Trying out different PDC profiles on devices with Qualcomm SoC / modem to make VoLTE / ViLTE / VoWIFI work on unsupported devices
crok - crok.bic @XDA - crokbic @Telegram!!! Do these at your own risk !!! !!! Read it from the beginning to the end before start !!! !!! Always have a backup of your EFS info, use TWRP & QPST too !!! !!! Don't even start when you don't know what you do and why !!! !!! Don't even start when you don't know how to use basic tools !!!
I came across the below german forum and an XDA thread based on that forum:
https://forum.xda-developers.com/poco-f1/how-to/guide-activate-vowifi-wlan-call-t3871263
https://android-hubo.de/thread/8781-volte-und-wificalling-xiaomi/
..and came to my mind that probably this can work for the Mido..
..and perhaps it can work for other Qualcomm devices, too.
So what you will need:
- QPST - https://qpsttool.com/category/download
- Qualcomm drivers - https://www.androidbrick.com/download/latest-2017-qualcomm-diag-qd-loader-windows-10-drivers-signed/
- MIUI ROM: no root required (diag port can be activated from dialer app)
- non-MIUI ROM: root required (diag port cannot be activated from dialer app thus root and terminal emulator or a small app called QCOMDiagMode.apk will be needed - ramdolpix created it and posted on 4PDA here)
- A working linux distro or 7zip - to mount the NON-HLOS.bin as FAT file system and modify it (or just use Ultimate or MTools or 7zip) and a decent texteditor (Notepad++ or Notepad2-mod or SciTE)
- common sense
Most files are available here:
https://mega.nz/#F!Rh5GCCjA!99ARUNlZhytTBq4w5sJJ6w
At least these one are there:
QPST
Qualcomm drivers
QCOMDiagMode.apk
Or on MediaFire here:
http://www.mediafire.com/file/san8mxso19zn6g8/VoLTE_experiment_pack_QCOMM.zip/file
Or maybe (at least QPST and driver):
https://mega.nz/#F!idxVBTwB!G1oW2igk22BvDYevH6i8Wg
!!!Before you even start to think about anything else!!!
Create an EFS backup in TWRP before you start. Just in case..
Create a QCN and an XQCN backup of your EFS data before you start.
QCN: QPST > Software download tool > Backup > save it somewhere save (qcn format)
XQCN: QPST > QFIL > Tools > Backup and restore > save it somewhere save (xqcn format)
If something goes wrong this will save your life..
or at least your phone to be an expensive non-GSM tablet..
So go through the XDA thread's first post and adapt it to your Mido.
Don't forget to enable LTE for the SIM card you want to play with and wait until it gets LTE network connectivity.
Don't forget to create an APN for IMS for the SIM you want to test VoLTE
(ex. Name: ims; APN: ims, APN Type: ims, protocol: IPv4/IPv6; Roaming protocol IPv4/IPv6; these are working most of the time)
Diag port activation:
On MIUI it is easy, in dialer app issue *#*#717717#*#* and you are good to go
On non-MIUI.. Simply use the QCOMDiagMode.apk (:
(give it root access, sometimes you have to go to Magisk Manager and grant it manually)
Or you can do it in terminal emulator - after su - you have to issue
setprop sys.usb.config diag,serial_smd,rmnet_qti_bam,adb && setprop sys.usb.configfs 0 - or try - setprop sys.usb.config diag,serial_smd,rmnet_bam,adb && setprop sys.usb.configfs 0 - or try - setprop sys.usb.config diag,serial_smd,rmnet_ipa,adb && setprop sys.usb.configfs 0
// 1st one worked for us.
After you activated the diag mode (ex. with the small app I mentioned in the beginning - give it root access!) you will see a Qualcomm HS-USB WWAN or Ethernet device in the network devices' list in Windows's device manager, and it's "number" should be "9091" - that's the only one that is working with PDC as far as I can tell you.
