted a file that is viewable but haven't figure out how edit. The second was more of a process where I "read the phone", edit out my IMEI, and then save the resulting file. Through the RF_NV_MANAGER after you read from the phone all you have to do is look on the left where it'll say something like NV_IMEI and then on the right you'll see your IMEI so just 00 it out. After then you just write nv data to qcn file and then just name it
[One (M7) General] tjsooley:
Here is my ATT (NON AWS device) RF_NV_MANAGER backup Without IMEI.
[One (M7) General] tjsooley:
I am wondering why enabling diag mode gives you 2 com ports and what the non 9k port is for.

---------- Post added at 07:28 AM ---------- Previous post was at 07:27 AM ----------

Read this. It was just posted on the Qualcomm device thread.

http://xdaforums.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059

---------- Post added at 08:06 AM ---------- Previous post was at 07:28 AM ----------

Even using the correct 1877 code for t-mobile htc one m7 it does not save in rf_nv_manager. I writed and saved then just reread without rebooting and the value reverted. we must be missing a step
[One (M7) General] tjsooley:
read this http://xdaforums.com/showpost.php?p=55672071&postcount=470
[One (M7) General] ayoshidage:
Can someone make a backup copy of the original ATT and then try to flash the TMOBILE one to see if it working? Try to use the same concept as the samsung dump file, and use that as a guide to backup and then restore on a ATT version and see if we can get the bands unlocked. Anyone tried using the TMOBILE qcn backup that was just posted here... To see if its working ?
[One (M7) General] ayoshidage:
This is the T-MOBILE AWS qcn backup file, can we try this on the ATT or Canadian version model, to see if we can restore this QCN and see if we get the bands? Obviously we would backup are original qcn first before trying this out. Did someone try this ?
[One (M7) General] tjsooley:
We need someone without a aws device who's on a network that uses aws. to test
[One (M7) General] SaHiLzZ:
I should have both devices for tests shortly. Will post back results. I have tried to write QCN and nvdata for line 1877 before with no results. The values disappear on restarts, worse than S3 mod (see my sig).

Anything other than trying to write entire tmobile m7 qcn on non-aws m7?
[One (M7) General] tjsooley:
Just writing the nv from t-mobile after entering your imei does not work. either their is some kind of write protection we need to disable or the k9 interface is not correct for what we need to change. I tried to connect the other interface and got a error invalid spc . so it looks like the other interface has some kind of spc other than all 0
[One (M7) General] ayoshidage:
I have M7 Telus unlocked, non AWS model, I have a AWS service but the problem is , its not restoring the T-Mobile QCN, whats makes the S4 qcn different, is the IMEI inside the mod too for that, or did the just remove the IMEI from that QCN thats used for the S4, im sure we can find a way somehow if we put our mind and effors into it.
[One (M7) General] SaHiLzZ:
So just tried to write QCN from AWS M7 to non-AWS M7, and also tried to write NV data file of all parameters, no effect.

Non-AWS phone was S-OFF, and RUU'd to Tmobile 4.4.3 latest.

Whats next?
[One (M7) General] tjsooley:
I read somewhere that if you install a verizon rom without firmware then you can edit the nv. that does not make any sense to me because the nv is in the firmware. but it may get us somewhere
[One (M7) General] ayoshidage:
So I guess nobody found a solution to this, common guys im sure we can get this thing working.
[One (M7) General] Product F(RED):
It sounds feasible considering that the software provides the interface to the hardware.
[One (M7) General] SaHiLzZ:
However the phone is acting as it is in read only mode
[One (M7) General] ayoshidage:
Im sure there is a solution to this method. Lets all work together lets get this thing working! We can do it guys!
[One (M7) General] J_M_V_S:
Count me in for testing as I ran out of ideas really!
[One (M7) General] Product F(RED):
You mean values don't stick in QXDM/QPST? According to a guide I read, you have to write "0" to the field to enable writing. Then you put in the actual value and write that.
[One (M7) General] tjsooley:
Still doesn't work
[One (M7) General] SaHiLzZ:
Which guide?
[One (M7) General] Product F(RED):
http://xdaforums.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059

If you scroll down, you can see its even been used to enable some LTE bands on the Verizon M8.
[One (M7) General] tjsooley:
I think we may have some kind of anti tamper code in the kernels that prevent the writes from sticking. Someone with kernel compiling experience should try to compile a new sense kernel from source. I would gladly test. The thing is most sense roms use modified kernels and not kernels compiled from htc source.
[One (M7) General] oksagi:
Already tried to change NV items from AOSP rom like PA latest
[One (M7) General] tjsooley:
Does anyone know how to enable qxdm? I tried fastboot oem enableqxdm 0 and it doesn't

I am trying to make a qpst backup of the efs to see if we can enable aws for hspa
[One (M7) General] SmiLey497:
Found this, don't know if it's useful.

