[Galaxy S 5 General] fffft:
.

[size=+1]The Gory details[/size]

If you are following the Quick Start guide, you can probably skip this section for now. This is a detailed explanation of how to calculate values for custom configurations. And other gory details.

This is an S5 forum, but you're welcome to post here if you own a different brand of Qualcomm based phone.

This mod should work for almost any Qualcomm based phone which is a lot of Samsung, Sony, LG, Opo, Nexus, and other models.

If you own a Samsung phone, you should know that installing a custom kernel will increment something called the Knox flag. Most of us don't care about Knox, but some people do because it might affect your phone's warranty. Samsung threatens to void your warranty if the Knox flag changes. That still doesn't affect most warranties because most people make warranty claims through their carrier, rather than directly with Samsung. And most carriers don't care about Knox. It's also illegal for Samsung to void warranties this way in the E.U. Anyway, what you need to know is that if you install a custom kernel it will increment your Knox flag. And that might afffect you if your phone is still under warranty.

The actual information in your phone's non-volatile (NV) memory is formatted in byte swapped, little endian hex. Huh? Just something that programmers did to confuse the rest of us. If you're really curious, you can read about it here. We start off with a binary number because it's easy to represent what bands we want that way. Then we use a calculator to convert that number to decimal or hex, depending on which NV editor program we use. Windows has a built in calculator that you can use, just set it to scientific mode. Or there are a plethora of online calculators.

Note that some NV editors use a non-standard binary format as well.

e.g. if we want to represent an NV edit for bands 1/4/5/6/15, we can write it in binary as follows

1000000001110010

15 <------------------ 0

bands 1/4/5/6/15 (standard notation)

We write the bands we want as "1", meaning that they are enabled. We start with a placeholder for zero on the right side. Then construct or read the number, right to left. So band 1 is the second position from the right. This is the standard way of doing things and what most of your NV editors will use (newer tools may take decimal numbers instead).

Just to complicate things though, QXDM lops off the zero placeholder just to be different.

100000000111001

15 <------------------ 1

bands 1/4/5/6/15 (QXDM notation)

It's all arbritrary, so the editor still works fine. It just creates unnecessary confusion because calculations will now be different from a standard editor than the renegade. So double check your writes to see that the expected value was written. And of course the best test of all is finding that the new band works properly!

[size=+1]What bands do you want?[/size]

We need to make a list of 2G/3G bands. And a second list for LTE bands. Your list should probably include the bands that your phone already has, plus the ones that you want to add. You can find out what bands your phone already supports with a search. Be sure to use your actual S5 model, e.g. sm-g900t for TMobile, sm-g900v for Verizon, etc.

Google: sm-g900a specs site:samsung.com

S5 models (variants)

Asia sm-g900i

ATT sm-g900a

BMC sm-g900w8

Canadian S5's sm-g900w8

China sm-g9006v

China ZM sm-g9008v

China CTC sm-g9008d

Claro PR sm-g900w8

Europe sm-g900f

Japan DCM sm-g900d

Japan KDI sm-g900j

Korea KTC sm-g900k

Korea STC sm-g900s

Sprint sm-g900p

TMobile sm-g900t

US Cellular sm-g900r4

Verizon sm-g900v

Vodafone sm-g900m

Note that the sm-g900h is not supported

because it uses a different processor

[size=+1]NV editors[/size]

QPST v. 2.7.411 download . (QPST v. 2.7.323)

QXDM v. 3.12.714 download

EFS Professional v. 2.1.73

CDMA Workshop (Demo)

Caution, some antivirus programs flag this as a generic trojan. Appears to be a false alarm, they've categorized it as a "hacker tool" and lumped it in with trojans! Political Correctness /FUD to the rescue. Yes Virginia, we do want to hack our phone. No apparent evidence of actual malware, but use at your own risk

DFS Tool (Demo)

QRCT

QDART

Untested downloads. Download the following links

at your own risk

!

These are Google search hits that I haven't found time to check out yet. Be sure to scan these for malware and viruses.

These QXDM 3.14.x builds are not usable unless you have already have a license.

QXDM v. 3.14.514, unlicensed

QXDM v. 3.14.594, expired license

NV writes don't succeed? You may need to enable the NV parameter first (write enable it) - details

NV changes revert? - This may mean that the NV wasn't write enabled (see above).Or that you need a custom ROM and kernel to avoid the apparent anti-tamper code added to Kitkat. e.g. CM11 & Ark kernel or Phoenix v3 ROM & kernel.

[size=+1]An example[/size]

Say that you want to use an ATT phone on TMobile?

The ATT version S5 is missing the AWS band (RF band 25) that TMobile uses.

So we will want to add the AWS band to the ATT version S5 i.e. the sm-g900a.

Determine what bands you want

In this case, the bands that TMobile uses.

