yashsingh1/xdaforums huggingface dataset:
[Android General] wr3cckl3ss1:
This is also accessible thru the dialer....

For S908U/U1......i use *#73#

I discovered this many many months ago and made a guide all about it.

Enable & Select Bands thru Dialer (S22 Fam) /CSC CHANGE (S22 & MORE)

***Tested on S908U & S908U1*** But not limited, to those specific models. S22 Family should also be compatible as well...as the NEW FOLD 4. Thanks @Abaddon BAND SELECTION: To ENABLE all bands, please do the following: (See pictures attached...

xdaforums.com

Then it spawned a more professional guide...thanks to @peacey8

How to Enable All Bands Through Service Menu on US/CA S22 series (including Sub-6 and mmWave)

What is this? This is a guide on how to enable all LTE and 5G bands on the US or Canadian S22 series phones by going through the service menu. This guide is mostly based on this S20U guide by mellojosh, but has been adapted for the S22U phone...

xdaforums.com
[Android General] rayw_xda:
@wr3cckl3ss1

I found out that only "VZW" CSC will show the "Visual Voicemail" app (I can force CSC to VZW and disable cidmanager to keep it there). But it ONLY works on Verizon - if you try to activate it on T-Mobile or AT&T it just errors out.
[Android General] wr3cckl3ss1:
I'm not sure.

What device do you have?
[Android General] rayw_xda:
*#73# and others only work on US/Canada phones as I mentioned before. IOTHiddenMenu is also a US/Canada only app.

The command that I provided works on any Samsung phone that can use the System Shell exploit, including International phones (which the original poster had, in his case a Korean phone).

Z Flip4 US Unlocked.

Switched to VZW CSC, and the Visual Voicemail app showed up. I disabled auto CSC switching and switched the SIM to a Tmobile one, tried to activate the Visual Voicemail app - it errors out when trying to reach out to the provider. Same with AT&T.

From doing research online, it appears the app was SOLELY made to work on Verizon (and its MVNOs) only.

Once I switched back to Verizon SIM I was able to go through the in-app activation process no issue.
[Android General] mohitgalaxy3:
I

I Tried to follow this guide but for Korean variant i don't see any option to access service menu.

I am able to access market hidden menu which shows bands but don't have GCF settings to whitelist or enable locked bands.

Anyway to access the service menu, I am posting screenshots of hidden market menu and service menu as apk which i want to access.
[Android General] wr3cckl3ss1:
Can your device...change from U to U1. I'm only familiar with my device.
[Android General] rayw_xda:
Yes, you should follow my previous post:

https://xdaforums.com/t/system-shel...s-no-bl-unlock-required.4543071/post-88033855

This will get you to the Service Menu on your Korean phone.

After that you can follow the original guide meant for US/CA phones to unlock CA combos and 4G LTE/5G NR bands: https://xdaforums.com/t/how-to-enab...22-series-including-sub-6-and-mmwave.4488435/

Don't worry about "GCF", just follow the first method.
[Android General] rayw_xda:
It was purchased factory unlocked from Samsung. It natively runs U1 firmware.

I was reporting my test results - cycling through different CSCs until I found "Visual Voicemail" pop up. And then testing it out against various carrier SIMs.

From doing research online, it appears the app was SOLELY made to work on Verizon (and its MVNOs) only.

Once I switched back to Verizon SIM I was able to go through the in-app activation process no issue.
[Android General] ezdiy:
Yet here we are, nearly anything launched with A11 and up can boot Google's GSI images. Bootloader is hardly your worry though, what limits useability is vendor crap in HAL. It's all nice you get AOSP, until you open the camera app.
[Android General] wr3cckl3ss1:
So...in my experience since I have the US version of the s22 ultra...i found that by having the U1 firmware I have more CSCs to choose from....and with that being said.... The only way for me to get the Samsung visual voicemail app and make it work 100% was to change my CSC first to a CSC that had that app visible. For me there were several...VZW....FKR....XAR..etc. In finding which CSC did enable it that's when I broke it down and i was left with this after hours and hours of testing and going back and forth enabling System Shell and also hammering out what worked best.

