Koti » How to get 4G/5G supported CA and ENDC Combinations from your Android Phone?

How to get 4G/5G supported CA and ENDC Combinations from your Android Phone?

Here i instruct how you could get 4G/LTE-A/4G+/LTE+/5G Carrier Aggregation (CA) and Dual Connectivity (ENDC) combinations support from your phone. Your phone show Carrier Aggregation with icon 4G+ or LTE+ normally. on status bar. Carrier Aggregation idea is use multiple bands same time to improve download and upload speed.

You can also check if your device is on https://cacombos.com or https://smartphonecombo.it/ website. Please share to us your device modem logs so we can improve our websites.

Qualcomm diag-logging

This method should work every Qualcomm devices and require root. Before Android 10 could work without root

Then download and extract platform tools to your computer and open adb shell

adb shell

Now with adb shell, download configuration file to diag_logs directory. This need to get logging working.

J9110:/ $ cd /sdcard
J9110:/sdcard $ curl https://mt-tech.fi/wp-content/uploads/2019/09/Diag.zip >> Diag.zip
J9110:/sdcard $ unzip Diag.zip
J9110:/sdcard $ mkdir diag_logs
J9110:/sdcard $ mv Diag.cfg diag_logs/Diag.cfg

Now we are ready to start logging use diag_mdlog command. Open again adb shell. You can stop logging with CTRL+C

J9110:/ $ su
J9110:/storage/emulated/0 # diag_mdlog

Cellular-Pro

Require Qualcomm device and rooted. Require paid license 24$/mo or 240$/year

Cellular-Pro application allow read signaling information and give supported Carrier Aggregation combinations from UE Capability information signaling message.

To see UE Capability Information message, you have to open Cellular-Pro first, then put your phone to Airplane mode on and then off. Wait some time when you phone connect back to network and you should see UE Capability Information message (screenshot below). With 5G-devices you can also see 5G Capability in UE MRDC Capability message.

NSG Premium

Require Qualcomm device, rooted and 50$/month license. 

Network Signal Guru application offer read signaling information and give supported CA Combinations from UE Capability Information signaling message. This is not perfect because many networks request only some bands and also there is max 128 combo limitation. Device could support more than 128 but signaling show only 128 combinations. You can of course disable some bands and then see combinations.

Also NSG Premium is not free, 50$/month licence required.

  • Open Network Signal Guru application
  • Go to signaling tab (swipe to right).
  • Put phone to Airplane mode on / off and wait your phone connect to network.
  • Find UE Capability Information message. If you have 5G phone, you may see multiple UE Capability Information messages.

QPST

Require Qualcomm 855+ or older and rooted device. Some devices possible expose diag interface without root. This doesn’t work with 5G-devices.

The second way to use QPST Application on Windows. You have to connect your phone to your Windows computer to get access your phone modem (Root required. Some device allow access phone modem without root).

On our blog have few instructions how to get access to QPST:

Blackberry devices: Dial to *#46368676#*#* to enter to Testing-menu. Enable RMNET.

Alcatel/TCL devices: Dial to ###2324# until device promts Diag Protector OFF.

After connection open QPST EFS Explorer and go to /nv/item_files/rfnv and find file 00028874. Copy this file to your computer.

Scat (Qualcomm)

This method works with Linux, Mac and Windows.

This is scat-fork what save UE Capability Information message and 0xB0CD hardware combos to qmdl file. This work example Samsung devices with Qualcomm-modems. If you have Exynos-version of Samsung, please check below Exynos specific instructions.

Install to Debian/Ubuntu

sudo apt-get install git python3-usb python3-serial
git clone https://github.com/HandyMenny/scat
cd scat

Connect your phone with USB to your computer and enable diag if have internal modem like Snapdragon X24:

setprop sys.usb.config diag

Or if you have external modem like Snapdragon X50 or X55

setprop sys.usb.config diag,diag_mdm

Or for Samsung devices can enable diag calling *#0808# and then enable DM + RMNET + MODEM.

Continue to “Run Scat” section and run scat.

Install to MacOS

Run these commands on Terminal.

curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
python3 get-pip.py
python3 -m pip install pysub
python3 -m pip install pyserial
python3 -m pip install libusb
git clone https://github.com/HandyMenny/scat
cd scat

Install Windows

Install Python 3.8 from Windows Store.