And here's the list in mbn_ota.txt mcfg_sw/generic/al1512/airtel/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/cmcc/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/ct/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/ct_test/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/cu/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/pl/gen_3gpp/mcfg_sw.mbn mcfg_sw/generic/al1512/row/gen_3gpp/mcfg_sw.mbn mcfg_sw/generic/al1512/rjio/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/umobile/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/vdf_in/gen_3gpp/mcfg_sw.mbn mcfg_sw/generic/al1512/vodafone/volte/de/mcfg_sw.mbn mcfg_sw/generic/al1512/vodafone/volte/turkey/mcfg_sw.mbn mcfg_sw/generic/al1512/vodafone/volte/uk/mcfg_sw.mbn
So, when ROW profile is not working for you.. you can start your experiment:
try to find a profile where VoLTE starts to work.
Deactivate the ROW one and activate another one for the slot where's your VoLTE capable carrier's SIM is sitting.
CT means China Telecom, CU means China Unicom.. etc..
To check what's going on in terms of IMS registration you can use Network Guru
or go to dialer app and issue *#*#INFO#*#* and Phone then menu and IMS registration info (not available in MIUI).
I advise you to put the SIM card you are testing to SIM slot 1 (PDC: Slot0)
because Network Guru goes crazy when dual SIM situation is in use
and custom ROMs have only one "Phone" menu in *#*#INFO#*#* (SIM slot 2 not visible..).
When you already tried all of the available you still can have luck:
go to https://xiaomifirmwareupdater.com/#stable
or somehow get a recent ROM and extract NON-HLOS.bin from the firmware files - that's the modem's firmare file. It is a flat FAT image file, you can either mount it under linux to a dir or you can extract (or copy and paste files to/from) it with 7Zip, use Ultimate (check the link in the beginning of the article!) to copy files back-and-forth to-and-from the .bin image (the NON-HLOS.bin is a FAT image actually). Extract (or mount..) NON-HLOS.bin and go to image/modem_pr, there's a file called mbn_ota.txt. This file holds the list you can see in PDC.
Now, when you go to image/modem_pr/mcfg/configs/mcfg_sw/generic you will see all the .mbn files stored in lots and lots of directories.. in a deep (3+) directory tree..
So, to list all of them in PDC you will have to extend the list in mbn_ota.txt
But the directory level is quite deep. So I advise you to generate the list instead of type it one-by-one.
Easy example:
in Windows CMD go to image/modem_pr/mcfg/configs/
and issue dir /s /b *.mbn | clip
This will copy the whole output to the clipboard, you can paste it to Notepad++ and strip everything in the beginning to have the same structure of the path just like in the original mbn_ota.txt - !!! DON'T FORGET THAT IT'S LINUX BASICALLY, SO CHANGE ALL \ to / IN THE PATHES !!!
(Little help for Win users:
Example extracted from Xiaomi Redmi Note 4 Mido MIUI V10.2.3.0 - you can copy and paste it to mbn_ota.txt but this is an overkill I think..
