Google Nexus One Field Test Mode

It is a bad news that Nexus One doesn't come with a decent default netmonitor function like iPhone or symbian phones. I don't have Nexus One with me. When I played my friend's one with code *#*#4636#*#* , it only shows you the cell serving cell id.

There is one application called "Netmonitor" in Android Market provides limited engineering mode. Here is the description from Android Market:

----- Description from Android Market: -----
Monitor GSM network; the info about current and neighboring cells (Cell ID, LAC, rf signal strength); a custom database with the info on cells; switches between cells in a log and on a map; saving log in a file

* tested on Hero, Magic, Milestone; no neighborings on Samsung Spica & Galaxy
* currently no CDMA support

was developed for Android by parizene

Package name : com.parizene.netmonitor

----- Description from the developer: ------
Program for monitoring GSM network of the mobile operator.
It shows the information about current and neighboring cells (Cell ID, LAC, signal strength).
You can also use a custom database with the information on cells.
Shows switches between cells in a log (saving log in a file) and on a map (if there are coordinates for them in google's database).

* Currently there is no CDMA support.
* It was tested only on HTC Hero & HTC Magic (GSM).

Forces closed, bugs, problems? Contact me (parizene@gmail.com)

Field Test Mode on Nokia Symbian Phone June 2009 Update

The following steps apply to Nokia Symbian phones. To be more specific, it should work with S60, FP 9.X Symbian phones. There are many hacking tools around the web and I am confuse at the beigining what steps I should do to install the Field Test Mode or Net Monitor to my phone. Some old methods are no longer work and therefore I try to write the steps here to remind myself. The following steps is tested in June 2009.


In brief, you need to have the following stuffs to install FTD:

1. A Cert and Key to sign some hacking applications.

2. A SIS signing tool.

3. HelloOX v1.0.3 This is the application to allow us access the hidden system folders.

4. FTD files or installation (.sis) file. You need to copy files or install signed FTD apps to provide the FTD function.



1. How To Get a Developer Cert and Key for free

To get a cert & key for your Symbian phone, go to the famous OPDA http://www.opda.net.cn to get a cert for free. OPDA is a Chinese forum and generously provide free cert for Symbian users. If you don’t know Chinese, visit http://mynokiamobile.org/2009/05/25/how-to-get-our-own-opda-developer-certificate/ and follow the step-by-step tutorial. It should take to around several hours to one day to get the cert and key. One thing need to point out is that the forum will ask you to provide your 11 digits phone number that started with 13, 15 or 18. Just provide any number start with 13, 15 or 18 and it doesn’t need to be your number. But try to make it random enough so that it won’t be used by other to avoid collision.

2. Signing Tool
You can use any signing tool available. I get the sigining tool from here http://www.mediafire.com/?wojtgmwdjai
SisSigner.zip - 664.2 KB

3. HelloOX v1.0.3
Use this version or later one. I have tried v1.0.1 with no success. V1.0.1 has to rely on another application called mapdrive. In V1.0.3 Mapdrive is integrated into HelloOX and hence you don’t need to trouble about it. Get it from the link here: http://www.mediafire.com/?dzmkyruvomz
HelloOX v1.03.rar - 186.9 KB

Sign the HelloOX with your cert & key. Install and Run it.

With my Nokia 5320, it took me very long time in the “Install Root Certificates…” step. Therefore be patient during the installation.

After install ROMPatcher, HelloOX will try to remove some files. In my case, it just hanging for 30mins and I just press the “cancel” button to complete the installation.
After the installation, you should find an “LeftUp” Item in your phone. Open it you should see “Modo” application. Open “Modo” you should able to see the hidden folders like “Private” and “SYS”. Now you are very close to success.



4. Install the FTD files
There are two ways to install the FTD files.

Method 1: Sign packed sis file and install it. Get the file here: http://www.badongo.com/file/15838439
12 Mar 2010 Update: badongo link is dead. File is uploaded to rapaidshare : http://rapidshare.com/files/362415236/FieldTest_9.2_new.zip

It should work for some models but not all. If the installation fails, use method 2. My N5320 doesn't work with this method.

Method 2: Copy the FTD files to specific folder by using “Modo”.

Download the FTD files from the following link: http://www.badongo.com/file/15838444
12 Mar 2010 Update: badongo link is dead. File is uploaded to rapaidshare : http://rapidshare.com/files/362415650/ftdALLSymbian.zip

Copy the respective files to corresponding folder as below:

C/Private/10003a3f/import/Apps
FtdApp_reg.rsc

C/Resource/Apps
Ftd.mbm
Ftd.mif
ftd.rsc
Ftd_aif.mif
ftdata_wk15_07.dat
ftdata_wk41_06.dat
Alarm.rsc
AlarmList.mbm
CallEnd.rsc
Custom.rsc

C/Resource/Plugins
ftd.dll55l
baseimage.dof

C/Sys/Bin
FTD.exe
FtDaInterface.dll
ftdaserver.exe
FtDbInterface.dll
ftdbserver.exe
FtdGwcTest.exe
FtEngine.dll

C:\private\101F457f\
MmRmDSPInitData.RSC

C:\system\apps\dynbase\
dynbase.dof55l

If a specific folder cannot be found, just create it yourself. After you copy all the files, you should able to see the "Field Test" icon in the Application or Application->My Own folder of your phone.