Open PowerShell with Administrator.

cd C:
pip install pysub
pip install pyserial
git clone https://github.com/HandyMenny/scat
cd scat

Connect your phone with USB to your computer and enable diag if have internal modem like Snapdragon X24:

setprop sys.usb.config diag

Or if you have external modem like Snapdragon X50 or X55

setprop sys.usb.config diag,diag_mdm

Or for Samsung devices can enable diag calling *#0808# and then enable DM + RMNET + MODEM.

For Windows, you have to install libusbK driver.

End setup with Finish & Install Driver Now. Now you have driver installed and you can start use scat.

Run Scat

Then use scat to record modem data to qmdl and pcap file. Use lsusb to setup -a parameter. On Windows you may have to change -i parameter, you can check value in Device Manager and find lsusbK Usb Devices.

python3 ./scat.py -t qc -u -a 000:255 -i 0 --qmdl output.qmdl -F sim1.pcap

During logging, switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network. Stop logging with CTRL+C.

You can then open this pcap file with Wireshark. Please share to us the qmdl file.

Phone specific methods

OnePlus, Oppo and RealMe devices

Works only with Qualcomm devices.

  • Input *#800# from dialing interface (Phone App) to enter Logkit.
  • – OnePlus Android 9 and older: Go to Advanced -> Click Get QXDM Log, choose “modem-common”, roll down, click “open device log”. On first time QXDM logging may ask save location. Select default value. Don’t reboot.
    – OnePlus Android 10 and newer: Just start recording clicking next of QXDM Log recording button.
    – Oppo Realme Android 10 and newer: Go to Cellular Network and Calls -> Start recording.
  • Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
  • To stop log caching, enter QXDM Log and choose “close device log” . on Android 10 use pause button to stop logging.
  • Enter to the file manager, choose storage and find the /sdcard/oem_log/XXXX/mdm/diag_log_XXXX file (XXX is some generated timestamp value). Log file extension is qmdl or qmdl2.
On my OnePlus 8 new log file saved to /sdcard/oem_log/diag_logs/20200717_171909/mdm/ directory. It’s qmdl or qmdl2 file.

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Xiaomi devices

Old method

This doesn’t work on Mi9 and Mi A3 series devices. Works only with Qualcomm devices.

  • Dial *#*#995#*#* via Phone App.
  • Put your phone to Airplane mode, wait 2 second and put phone back to online. Wait your phone reconnect back to 4G. Repeat this couple of times.
  • Stop logo on phone notification drawer or dial *#*995#*# again.
  • The logs are saved in dialog_logs/01XXXXX_XXXXX

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Method for Qualcomm Devices before 2020

Doesn’t work with Android One devices. This works only with Qualcomm Devices before SD865.

  • Open Android Settings -> About phone and click Kernel version 5 times. This will open CIT menu

Open Additional tools on dropdown menu

  • Open Modem test tools -> Open/Close Offline Log to open logs
  • Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
  • And then go to back and click Open/Close Offline Log to close logs
  • Logs will saved in dialog_logs/01XXXXX_XXXXX

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Method for Qualcomm Devices after 2020

Tested with Xiaomi Mi 10 5G, Redmi Note 8, 8T, Redmi Note 9. Works only with Qualcomm devices.

  • Go to Android Settings -> Service & feedback
  • Open additional menu on right top -> Generate logs
  • Go to “Find Phone, signal and mobile networks” section and press Generate log. Put your phone to Airplane mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
  • Go back to Logs menu and tap “Finish and upload”
  • Logs will saved in dialog_logs/01XXXXX_XXXXX

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

LG devices

Old method

  • Dial *#546368#*#modelnumber#. (Replace model number of your phone model number. You can find model number on Android Settings -> About.
  • Open Field Test -> LGODM Logging(LGODL).
  • Click Start.
  • Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
  • Click Stop.
  • Now you should find log File Manager -> lgodm -> logs.

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

New method

Tested with LG V60. 

  • Dial to 277634#*#
  • Open Log Service -> Modem log to enable modem logging. 
  • Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected 4G LTE network. 
  • Disable Modem logging via same menu.
  • Now you should find log File Manager -> lgodm -> logs.

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Nokia Android Devices

Tested with Qualcomm based devices.