XAR,XAA/XAA/VZW

Fully enabled Samsung VM app....

My next question to you is have you tried all the CSCs to see which CSCs enable the voicemail app....
[Android General] rayw_xda:
I completely agree in principle that DSU is only useful if it works with a locked bootloader, but reality doesn't seem to reflect this.

Context: using DSU to load Android 12 GSI onto OnePlus Nord N100 https://xdaforums.com/t/android-12-dsu-loader-oneplus-nord-n100.4308133/
[Android General] rayw_xda:
So you're saying the Samsung Visual Voicemail app is working for you, on T-Mobile and AT&T?
[Android General] ezdiy:
I've never seen DSU working on A9/A10-launch devices tbh. A10->A11 upgrade is usually not enough (not only because of bootloader key, but also dynamic partition layout). This is likely to be the case of samsung, too.
[Android General] wr3cckl3ss1:
Originally my phone out the box looked like this

VZW,VZW/VZW/VZW

Verizon does enable the Samsung VM app but i can't stand the icons it has for 5G...4G LTE...etc.

And i knew by switching CSCs...i could change what it looked like depending on preference. I also figured out that many other cscs did not have this enabled and then that's where my search of hammering out what worked and what didn't began. I have dual SIM so I carry two operators my esim is Verizon and my SIM card is T-Mobile. All in all I think that is just a matter of playing with the cscs to first get a CSC that enables the voicemail app then it would be strictly on you to change the two middle cscs which can be done in pre-configuration and strictly only in preconfiguration and that's something not even Sam FW could do.
[Android General] rayw_xda:
I don't think so. As per the XDA article linked earlier, it's because OEMs omitted Google's Verified Signing Key from their final production images.

This would be why many people that unlock their bootloaders on these phones (Nokia, Xiaomi, Motorola) CAN boot GSIs through DSU but can't with a locked bootloader.
[Android General] rayw_xda:
Like I said, I forced the VZW CSC to get the Visual Voicemail app to show up.

But it does not actually do anything when you use a T-Mobile or AT&T SIM. The visual VM service activation fails. But when I put back Verizon SIM it works.

This was my point.

It goes through the entire motion of "Checking your account..." sits there for 5 minutes, and then errors out. (when using EITHER a T-Mobile or AT&T SIM)
[Android General] wr3cckl3ss1:
And let me add that everyone is different and it all depends on of course the firmware. As I only have the S908U on U1 firmware. My research can only go so far. But I imagine that any phone from the s22 and above should be the same way especially when you have the ability to have more cscs like the U1 firmware does have. I havent researched very much of it all but I assume that someone will once they read all this.
[Android General] rayw_xda:
We've established this:

1. VZW and XAR CSCs make Visual Voicemail app show up.

2. Visual Voicemail app works with Verizon (and its MVNOs) SIM cards (and presumably C-Spire as well, as apparently that's what XAR is)

3. Visual Voicemail app does NOT work with AT&T or T-Mobile SIM cards.

Point #3 is what I was trying to convey. CSC has nothing to do with that.
[Android General] mohitgalaxy3:
I tried to open RIL service menu but it doesn't open with the command, then i tried to change the code which opens a blank service menu on my phone that also didn't do anything. Can you please check and help.
[Android General] rayw_xda:
Looking at the screenshot it appears that the last part of the command is missing. I would try making sure to copy the entire contents of the code block
[Android General] mohitgalaxy3:
Thanks...service menu is coming up but it's different from the steps you mentioned in your post. I am checking what all i can find.

