I have a fully-patched Pixel Fold with the latest version of Android. If I boot into airplane mode with no SIM cards installed while the “NR only” option is enabled, as soon as I disable airplane mode, the phone immediately connects to a GSM (2G) network, opening my phone up to 2G attacks despite having no SIM card. My expectation is that these connections would be blocked. I also see that the phone occasionally makes UMTS and WCDMA (both 3G) connections in this mode as well, even though 3G is supposedly defunct in the United States. My expectation is that these connections would also be blocked. If I then enable a network (i.e., Cricket or Visible) that seems to only support 5G in the form of 5G Non-Standalone (NSA) (4G+) (again, with “NR only” enabled), the phone proceeds to connect me to LTE, sometimes simultaneously with an NR network (with null MCC/MNC values and a TAC value of 0). My expectation would be for the phone to report no service. So not only is “NR only” not NR only (it allows 2G, 3G, and 4G), but if I enable airplane mode, both \*#\*#4636#\*#\* and the CellMapper app continue to report that my phone is always connected to various cells over 2G, 3G, 4G, and 5G, the latter two with a SIM cards installed and the former two without SIM cards installed. Is “NR only” just “prefer 5G, otherwise connect to anything”? Does “NR only” include 5G NSA, which necessitates allowing LTE (making the option identical to “NR/LTE”)? Shouldn’t airplane mode entirely disable the mobile radio? It seems if “NR only” is not literally “NR only”, then there’s no defense against the attacks described at https://www.mdpi.com/2624-800X/4/1/2 (which leverage 2G, 4G, and 4G+ (AKA 5G NSA)).

I have Moto G4+ and I was playing around with *#*#4636#*#* and accidentally set the radio band to USA Band. Now there's no way of changing it back, so now I can't even connect to a network, let alone use data. I've searched for this issue and it appears that there were other people with the problem, but all of them didn't have answers. The only possible answer was to flash the ROM again, but there was no confirmation of it having worked. And anyway my phone isn't rooted, and I don't want to root, since it is new, as well as the fact that it's not easy for the Moto G4+.

As soon as I connect a USB modem to Android device, the system grabs ttyACM0 and ttyACM1 in an attempt to open connection. As a result, the ports are blocked and can not be opened by other services. I have tried making the following changes in init.rc, as well as deleting ril-deamon service entry. setprop ro.radio.noril yes setprop hw.nophone true How, if possible, can I disable RIL on Android to avoid having it block ttyACM0 and ttyACM1 as soon as modem is plugged in? Is it doable without having to rebuild Android?

I want to transmit and receive custom wireless data by using Android's baseband. So the question remains: - How to do it? - Is that true that the baseband operates on separate SoC & separate firmware? - If the baseband operates on different firmware, then can it be changed? - As we know, OTA updates exist on Android, so it means it's possible to upload a different firmware. But, is it possible to change the baseband firmware using a Cable-USB-PC method or not? Case 2: if the baseband shares the same storage unit with the main OS, then it could be easier, but where to locate the firmware, what does the firmware extension look like, converting binary files to relative files? Scenario 3: We can modify the stock ROM which contains baseband firmware. The stock ROM file contains baseband firmware which can be edited/modified or replaced with custom firmware, then we can upload it to the phone. There could be multiple cases. Please help me. I have experience in coding, custom Android firmware cooking, mobile rooting, extracting firmware of TVs/routers, etc. Please remember my ultimate goal is to transmit and receive wireless custom data using a built-in Android baseband radio chip.

Software Defined Radio (SDR) devices are very costly and not everybody can afford them. Even if they could, **some people are not willing to invest their one-month salary into it.** There are RTL-SDR dongles in the market costing some ten dollars, but this is not about external SDR devices. I am thinking of making some code changes in the Android Linux kernel to act as the wireless-cellular chip as SDR. There are projects in XDA Forums where they have built codes that put their WiFi into monitor mode, let's say it is a monitor mode support driver for Android. So as a context to that; what I am trying to do is; make/write some code changes to the Android Linux kernel which will set the cellular chip into SDR mode. Is it possible? If it's possible, then can you give me some ideas on where to begin? I expect only Android core developers from the networking field to correctly answer this question + those of Android hardware engineers.