##3424# (##DIAG#) is for the DIAG mode.

Taken from http://xdaforums.com/showthread.php?p=23075405
[One (M7) General] WorldIRC:
I would want to try this too if we find out
[One (M7) General] short/y:
Has anybody tried to change the modelid to the T-Mobile US modelid (PN0713000) using the ENG HBOOT and the writemid command (fastboot oem writemid PN0713000)? That may be the key. See http://xdaforums.com/showthread.php?t=2322313, http://xdaforums.com/showthread.php?t=2321613 as we well as a few other threads in this section
[One (M7) General] WorldIRC:
Would be great if this is all it takes!
[One (M7) General] sovanyio:
Anyone in DFW want to be the guinea pig? There's an ice cold beer in it for you! haha
[One (M7) General] short/y:
I'd try this myself if I had the time -- I'm waaaayyyy too cautious and. between backups, checking and re-checking things, it would take me probably 3-4 hours from beginning to end, even though the actual process itself should probably take more more than 30 minutes. I may have time this weekend to give it a try. If I do, I'll post back on my process and results.

BTW, does anyone have a stock US Developer Edition HBOOT? I've taken a backup of mine with dd but I'd like to have a flashable zip of the stock 1.44.0000 from/for my specific platform (there's that extreme caution, again!)
[One (M7) General] WorldIRC:
If any Canadians within WIND / Mobilicity / Videotron coverage want to test, they could too.

Currently, if you do a network scan, those 3 networks will not appear (as they operate ONLY on AWS HSPA). If this tweak works, then those 3 carriers, plus all the others in Canada should appear).
[One (M7) General] SaHiLzZ:
As there is no TMOB RUU to run...the assumption is that changing MID & CID to TMOB US should get 3G AWS on ATT/DEV/INT HTC ONE?
[One (M7) General] WorldIRC:
Changing the MID and CID is required to install the RUU (otherwise device mismatch occurs). No guarantees changing the MID / CID alone is enough to enable the bands (assuming it is possible at all) but who knows, perhaps this is a required step.
[One (M7) General] MegaMan X:
If it was this easy to get the t-mobile radio, how come nobody has posted it yet? Just curious.

Isn't there anyone with a s-off, rooted, terminal installed, t-mobile htc one that could perform the above (and be willing to post) ?
[One (M7) General] Hunt3r.j2:
I can guarantee that the Dev edition and ATT versions have hardware support for the AWS WCDMA band. The problem is that it needs to be enabled, and the software block might not be able to be removed.
[One (M7) General] PcFish:
There are radio images in the T-Mo forum. It is easily flashable, it just doesn't activate the band.
[One (M7) General] short/y:
Correct. Prior to having S-OFF, I flashed the T-Mobile radio but still only had LTE and the 1900MHz refarmed network on my Dev Edition device. I ran that way for several weeks until I flashed a newer International radio. Bands are still the same for me. Now that we have S-OFF, I tried changing CID (via the fastboot command .. I didn't hex edit any partitions) but that changed nothing. If this phone's radio is hardware identical to the T-Mobile US version, I figure modelid is the next most likely thing to change. If that doesn't do it then we're left iwth two possibilities: 1) the radio is NOT hardware identical or 2) there is something else somewhere that tells the radio to use the other bands.
[One (M7) General] WorldIRC:
In the case of Samsung, uploading a QPST backup via the Qualcomm software is the ONLY way to enable AWS HSPA on compatible Samsung handsets (because the radios on the models are identical in those cases).