Thank you so much.
[Android General] wr3cckl3ss1:
Can you share any screenshots for context?
[Android General] mohitgalaxy3:
Strange enough I don't find any option for NR 5G or LTE +.
[Android General] wr3cckl3ss1:
I'll pass this along to @oakieville as he's knows more about this.
[Android General] mohitgalaxy3:
Got 1 options for NR setting.
[Android General] wr3cckl3ss1:
BAND CITY 2023

ENTER THE DRAGON....
[Android General] rayw_xda:
Sure.

Probably because this is on Exynos. A volunteer tested it on S908E (International Snapdragon variant) and for them apparently the menus were similar to the US version.

This is great to know though, to get full picture of what's possible :)
[Android General] mohitgalaxy3:
Got tired of searching options but didn't get any options for PRUNE or CA settings on Exynos menu. Is there any chance to open service menu as well which i posted apk in the screenshot.

Also can anyone help what is LTE CAT settings.

CAT ENABLE, DISABLE AND CAT 4 TO CAT 10.
[Android General] subevilx:
One question can we use custom rom with this or flash combination file ?
[Android General] Unreal_Hawkzz:
this is the s8+ kddi au docomo japanese variant....for some reason i cannot flash anything through odin..fails in setup connection...tried different versions ...it was initially even lower android version...was fed up...went to unofficial shop where they used softwares like samsungtool pro etc to upgrade my device to android 9 pie...they tried to install twrp too but twrp's touch wasnt working not even woth otg mouse....so i gave up
[Android General] wr3cckl3ss1:
This is something @oakieville could help you on. He's a pro at that era of phones.
[Android General] wr3cckl3ss1:
Currently no, but you never know.
[Android General] subevilx:
i tried it with dsu sideloader it just ask me again and again to reboot my device i tried AOSP GSI no success
[Android General] subevilx:
hay did it work and also where did u get su binary from?
[Android General] subevilx:
Also any way to change this ro.debuggable=0 to 1

this is what im getting
[Android General] Unreal_Hawkzz:
For those who want to know more about roll back feature

How to Downgrade an App using Android’s Hidden Rollback Feature

Android doesn't normally let users install an older version of an app (downgrade), but there's a hidden mechanism to rollback app updates.

blog.esper.io
[Android General] adfree:
@subevilx​

Google search su Binary failed or bring tooooo much...

I have taken the su Binary from my Magisk rooted SM-A202F...

With Total Commander... from path:

/system/bin

symlink... but it copies 200 KB file...

But I have NO access with system to few folders... like:

/data/local/tmp

And I can not:

cd /

And I am not sure if su is good for armeabi...

So at this point i have to give up... and need to be better prepared.

I have allready Root procedure for my SM-R875F....

So maybe later I will come back to this idea... with proper su...

Maybe then I know where else I can execute binaries... and chmod them to superuser...

Best Regards

Edit 1.

And I have no access to:

/system/bin

So I can not try other stupid things... verity related or start *.sh or...

Edit 2.

I am back on my rooted SM-R875F.... so su is not same I pulled from SM-A202F...

D:\Android\adb>adb shell
freshul:/ $ su
Permission denied
13|freshul:/ $ su
freshul:/ # su -version
25.2:MAGISKSU
freshul:/ # cd /system/bin
freshul:/system/bin # ls -a1l su
lrwxrwxrwx 1 root root 8 2023-01-22 17:49 su -> ./magisk
freshul:/system/bin # cp /system/bin/su /sdcard
freshul:/system/bin # exit
freshul:/ $ exit

D:\Android\adb>adb pull /sdcard/su
/sdcard/su: 1 file pulled, 0 skipped. 2.1 MB/s (154452 bytes in 0.072s)
[Android General] Pervokur:
How do you expect to elevate privileges? You need to find exploit like dirty-vow or dig into *.rc scripts, maybe there is something which could help
[Android General] kountry83:
I can't find cidmanager anywhere on my s10 5g with GCF CSC. Is it called something else on mine?