  • Dial to *#*#3248665#*#* via Phone App.
  • Go to 4. Modem Conf.(DbgCfgTool Orginal)
  • Enable diag logging
  • Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
  • Stop logging
  • Copy log to your storage with Copy diag log.
  • Now  you can find log file on  File Manager -> diag_log_xxxx -> log -> diag_log_XXXXXX.gmdl

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Samsung Devices

Exynos devices (2019 and older devices)

Tested with Samsung Galaxy S10

This example is for Debian/Ubuntu .

sudo apt-get install git python3-usb python3-serial
git clone https://github.com/fgsect/scat

Dial to *#0808# on your phone and enable RDNDIS + ACM + DM(2CP) + ADB and click OK to save settings

Then run commands on your computer. Check with lsusb -command you can find Samsung device.

scat.py -t sec -m e303 -u -a 001:$(lsusb | awk '/Samsung/ {print substr($4, 1, length($4)-1)}')  -i 4 -F sim1.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Exynos devices

Tested with Samsung Galaxy A5 (2016), Galaxy S20 5G

This method require ShannonDM. Please find application from internet

  • Connect your phone to your computer
  • Dial to *#0808# and enable RNDIS + ACM + DM + ADB and click OK to save settings.
  • Open ShannonDM
  • Open Preference (blue) and click Auto Detect Modem Interface (red) and Apply settings and OK.
  • Now you can start record with recording button (red). Shannon will ask where to save log file.
  • Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
  • Stop logging with same button you started recording. Wait few minutes so Shannon complete writing log file.
  • You can then open log file with Shannon (need Wireshark to be installed)

  • Use Filter (red) and select 1st (ST1) or 2nd (ST2) SIM (blue) and then under LTE RRC -> ULDCCH -> ueCapabilityInformation. Click ok.
  • You can see supported combinations when you search ueCapabilityInformation on signaling. Please share this with us.

Qualcomm devices

This method export 00028874 file on 4G-devices. For 5G-devices recommend use scat-method.

  • Dial to *#9900# and then SysDump menu should open.
  • Press Run CP based log and then Copy to sdcard (include CP Ramdump).
  • You should find BandInfoXXX file on Internal Storage: ./logs/err/bandinfo_XXXX
  • Open file and copy hexadecimal values on “= Combo Info =” section to Hexadecimal -> file (binary) converted. You can use this online converter.
  • Then use 28874Decoder to decode file.

How to find UE Capability Information message on pcap file?

Open pcap with Wireshark and search “UE Capability Information Message”.

When you find UE Capability Information message, Expand Subtrees

And copy visible text to text file

53 thoughts on “How to get 4G/5G supported CA and ENDC Combinations from your Android Phone?”

  1. Generator Rex

    Hey there , can we add more combos in it , i have redmi note 7 pro , in my country , there’s only 3+5 ,5+40 ,3+40 ,3+5+40 bands for a 4g carrier provides ca combinations (not supported on my phone) .btw what is difference between 40C and 40 , similarly 3C and 3 etc.can i enable intra ca combinations .further in nsg ,i can see 4×1 or 4×2 mimo ,can i increase it to 4×4 ,i know its cell tower limited ,but can it be increased in phone .

      1. Hi
        How can i do to get 4G supported CA Combinations from Redmi Note 8 Pro and Mediatek ?
        I searched everywhere but didn’t find any information .
        Thanks a lot.

        1. Sorry but there is no way to get CA combos from mediatek but i think it only support contiguous CA.

          1. Redmi 8pro:
            only 2xCA 2100+1800MHz
            support BW40Mhz on 1C ,3C,7C,38C,40C
            reply from Xiaomi industry for CA added: no possible …HW limit. 🙁 change CA combo it is ??? 🙂
            Rudy

    1. Do you have rooted device? If you have, then you can try that QPST method to get 28874 file. NSG is second method to get combos from your device but it require licence.

  2. In Redmi Note 3 pro , I cnat able to find 28874 nv item in rfnv item files .I can see other 28876 like items .how else I can get it ?
    Thanks

    1. Please use Xiaomi own logging method to record 4G Combinations. I think that old method should work with your device. Could you then send your log file to me [email protected] so i can add supported 4G combos to cacombos.com site?

  3. how to get CA for samsung galaxy s20 ultra 5g? i tried with scat method and couldn’t get it

  4. Hi ,
    Are you sure that there is no band B2 or B4 or B5 or B8 or B20 or B28 on Redmi Note 9S (M2003J6A1G) ?
    I don’t talk about CA combos , but just bands .
    https://cacombos.com/device?model=M2003J6A1G

    On Redmi Note 8 Pro (Global) (M1906G7G) , we can see all CA combos , and all bands 1, 2, 3, 4, 5, 7, 8, 20, 28, 38, 40
    https://cacombos.com/device?model=M1906G7G

    I ask because a lot of people said that they don’t have B28 on Redmi Note 9S (M2003J6A1G) , and i don(t see it on your site .

