How to Connect QPST to Your Motorola Droid 2

[EV][20140108] This is probably outdated, but it's still cool and has educational value so I'm leaving it.

DISCLAIMER: You should only attempt the following if you have been authorized to do so by Qualcomm!

This will likely work on other Qualcomm CDMA phones as well...

Rooting an Android phone such as the Droid 2 allows you to view and modify low-level operating system files. But what if you want to modify the parameters of the CDMA chipset itself? This tutorial will show you how to do just that! Using an internal development tool for the Qualcomm chipset, you will be able to modify the number assignment module (NAM) and it's associated flash registers. Why would you want to do this? The amount of low-level configuration is endless. I did this so I could build a custom preferred roaming list (PRL) and force my phone to connect to specific towers. I'm a Verizon customer and Verizon doesn't have any towers in my area. Under the PRL's directive, my phone connects to an old 1XEV tower, however I would rather be connected to a closer 3G tower. In this tutorial I will cover the steps required to connect Qualcomm's development tool (QPST) to your phone and build and flash a custom PRL. Let's get started!

install qpst droid 2The Qualcomm chipset contains the low-level logic used to communicate with code division multiple access (CDMA) cellular towers. CDMA allows multiple devices to communicate over the same frequency by modulating the signal with an orthogonal code.


What you'll need:



The first steps are to install QPST and HW Virtual Serial Port on your Windows machine.

Next, connect your Droid 2 to your PC via USB. Set the phone's USB connection to "PC Mode". Once you do this, Windows should install a networking driver for the phone. If you open up a command prompt and type "ipconfig /all", you should see the a network adapter named "Motorola USB Networking Driver". The IP address will generally be 192.168.16.1

With the networking driver installed, open up HW VSP. This tool will allow you to map a virtual COM port to the Motorola network adapter. Go to the Settings tab and click "Login". You can use the default password. Uncheck the NVT Enabled checkbox. Next, click the Virtual Serial Port tab. Pick a COM port, and enter the IP address of your Motorola networking adapter, adding 1 to the last octet. So if your adapter has an address of 192.168.16.1, you would enter 192.168.16.2. The port number is 11008. Finally, click the "Create COM" button.

Now that we have a virtual COM port set up, open QPST Configuration from the QPST program group. Click on the Ports tab and add the virtual port you created, e.g. "COM3". Click OK and after a few seconds you should see your phone connected as "SURFQSC6055". You can now close the configuration program.

Open QPST Service Programming. Select your phone and the service programmer should bring it online. Click the "Read from Phone" button and the contents of your NAM register will be downloaded. At this point you can click "Save to File". Save the output to your desktop. IMPORTANT: Make sure your system is set to show hidden files!

Open the Roaming List Editor and open the .rl0 file that was saved to your desktop. You now have the ability to modify your PRL.

A PRL contains two tables: an aquisition list, which tells the phone which frequencies it can use to search for towers, and a system table, which contains a list of towers the device is allowed to access, and the priority at which the phone will connect to them. A phone picks a tower based on PRL priority, NOT based on signal quality. In my case, I was being connected to a tower with a weak signal because it had higher PRL priority than a closer, better tower. It's my guess that Verizon pays lower usage fees for the weaker, slower tower.

Once you've updated your PRL, you can save it and flash it to the NAM register using "Write to Phone." This action will cause your phone to reboot. Once the phone has rebooted you can go into Settings --> About and verify that the PRL version you loaded is listed.

If you are a Verizon customer living in central Wisconsin, you can download the PRL I built (version 11112). Before I built and loaded this PRL, I had a weak 1XEV signal. Now I have a strong 3G connection all the time.


Working with a PRL using QPST (click to enlarge)