I am aware about the different apps for checking 5G connection status on Android, the most useful of which I see CellMapper which says a lot of useful info about the current 5G connection. The one piece I am still missing is the deployment type of the 5G on the cell tower I am connected to. What I mean by deployment type is either SA (Standalone 5G) or NSA (non-standalone). Briefly speaking, it is the way 5G connection is established on the cellular infrastructure, either it uses the legacy 4G equipment (NSA) or new 5G equipment built from scratch (SA). I wasn't able to find that info in CellMapper, nor in the ***#0011#** service menu Is there any way to check this info? I am asking specifically for Samsung Galaxy but appreciate any Android-wide answer. P.S. I have Samsung Galaxy A35 and I'm on Metro PCS carrier.

For my Google Pixel 4 on Android: I often go sailing out in the ocean or motorbiking in distant woods where there is no cell phone signal. I want to leave Bluetooth on so I can listen to podcasts, music and books through my ear buds, but turn cell phone service off so it is not using up power searching for towers that aren't there. Is there a way (or an app) to do this?

I am trying to use my Verizon SIM card as well as a SIM card from airvoice wireless on my xiaomi Note 8. It says that it's reading the cards but I don't know how to enable them if I can.. Please help?!

I'm looking for some help in finding a workaround for the pixels (6 pro, 7) dropping 5g nr connection due to lack of ims registration on Android 13 and 14. - My device is running build: tp1a.221105.002 - Update: also tested on tq2a.230505.002; problem persists. - Borrowed a friends Pixel 7 running android 14 and the problem still exists on even the newest Android. - Pixel 7 was a friends device running the latest. - Pixel 6 is working fine on Android 12. (I wish I could just roll back like we could in the old days...) Test setup:

Ubuntu 22.04 desktop
Open5gs core
SRSRan_Project running on a b210, transmitting inside a Faraday cage
USB C connect to phone through Faraday Cage USB port
Running scrcpy to monitor phone visually in parallel with "logcat -b radio"

So far I've tried using the *#*#0702#*#* ims menu. I futzt around with a menu called, "Edit Ignored CarrierConfig Filter". Tried a few registrations with a handful of ims registration related toggles. The most promising was: ims.ims_registration_required But it didn't fix the issue. Still getting PDU sessions and just losing connection after a few minutes. For more details *check out the GitHub logs *, but in human speech; The device registers just fine according to the amf. The UE is even assigned a PDU session and I can access the internet to watch YT or ping around the network. But after 1~5 minutes (always random) the UE will use drop connect. The amf logs don't show a reregistration or UE-idle message either. For comparison sake, I used a gold standard pixel 5 and pixel 6 running Android 12 and they work fine. Additionally, I found an S22 to try running Android 13 and that phone stays connected for hours when testing. Before I set out to build the ims server using Kamailio, I wanted to make sure the phone didn't require it. When I move to 5g handovers I'd like to isolate the test using the RSRP to trigger by itself and not have to get lost in the ims networking handover also. Thanks in advance for all the help! P.S. I wrote this in a bit of a hurry. I'll make some edits around lunch.

Is there any way I can disable the radio of SIM2 so I can only have 1 active SIM and 1 WiFi calling? Can I use ADB to achieve this, or anything else that doesn't need root or bootloader unlocked?

Since all smart phones have antennas, and these antennas are capable of detecting and receiving many types of signals including wifi, 2g, 3g, 4g, and 5g, then "we" should be able to make apps that help us observe the strength and presense of all these signals independent of the SIM card we happen to have and whether or not our phone is in airplane mode, correct? However, the signal-detector type Android apps I see out there only work when the radio transmitter is powered on, and even then it's limited to the particular service addressed to our SiM. Am I missing some vital factoid? I feel I must be. Something is not adding up for me. I do have a dedicated EMF detector "Electro-smog Meter". It doesn't have transmitters yet it's antennae seem to work just fine.

A feature was introduced in Android 12 that prohibited 2G usage (except for emergency situations), that’s sometimes called the 2G kill switch . However, I now have a Samsung Galaxy A04s and the switch is nowhere to be seen, despite having 2G, 3G and 4G available in the preferred networks menu. So, was it removed from Android 13 ? Or is there something specific with my phone, my country (France) or my mobile operator (Free) ?

When I boot android device having a SIM on roaming it took around 2-10 minutes to get cellular reception. I've tested this on multiple devices, similar behavior. One interesting thing is, if device is already booted and then I inserted the SIM, it instantly gets cellular reception. For a non-roaming SIM it works instantly even after boot. Edit: The SIM provider told us it's an eSIM, though it looks like a regular SIM card. If you've any explanation on this, could you please share?

