[Galaxy S 4 Mini General] E:V:A:
Every time Samsung releases a new series of phones, they try to make

it just a little harder for us to find and enter the Service Mode (SM)

menus. Understandably the Service Mode menus allow you to access

functions on your phone directly related to its operation, from

selecting particular service providers, unlocking your SIM card,

changing default networks, bands and destroying your internal

non-volatile (NV) memory, that contain all your IMEI, RF, EFS

parameters, and to make a complete factory wipe and reset.

So this is not to play around with, randomly!

You have been warned.

On the other hand, it also provides extremely useful detailed

information about your mobile network, including all radio related

systems like GPS, WiFi, BlueTooth and NFC. Most of this information

is not available through the usual AOS Java API, and probably will

never be, as vendors consider this area as off-limits to users and

amateur developers.

Note:

All this info was obtained on a European

Samsung Galaxy S4-mini (GT-I9195 LTE)

But reported to work also on:

Samsung Galaxy S5 on US Cellular (SM-G900R4)

[SIZE=2]Baseband: I9195XXUBML4 [/SIZE]
[SIZE=2]Kernel: 3.4.0-2340422 [/SIZE]
[SIZE=2] se.infra@SEP-65 #1 [/SIZE]
[SIZE=2]Build: JDQ39.I9195XXUBML4 [/SIZE]
[SIZE=2]SE: SEPF_GT-I9195_4.2.2_0022[/SIZE]

Getting into Service Mode (SM)

On this particular model, you have to do this:

Go to dial pad and enter: *#0011#

This will initially take you to Service Mode and showing you

various signal status items, by default. But it's a locked

entry. So to unlock and go to the Main Menu do this:

==> [MENU] + [Back]

==> [MENU] + [Key Input] + "Q0"

==> <wait ~5-10 seconds>
​

Now you can hit the thank you button below!

I have not seen this solution anywhere else, and

it required some reversing...

Understading the ServiceMode Menu

<WIP>

This will take some time to investigate, so anyone

who already knows, please post in this thread.

The ServiceMode Menu Structure (brief)

Go to Post#2 for formatted menu structure and items.

[SIZE=2]MAIN MENU[/SIZE]
[SIZE=2][1] UMTS [/SIZE]
[SIZE=2][2] CDMA [/SIZE]
[SIZE=2][3] LTE [/SIZE]
[SIZE=2][4] SIM- Not Used. --> <E>[/SIZE]
[SIZE=2][5] DOCOMO DEBUG SCREEN [/SIZE]
[SIZE=2][6] run EFS SYNC() [/SIZE]
[SIZE=2][7] DEBUG SCREEN [/SIZE]

Some Important Codes

9900 SysDump

This is an important hidden code is that for making a wide range

of system dumps and changing many unknown logging functions.

This will give you a list of the following functions:

[SIZE=2]Menu Item Setting Description[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
[SIZE=2]Run dumpstate/logcat/modem log - logcat -v threadtime -b radio -d -f /data/log/radio_*.log[/SIZE]
[SIZE=2]Delete dumpstate/logcat [/SIZE]
[SIZE=2]Run dumpstate/logcat [/SIZE]
[SIZE=2]Copy Kernel Log to SD card [/SIZE]
[SIZE=2]Run CP based log [/SIZE]
[SIZE=2]Run Forced CP crash dump [/SIZE]
[SIZE=2]Copy to sdcard (include CP Ramdump) [/SIZE]
[SIZE=2]Debug Level Disabled/LOW - Change debug level [LOW/MID/HIGH][/SIZE]

[SIZE=2]CP Debugging Popup UI: Disabled [/SIZE]
[SIZE=2]Silent Log: Off dev.silentlog.on=(On,Off)[/SIZE]
[SIZE=2]Translation Assistant: Off persist.translation.assistant=(0,1)[/SIZE]
[SIZE=2]Low battery dump: Off [/SIZE]
[SIZE=2]Wakelock Monitoring: OFF [/SIZE]
[SIZE=2]TCP DUMP START ro.product_ship=(true,false) lucky_ril*.log[/SIZE]
[SIZE=2]Enable SecLog (currently disabled) persist.log.seclevel=(0,1)[/SIZE]
[SIZE=2]MTT Logging Setting: OFF persist.brcm.log=(sdcard,none) [Broadcom][/SIZE]
[SIZE=2]ACT data copy [/SIZE]
[SIZE=2]Exit [/SIZE]

9090 DIAG CONFIG

This is also important for changing the internal MUX used for

diagnostic debug output, to/from USB and UART.