Oh yeah this group should have a telegram channel.
[Android General] rayw_xda:
S10 5G was a black sheep in the lineup. It had several different carrier specific models. That would probably be why it doesn't have cidmanager as they're all carrier specific.
[Android General] BlackMesa123:
Read-only props value can't be changed once they're set, resetprop is required to do that.
[Android General] subevilx:
where exactly is reset prop located?
[Android General] BlackMesa123:
https://github.com/topjohnwu/Magisk/blob/master/docs/tools.md#resetprop
[Android General] subevilx:
ohh i thought it was something like build.prop but u need magisk for this 😭
[Android General] markimoo14:
Is it possible to change system/fonts with this exploit?
[Android General] evil22:
This method worked only once for me, I dont know why it is not starting the shell again. I've tried it alot of times. I enabled all the 5G bands but still not getting the signal, while my friends can. Could someone please help thanks
[Android General] wr3cckl3ss1:
there is a telegram group....look at OP for link
[Android General] kountry83:
That's odd because I thought my s10 5G was generic because the CSC is GCF.
[Android General] wr3cckl3ss1:
GCF just means factory and if it came like that in your hands....someone ****ed up and forgot ton change it back because i have never seen a phone come with GCF automatically. And of it did....maybe they forgot other stuff to change as well. Who knows....
[Android General] adfree:
pm list packages

Maybe usefull to know what is on device... APK related...

pm path <package-name>

Also usefull because filename differ from package name...

Taken from here:

https://xdaforums.com/t/watch4-adb-...restore-system-app-install-pull-apps.4324063/

Only as info...

Best Regards

Edit 1.

@kountry83

Maybe usefull if you check...

pm list packages

Edit 2.

Here also few more usefull comands APK related... to sort out... what is on device... what not...

https://xdaforums.com/t/how-to-prepare-smartwatch-for-advanced-functions.4511103/
[Android General] kountry83:
Gotcha. Yeah I got it from a guy off of coolapk and it says "not for sale" on it when I got it and it won't update. Still on android 9.
[Android General] wr3cckl3ss1:
Haven't forgotten about you....but i have something for you to test....

am start -n com.samsung.android.cidmanager/.preconfig.PreconfigActivity -a com.samsung.android.action.SECRET_CODE -d secret_code://27262826 --ei type 2

If this brings up PRECONFIG for you than end of story.....for me...it doesn't but i know it's the correct command as i thoroughly tested this. For me..it brings up an error on my watch 4. And I'm guessing it's because it's a Watch 4 from the US. But let me know how it works for you.
[Android General] wr3cckl3ss1:
Send me a private message
[Android General] adfree:
@wr3cckl3ss1

At the moment for faster tests I am back on my rooted SM-R875F...

I will check your Command in both system and root...

As I ever failed... in my last attempts...

IMHO reason is space...

<receiver android:name="com.samsung.android.cidmanager.receiver.PreconfigReceiver" android:permission="com.sec.permission.preconfig">
<intent-filter>
<action android:name="com.samsung.android.action.SECRET_CODE"/>
<data android:host="\ 83052020100812173552301071192687" android:scheme="android_secret_code"/>
<data android:host="27262826" android:scheme="android_secret_code"/>
<data android:host="\ 22623277326634424320" android:scheme="android_secret_code"/>
<data android:host="\ 272837883" android:scheme="android_secret_code"/>
</intent-filter>
<intent-filter>

GVH2 Firmware...

But will check your sin 5 minutes to be sure...

Best Regards

Edit 1.