mcfg_sw/generic/al1512/airtel/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/cmcc/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/ct/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/ct_test/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/cu/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/pl/gen_3gpp/mcfg_sw.mbn mcfg_sw/generic/al1512/row/gen_3gpp/mcfg_sw.mbn mcfg_sw/generic/al1512/rjio/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/umobile/commerci/mcfg_sw.mbn mcfg_sw/generic/al1512/vdf_in/gen_3gpp/mcfg_sw.mbn mcfg_sw/generic/al1512/vodafone/volte/de/mcfg_sw.mbn mcfg_sw/generic/al1512/vodafone/volte/turkey/mcfg_sw.mbn mcfg_sw/generic/al1512/vodafone/volte/uk/mcfg_sw.mbn mcfg_sw/generic/apac/airtel/commerci/mcfg_sw.mbn mcfg_sw/generic/apac/dcm/commerci/mcfg_sw.mbn mcfg_sw/generic/apac/kddi/commerci/mcfg_sw.mbn mcfg_sw/generic/apac/reliance/commerci/mcfg_sw.mbn mcfg_sw/generic/apac/sbm/commerci/mcfg_sw.mbn mcfg_sw/generic/china/cmcc/commerci/volte_op/mcfg_sw.mbn mcfg_sw/generic/china/cmcc/commerci/volte_su/mcfg_sw.mbn mcfg_sw/generic/china/cmcc/lab/conf_vol/mcfg_sw.mbn mcfg_sw/generic/china/cmcc/lab/eps_only/mcfg_sw.mbn mcfg_sw/generic/china/cmcc/lab/loctech_/mcfg_sw.mbn mcfg_sw/generic/china/cmcc/lab/nsiot_vo/mcfg_sw.mbn mcfg_sw/generic/china/cmcc/lab/tgl_comb/mcfg_sw.mbn mcfg_sw/generic/china/cmcc/lab/w_irat_c/mcfg_sw.mbn mcfg_sw/generic/china/ct/commerci/openmkt/mcfg_sw.mbn mcfg_sw/generic/china/ct/commerci/subsidiz/mcfg_sw.mbn mcfg_sw/generic/china/ct/lab/cta/mcfg_sw.mbn mcfg_sw/generic/china/ct/lab/test/mcfg_sw.mbn mcfg_sw/generic/china/ct/lab/test_eps/mcfg_sw.mbn mcfg_sw/generic/china/ct/lab/test_no_/mcfg_sw.mbn mcfg_sw/generic/china/cu/commerci/openmkt/mcfg_sw.mbn mcfg_sw/generic/china/cu/commerci/subsidiz/mcfg_sw.mbn mcfg_sw/generic/china/cu/lab/test/mcfg_sw.mbn mcfg_sw/generic/eu/dt/non_volt/commerci/mcfg_sw.mbn mcfg_sw/generic/eu/dt/volte/commerci/mcfg_sw.mbn mcfg_sw/generic/eu/dt/volte/czech/mcfg_sw.mbn mcfg_sw/generic/eu/ee/commerci/mcfg_sw.mbn mcfg_sw/generic/eu/orange/commerci/france/mcfg_sw.mbn mcfg_sw/generic/eu/orange/commerci/group_no/mcfg_sw.mbn mcfg_sw/generic/eu/orange/commerci/romania/mcfg_sw.mbn mcfg_sw/generic/eu/orange/commerci/spain/mcfg_sw.mbn mcfg_sw/generic/eu/telefoni/non_volt/spain/mcfg_sw.mbn mcfg_sw/generic/eu/telefoni/volte/de/mcfg_sw.mbn mcfg_sw/generic/eu/vodafone/non_volt/gen/mcfg_sw.mbn mcfg_sw/generic/eu/vodafone/volte/de/mcfg_sw.mbn mcfg_sw/generic/eu/vodafone/volte/italy/mcfg_sw.mbn mcfg_sw/generic/eu/vodafone/volte/portugal/mcfg_sw.mbn mcfg_sw/generic/eu/vodafone/volte/spain/mcfg_sw.mbn mcfg_sw/generic/eu/vodafone/volte/turkey/mcfg_sw.mbn mcfg_sw/generic/eu/vodafone/volte/uk/mcfg_sw.mbn mcfg_sw/generic/korea/kt/commerci/mcfg_sw.mbn mcfg_sw/generic/korea/lgu/commerci/mcfg_sw.mbn mcfg_sw/generic/korea/skt/commerci/mcfg_sw.mbn mcfg_sw/generic/korea/tta/commerci/mcfg_sw.mbn mcfg_sw/generic/latam/amx/non_volt/mcfg_sw.mbn mcfg_sw/generic/latam/amx/volte/mcfg_sw.mbn mcfg_sw/generic/na/att/non_volt/mcfg_sw.mbn mcfg_sw/generic/na/att/volte/mcfg_sw.mbn mcfg_sw/generic/na/sprint/commerci/mcfg_sw.mbn