pixel-volte-patch
pixel-volte-patch copied to clipboard
kyujin-cho
5G DC-NR(ENDC) 활성화 설정 가능의 여부
안녕하세요. 기존에 루팅된 픽셀을 5G ENDC 강제 활성화해서 0x11, 0x14로 옵션을 물려서 사용이 가능했는데, 이 방법으로 5G ENDC 설정까지 강제할 수 있는지 여부가 궁금합니다. 가능하다면 상기 기능도 추가하면 더 좋을 거 같네요.
먼저, 루팅된 픽셀 기기에서 Network Signal Guru 앱을 설치합니다. 우측 상단 Forcing Control에서 SIM1 - Nr Setting에 들어가준 다음에 ENDC 설정을 조합해 0x11로 만들어줍니다.
그러면 픽셀 기기에서 5G 사용이 가능해왔습니다.
해당 앱의 작동 구조를 알 수 있으면 좋을 것 같은데 아무쪼록 감사드립니다!
찾아봤으나 이 앱이 어떠한 방식으로 해당 값을 변조하는지를 알기 어렵네요. API 호출이나 파일 변조 등으로 직접적으로 수정 가능한 방법을 알고 계신 분이 레퍼런스를 남겨주시면 좋겠습니다. 이슈는 열어두겠습니다.
Here are some references that might help
1- https://github.com/swangjang/Pixel-Redbull-Carrier-Patch
2- https://forum.xda-developers.com/t/no-root-sercrtcode-to-unlock-all-country-5g-and-volte.4355759/post-85973125
This is not accessible via an api, it is an nv value set in the modems efs. The "forcing control" menu in NSG on Pixel 6/7 comes from the modem directly - it is also accessible in Shannon DM.
nv item arrays for carriers are kept in confseq protobuf files, which get handled by the modem itself directly: /system/vendor/firmware/carrierconfig/confseqs
There are +AT commands that can be used to read/write nv items, but access to AT commands is not doable.
@NXij Thanks for clarification.After digging in a little bit, I found an API that insists to read/write NVRAM config. Perhaps this can alter NVRAM values. Do you know anywhere to find exact key/value pairs to enable 5G on Pixel? I will test if 5G can be enabled with only using this API.
NR.CONFIG.MODE (668110670) NASU.NR.CONFIG.MODE (1861261133) DS.NR.CONFIG.MODE (2515476338) DS.NASU.NR.CONFIG.MODE (1294047639)
DS ones are for SIM2, no idea what NASU stands for.
0 should be disabled 1 should be NSA 11 should be SA+NSA
!NRCAPA.Switch.DssFeature (1185698488) !NRCAPA.Switch.DssFeature_DS (1651918123)
1 allows dss
since nvWriteItem seems to expect Int for id, it could be the crc32 of the nv item names. That is how they are actually defined in the confseq files, I added them next to the item names. You can take a look at the decoded confseqs here https://github.com/iscgar/pixel-shannon-scripts/tree/master/confpack/panther-tq1a.221205.011/confseqs
nvWriteItem probably requires MODIFY_PHONE_STATE permissions
🤷 I don't think it's a good sign...
@kyujin-cho You should use values from NVRadioItems (values in range 0-90) as itemID in above methods. But NVRadioItems doesn't contains any info about NR. Maybe NR values are 90+. Also, both methods require MODIFY_PHONE_STATE permission
Hey all.
If my memory serves me right, MODIFY_PHONE_STATE can't be used by user-installed apps. Can this potentially be solved by working with https://grapheneos.org/ or https://calyxos.org/ to include a system app that does what we need?
cc @kyujin-cho @SnapSuzun
Hey all. I recently updated to Android 14 beta (Pixel 7 Pro) and 5G seems to work in South Korea under SK Telecom. Maybe the changes introduced allowed 5G outside the supported countries?