[SIZE=2]DIAG CONFIG[/SIZE]
[SIZE=2][1] USB ( )[/SIZE]
[SIZE=2][2] UART (*)[/SIZE]
[SIZE=2][3] DBG MSG ON (*)[/SIZE]
[SIZE=2][4] DBG MSG OFF ( )[/SIZE]

Basically if you wanna use UART output, you will probably need

to build the MyWay box or use the correct resistance between

the USB ID and GND pins. (See my AnyWay thread.)

0808 USB Settings

This is by far the most important code to know, because it is used to determine,

what drivers are enumerated when connecting your phone to PC via USB cable.

Technically it is a multiplexer (MUX) switch which determine whether the USB

port is directly connected to the CP (Cellular/baseband Processor/modem),

or the AP (Application Processor). This also selects what device features will be

enabled once connected. Such as ADB, RNDIS, and DM (Diagnostic Mode) etc.

To change the mux settings on a Samsung S4/mini, use your dialpad

to get to the "USBSettings" menu, like this:

For AOS <= 4.2.2, without SELinux, use *#7284# or *#3424#.

For AOS >= 4.2.2, with SELinux, use *#0808#.

[SIZE=2]USB
( ) CP
( ) AP

USB Settings
( ) MTP
( ) MTP + ADB
( ) PTP
(o) PTP + ADB
( ) RNDIS + DM + MODEM
( ) RMNET + DM + MODEM
( ) DM + MODEM + ADB

[OK] [Reboot]
[/SIZE]

A few other service/secret codes

Similarly to my GT-I9300 "Secret Codes" thread, we find many of the

same codes present also in this phone. Do check that thread out, for

understanding how to find more codes relevant for your phone and AOS

version. Also note that most custom ROMs does not support all these,

as they are usually left out or forgotten about, since they are

vendor/modem specific.

Here I show only the most interesting & useful ones, and I have also

used the excellent website PhoneSpell to try to find sensible word

combinations for some of these numbers.

Now, many of these seem not to work at all, but they are present in

the ServiceMode application(s) code and rely on various other

properties being set before being available/activated. Another

type of block is is determined by the content of the EFS files:

/efs/FactoryApp/keystr

/efs/carrier/HiddenMenu

These can be set on a rooted phone by:

echo -n "OFF" > /efs/FactoryApp/keystr
echo -n "ON" >/efs/carrier/HiddenMenu
echo -n "ON" >/efs/FactoryApp/factorymode

(Somebody need to confirm the KeyString block boolean!)

Here is list of some particularly interesting properties that often

seem involved in blocking/enabling particular ServiceMenu

items/features.

[SIZE=2]property value/note[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
[SIZE=2]ril.tcpdumping=On [On,Off][/SIZE]
[SIZE=2]ril.OTPAuth=true OTP Authentication key is 6 random digits long[/SIZE]
[SIZE=2]ro.build.type=eng [eng, user]][/SIZE]
[SIZE=2]ro.cp_debug_level= [0x5500,0x55FF] [/SIZE]
[SIZE=2]ro.csc.sales_code=CHM [NONE, <many otehrs> ][/SIZE]
[SIZE=2]ro.csc.country_code= [KOREA, Unknown, ...] KOREA allows extra menu item: "IMS"[/SIZE]
[SIZE=2]ro.product_ship=false [true,false][/SIZE]
[SIZE=2]ro.product.model= [/SIZE]
[SIZE=2]ro.factorytest=1
dev.silentlog.on= [0,1][/SIZE]
[SIZE=2]persist.radio.lteon=true [true,false][/SIZE]

And here are some of the codes:

[SIZE=2]code mnemonic description[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
[SIZE=2]06 - IMEI[/SIZE]

[SIZE=2]00112 [/SIZE]
[SIZE=2]0228 0BAT Battery status (ADC, RSSI reading)[/SIZE]
[SIZE=2]0514 - [/SIZE]
[SIZE=2]0599 -[/SIZE]

[SIZE=2]1234 - FW Versions for AP,CP,CSC[/SIZE]
[SIZE=2]123456 -[/SIZE]
[SIZE=2]1575 - GPS test[/SIZE]
[SIZE=2]1111 - FTA SW Version [/SIZE]
[SIZE=2]2222 - FTA FW Version[/SIZE]
[SIZE=2]8888 - [/SIZE]
[SIZE=2]9090 - USB/UART MUX debug switch[/SIZE]
[SIZE=2]99007788 - [/SIZE]

[SIZE=2]197328640 - Service Mode[/SIZE]
[SIZE=2]22558463 CALLTIME Reset Total Call Time[/SIZE]
[SIZE=2]2263 BAND [/SIZE]
[SIZE=2]2580 <mid-col> [/SIZE]
[SIZE=2]268435456 ANTIFKILO "antenna IF kilo?? serviceModeApp_FB.apk / FTATDumpReceiver.class[/SIZE]
[SIZE=2]27663368378 CPMODEMTEST [/SIZE]
[SIZE=2]2767*2878 APOS*CUST Current firmware with factory default settings[/SIZE]