It is possible an RUU from T-Mobile (with S-OFF, CID, and ModelID) would be deep enough to enable the appropriate radio frequencies, but as we do not have this RUU we cannot test. The only OTHER test we could do in the interim is to have a T-Mobile handset user with S-OFF change CID and Model ID to a non-Tmobile one, flash the RUU from say, the dev model, and see if AWS HSPA is still working. If it stops working, then we know the solution to our problem. If AWS continues to work on the T-Mobile device (which for all intents would no longer be a T-Mo device) then we are left with two possibilities: Qualcomm software is required for direct-firmware modification OR the hardware is indeed different.
[One (M7) General] stevedebi:
Do you have a source for this guarantee?
[One (M7) General] Hunt3r.j2:
Yes. AWS LTE means AWS WCDMA support. This has been shown in the iPhone 5 and Nexus 4.
[One (M7) General] stevedebi:
I assume your source is the specs listed on the HTC website then. I thought you might have seen something definitive.

AWS in this case means LTE on the 1700 band, that is entirely different from AWS indicating HSPA+, used only by TMO (1700/2100). That is an entirely different radio usage.

The unlocked and dev models already support AWS LTE.

There have been some posts (with pictures) showing different motherboard chips (NOT the radio chips) on the various models (but I'm not sure they were different between the ATT & TMO boards). Also, and HTC rep said they were different hardware (but I don't always believe those folks - no offense intended if they are reading this)!
[One (M7) General] Hunt3r.j2:
No, you don't understand. If you build radio band support for AWS LTE, the power amplifiers used support AWS WCDMA by default. That's how the Nexus 4 magically had AWS LTE support, and how the ATT model iPhone 5 magically sprouted AWS WCDMA support when moved to TMobile despite no SKU or model number change.

ATT is requiring all phones sold on their network to have AWS LTE but a lock on the AWS WCDMA band.
[One (M7) General] stevedebi:
I had not heard of the Iphone 5 having the AWS support; I'd assumed some kind of hardware change. I'm hoping you are correct. I have the TMO version, but a lot of folks opted for the dev model (I almost did).

I can see the logic, since the ATT uses the 2100 band differently, and the AWS LTE uses the 1700 band.
[One (M7) General] tjsooley:
just to rule out the kernel completely. someone should try to flash back to JB. and see if the changes stick
[One (M7) General] SaHiLzZ:
Tried it on 4.1.2, phone won't accept any nv changes in restart. All values are same as before.

There must be key somewhere which enables the phone to accept changes, just need to find out what .
[One (M7) General] jasalta387:
Has anyone tried this for enabling bands on the M7?

http://xdaforums.com/galaxy-s5/general/how-to-add-rf-lte-frequency-bands-to-t2886059
[One (M7) General] tjsooley:
Yep their is no way to add bands to the m7. Their is a hardware lock on them.
[One (M7) General] myztikal47:
Has there been any development in finding a solution to this issue yet? Or is it still stuck at a standstill? Thank you in advance!
[One (M7) General] Paul_Days:
AT&T M7 on T-Mo

Hello Guys,

My case might be a tad bit simpler. I am wanting to use the T-Mo 3G bands (900/1900) on my AT&T M7 UL.

I am unlocked, Rooted, S-OFF.... 4.3, Sense 5.0
[One (M7) General] Product F(RED):
T-Mobile US?

T-Mobile US uses 1700/2100 (together; Band 4) and 1900 (Band 2). Band 2 is enabled on the AT&T variant because that's one of AT&T's primary frequencies.
[One (M7) General] Paul_Days:
So.... I cant run T-Mo 3G on this device, I only get EDGE?
[One (M7) General] Product F(RED):
If you use this phone on T-Mobile US, you'll get LTE for sure (they use Band 4 and Band 2 as main bands) and you'll get HSPA+ on 1900 MHz. For a few years now, they've been rolling out "4G" (3G/HSPA+) on 1900 MHz. So yeah, you can get LTE and EDGE on T-Mobile US with AT&T devices.
[One (M7) General] Paul_Days:
Then what do I have to do, for I only seem to be getting EDGE on it.... did APN, tried flashing radios.... Do i have to swap ROMs? or use an aftermarket one?
[One (M7) General] Product F(RED):
Do you have LTE where you are? Anywhere with LTE also has HSPA+ 1900 MHz. If you're not there's nothing you can do. Make sure APN is fast.tmobile.com
[One (M7) General] slavasz:
I hope it helps (Ontario, Canada), three phones:-

HTC One (M7) locked to Rogers:

1. with Fido SIM card shows Fido, Fido-EXT, Fido-EXT, WIND :) ;

2. with Wind SIM card shows "Network locked, type PIN to unlock SIM",

3. typed PIN to unlock, unlocked, reboot,

4. huge disappointment :( , shows roaming, sees only WIND Away, TELUS and Bell.

