How to get 4G/5G supported CA and ENDC Combinations from your Android Phone?

Here i instruct how you could get 4G/LTE-A/4G+/LTE+/5G Carrier Aggregation (CA) and Dual Connectivity (ENDC) combinations support from your phone. Your phone show Carrier Aggregation with icon 4G+ or LTE+ normally. on status bar. Carrier Aggregation idea is use multiple bands same time to improve download and upload speed.

You can also check if your device is on https://cacombos.com or https://smartphonecombo.it/ website. Please share to us your device modem logs so we can improve our websites.

Qualcomm diag-logging

This method should work every Qualcomm devices and require root. Before Android 10 could work without root

Then download and extract platform tools to your computer and open adb shell

adb shell

Now with adb shell, download configuration file to diag_logs directory. This need to get logging working.

J9110:/ $ cd /sdcard
J9110:/sdcard $ curl /wp-content/uploads/2019/09/Diag.zip >> Diag.zip J9110:/sdcard $ unzip Diag.zip
J9110:/sdcard $ mkdir diag_logs
J9110:/sdcard $ mv Diag.cfg diag_logs/Diag.cfg

Now we are ready to start logging use diag_mdlog command. Open again adb shell. You can stop logging with CTRL+C

J9110:/ $ su
J9110:/storage/emulated/0 # diag_mdlog -o /sdcard/diag_logs -f /sdcard/diag_logs/Diag.cfg -m /sdcard/diag_logs/Diag.cfg

Cellular-Pro

Require Qualcomm device and rooted. Require paid license 24$/mo or 240$/yea r

Cellular-Pro application allow read signaling information and give supported Carrier Aggregation combinations from UE Capability information signaling message.

To see UE Capability Information message, you have to open Cellular-Pro first, then put your phone to Airplane mode on and then off. Wait some time when you phone connect back to network and you should see UE Capability Information message (screenshot below). With 5G-devices you can also see 5G Capability in UE MRDC Capability message.

NSG Premium

Require Qualcomm device, rooted and 50$/month license.

Network Signal Guru application offer read signaling information and give supported CA Combinations from UE Capability Information signaling message. This is not perfect because many networks request only some bands and also there is max 128 combo limitation. Device could support more than 128 but signaling show only 128 combinations. You can of course disable some bands and then see combinations.

Also NSG Premium is not free, 50$/month licence required.

Open Network Signal Guru application
Go to signaling tab (swipe to right).
Put phone to Airplane mode on / off and wait your phone connect to network.
Find UE Capability Information message. If you have 5G phone, you may see multiple UE Capability Information messages.

QPST

Require Qualcomm 855+ or older and rooted device. Some devices possible expose diag interface without root. This doesn’t work with 5G-devices.

The second way to use QPST Application on Windows. You have to connect your phone to your Windows computer to get access your phone modem (Root required. Some device allow access phone modem without root).

On our blog have few instructions how to get access to QPST:

Blackberry devices: Dial to *#46368676#*#* to enter to Testing-menu. Enable RMNET.

Alcatel/TCL devices: Dial to ###2324# until device promts Diag Protector OFF.

After connection open QPST EFS Explorer and go to /nv/item_files/rfnv and find file 00028874. Copy this file to your computer.

Scat (Qualcomm)

This method works with Linux, Mac and Windows.

This is scat-fork what save UE Capability Information message and 0xB0CD hardware combos to qmdl file. This work example Samsung devices with Qualcomm-modems. If you have Exynos-version of Samsung, please check below Exynos specific instructions.

Install to Debian/Ubuntu

sudo apt-get install git python3-usb python3-serial
git clone https://github.com/HandyMenny/scat
cd scat

Connect your phone with USB to your computer and enable diag if have internal modem like Snapdragon X24:

setprop sys.usb.config diag

Or if you have external modem like Snapdragon X50 or X55

setprop sys.usb.config diag,diag_mdm

Or for Samsung devices can enable diag calling *#0808# and then enable DM + RMNET + MODEM.

Continue to “Run Scat” section and run scat.

