[Hardware Hacking General] E:V:A:
RF/Radio properties of the ServiceMode Application

Thread Difficulty: HARD

Thread Noob Patience: LOW

Thread Topic

This thread is a Reference and Research & Development thread for

investigating and to better document the various radio related variables

as found and displayed by the ServiceMode application. Here we are

particularly concerned with those found in Samsung phones, but as

you will see, this is more modem (BP/CP) dependent than phone model

dependent. So much of this info should also apply to other devices

using the same modem.

Off Topic?

If you have questions that does not directly concern the main focus

of this thread, please ask in the general forum. If you ask support

questions here, they will be deleted without warning.

If you're just looking for info how to enter the Service Menu on a recent

Samsung, look in this thread:

[REF][ServiceMode] How to make your Samsung perform dog tricks

Background

Because the ServiceMode (SM) application is really running in the

Modem under its own RTOS, it is limited in the presentation. So what

you see running in the AOS ServiceMode application is really just a

Java wrapper to code that is running in the RTOS. This severely

limits the information presented, if accessible at all.

Most mobile device manufacturers doesn't want their users to have

access to the ServiceMode functions, for various and good reasons.

Perhaps the best reason is that you can easily hard-brick your

device and/or mess up all the internal radio related settings.

However, we are already used to this, so why not have a better look

at the mobile network parameters within our devices. These can be

extremely useful from identifying network problems to detect and

prevent illegal or clandestine mobile network monitoring.

So what are the limiting factors of the ServiceMode Application?

It is a Java wrapper application that is usually made by

the device manufacturer (Samsung, HTC, Nokia etc) that

need to be present and compatible with your AOS FW.

(API, RIL etc)

The actual code is running in Modem RTOS and usually queried

by ServiceMode.apk by the use of a RIL_REQUEST_OEM_HOOK_RAW request,

that allows requests to circumvent the normal RIL filter.

The parameters present depends on the Modem FW versions.

(You will find many misspellings and other FUBAR objects in

various modem SM presentations.)

The displayed RF related parameters depend on the Modem HW,

and are thus completely different in an Intel XMM modem, than

for an Qualcomm MSM type modem/processor SoC, and so on.

The displayed RF related parameters depend on the network

you are currently using and connected to.

But the mobile network interface is transparent from the AOS AP point

of view, so a large set of radio parameters must comply to the 3GPP

standards in order for your device to function properly. But only a

very small subset of these RF parameters are part of the non-internal AOS API.

We want more!

By carefully looking at all the details and information that is

presented by the SM application, we can find out many more and

useful network details, such as ciphering modes, network types,

bands, and technology used. But to do this we need to understand

the language used. Unfortunately, many times the language does

not reflect the current 3GPP standards, so we are left to guess,

until some anonymous modem RF-expert/developer come along and

correct us.

So if you happen to know anything specific, this is where you

can really help this thread...

ServiceMode Vocabulary

Here I try to resolve some of the more obscure sounding items,

as found in the SM of mainly two devices.

(a) Samsung Galaxy S2 (GT-I9100, XXKI1 with Intel XMM6260 modem)

(b) Samsung Galaxy S4-mini (GT-I9195, XXUBML4 with Qualcomm MSM8930AB SoC)

In post#2 you will find an almost complete menu structure for

the UMTS MENU items as found in (b). I have not posted the items

for the LTE or CDMA menus, since I don't have that network, which

means I don't know how they would look. So feel free to post your

own findings, if you use those.

Also, remember that the end-point/detailed view of the menu

items, depend on your current network. I.e. you will see

different items, when connected to GSM vs. WCDMA, and so on.

In post#3 I show the detailed explanations of the various

3GPP defined RR timers as shown under the NAS/MM items.

In post#4 I attempt to describe the specific end-point menu items:

[SIZE=2] [1] BASIC INFORMATION
[1] MM INFORMATION
[2] MM REJECT CAUSE
[3] GMM REJECT CAUSE
[3] AS INFORMATION
[4] NEIGHBOUR CELL
[/SIZE]

I still need help deciphering some of those values.

(What exactly do they represent and mean?)

​