Nexus 5, locked to Fido:

1. with Fido SIM card shows Fido, Fido-EXT, Fido-EXT, WIND :) ;

2. with Wind SIM card registers on Wind (no roaming) and works without problems!

HTC One S locked to Fido:

1. with Fido SIM card shows Fido, Fido-EXT, WIND :) ;

2. with Wind SIM card shows "Network locked, type PIN to unlock SIM",
[One (M7) General] Hunt3r.j2:
Nope. There was no model nor SKU change. Exactly zero hardware was changed, that's why Apple didn't change the model number from ATT to TMobile.

The difference is a software lock.
[One (M7) General] WorldIRC:
In the case of Apple though the software lock on the bands was so deep they did have to release a new version from the facrory simply with deep level software revision to enable the bands.

Sent from my HTC One
[One (M7) General] cschmitt:
mmcblk0p17 is the radio_config partition, there might be something in it that holds the key. For instance dump the partition and have a look around 0x100000 you see something like this on an ATT One:

QCT_UMTS_RADIO_VER=1
DisH=4
EnableHTCENS=1
AGPSNVSetting=1
EnDTM=0
MSCMode=10
HSDPACat=14
HSUPACat=6
IMEISVN=2
GEA3=1
CIQ=0
LTEFGI=1577974912
CMSUPPORT=0
EnableLTEBANDSCANPRI=1
QCT_UMTS_RADIO_END=1
[One (M7) General] WorldIRC:
I wonder if this is simply a readout or if it is modifiable pre-defined conditions.
[One (M7) General] cschmitt:
Well...., if you check inside a decrypted rom.zip you'll find a little file named rcdata.img (i.e. radio config data ?) that contains:

ATT ruu:

QCT_UMTS_RADIO_VER=1
DisH=4
EnableHTCENS=1
AGPSNVSetting=1
EnDTM=0
MSCMode=10
HSDPACat=14
HSUPACat=6
IMEISVN=3
GEA3=1
CIQ=0
LTEFGI=1577974912
CMSUPPORT=0
EnableLTEBANDSCANPRI=1
QCT_UMTS_RADIO_END=1

Dev Edition ruu:

QCT_UMTS_RADIO_VER=1
DisH=4
EnDTM=1
HSDPACat=14
HSUPACat=6
IMEISVN=1
LTEFGI=1578105984
QCT_UMTS_RADIO_END=1

Which leads me to believe that it can be written to the radio_config partition during RUU (or manually edited ??) and that it does has significance.

Would like to see what's inside p17 partition at 0x100000 on a TMO model.
[One (M7) General] grim489:
I have a T-Mobile HTC One and I tried looking for something similar to what you posted above, this is what mine shows. I'll go ahead and upload it as well because I really don't know anything about anything haha

DisH=4

AGPSNVSetting=1

EnDTM=0

MSCMode=10

HSDPACat=24

HSUPACat=6

IMEISVN=1

GEA3=0

LTEFGI=1594883200

QCT_UMTS_RADIO_END=1
[One (M7) General] WorldIRC:
Quite a few different figures in yours compared to ATT / Dev

How do I get this info? I'll run it for my TELUS model (which should be similar to ATT / Dev).
[One (M7) General] cschmitt:
One thing that stands out up front is HSDPACat (HSDPA category.) For TMO is 24 (64 QAM, duel-cell 42.2Mbps) and ATT is 14 (64 QAM, single-cell, 21.1 Mbps).

This makes sense as AT&T doesn't support dual channel HSPA.

The other one is LTEFGI (LTE feature group indicators, http://niviuk.free.fr/fgi.php) Just convert the numeric value from decimal to binary and read the bit values from the website (left to right). That might shed some light on LTE functionality.
[One (M7) General] stevedebi:
That is rather strange, since the ATT and dev are supposed to be basically the same device, radio wise.

---------- Post added at 10:35 PM ---------- Previous post was at 10:34 PM ----------

Yes, but saying that the Applie Iphone 5 was built to support both does not translate over to what HTC may have done.
[One (M7) General] Hunt3r.j2:
Dev edition software is based on international RUU. Many of those settings are based on ATT request.