But if your phone is FP9.1 (My 5320), the icon will not be shown and you need to override the Ftd.mbm, Ftd.mif, Ftd_aif.mif with FP9.1 version.

5. Done! Enjoy your test mode.

6. Confirmed model:
N85, 5800, 5320, 6120 Classic. The critical step is to be able to access the hidden folders.



9 Mar 2010 Update:
The download links are dead in badongo server as mentioned by one reader. I shall upload the files again when I back to home (around 13-14 Mar 2010).

12 Mar 2010 Update:
Files are uploaded again.

PyNetMony - the Python NetMonitor

PyNetMony is a freeware GSM, UMTS, WLAN and Bluetooth Monitor and scanner tool with support of the internal, external or assisted GPS of all new Nokia E and N Series mobile phones.

PyNetMony shows and logs GSM and UMTS network information like Cell ID, Location Area Code, Mobile Network Code , RX level and so on in the NetMon tab. PyNetMony supports Nobbis clf v3.0 format, but only decimal at this time, please read the readme.txt for details. PyNetMony has a voice notifier for cell changes. The white headline shows always the current cell id, how many WLAN and Bluetooth devices are in range, how many GPS satellites are fixed and the current time.

You can find the latest version of PyNetMony at

http://pynetmony.googlepages.com/home


Related topics:
Symbian 9.1/9.2 NetMonitor (FTD) for hacked phone
iPhone field test modeSony Ericsson Techmode
HTC Field Test Mode/Engineering Mode
Blackberry Engineering Mode
Nokia DCT-4 phone model and type mapping

Engineering Field Mode (EFEM) in A780

1° Dowload from phone Seem 0032_0001. Check bits 4,5,6&7 offset 44. Upload to phone.

2° In your TFlash you should have this hidden folder /system/Qtdownload/ if you already installed LinLoader (see Yantz Topics). If not create it.

Under Qtdownload create a new folder "fem". Create an icon size 32*32 png for your new application and copy "efem" that you will find by telneting in /usr/SYSqtapp/ap_tcmd/ in this new folder.

3° In your TFlash add to /system/java/PlugcardDB this

[AppLinkRecord100001000]
AllPosition = 202
BigIcon = fem.png
Directory = fem
Exec = efem
Group = 3
Icon = fem-sm.png
InstalledDate = 2005/9/26
JavaId = -1
Mime =
MpkgFile =
Name = EngField
OsVersion =
Position = 1
Rotation =
Shared = 0
Size = 24K
Type = 4
uid = 100001000

It's quite finished. You create your new Icon named EngField.
Tap on it and you will have the next screens I join.
For enabling Efem receiver that allows you to see the active cell and neighbours cells and all attached parameters check in FTS Options Eng Field Mode On.
Then you only have to press the Homme Button at the right side of tour phone and the parameter creen appears. Use the scroll button to defile.

Nokia DCT-4 Netmonitor/Field Test Mode

To activate Netmonitor in DCT-4 Nokia phone, you need to have the following tools first:

1. DCT-4 phone of course
2. Firmware of the phone
3. Hex editor
4. Flasher tool like JAF Flasher


The overall process is easy:
1. Download the correct firmware of your phone. If you cannot find it from internet, try to visit GSM Forum. The forum has many helpful guys. If you have puchased Flasher like JAF by Odeon, you can login to support area and download necessary firmware. Official website of JAF
http://www.odeon.cn

2. Install the firmware. Use hex editor to modify the MCU file as follow:
Replace the value in 23-24 of claudia with 3D 88. Search for "D3 40" first to identify claudia sequence.
Below is a sample:

D340 XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX
Change it to this

D340 XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX XXXX 3D88 XXXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX
XXXX


3. After modification, falsh the modified MCU and enjoy the activated FTD.

Using this method, I have activated netmonitor in 6230, 6230i, 3120, 1100.

4. Press Menu and scroll to "Net monitor" and press select. The screen should show you 0000. Enter 0101 and press OK, it should give your the first page of netmonitor. Press "*" and hold for a while will toogle between help page and data page.

5. Playing with the DCT-4 FTD should have no harmful effect at all. Some said that the field test mode will affect your phone performance. It is not true at all. Even through without field test display, the mobile is measuring the network information in background for cell reselection and handover process.