Install to MacOS

Run these commands on Terminal.

curl https://bootstrap.pypa.io/get-pip.py -o get-pip.py
python3 get-pip.py
python3 -m pip install pysub
python3 -m pip install pyserial
python3 -m pip install libusb
git clone https://github.com/HandyMenny/scat cd scat

Install Windows

Install Python 3.8 from Windows Store and Git.

Open PowerShell with Administrator.

cd C:
pip install pysub
pip install pyserial
pip3 install pyusb
pip3 install pyserial
git clone https://github.com/HandyMenny/scat
cd scat

Connect your phone with USB to your computer and enable diag if have internal modem like Snapdragon X24:

setprop sys.usb.config diag

Or if you have external modem like Snapdragon X50 or X55

setprop sys.usb.config diag,diag_mdm

Or for Samsung devices can enable diag calling *#0808# and then enable DM + RMNET + MODEM.

For Windows, you have to install libusbK driver.

Select Create and install libusb-win32 device driver a package
Select libusbK
Select your phone interface.
Select Client Installer

End setup with Finish & Install Driver Now. Now you have driver installed and you can start use scat.

Run Scat

Then use scat to record modem data to qmdl and pcap file. Use lsusb to setup -a parameter on Linux/MacOS. On Windows you may have to change -i parameter, you can check value in Device Manager and find lsusbK Usb Devices.

python3 ./scat.py -t qc -u -a 000:255 -i 0 --qmdl output.qmdl -F sim1.pcap

During logging, switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network. Stop logging with CTRL+C.

You can then open this pcap file with Wireshark. Please share to us the qmdl file.

Phone specific methods

OnePlus, Oppo and RealMe devices

Works only with Qualcomm devices.

Input *#800# from dialing interface (Phone App) to enter Logkit.
- OnePlus Android 9 and older: Go to Advanced -> Click Get QXDM Log, choose “modem-common", roll down, click “open device log”. On first time QXDM logging may ask save location. Select default value. Don’t reboot.
- OnePlus Android 10 and newer: Just start recording clicking next of QXDM Log recording button.
- Oppo Realme Android 10 and newer: Go to Cellular Network and Calls -> Start recording.
Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
To stop log caching, enter QXDM Log and choose “close device log” . on Android 10 use pause button to stop logging.

Click record button to start recording log file. Use same button to stop logging. On right side have older version of LogKit.

Enter to the file manager, choose storage and find the /sdcard/oem_log/XXXX/mdm/diag_log_XXXX file (XXX is some generated timestamp value). Log file extension is qmdl or qmdl2.

On my OnePlus 8 new log file saved to /sdcard/oem_log/diag_logs/20200717_171909/mdm/ directory. It’s qmdl or qmdl2 file.

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Xiaomi devices

Old method

This doesn’t work on Mi9 and Mi A3 series devices. Works only with Qualcomm devices.

Dial *#*#995#*#* via Phone App.
Put your phone to Airplane mode, wait 2 second and put phone back to online. Wait your phone reconnect back to 4G. Repeat this couple of times.
Stop logo on phone notification drawer or dial *#*995#*# again.
The logs are saved in dialog_logs/01XXXXX_XXXXX

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Method for Qualcomm Devices before 2020

Doesn’t work with Android One devices. This works only with Qualcomm Devices before SD865.

Open Android Settings -> About phone and click Kernel version 5 times. This will open CIT menu

Open Additional tools on dropdown menu

Open Modem test tools -> Open/Close Offline Log to open logs
Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
And then go to back and click Open/Close Offline Log to close logs
Logs will saved in dialog_logs/01XXXXX_XXXXX

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Method for Qualcomm Devices after 2020

Tested with Xiaomi Mi 10 5G, Redmi Note 8, 8T, Redmi Note 9. Works only with Qualcomm devices.

Go to Android Settings -> Service & feedback
Open additional menu on right top -> Generate logs
Go to “Find Phone, signal and mobile networks” section and press Generate log. Put your phone to Airplane mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
Go back to Logs menu and tap “Finish and upload”
Logs will saved in dialog_logs/01XXXXX_XXXXX

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

LG devices

Old method

Dial *#546368#*#modelnumber#. (Replace model number of your phone model number. You can find model number on Android Settings -> About.
Open Field Test -> LGODM Logging(LGODL).
Click Start.
Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
Click Stop.
Now you should find log File Manager -> lgodm -> logs.