No, it's hardware. If you have the power amplifiers for AWS LTE, those same power amplifiers are going to be used for AWS WCDMA. The proof is out there.
[One (M7) General] stevedebi:
Oh, the HTC folks got it wrong again. The Dev is hardware identical to ATT... they had said identical.
[One (M7) General] Hunt3r.j2:
Stop being obtuse. The hardware is identical. The only difference is software.
[One (M7) General] WorldIRC:
Like I said earlier, the big difference with Apple is the software changes were so low level that only the most recent serial #s would be compatible due to a factory level software update (which is not possible for the end user to do themselves at home).

But given we're dealing with HTC here, I remain hopeful a solution will be found.
[One (M7) General] Hunt3r.j2:
Yes, that's definitely true. The goal right now is to see whether we can get rid of the software lock.
[One (M7) General] stevedebi:
I didn't realize I was being obtuse, just passing along (mis)information from HTC.

EDIT: And no offense meant, but I don't see how insulting people adds to the content value of the thread.
[One (M7) General] WorldIRC:
Come on guys -- let's get back on track :cowboy:
[One (M7) General] matuka123:
Is the developer edition same as the unlocked international version? Would be cool to have HSPA+ enabled on my HTC ONE. I now always have HSPA on my one. ;) (801n Version unlocked)

EDIT:stevedebi I saw those posts and i understand. But is HTC one dev edition = HTC one unlocked international version? I think it is.

I hope someone will make some modification or something so that HSPA+ can be used. Please =(.
[One (M7) General] stevedebi:
That was actually the discussion a few posts ago. The Dev is hardware identical to the US ATT model.
[One (M7) General] ainstein001:
Seems 1700 HSPA+ band doesnt seem to be activated after flashing with the t-mobile radio under S-OFF conditions. See my other post.

http://xdaforums.com/show...4&postcount=84

I tried this phone in downtown Los Angeles and was getting LTE 20+mbps speeds BEFORE and AFTER flashing the t-mobile radio. Therefore the LTE bands are fine regardless of radio. The only thing is 1700 HSPA+ isn't enabled at all.
[One (M7) General] emailer33:
Well it would seem that every one of the AWS unlocks involves flashing the Qualcomm chip. Do we have any idea how we can go about dumping this or obtaining one, let alone putting our phone into "diag" mode to be able to flash a new one?
[One (M7) General] ainstein001:
Have a look at the following website which is a method for enabling the HSPA+ band for the galaxy s4. If such a method is applicable to the HTC One, then we might have a chance!

http://galaxys4root.com/galaxy-s4-t...aws-bands-on-att-galaxy-s4-sgh-i337sgh-i337m/

Ill see if i can use this method to dump my .qcn file.

--Cheers!
[One (M7) General] ericdjobs:
Erm, guys..

There was a post from someone who works at HTC who straight up said that the t-mobile edition has very very slight hardware differences, I believe it was either amps or baseband... and that it is not possible to be modded in software.

You can probably find the post if you search, but I can't recall it off the top of my head..

Honestly, if this was possible, it would have been done by now with s-Off and all.

I'm just glad I got the T-MO version, as it seems to be the more 'complete'... it really doesn't make sense why they would do it this way... maybe ATT paid HTC to do this, as to encourage less people switching to TMO (For international and dev editions)?

Anyhow, I think we should all make the best effort to write HTC at every email we can find until some sort of engineer can give us a concrete answer. I honestly think it would have been achieved by now if it was possible, though
[One (M7) General] emailer33:
I am attempting to install PhoneUtil.apk with no luck at the moment. Always says "App not installed." Going to try to sideload it here in a bit and see if adb throws a proper error. For the record I have a Dev edition on T-Mobile's network currently, and can only access the EDGE network. Not re-farmed and no LTE here.

[EDIT] error is "missing shared library". It relies on sec_platform_library which is included on Samsung roms. It'd be awesome if the creator of that app would release the source so we could see if it can be adapted to our phones.
[One (M7) General] stevedebi:
I also saw those posts. There is a possibility that flashing a rru file will work. But we won't have one until 4.2.2 is released by T-Mobile .
[One (M7) General] ainstein001:
Yeah I have a Dev Edition too. No go with the phoneutil.apk. Seems it is samsung specific. Like you said if there was one for the htc one. Isn't there a code you could use in dialer to access some sort of hidden menu? I remember something called flexnet mode for the htc one X.