6. However, one should take great care when playing with "BTS TEST" page. It will permanent store the carrier you entered into memory and the phone will just search the carrier to log on. If the phone displays "OFF" in this page, it means the phone works in normal state. If it shows a number (e.g. 755), it means the phone log to the carrier and ignore neighbouring cells information. Handover and cell reselection are disabled. To disable the "BTS TEST" function, press menu and select net monitor, eneter 0112 to go to "BTS TEST" page, enter 9999 and press OK. Restart the phone and it should back to normal.


Page 01-12 BTS-Test. Be caution.

Have fun with the engineering mode!


Related topics:
Symbian 9.1/9.2 NetMonitor (FTD) for hacked phone
iPhone field test mode
Sony Ericsson Techmode
HTC Field Test Mode/Engineering Mode
Blackberry Engineering Mode
Nokia DCT-4 phone model and type mapping

Blackberry Engineering Mode

You can access the engineering screen by press Alt+Cap+H at the same time. It should bring you a lot of technical information, including RF info.

Related topics:
Symbian 9.1/9.2 NetMonitor (FTD) for hacked phone

iPhone field test mode
Sony Ericsson Techmode

Nokia DCT-4 Netmonitor/Field Test Mode

HTC Field Test Mode/Engineering Mode

iPhone field test mode

To access the field test display in iPhone, dial *3001#12345#*. If you are already in a call, just hit "add call", enter the number above and hit call; the phone will go into test mode, but keep your call connected.

The following pages are available in iPhone field test mode:
Network Information
Cell Information
GPRS Information
PDP Information
Call Information
Versions

Network Information



Cell Information


GPRS Information & PDP Information


Call Information & Versions


iPhone provide basic network information in field test mode. Timing Advance (TA) is missing in the network information and cell information is a disadvantage.

iPhone 3G also get the field test mode. I don't have a 3G iPhone and cannot provide you detail information. A screen capture is found from the web:



There are 3 sections:

UMTS Cell Environment
MM Info
GSM Cell Environment

GSM Cell Environment should be the old GSM pages. UMTS Cell Environment is of course 3G stuff. I have no idea what is MM Info. In GSM terminology, MM can refer to mobility management. If you have and 3G iPhone, please leave me some info in the comments :).

Related topics:
Symbian 9.1/9.2 NetMonitor (FTD) for hacked phone

Sony Ericsson Techmode

Nokia DCT-4 Netmonitor/Field Test Mode

HTC Field Test Mode/Engineering Mode

Blackberry Engineering Mode

Symbian 9.1/9.2 NetMonitor (FTD) for hacked phone

As the title already told, you need to have hacked phone in order to activate the netmonitor for field test display in Symbina 9.1/9.2 phone. Hacked phone allows you to see the hidden system folder inside the phone. You can then copy the necessary files into corresponding folders as listed below.

Hack symbian phone
Why we need to hack? It's because Nokia hide system folder/files and do not allow us to install unsigned applications. To use netmonitor/ftd program, we need to hack the phone first. Therefore, if you feel unsafe or do not want to hack the phone, you can find other netmonitor infos in this blog.

When Nokia made new firmware to kill the old AppTRK method to hack Symbian phones, the hackers responded with HelloCarbide. ROMPatcher is a program to toggle the Symbian locks on your phone on and off, and comes with a bunch of plugins to customise menus, silence the camera shutter sound, and more. Installserver lets you install unsigned programs on your phone so you don't have to deal with the slow, clumsy Symbian Signed bureaucracy.

Just use google to search for the tools and you can easily hack your symbian phone painlessly.

Download netmonitor program
Download ftdALLSymbianV3.zip from the following link:
ftdALLSymbianV3.zip (Updated on 16 Sept 2011)

The tool is tested on:
N73/N95/N80/6120c/6290/5700/E65/E51/E90

Put:
C/Private/10003a3f/import/Apps
FtdApp_reg.rsc

C/Resource/Apps
Ftd.mbm
Ftd.mif
ftd.rsc
Ftd_aif.mif
ftdata_wk15_07.dat
ftdata_wk41_06.dat
Alarm.rsc
AlarmList.mbm
CallEnd.rsc
Custom.rsc

C/Resource/Plugins
ftd.dll55l
baseimage.dof

C/Sys/Bin
FTD.exe
FtDaInterface.dll
ftdaserver.exe
FtDbInterface.dll
ftdbserver.exe
FtdGwcTest.exe
FtEngine.dll

C:\private\101F457f\
MmRmDSPInitData.RSC

C:\system\apps\dynbase\
dynbase.dof55l

P.S
For icon in symbian9.1 (n73/n80/e65 ecc ecc) use the 3 files in attachment (ftd symbian9,1 icon)