    Thx

    1. Hi,

      Redmi Note 9S combinations based from 28874 file, what doesn’t include single band list. So i had to rely official specs. But combinations are correct. I haven’t personally tested this model.

      If you know someone who have this device, we can verify. Just use Xiaomi method to send log to https://cacombos.com/contribute

  5. Hi,
    Are you olkitu ?
    I saw your comments on Xda and Mi Community.

    I want to Thank you ,
    I can confirm that the Redmi Note 8 Pro supports B3 + B1, but I had to deactivate the other bands (B7 and B20) to have 4g + .

    Now i have 4G+ between 220 and 250 Mbps at home 🙂

    Next time i need to buy a phone , I will check first on your website

    1. Yes i am and please share my page so more people knows about CA Combinations.

      I also tested Redmi Note 8 Pro because many complains no 4G+/CA/LTE-A and it support B3+B1 and Contigous CA between middle and high bands.

      cacombos.com missing still many phones so if you know anyone have device where could get logs, please share this page so then we can build together even better 4G+ Combination database.

      1. Hi ;
        I also have a Redmi Note 5 M1803E7SG.

        I think your log isn’t the good one . It must be a china model .
        https://smartphonecombo.it/?device=M1803E7SG

        The european version M1803E7SG doesn’t have B39 and B41 bands.
        https://www.kimovil.com/fr/ou-acheter-xiaomi-redmi-note-5-global-64gb
        4G LTE :B1 (2100), B3 (1800), B4 (1700/2100 AWS 1), B5 (850), B7 (2600), B8 (900), B20 (800), B38 (TDD 2600), B40 (TDD 2300)

        Here , you can download my log converted to pcap , than opened with Wireshark , and saved to txt file .
        https://drive.google.com/file/d/1j3s_dmGzlZFzXvutRYj4AfzXNmZhIuT3/view?usp=sharing

        If i understand , Redmi Note 5 M1803E7SG – DL Band / CA :
        1 1C 3 3B3C 4 5 7 7B 7C 8 20 38 38C 40 40C

        My provider is Free Mobile – France.

        PS: you have never told me how to open my Redmi Note 8 Pro logs 🙁
        Pleaaaase , what extra tools do you use for mediatek smartphones ?

        1. Smartphonecombo.it is not my own site even we work together to provide best 4G combination database. cacombos.com is my site and now i have added this device: https://cacombos.com/device?model=M1803E7SG

          Yes in UE Capability Information message there is no B39 and B41 bands.

          Redmi Note 8 Pro have Mediatek chipset and all these log methods here are for Qualcomm.

          1. Thank you to have added the device .
            Sorry , I thought the 2 sites were yours .

  6. I forgot to tell you that my Redmi Note 5 M1803E7SG have 11.0.3.0 PEIMIXM official global rom , and i have to use ”Xiaomi Method for Qualcomm Devices after 2020 ” .

    On this website https://github.com/fgsect/scat , there’s written :”Only tested in Linux”

    Good news , I managed to use “scat” with Windows 10 .
    1- Download and install “Python 3.8” from Microsoft Store https://www.microsoft.com/fr-fr/p/python-38/9mssztt1n39l?activetab=pivot:overviewtab
    2- Download and unzip “scat-master.zip” in “C:\” from https://github.com/fgsect/scat
    3- Download “pyusb 1.0.2.tar.gz” from https://pypi.org/project/pyusb/ , copy in “C:\scat-master” and rename it “pyusb.tar.gz”
    4- Download “pyserial 3.4.tar.gz” from https://pypi.org/project/pyserial/ , copy in “C:\scat-master” and rename it “pyserial.tar.gz”
    5- Copy your “qmdl log” from your phone in “C:\scat-master” and rename it “1.qmdl”
    6- Press Windows+R to open “Run” box. Type “cmd” and then click “OK” to open Command Prompt.
    7- run ”cd c:\scat-master”
    8- run “pip install pyusb”
    9- run “pip install pyserial”
    10 -run “python scat.py -t qc -d 1.qmdl -F 1.pcap”

    Now you can use Wireshark and find UE Capability Information message .
    Execute “Wireshark.exe” and open file “1.pcap” in “c:\scat-master”

  7. Hello … thanks for all informations
    im using the new huawei Y7P … kirin 710f support ca but there is no carrier aggregation option in menu
    right now CA not working … my old phone samsung a7 2017 support 4G+ and use two combinations 3+3 / 20+3 … do you know any method to save log from huawei phone ?