Tested now with GVK6 Firmware... the latest crap I have for SM-R875F

freshul:/ $ su system
freshul:/ $ whoami
system
freshul:/ $ am start -n com.samsung.android.cidmanager/.preconfig.PreconfigActivity -a com.samsung.android.action.SECRET_CODE -d secret_code://27262826 --ei type 2
Starting: Intent { act=com.samsung.android.action.SECRET_CODE dat=secret_code://27262826 cmp=com.samsung.android.cidmanager/.preconfig.PreconfigActivity (has extras) }
freshul:/ $ su
^C
130|freshul:/ $ whoami
system
freshul:/ $ exit
freshul:/ $ whoami
shell
freshul:/ $ su
freshul:/ # am start -n com.samsung.android.cidmanager/.preconfig.PreconfigActivity -a com.samsung.android.action.SECRET_CODE -d secret_code://27262826 --ei type 2
Starting: Intent { act=com.samsung.android.action.SECRET_CODE dat=secret_code://27262826 cmp=com.samsung.android.cidmanager/.preconfig.PreconfigActivity (has extras) }
freshul:/ #

But this is at the moment nooo real big problem... as workaround with access to

/efs/imei

Thanx for Command... maybe we find something in 2023...
[Android General] wr3cckl3ss1:
This is just showing the edited intent....where it counts was where we need to find out the activity name and i kept over looking it then came to realization of how clumsy i can he when I'm deep into testing.
[Android General] adfree:
Searched in my old posts... for something else... but found this first...

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-26#post-87527747

IMHO it would be cool to have access to:

/system/bin

Hmmm strange... on not rooted Firmware with Exploit no way to enter this path...

freshul:/ # cd /system/bin
freshul:/system/bin # ls -1al su
lrwxrwxrwx 1 root root 8 2023-01-23 00:02 su -> ./magisk
freshul:/system/bin # exit
freshul:/ $ whoami
shell
freshul:/ $ cd /system/bin
freshul:/system/bin $ ls -a1l su
lrwxrwxrwx 1 root root 8 2023-01-23 00:02 su -> ./magisk
freshul:/ $ su system
freshul:/ $ cd /system/bin
freshul:/system/bin $ ls -1al su
lrwxrwxrwx 1 root root 8 2023-01-23 00:02 su -> ./magisk

Anyway... I searching for Dpparser blabla... need to look correct name...

Edit 1.

I mean this... why Secret Codes work or not...

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-29#post-87685255

https://xdaforums.com/t/firmware-an...-csc-change-and.4323469/page-29#post-87685463

Because funny example... for users from India with CSC INU they can simple enter old Code...

https://xdaforums.com/t/csc-change-on-watch-4-bluetooth-100-samsung-pay-working.4452691/
[Android General] Mr NI:
Is it possible to enable DFU mode on the S21 FE 5G? I looked at your other posted you have here and I'm wondering if I could run DFU mode
[Android General] Mr NI:
Nevermind I meant GSI
[Android General] Romeo Nickolas:
Easiest way to do this is using Ashell app with shizuku.

Edit: sorry it can't run shell command
[Android General] irshansk:
I still did not get the working VM on T-Mobile. However, it seems like CSC on its own is not the only issue or might not be an issue at all.

Yes, CSC change will show\hide VM app for certain CSC options on T-Mobile, moreover the VM app will follow csc code to represent VM app accordingly. So, let's say, you have VZW or ATT - the app, even if shown on T-Mobile sim, will try to "activate" according to the corresponding csc carrier. I.E. on Verizon the VM app will try to activate voicemail as if it is for Verizon sim card. The thing is, according to internal code, the VM app is "unified" - so it kind of morphs depending on current carrier (set by csc). Package\app manager shows many activities within app that are used for configuration screen for many carriers - the app has activities for T-Mobile, Verizon, ATT, Google FI etc. That's also why on XAA VM app thinks that Google Fi is being used - VM settings screen tells you to check Google Fi app for voicemail settings.

I went further on and did set TMB\TMB,TMB\XAA. Then I did use ADB shell to push VM apk into the phone and install it - now I can see the VM app even on T-Mobile CSC with TMB sim. Problem is - it crashes immediately.