Maybe related to this
Good news if you use a Pixel 7 or Pixel 7 Pro: Android 14 Beta 1 has an upgraded modem that brings 3GPP Release 16 support, according to Redditor /u/Starks: Google said this would be coming in Android 14, so it's not a surprise.
https://twitter.com/MishaalRahman/status/1646251083075919876?t=-ikajK1f-p_0LVmuIG1PiQ&s=19
I can help investigate if anyone can direct me how. Cheers.
Has someone figured out how Network Signal Guru enables 5G exactly? My understanding is that NSG writes to the NVRAM of the modem, but I can't seem to find the exact values that it writes to enable 5G or how it writes exactly. Does it use nvWriteItem? AT commands?
Also, #190, along with other XDA threads, suggest that editing a carrier config file at data_mirror/data_de/null/0/com.android.phone/files/Carrierconfig-com.google.android.carrier-(ID_sim_card).xml works to enable 5G.
However, it involves deleting the row <int-array name="carrier_nr_availabilities_int_array" num="0" />. As referenced in #13, this seems to already be set via KEY_CARRIER_NR_AVAILABILITIES_INT_ARRAY to [1, 2], and 5G does not work.
So, it seems as if we need to write to the NVRAM of the modem, but editing a carrier config file also works, but not through Shizuku or the Android telephony API?
Here's a few XDA threads on using NSG which I found to be referenced online in enabling 5G: https://xdaforums.com/t/activate-5g-on-non-5g-country.4457071/ https://xdaforums.com/t/root-enable-5g-volte-and-call-screening-in-unsupported-countries.4510243/
Firstly there is no way to achieve it without root.
NSG Forcing Menu on Shannon modems is actually calling an activity in the Samsung Engineer Mode apk - see https://github.com/samsungexynos9810/vendor_samsung_slsi/blob/f61c4f94aafd0149e7f5ddd78ce9ad22062c8837/telephony/common/packages/apps/EngineerMode/src/com/samsung/slsi/engineermode/EngDetailActivity.java you can get this compiled but it has to be a system app and hence it triggers SElinux, otherwise it'll let you access three different menus where one of them is the one spawned by the activity inside NSG.
In this case the item is set not through AT commands or interfacing with the NV directly but a set of strings in packets that come from the modem directly that then get turned into a listview UI.
nvWriteItem method seems to interface with some other nv which is the nv of the RIL implementation on the android side, not the modem itself.
The nv item for controlling the NR state is in the modem nvram. You can interface with this through AT commands, you can look at https://github.com/davwheat/shannon-pixel-modem-tweaks-app (root only!) that for example uses this implementation (and also has the NR setting along with some other testable things implemented).
Firstly there is no way to achieve it without root.
NSG Forcing Menu on Shannon modems is actually calling an activity in the Samsung Engineer Mode apk - see https://github.com/samsungexynos9810/vendor_samsung_slsi/blob/f61c4f94aafd0149e7f5ddd78ce9ad22062c8837/telephony/common/packages/apps/EngineerMode/src/com/samsung/slsi/engineermode/EngDetailActivity.java you can get this compiled but it has to be a system app and hence it triggers SElinux, otherwise it'll let you access three different menus where one of them is the one spawned by the activity inside NSG.
In this case the item is set not through AT commands or interfacing with the NV directly but a set of strings in packets that come from the modem directly that then get turned into a listview UI.
nvWriteItem method seems to interface with some other nv which is the nv of the RIL implementation on the android side, not the modem itself.
The nv item for controlling the NR state is in the modem nvram. You can interface with this through AT commands, you can look at https://github.com/davwheat/shannon-pixel-modem-tweaks-app (root only!) that for example uses this implementation (and also has the NR setting along with some other testable things implemented).
Very interesting. Shouldn't it be possible to deploy the samsung engineering APK as a magisk module so it becomes a system app ? (I am not quite clever enough to get it to build, but making a magisk module out of an app seems straightforward enough, so... is there perhaps a prebuilt Samsung Engineering app around anywhere ?
Closing as it is not possible to achieve the object without explicit root permission.
A bit more explanation on why it is not doable: enabling 5G is up to the "cellphone vendor" configuration, which is only possible by escalating permission to root user. What this app alters is bunch of "carrier" configuration.