  8. hi, my phone is model M1908C3JH.
    In the manual it says to have the band b28 700mhz, but in my provider it is not working.
    already contributes with information from it to cacombos could you check if the support for this frequency?

    att. Luan

  9. Hi, Any ways to enable Band 40A-40A CA on Nokia 7 Plus TA-1046 it only supports 40C but here carriers only support 40A-40A Non contiguous

  10. I’ve tried this with with Oneplus 8 In2010 but one thing I don’t understand: do the logs show only what bands my carrier supports or what the modem theoretically supports?

    For example rf-Parameters shows 1 3 7 8 20 38 40 but these are included in both IN2010 and IN 2013

    1. Both models support LTE bands 1,3,7,8,20,38,40 – this is single band list. UE Capability Information message tell to network (to carrier) what bands, carrier aggregation and dual connectivity combinations phone support. There is Carrier Policy in phone modem what limit bands and carrier aggregation combinations depends PLMN.

  11. Great work !
    I have a problem in oppo and Samsung devices

    First: Oppo Reno2 the output extension is not qmdl ..the generated files are with extensions .muxz,
    .xz, .edb

    Second: for Samsung I got the hexa file and converted to binary but I don’t know how to use 2887 decoder , the commands to decompress and run the decoder should be run on python or what? (N.B: I am windows user)

      1. Thanks for your reply,
        I sent to you by mail the band info file for Samsung Galaxy A71 ..thanks to send me back the decoding of that file as I need it ASAP

        Thanks for the great support

  12. Hi

    Is there a way to check this on Huawei P40 Lite?
    I just bought this model recently and it doesn’t seem to have 256QAM activated although is using the same Balong 5000 modem just like P40 Pro.

    Thank you,

  13. Hello bro, im struggling of how to do it with my Note 10+ N9750 Variant Snapdragon Dual Sim, i entered the menu, open bandinfo file, copied the hex, and created binary, then i went to decoder page, but from there i dont understand what to do, sorry for being so ignorant.
    PS I enteder to cacombos, but my variant does not appear there, only N975U and N975F.

    Please help!

      1. OK, I wait then until the info of my band information is added? To get 4G+? This phone is Taiwan variant, but I’m using it in Central America, Honduras.

      2. I did, what I do next? please help im here:

        Hello bro, im struggling of how to do it with my Note 10+ N9750 Variant Snapdragon Dual Sim, i entered the menu, open bandinfo file, copied the hex, and created binary, then i went to decoder page, but from there i dont understand what to do, sorry for being so ignorant.

        Thank you!

        1. Could you please help me? I don’t understand how to use the decoder or how to use the info in cacombos.com

      1. yes i know that, but what i do with the decoded file? i recplace that file with the one on my phone? im sorry but your instructions are not clear.

  14. yes i know that, but what i do with the decoded 0028874 file? i replace it with the one on my phone? sorry, but your instructions are not clear.

  15. ok i have the decoded file, and i know the combination are available on my phone, B1 + B5, my question is, what i do with that text (decoded 0028874) file, i need to change something there, or i just replace my current 28874 file with this new one?

      1. OK what I do with this info? I want to enable carrier aggregation on my phone, what I do next? I have the information of the decoded file.

        1. Carrier Aggregation is enabled by default and activated when network and device support same combinations. In decoded file you can see what combinations your device support.

        2. the bigger question here is, how i use the information to enable my carrier agreggation on my device? im guessing this information obtained on the decoder is needed to obtain carrier aggregation right? could you please email me directly to [email protected], you are my only hope at this.

          1. Its already enabled with these combinations what your hardware support: https://cacombos.com/device?model=SM-N9750 . There is no other way enable. My instruction on this page help only list supported combinations of devices. Decoder only convert 00028874 NVITEM to readable format – nothing more if you read Readme first.

  16. I have another question I’m checking the page CA combos but it says that my phone does not support the band 4 of LTE but check in with the code *#0011# it is showing that I am connected to the band 4 of LTE. Can you explain me if I’m wrong or is something wrong in the page

  17. ok so doing some research with my carrier, they do carrier aggregation with bands B4 and B5, so basically you are telling me, that even my phone runs both bands, cause i have checked and also it has connected to LTE band 5, but it cannot perform carrier aggregation using those to bands? (B4 and B5). How is that possible? shouldn’t a phone perform carrier aggregation with all the bands it uses?

    1. N9750 Samsung Note 10+ doesn’t support B4+B5 Carrier Aggregation combination. So you have to find device support this combination.

Kommentoi