[T-Mobile Samsung Galaxy S 5] tom1283:
Bored and thought I would help expand the menus. I don't know enough to be of any other help. Maybe this will help you stumble onto something. I went through the menus on a G900T1. If I get more time I'll try to add to it.

ServiceMode
MAIN MENU
[1] PROTOCOL STATE
PROTOCOL MENU
[1] BASIC INFORMATION
[2] AS INFORMATION
[3] ETC
menu not exist
[4] NAS INFORMATION
NAS INFORMATION
[1] MM INFORMATION
[2] GPRS INFORMATION
[3] REJECT INFORMATION
[4] BACKOFF FPLMN
[5] SMC RESULT INFO
[6] CALL END CAUSE
[5] SIM INFORMATION
SIM INFORMATION
[1] GENERAL INFO
[2] QMI UIM STATUS
[3] CHECK NV
[6] PROTOCOL SIMULATION
PROTOCOL SIMULATION
[1] KPI
[2] UE SETTING & INFO
UE SETTING&INFO MENU
[1] SETTING
UE SETTING MENU
[1] PROTOCOL
UE SETTING PROTOCOL MENU
[1] AS
AS CONFIGURATION
[1] FREQUENCY LOCK
FREQUENCY LOCK
[1] WCDMA FREQ LOCK
Current CH: FULL
[1] Set freq full
[2] Set IMT2K BAND Channel
[3] Set PCS 1900 BAND Channel
[4] Set AWS BAND Channel
[5] Set 850 BAND Channel
[6] Set 900 BAND Channel
[7] Set PSC
[2] GSM FREQ LOCK
Current CH: FULL
[1] Set Freq Full
[2] Set EGSM 900 BAND Channel
[3] Set PGSM 900 BAND Channel
[4] Set PCS 1900 BAND Channel
[5] Set DCS 1800 BAND Channel
[6] Set 850 BAND Channel
[3] LTE FREQ LOCK
Current CH: FULL
[1] Set freq full
[2] Set LTE BAND2
[3] Set LTE BAND3
[4] Set LTE BAND4
[5] Set LTE BAND5
[6] Set LTE BAND7
[7] Set LTE BAND17
[8] Set PCI Lock
[4] GSM BARR CONTROL
GSM CELL BARR CHECK is ON
please reboot the phone
[5] CDMA FREQ LOCK
CDMA Channel Lock (TEST_SYS)
Current channel = 1091880
USE 'Key input' of MENU for set
[6] TDSCDMA FREQ LOCK
FEATURE DISABLED -
FREQ_LOCK_TDSCDMA
[7] RESET
[2] RELEASE VERSION
RELEASE VERSION CONTROL
[1] UE REVISION LEVEL
REVISION CONTROL
[1] REV LEVEL R99 ()
[2] REV LEVEL R97 ()
[3] REV LEVEL R5 ()
[4] REV LEVEL DYNAMIC (*)
[2] WCDMA RRC VERSION
RRC(HSPA) CONTROL
[1] R99(HSPA OFF) ()
[2] R5(HSDPA ONLY) ()
[3] R6(HSDPA/HSUPA) ()
[4] R7(HSPA+) ()
[5] R8(HSPA+) (*)
[3] LTE 3GPP REL/CA CONTROL
RELEASE VERSION CONTROL
[1] LTE 3GPP REL 9 (*)
[2] LTE 3GPP REL 10 ()
[3] CA ENABLE ()
[4] CA DISABLE (*)
[3] DUAL MODE IMPROV.