Related topics:

iPhone field test mode
Sony Ericsson Techmode

Nokia DCT-4 Netmonitor/Field Test Mode

HTC Field Test Mode/Engineering Mode

Blackberry Engineering Mode

Sony Ericsson Techmode

Techmode of K600i


Some Sony Ericsson phones can activate Techmode by:

enter *585*0000# + press send button
or
enter *585*0000 + press call button

The techmode screen is in Setting/ Connectivity/ Mobile networks

There are 6 screens in TechMode for GSM/WCDMA phone:
- GSM Channel
- GSM AMR
- GSM GPRS
- GSM WCDMA Neig
- GSM WCDMA Cell
- WCDMA Intra/Inter

The last 3 screens are available in 3G phone only. To minimize TechMode push and hold return button.

The code is not working on K300i, K500i, K700i, J300i (db2000) and the more J200i, J210i, J230i, Z200, Z300 (Chinese ODM models) and older models

The code works on the K750i, D750i, W800i, K600i, K608i, V600i, Z520i (db2010)

The code is not working on the new platform SE db2020 - K790i, K800i, K610i, K630i, W850i, W710i, Z710i, Z610i without modification of GDFS.

If after entering the code nothing but incorrectly dialed numbers means modification of GDFS is needed to activate Techmode.

*BACKUP YOUR GDFS BEFORE ANY MODIFICATION

For DB2010 phones:
gdfswrite:00020D1D01
gdfswrite:00020D1E01
gdfswrite:00020D1F00000000

For DB2020 phones:
gdfswrite:00020E4901
gdfswrite:00020E4A01
gdfswrite:00020E4B00000000


Description of TechMode:
-------------------------
GSM Channel
-------------------------
A BBB CC -DD EEEEF GG
HHHH I JJJ K LL MM
NNN OO PP QQQ RR SSSS
TTT -TT UUU -UU VVV -VV
WWW -WW XXX -XX ZZZ -ZZ

A - Current type of service:
B - BCCH - Broadcast Control CHannel - Standby Mode
S - SDCCH - Standalone Dedicated Control CHannel - Used fo registration, autorization and refreshing status.
F - Frequency Hopping - TDMA frames are transfered at different frequencys.
T - TCH - Transfer CHannel - Data transfer/Speaking Mode.
BBB - Number of current channel:
001...124 - GSM 900 (124 channels)
512-885 - DCS 1800 (374 channels)
974...1xxxx - EGSM 1900
9999 - No Signal.
CC - Number of current channel on a current BS (Base Station)
DD - Recieve level (RxLevel): -40dBm...-117dBm. -40dBm is the strongest signal.
EEEE - Cell ID
F - Cell Sector Number
GG - DTX
HHHH - seems like another channel (?)
I - Timeslot number: 0...7
One of the eight channels which are used to transfer TDMA traffic.
On 0 channel is transfered control information: BCCH, SDCCH, etc. Other channels are used for traffic.

JJJ - Transmitter signal level, 0...34 dBm
K - Bit Error Rate - number of errors, 0...7.
0 - No errors. When more than 5, sound is being lost frequently.
RxQual table
0---BER < 0.2 (%)
1---0.2 < BER < 0.4
2---0,4 < BER < 0.8
3---0.8 < BER < 1.6
4---1.6 < BER < 3.2
5---3.2 < BER < 6.4
6---6.4 < BER < 12.8 (Half of packets are lost here)
7---12.8 < BER

LL - Timing Advance. 0...63.
With this parameter it is possible to calculate distance to BS using the following formula:
L=1.11 x TA/2, where L is the distance to BS, TA - Timing Advance.
In GSM standard max distance from BS is 35.2 km, so one number here is rouhly 550 m.
Timing Advance: 0; 1; 2; 3; 4; 5...63
Distance to BS: <550 m; 550-1100 m; 1100-1650 m; 1650-2200 m; 2200-2750 m; 2750-3300 m ... 35.2 km.

MM - No Info. 0...31 (maybe it is number of lost packets)
NNN - Rate of speech codec:
HR - Half Rate
FR - Full Rate
EFR - Enhanced Full Rate
OO - No Info. 0...95 (seems like RxQual)
PP - No Info. 0...83
QQQ - Network Country Code (NCC)
RR - Operator Code (MNC)
SSSS - Local Area Code (LAC)
TTT -TT UUU -UU VVV -VV
WWW -WW XXX -XX ZZZ -ZZ Channel Numbers & Rxlev of neighbouring cells

Related topics:
Symbian 9.1/9.2 NetMonitor (FTD) for hacked phone
iPhone field test modeSony Ericsson Techmode
Nokia DCT-4 Netmonitor/Field Test Mode
HTC Field Test Mode/Engineering Mode
Blackberry Engineering Mode