Radio IMGs in Hex editor Findings.

[fogozito]

i just opppened the italy radio in a Hex editor and i found metions in the code where the radio tries to lock the band at 800 or 850mhz take a look:



6C 79 00 52 65 61 64 20 4E 56 5F 41 43 51 5F 44 42 5F 49 20 73 75 63 63 65 73 73 66 75 6C 6C 79 00 57 72 6F 74 65 20 4E 56 5F 41 43 51 5F 44 42 5F 49 20 73 75 63 63 65 73 73 66 75 6C 6C 79 00 53 65 74 74 69 6E 67 20 74 68 65 20 62 61 6E 64 20 74 6F 20 38 30 30 4D 48 48 7A 00 53 65 74 74 69 6E 67 20 74 68 65 20 62 61 6E 64 20 74 6F 20 38 35 30 4D 48 48 7A 00 45 6E 61 62 6C 69 6E 67 20 4D 56 53 5F 43 4C 49 45 4E 54 5F 57 43 44 4D

Read NV_ACQ_DB_I successfully.Wrote NV_ACQ_DB_I successfully.Setting the band to 800MHHz.Setting the band to 850MHHz.


53 75 63 63 65 73 73 66 75 6C 6C 79 20 73 63 61 6E 6E 65 64 20 25 64 20 61 64 64 69 74 69 6F 6E 61 6C 20 63 68 61 6E 6E 65 6C 73 20 66 6F 72 20 38 35 30 20 4D 48 7A 20 62 61 6E 64 00 4E 75 6C 6C 20 70 74 72 20 69 6E 20 6C 6F 63 61 6C 20 63 6D 64 20 53 52 43 48 5F 46 52 45 51 5F 53 43 41 4E 5F 44 4F 4E 45 20 70 72 6F 63 65 73 73 69 6E 67 00 46 53 5F 4F 50 54 3A 5B 25 64 5D 20 66 72 65 71 20 3D 25 64 20 72 73 73 69 3D 25 64 20 64 69 64 20 6E 6F 74 20 6D 65 65 74 20 74 68 65 20 74 68 72 65 73 68 00 46 53 5F 4F 50 54 3A 20 5B 25 64 5D 20 66 72 65 71 3D 25 64 20 61 67 63 3D 25 64 20 73 61 74 69 73 66 79 20 74 68 72 65 73 68

.Successfully scanned %d additional channels for 850 MHz band.Null ptr in local cmd SRCH_FREQ_SCAN_DONE processing.FS_OPT:[%d] freq =%d rssi=%d did not meet the thresh.FS_OPT: [%d] freq=%d agc=%d satisfy thresh.


44 6F 69 6E 67 20 61 64 64 69 74 69 6F 6E 61 6C 20 63 68 61 6E 6E 65 6C 20 73 63 61 6E 20 6F 6E 20 38 30 30 20 4D 48 7A 20 62 61 6E 64 00 53 75 63 63 65 73 73 66 75 6C 6C 79 20 73 63 61 6E 6E 65 64 20 25 64 20 61 64 64 69 74 69 6F 6E 61 6C 20 63 68 61 6E 6E 65 6C 73 20 66 6F 72 20 38 30 30 20 4D 48 7A 20 62 61 6E 64 00 44 6F 69 6E 67 20 61 64 64 69 74 69 6F 6E 61 6C 20 63 68 61 6E 6E 65 6C 20 73 63 61 6E 20 6F 6E 20 38 35 30 20 4D 48 7A 20 62 61 6E 64 00 53 75 63 63 65 73 73 66 75 6C 6C 79 20 73 63 61 6E 6E 65 64 20 25 64 20 61 64 64 69 74 69 6F 6E 61 6C 20 63 68 61 6E 6E 65 6C 73 20 66 6F 72 20 38 35 30 20 4D 48 7A 20 62 61 6E 64 00 4E 75 6C 6C 20 70 74 72 20 69 6E 20 6C 6F 63 61 6C 20 63 6D 64 20 53 52 43 48 5F 46 52 45 51 5F 53 43 41 4E 5F 44 4F 4E 45 20 70 72 6F 63 65 73 73 69 6E 67 00 46 53 5F 4F 50 54 3A 5B 25 64 5D 20 66 72 65 71 20 3D 25 64 20 72 73 73 69 3D 25 64 20 64 69 64 20 6E 6F 74 20 6D 65 65 74 20 74 68 65 20 74 68 72 65 73 68 00 46 53 5F 4F 50 54 3A 20 5B 25 64 5D 20 66 72 65 71 3D 25 64 20 61 67 63 3D 25 64 20 73 61 74 69 73 66 79 20 74 68 72 65 73 68 00


Doing additional channel scan on 800 MHz band.Successfully scanned %d additional channels for 800 MHz band.Doing additional channel scan on 850 MHz band.Successfully scanned %d additional channels for 850 MHz band.Null ptr in local cmd SRCH_FREQ_SCAN_DONE processing.FS_OPT:[%d] freq =%d rssi=%d did not meet the thresh.FS_OPT: [%d] freq=%d agc=%d satisfy thresh.





41 64 64 69 6E 67 20 41 52 46 43 4E 20 25 64 20 28 38 35 30 20 62 61 6E 64 29 20 74 6F 20 61 63 71 75 69 73 69 74 69 6F 6E 20 64 61 74 61 62 61 73 65 2C 20 50 4C 4D 4E 20 25 64 2D 25 64 00
Adding ARFCN %d (850 band) to acquisition database, PLMN %d-%d.


62 61 6E 64 5F 70 72 65 66 20 62 69 74 2D 6D 61 73 6B 20 66 6F 72 20 47 53 4D 38 35 30 20 69 73 20 6E 6F 74 20 61 6C 6C 6F 77 65 64 00
band_pref bit-mask for GSM850 is not allowed.



62 61 6E 64 5F 70 72 65 66 20 62 69 74 2D 6D 61 73 6B 20 66 6F 72 20 47 53 4D 38 35 30 20 69 73 20 61 6C 6C 6F 77 65 64 00
band_pref bit-mask for GSM850 is allowed.



Summary:
If u open the lastest Tmobile Radio u will find very similar code in the radio IMG, that means that the 5036 radio can be modded to work with 850mhz Phones.

But the radio band apparently is not controled by the radio IMG it selfi dunno if unlocked phones can change bands, or maybe the config is hidden in parttion or code


2F 77 63 64 6D 61 2F 72 72 63 2F 72 72 63 72 62 72 65 63 6F 6E 66 69 67 2E 63
/wcdma/rrc/rrcrbreconfig.c


share ur thoughts!

[fedegin]

If somebody can modify the bits on a 5036 radio maybe latam users can update the radio 5025 to 5036 and get 3g back!