DUALMODE IMPROVEMENT
[4] DRX CONTROL
DRX CONTROL
[1] DRX ON (*)
[2] DRX OFF ()
[5] SECURITY CONTROL
SECURITY CONTROL
[1] FAKE SECURITY ON ()
[2] FAKE SECURITY OFF (*)
[3] CIPHERING ON (*)
[4] CIPHERING OFF ()
[5] INTEGRITY ON (*)
[6] INTEGRITY OFF ()
[6] AMR CONTROL
AMR CONTROL
[1] WB AMR Status
[2] WB AMR Setting
WB AMR Settring
[1] UMTS WB ENABLE (*)
[2] UMTS WB DISABLE ()
[7] LTE FGI FILE CONTROL
LTE FGI FILE CONTROL
[1] FGI FILE STATUS
[2] FGI FILE DELETE
[8] ACQ DB DELETE
ACQ DB DELETE
[1] LTE ACQ DB DELETE
[2] WCDMA ACQ DB DELETE
[2] NAS
NAS CONFIGURATION
[1] NETWORK CONTROL
[2] AUTO ANSWER
[3] SELLOUT SMS
[4] DUN ENABLE/DISABLE
[5] LTE RELATED SETTINGS
[3] CDMA
CDMA CONFIGURATION
[1] DATA SYNC
[2] (UN)BLOCK VOICE MT
[3] CHECK FACTORY CMD
[4] DATA
[5] EHRPD SETTING
[6] TEST_SYS
[7] RTRE CONFIG
[4] GCF
GCF CONFIGURATION
[1] GSM/(E)GPRS/WCDMA GCF ON
[2] CANCEL SETTING (GCF OFF)
[5] SIM
UE SIM CLASS CONTROL
[1] CLASS Status
[2] UMTS ON
[3] GSM ON
[6] GPS
GPS CONFIGURATION
[1] SMART ASSISTANT
[7] IMS
IMS CONFIGURATION
[8] TDSCDMA
TDSCDMA CONFIGURATION
[1] COT,RRM SET (NV947,69731)
[2] SGLTE SET
[2] SYSTEM
UE SETTINGS SYSTEM MENU #1
[1] SIMULATION
SIMULATION MENU
[1] MODEM ASSERT(RESET)
[2] SW WATCHDOG
[3] HW WATCHDOG
[2] FORCE EFS_SYNC
SYNC success. please reboot
[3] NV REBUILD
NV REBUILD MENU
[1] PROTOCOL, GPS, IMS NV
[2] SYSTEM STATIC NV ONLY
[3] ALL
[4] NV BACKUP TEST
[5] QXDM QUICK LOGGING TEST
[6] DIVERSITY CONTROL
DIVERSITY CONTROL MENU
[1] CDMA DIVERSITY CONTROL
[1] UMTS DIVERSITY CONTROL
[1] LTE DIVERSITY ONLY TEST
[7] SAR BACKOFF(SENSORS)
SAR BACKOFF MENU
[1] SAR BACKOFF FLAG
[2] SET SAR STATE
[8] SECUREBOOT STATUS
SECURE BOOT STATUS
Not support
[9] NEXT PAGE ->
UE SETTING SYSTEM MENU #2
[1] DIAG CONTROL
DIAG CONFIG
Not Support
[2] HSIC TEST
HSIC TEST
Not Support
[3] AUDIO
AUDIO MENU
[1] Push ACDB
[4] Ramdump Mode ON/OFF
Ramdump Mode ON/OFF
Not Support
[5] SS EFS Log
SS EFS Log
Not Support
[6] LTE TXPL DEBUG ON/OFF
LTE TXPL Debug On/Off
[1] LTE TXPL DEBUG ENABLE()
[2] LTE TXPL DEBUG DISABLE(*)
[2] INFORMATION
UE INFO MENU
[1] SW VERSION
SW VERSION MENU
[1] READ IMEI
[2] READ IMSI
[3] READ SW VERSION
[4] READ FTA SW VERSION
[5] READ ALL SW VERSION
[2] HW VERSION
HW VERSION MENU
[1] READ HW VERSION
[2] READ FTA HW VERSION
[3] CAL INFO
CAL INFO MENU
RF Cal Date : 2014.04.09
CAL DONE w SS PGM
[1] XO CAL INFORMATION
[2] RF CAL MODE (ET/APT)
[3] INTERNAL DEVICE CAL
[3] ETC
ETC MENU
[4] DEBUG SCREEN(OPEN)
DEBUG SCREEN
[1] BASIC INFORMATION
[2] NAS INFORMATION
[3] AS INFORMATION
[4] SIM INFORMATION
[5] CDMA DEBUG INFORMATION
[6] WB-AMR