mcfg_sw/generic/na/tmo/commerci/mcfg_sw.mbn mcfg_sw/generic/na/uscc/commerci/mcfg_sw.mbn mcfg_sw/generic/na/verizon/cdmaless/mcfg_sw.mbn mcfg_sw/generic/na/verizon/hvolte/mcfg_sw.mbn mcfg_sw/generic/russia/beeline/gen_3gpp/mcfg_sw.mbn mcfg_sw/generic/russia/megafon/volte/mcfg_sw.mbn mcfg_sw/generic/sa/brazil/commerci/mcfg_sw.mbn mcfg_sw/generic/sea/3hk/volte/hk/mcfg_sw.mbn mcfg_sw/generic/sea/cherry/commerci/mcfg_sw.mbn mcfg_sw/generic/sea/hkt/volte/hk/mcfg_sw.mbn mcfg_sw/generic/sea/imobile/commerci/mcfg_sw.mbn mcfg_sw/generic/sea/p1/volte/malaysia/mcfg_sw.mbn mcfg_sw/generic/sea/singtel/volte/singapor/mcfg_sw.mbn mcfg_sw/generic/sea/smartfre/commerci/mcfg_sw.mbn mcfg_sw/generic/sea/smartone/volte/hk/mcfg_sw.mbn mcfg_sw/generic/sea/starhub/volte/singapor/mcfg_sw.mbn mcfg_sw/generic/sea/ytl/gen_3gpp/mcfg_sw.mbn
So, you put back the new mbn_ota.txt to the bin image and you can flash it via fastboot
fastboot flash modem [name_of_the_file.bin]
Another - to me quite convenient - solution is to use a firmware zip from https://xiaomifirmwareupdater.com as a template, delete all files except NON-HLOS.bin and replace this .bin with your new, edited file + edit the updater script to flash only this .bin
But.. Before doing so please go to TWRP and delete the content (all files and dirs, recursively - these are the modem config files and settings stored in the ROM)
of /data/vendor/radio on Oreo/Pie
or /data/misc/radio on Nougat MIUI
(there are some files to check whether a radio related firmware update was successful and there are the copied mbn files and some generated SQLite databases so because you want to use your patched version of the firmware you must re-generate these items.)
Then, when you rebooted your phone start the experiment again, check the profiles one-by-one.
mcfg_sw/generic/al1512/row/gen_3gpp/mcfg_sw.mbn
with
mcfg_sw/generic/al1512/vdf_in/gen_3gpp/mcfg_sw.mbn
which is stupid but seems to work fine..
(overwrote the ROW_Gen_3GPP with the working one)
Another possible solution is to remove the ROW_Gen_3GPP profile completely: delete
mcfg_sw/generic/al1512/row/gen_3gpp/mcfg_sw.mbn
completely from the image file and from mbn_ota.txt as well and flash it.
BUT!!! Don't forget to delete the modem directories before flashing the new (edited) image.
How to rollback: flash your original firmware zip downloaded from https://xiaomifirmwareupdater.com or clean / dirty flash your MIUI ROM and restore the EFS data from your TWRP backup or QPST backup (qcn or xqcn file). Does not take more than 1..2 mins, I promise.
Don't be surprised when very-unlikely-to-work profiles start to work :D For instance here, in Hungary it seems that the 4 VoLTE capable carriers (Magyar Telekom / Telenor / Vodafone / Digi.HU) are all working in terms of VoLTE when we set the Vodafone India profile :D
Good luck, have VoLTE!
Special thanks:
Lackooo84 - @Prohardver/Mobilarena forum in Hungary
edgonzo - @android-hubo.de forum in Germany
Hikari no Tenshi - @XDA / Serhij @Telegram
ramdolpix @4pda for the Qualcomm Diag mode enabler app, really appreciate it