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

New method

Tested with LG V60.

Dial to 277634#*#
Open Log Service -> Modem log to enable modem logging.
Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected 4G LTE network.
Disable Modem logging via same menu.
Now you should find log File Manager -> lgodm -> logs.

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Nokia Android Devices

Tested with Qualcomm based devices.

Dial to *#*#3248665#*#* via Phone App.
Go to 4. Modem Conf.(DbgCfgTool Orginal)
Enable diag logging
Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
Stop logging
Copy log to your storage with Copy diag log.

Now you can find log file on File Manager -> diag_log_xxxx -> log -> diag_log_XXXXXX.gmdl

You can convert qmdl logs to pcap with scat.

python scat.py -t qc -d pathtogdmllog -F xxx.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Samsung Devices

Exynos devices (2019 and older devices)

Tested with Samsung Galaxy S10

This example is for Debian/Ubuntu .

sudo apt-get install git python3-usb python3-serial
git clone https://github.com/fgsect/scat

Dial to *#0808# on your phone and enable RDNDIS + ACM + DM(2CP) + ADB and click OK to save settings

Then run commands on your computer. Check with lsusb -command you can find Samsung device.

scat.py -t sec -m e303 -u -a 001:$(lsusb | awk '/Samsung/ {print substr($4, 1, length($4)-1)}')  -i 4 -F sim1.pcap

Use then Wireshark and find UE Capability Information message. More instruction below.

Exynos devices

Tested with Samsung Galaxy A5 (2016), Galaxy S20 5G

This method require ShannonDM. Please find application from internet

Connect your phone to your computer
Dial to *#0808# and enable RNDIS + ACM + DM + ADB and click OK to save settings.
Open ShannonDM
Open Preference (blue) and click Auto Detect Modem Interface (red) and Apply settings and OK.

Now you can start record with recording button (red). Shannon will ask where to save log file.
Switch your device to Airplane Mode, wait few second and turn Airplane mode off. Wait some time to get connected to 4G LTE network.
Stop logging with same button you started recording. Wait few minutes so Shannon complete writing log file.
You can then open log file with Shannon (need Wireshark to be installed)

Use Filter (red) and select 1st (ST1) or 2nd (ST2) SIM (blue) and then under LTE RRC -> ULDCCH -> ueCapabilityInformation. Click ok.
You can see supported combinations when you search ueCapabilityInformation on signaling. Please share this with us.

Qualcomm devices

This method export 00028874 file on 4G-devices. For 5G-devices recommend use scat-method.

Dial to *#9900# and then SysDump menu should open.
Press Run CP based log and then Copy to sdcard (include CP Ramdump).
You should find BandInfoXXX file on Internal Storage: ./logs/err/bandinfo_XXXX
Open file and copy hexadecimal values on “= Combo Info =” section to Hexadecimal -> file (binary) converted. You can use this online converter.
Then use 28874Decoder to decode file.

How to find UE Capability Information message on pcap file?

Open pcap with Wireshark and search “UE Capability Information Message”.

When you find UE Capability Information message, Expand Subtrees

And copy visible text to text file

Qualcomm diag-logging#

Cellular-Pro#

NSG Premium#

QPST#

Scat (Qualcomm)#

Phone specific methods#

OnePlus, Oppo and RealMe devices#

Xiaomi devices#

Old method#

Method for Qualcomm Devices before 2020#

Method for Qualcomm Devices after 2020#

LG devices#

Old method#

New method#

Nokia Android Devices#

Samsung Devices#

Exynos devices (2019 and older devices)#

Exynos devices#

Qualcomm devices#

How to find UE Capability Information message on pcap file?#

Qualcomm diag-logging

Cellular-Pro

NSG Premium

QPST

Scat (Qualcomm)

Phone specific methods

OnePlus, Oppo and RealMe devices

Xiaomi devices

Old method

Method for Qualcomm Devices before 2020

Method for Qualcomm Devices after 2020

LG devices

Old method

New method

Nokia Android Devices

Samsung Devices

Exynos devices (2019 and older devices)

Exynos devices

Qualcomm devices

How to find UE Capability Information message on pcap file?