[Samsung Galaxy S22] rayw_xda:
Background​

Previous methods have only worked on US and Canada phones due to the dialer code only working on US/Canada phones on U and U1 firmware, and also the presence of IOTHiddenMenu on those devices' firmware. However, thanks to @K0mraid3's successful resurrection of the System Shell exploit, the Service Menu method can now be applied to International Snapdragon phones as well.

This means, any international Samsung S20/S21/S22/Fold2/Fold3/Fold4/... with Snapdragon processors, including but not limited to G9880, G988N, G9980, S908E, F936B...

The method used in this post is to directly launch the Service Menu by invoking the Service Mode RIL directly and bypass the need for IOTHiddenMenu or equivalent dialer codes. I found this specific command by decompiling Service Mode RIL APK and tracing through its AndroidManifest and BroadcastReceiver implementation.

How to (new method)​

1. Download Samsung Toolkit app onto your phone

2. Follow the instructions for running the app.

3. Use the Service Menu option in the app and follow from #5 in the below instructions

How to (original)​

1. Obtain System Shell access on your phone by following the instructions in @K0mraid3 's System Shell Exploit thread.

2. In the newly-opened System Shell, copy and paste the following command,

am broadcast -a com.samsung.android.action.SECRET_CODE -d android_secret_code://27663368378 -n com.sec.android.RilServiceModeApp/.SecKeyStringBroadcastReceiver

Ensure the entire command is copied correctly.

3. Run the command.

4. You should now see the Service Menu appear on the phone.

5. Follow instructions for Method 2 in the original How to unlock bands thread.

6. Follow instructions for Method 1 in the original How to unlock bands thread.

7. Now all bands, both 4G LTE and 5G NR that the hardware is capable of, are unlocked.

Proof​

I got my hands on a Korean model S20 Ultra (G988N) which has a Snapdragon CPU. Out of the box, it ONLY supports 5G NR n78. After doing the above steps, it now supports n5, n77, n78.

Before After

View attachment 5820859 View attachment 5820861

Bonus​

On certain international phones *#0011# or *#2263# don't work the way you expect them to. But with the service menu, you can access the same exact ones as the US models through the service menu (RF Test -> Band Selection to replace 2263, and Protocol State ->Basic Information to replace 0011)

In the case of the Korean phone, 2263 did not work at all. But 0011 brought up a totally different looking screen than the US version did.

Limitations​

For Exynos models owners - sorry, you're out of luck for now. I haven't been able to find a single menu that helps unlock bands on those models. The menus that open are VERY different and limited in functionality. Unfortunately, that's just how Samsung made it.

While "Disable CA Combos" is enabled by forcing GCF, it does not overcome hardware supported CA combos. So using a US SIM on the Korean phone for example, will still refuse to engage Carrier Aggregation on US carriers' bands.

Credits​

@K0mraid3 for the System Shell exploit

@peacey8 / @wr3cckl3ss1 / @bigdave79 for the Band Unlocking instructions on US/CA models