On older Nokia phones, the name of the cell tower you were connected to was displayed, often the name of the neighborhood you were in. Is there a way to view this data now?

I have a Samsung Galaxy S4 Mini, powered by **CyanogenMod 13 (Android Marshmallow 6.0.1)**, which I use as Wi-Fi only, being it without SIM card. The device antenna, though, seems to be constantly connected to a cellular tower, so I'm afraid that this fact may result in an increased battery consumption (even if slight, that is). Plus, I don't want my position to be triangulated due to this behaviour. Simply dialing **\*#\*#4636#\*#\*** and disabling the antenna from there seems to suffice, but the change does not persist between reboots, and repeating all of the procedure each time is a nuisance. What I wish for, is a way to make the abovementioned change persistent, *without the need for a whole app, which I deem overkill for such a simple task*. Even better, I favor a solution that makes use of the built-in **Terminal**, be it a single command or a function, and I'm open towards solutions that require **root access**. Is there such a way to accomplish this?

**Motivation** My goal is to select or lock LTE frequency bands on mobile devices with Qualcomm chipset. On some devices like Samsung Galaxy S5, we can access hidden menu: *#2263# to select the radio bands, but this secret code is not available for other devices from other vendors, so a more generic way to do this task is needed. Using Qualcomm proprietary tool (QXDM) is another choice but it requires connecting your device to a PC. I want an in-device solution. I am referring diag_qcdm for achieving the goal but this source is out of date and not working. I have a rooted device whose kernel sources are available. Is there anyone who has experience in capturing the communication between the Qualcomm chipset and the ril daemon that are responsible for network selection. I want to lock a device on a particular - RAT - Band - PCI - EARFCN for testing their strength in the field. Please suggest the ways to do it..

I would like to set up an SM-DP+ server to provision my own eSIM profiles. These usually get certified by GSMA and are used for large-scale Remote SIM Provisioning, but I would want to use this for home testing only, so getting official certification would be overkill. I understand that I will need my own mobile network to work with it, which I also want to set up at home. My main concern is that either Android or the device manufacturers impose limitations that would only allow certified eSIM profiles to be installed on a device. I was thinking of using a Google Pixel 3A for testing, so I would be installing the eSIM profiles on this phone. I also tried to find information on what's inside a SIM profile but there isn't much on the internet. I know it contains ISMI and some shared keys which it uses to connect to the MNOs network. I would like to know what else is needed to create a functional eSIM profile and set up a server that provisions these to a Google Pixel 3A for a mock cellular network.

I want to get the information inside cellinfo using adb command, but tac, lac, ci and cid are hidden. How to get these? for example: > mCi=9*****68 mTac=3****1 command: adb shell dumpsys telephony.registry | grep -i mCellInfo output: mCellInfo=[CellInfoWcdma:{mRegistered=YES mTimeStamp=34662470924740ns mCellConnectionStatus=0 CellIdentityWcdma:{ mLac=3***1 mCid=2*****20 mPsc=233 mUarfcn=3028 mMcc=432 mMnc=11 mAlphaLong=IR-MCI mAlphaShort=IR-MCI mAdditionalPlmns={} mCsgInfo=null} CellSignalStrengthWcdma: ss=2147483647 ber=0 rscp=-24 ecno=0 level=0}] device: samsung galaxy a32 android version: 12

On Samsung devices, how to get the ModemServiceMode page (*#0011#) with ADB commands?

TL;DR I have a **Google Pixel 6** and I am able to see my private PLMN but attempting to connect will show instant text, "couldn't connect". No logs in my 5g core, and no registration attempt. Issue - GSM Arena shows that Pixel 6 can do n48 - I've verified that the Pixel 6 can decode SIB1 in n48 and see the test network name "Open5GCore" - Attempt to connect provides no logs in the core using the following radio imp files (Android still using version 12.1) 1. 12.1.0 (SQ3A.220705.003.A3, Jul 2022, Verizon, Verizon MVNOs) 2. 12.1.0 (SQ3A.220705.004, Jul 2022) 3. 13.0.0 (TP1A.220905.004, Sep 2022) I'm starting to think that the phone has a carrier block at the software level that I don't have the knowledge to verify. In the US, there aren't any carriers who use n48, maybe some flag hasn't been set true yet via OTA images? FCC branded it for private use, maybe Google intentionally blocks the capability? I'm writing this late so I'll upload my logcat in the morning.