Google: specs sm-g900t site:samsung.com

Using our table of bands (post No. 3), we can cross reference that to:

LTE (4G) bands 1/2/3/5/7/8/4/17

RF (UMTS /3G) bands 26/25/23/22

RF (GSM /2G) bands 19/8/7/21

So we end up with a total of these bands:

RF Bands 7,8,19,21,22,23,25,26

LTE Bands 1,2,3,4,5,7,8,17

Now that we know which bands we need to change six settings in the phone's non volatile (NV) memory. Some NV editors may let you choose the desired bands from a menu. Try the QPST service programming menu for that. If your editor doesn't have let you do this, then you need to calculate the six raw numbers and write them to your phone.

Calculate the required NV values

We write the two band lists as binary numbers, with "1"s representing the bands that we want. And "0"s for non-selected bands. Then we use a calculator to convert the binary number to decimal or hex number that your NV editor will need (see note about hex conversion, here).

#1 NV 1877

RF Bands 7,8,19,21,22,23,25,26

Now just to confuse you.. I know from looking at the stock Tmobile sm-g900t that it also includes RF band 9. This is a subset of band 8. As band 8 incorporates band 9 it might seem redundant to list both. It's done to ensure compatibility with roaming networks that are not band 8 aware.

So we'll revise our list to include band 9

RF Bands 7,8,9,19,21,22,23,25,26

binary 110111010000000001110000000

Remove any leading zeros = 110111010000000001110000000

decimal 115868544 = hex 6E803280

hex 6E80380 = byte swapped hex 80 03 E8 06

As a check, we find that this value is the same as the stock Tmobile NV (yea!)

#2 NV 6828

LTE Bands 1,2,3,4,5,7,8,17

binary 100000000110111110

Remove any leading zeros = 100000000110111110

decimal 131518

hex 201BE = byte swapped hex BE 01 02

#3 NV 441

Copy bits 0 - 15 from NV 1877 = 0000001110000000

Remove any leading zeros = 1110000000

decimal 896

hex 380 = byte swapped hex 80 03

#4 NV 946

Copy bits 16 - 31 from NV 1877 = 11011101000

Remove any leading zeros = 11011101000

decimal 1768

hex 6E8 = byte swapped hex E8 06

#5 NV 2954

Copy bits 32 - 63 from NV 1877 = N/A

Remove any leading zeros = N/A

We don't have any bits in this range, so write 0

decimal 0

hex 0

#6 NV 6829

Copy bits 0 - 63 from NV 6828 = 100000000110111110

Remove any leading zeros = 100000000110111110

decimal 131518

hex 201BE = byte swapped hex BE 01 02

Write the edits to your phone

Now you need to write (save) the changes to your phone:

Back up your phone, including your IMEI and EFS just in case

Open your NV editor

Enable USB debugging enabled in the Settings menu.

Put your phone into diagnostic mode.

Then use the dialer code *#0808# to enter the USB settings menu.

Set USB = CP (Modem) and USB settings to RNDIS + DM + Modem (USB mode)

Use QXDM to write enable a NV parameter by reading it. Then writing "0" to it.

Then write your intended NV edit with QXDM or other NV editor. The leaked versions of QPST are too old to write enable a field directly.

You can only write one NV parameter at a time, unless you found a copy of the more capable QRCT software.

Do the same for the remaining five NV parameters.

Return your phone to normal USB mode AP (CPU) and MTP + ADB USB mode.

Reboot your phone

Confirm that it worked by viewing what band is in actual use in the Service menu or with a monitor app e.g. LTE Discovery.

Celebrate! And tell us about your success.

[size=+1]Reference[/size]

Some existing threads

How to enable 3G on TMobile AWS 1700MHz for ATT Galaxy S3 i747

[WIP] How to enable Tmobile AWS 1700 band on S3 I747 and I747M (NV backup method)

Summary of cross model success (Japanese language - Google translation)

How modify a qcn file to enable AWS band

Unlock all bands of your Qualcomm device! Use your phone globally! No bs!

[size=+2]Caution: If using the NV calculator app advertised in the next post[/size]

[size=+1]The app is producing erroneous results[/size]

The app author was made aware of the errors earlier in this thread but refuses to address the errors. He is convinced that no errors exist. And being dogmatically certain, he won't actually take a little time to confirm that his app works with the various popular NV editors. He posted that he will rely upon people using his app to report if there are any issues. Since you are being set up as an unwitting guinea pig, you should know that the app may work fine for you or cause much frustration, depending on what NV editor you use. If you decide to use his app, ensure that you check the results and confirm that it is compatible with the particular NV editor you are using.

The app appears to work correctly with some NV editors. And clearly does not with others. This is logical as various editors require different input formats. The author hasn't provided for this, making his app incompatible with some popular NV editors. If you use this app, you need to be diligent in checking that it is producing accurate results for you. A lot of people have been asking me whether this app works as the app author is actively promoting it in this thread. And has even deleted some of his posts where he asked me how to use this method and how to make calculations (replacing his questions with ads for his new app) and quoted my instructions out of context to assure users that his app works correctly.

.