Based on all that - it seems like the only route to get the VM working is to not try to find a fancy CSC combo, but rather interact with the VM app directly. Either we should find on how to invoke T-Mobile configuration screen activity within the VM app or just modify the VM app to always treat everything as T-Mobile and just literally replace the apk with a modified one.
[Android General] subevilx:
I got one question cant we just edit the combination files for our device and flash them through odin because if u Extract the boot.img theres build.prop in it which defines the binary of the img so cant we just modify it ? I got combination files for s22 s901u,U1 and w
[Android General] mohitgalaxy3:
@rayw_xda , @wr3cckl3ss1

I need your help to find the command to open the service menu for the below mentioned service mode.

@rayw_xda the one you shared before is opening RIL service menu, similarly can I open the phone until service mode.

Please check the screenshot and help me out.
[Android General] rayw_xda:
am start -n package/class
[Android General] adfree:
@subevilx

If I read something about Combination...

Then you mean Combination Firmware aka FACtory crap?

And you know its high(er) protected as in old days... for older Samsung Models...

You know about eToken aka emToken aka steady.bin?

Only to be sure we mean the same stuff...

https://xdaforums.com/t/looking-for-emtoken-example.4312891/

On GW4 I am able to flash FAC boot.img and recovery.img by simple text change...

fac into mrk

Without eToken... but Bootloader is unlocked and vbmeta is "off"... to bypass AVB crap...

But then few other "tiny" problemS...

Only as info.

Best Regards
[Android General] rayw_xda:
I reported earlier that it works on Flip4 (which it still does). But, I tried out an S21 Ultra and it did not work there - it hangs during boot, and then reboots back into original OS.

For those who are messing around with the DSU mode, remember: *DO NOT FACTORY RESET WHILE BOOTED INTO THE GSI - IT WLL FACTORY RESET YOUR ORIGINAL OS*. Luckily this was a test device, so no harm no foul. Be warned.
[Android General] adfree:
No idea if we can expect new EXE "soon"...

Ehm thanx in advance.

1 User told me he installed Win 7 in VM to bypass... adbwinapi.dll not found Error or something like this...

I wish to run safe also on my other PC without fighting with Antivir Settings...

I will try some stupid old way... to make my own Batch file... something like this:

adb install komraids_POC_V1.6.apk
adb push samsungTTSVULN2.apk /data/local/tmp
adb shell pm install -r -d -f -g --full --install-reason 3 --enable-rollback /data/local/tmp/samsungTTSVULN2.apk
pause
adb shell am start -n com.samsung.SMT/.gui.DownloadList

If timing important... maybe better solutions possible...

Need "few" minutes to check my idea...

Best Regards

Edit 1.

My fault wrong filename in example...

But I am not able to do any manual way with my SM-R875F...

Also I have tested 3 packages...

K0mraids_Shell (2).zip

This looks cool to my old blind Augenkrebs eyes... but no success with SM-R875F

Komraids System Shell V4.4.zip

Forgotten...

Komraids System Shell V4.5.zip

Success... only with this EXE I can open system shell with my SM-R875F

So I hope Augenk... :alien:

No idea what kind of magic is inside this EXE... but only this work for me.
[Android General] wr3cckl3ss1:
Which specific activity are you wanting to execute?
[Android General] wr3cckl3ss1:
I'll check on this as i, too, have combo files for S908U. And this specific thought came to me this morning when i testing some stuff last night.
[Android General] rayw_xda:
Mohit wanted to know in general how to launch activities. I provided the syntax
[Android General] wr3cckl3ss1:
you can do this many ways...especially with the Watch 4. My preference is always the harder way....

i connect to the watch wirelessly....and then run commands thats needed. As many how found...some will not have to make any input to get system shell and while others do. Everyone will be different and whether theres a new EXE to ultimately end the user input....i doubt it'll ever come out because theres so many different devices out there and while under the name of Samsung theyre the same but still are all different in their own ways.
[Android General] wr3cckl3ss1:
With preconfig now available per OP.....i can give you access to VM....