[SIZE=2]301279||279301 - [/SIZE]
[SIZE=2]3214789650 - Start Angry GPS Build.TYPE != "user"[/SIZE]
[SIZE=2]32489 - Ciphering Info[/SIZE]
[SIZE=2]4238378 ICE/GCFTEST GCF Settings?[/SIZE]
[SIZE=2]4387264636 GETRAMINFO [/SIZE]
[SIZE=2]58366 LTEON set persist.radio.lteon=true[/SIZE]
[SIZE=2]6201 - [/SIZE]
[SIZE=2]638732 NETSEC Build.TYPE != "user"[/SIZE]
[SIZE=2]66336 MODEM CP Ram Dump (On/Off) ro.cp_debug_level=[0x5500,0x55FF][/SIZE]
[SIZE=2]6984125* MYTH1A5? ? [/SIZE]
[SIZE=2]7284 PATH Set USB/UART path [/SIZE]

[SIZE=2]738767633 SETSOSOFF Turn OFF SOS*[/SIZE]
[SIZE=2]73876766 SETSOSON Turn ON SOS*[/SIZE]
[SIZE=2]7387677763 SETSOSPROF Set SOS* profile[/SIZE]
[SIZE=2]7387678378 SETSOSTEST Set SOS* test[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]
[SIZE=2]* SOS = Sell Out SMS[/SIZE]
[SIZE=2]<> = some kind of keypad pattern[/SIZE]
[SIZE=2]---------------------------------------------------------------------[/SIZE]

In addition to these numerical codes, there are also few alphanumeric ones.

These can be used from the command-line with the "am" command, like this:

[SIZE=2]am broadcast -a android.provider.Telephony.SECRET_CODE -d android_secret_code://CP_RAMDUMP[/SIZE]

This might also work when already in ServiceMode, by entering the string

after selecting "Key Input" or "Select", from menu. (I have not checked.)

[SIZE=2]LTE_ANT_PATH_NORMAL[/SIZE]
[SIZE=2]CP_RAMDUMP[/SIZE]
[SIZE=2]DUMP_SVCIPC[/SIZE]
[SIZE=2]DEBUG_SCR[/SIZE]
[SIZE=2]EI_DEBUG_SCR[/SIZE]
[SIZE=2]DATA_ADV[/SIZE]
[SIZE=2]NAMBASIC[/SIZE]
[SIZE=2]TESTMODE[/SIZE]
[SIZE=2]NAMSIMPLE[/SIZE]
[SIZE=2]TEST_CALL[/SIZE]

The Samsung Diagnostics Menu

One special secret code is that of the Samsung Dignostic

Test Menu. This particular menu exsists on pretty much all

Android based Samsung phones. (AFAIK) The code is simply:

*#0*#

It provides for testing things like the Screen, Sound, Vibrator,

all the sensors and more. One one the cooler features for phones

that include an IR transmitter, is that you can use it on most

modern Samsung TV's as a remote control. Thus even easier to use

than any of Samsung's own Remote Control Apps, which are often

bloated and containing spyware.

The available test items you will find on this particular model are:

[SIZE=2][Red] - screen pixel test[/SIZE]
[SIZE=2][Green] - screen pixel test[/SIZE]
[SIZE=2][Blue] - screen pixel test[/SIZE]
[SIZE=2][Receiver] - (Ear) Receiver test[/SIZE]
[SIZE=2][Vibration] -[/SIZE]
[SIZE=2][Dimming] -[/SIZE]
[SIZE=2][Mega cam] -[/SIZE]
[SIZE=2][Sensor] -[/SIZE]
[SIZE=2][Touch] -[/SIZE]
[SIZE=2][Sleep] - sleep mode (power button) test[/SIZE]
[SIZE=2][Speaker] - listen![/SIZE]
[SIZE=2][Sub key] - testing keys [/SIZE]
[SIZE=2][Front cam] - [/SIZE]
[SIZE=2][IR LED] - Samsung TV compatible IR remote control[/SIZE]
[SIZE=2][LOW FREQUENCY] - Listen 100/200/300 Hz[/SIZE]
[SIZE=2][Black] - screen darkness test[/SIZE]

For other S4 models, check this YouTube video:

"Galaxy S4 Diagnostics Menu *#0*#"

For the S3 GT-I9300 check out the thread:

[REF][INFO][R&D] "Secret Codes" and other hidden features
​