carrier-explode
Explode and decode carrier data
GitHub
About
Carriers
Countries
Features
Builds
Compare
Wiki
iOS
▾
iOS
Pixel
Samsung
iPadOS
watchOS
Close
Carriers
CBN_cn
iOS 26.4 – 26.4.2 image · build 69.0
▾
iOS 27.2 beta 1–2 image · build 72.7.1
beta
iOS 27.0 – 27.0.1 image · build 72.0.2
current release
iOS 26.5 – 26.6.2 image · build 70.0
iOS 26.4 – 26.4.2 image · build 69.0
iOS 26.3.1 image · build 68.0
iOS 26.3 image · build 68.0
iOS 26.2 – 26.2.1 image · build 67.0
iOS 26.1 image · build 66.0
iOS 26.0 – 26.0.1 image · build 65.0.3
OTA iOS 16.4+ · build 54.1.0
Overview
Settings
Modem
Files (34)
Changes
overrides_D49.der.pri
iPhone SE (3rd generation)
Header
Written for
Qualcomm modem
PRI Revision
5.0.161
Settings (55)
efs:/data/3gpp
(1)
·
3GPP data dynamic config
likely
=
show XML, 682 bytes
Per-PLMN data rules, domestic/international roaming PLMN lists
efs:/data/3gpp/data_3gpp_dynamic_config.xml
efs:/nv/item_files/ims
(1)
·
IMS enable
=
2
Enables the IMS task (VoLTE, VoWiFi, SMS over IMS)
efs:/nv/item_files/ims/IMS_enable
efs:/nv/item_files/modem/lte/ML1
(3)
·
x2l_irat_2tx_ant
unverified
=
1
LTE setting: LTE RRC / L1 / L2
efs:/nv/item_files/modem/lte/ML1/x2l_irat_2tx_ant
·
num_enb_tx_ant
unverified
=
2
LTE setting: LTE RRC / L1 / L2
efs:/nv/item_files/modem/lte/ML1/num_enb_tx_ant
·
fr2_priority_optimization
unverified
=
hex, 16 bytes
LTE setting: LTE RRC / L1 / L2
efs:/nv/item_files/modem/lte/ML1/fr2_priority_optimization
efs:/nv/item_files/modem/lte/rrc/bbq
(1)
·
Fake eNodeB mitigation
likely
=
1
= On
LTE false-base-station (fake eNodeB) mitigation
efs:/nv/item_files/modem/lte/rrc/bbq/bbq_mitigation
efs:/nv/item_files/modem/lte/rrc/efs
(5)
·
dsds_timers
unverified
=
hex, 36 bytes
LTE setting: LTE RRC / L1 / L2
efs:/nv/item_files/modem/lte/rrc/efs/dsds_timers
·
c2k_rx_config
unverified
=
2
LTE setting: LTE RRC / L1 / L2
efs:/nv/item_files/modem/lte/rrc/efs/c2k_rx_config
·
LTE band priority list
likely
=
hex, 14 bytes
Prioritised band list for LFS/FFS scans (uint16 array)
efs:/nv/item_files/modem/lte/rrc/efs/band_priority_list_v2
·
LTE feature disable
likely
=
hex, 32 bytes
LTE RRC capability feature-disable bitmap
efs:/nv/item_files/modem/lte/rrc/efs/lte_feature_disable
·
hst_scan_params
unverified
=
37383
LTE setting: LTE RRC / L1 / L2
efs:/nv/item_files/modem/lte/rrc/efs/hst_scan_params
efs:/nv/item_files/modem/mav
(8)
·
disable_sa_icon_based_on_idle_l2nr_meas
likely
=
1
5G icon rule: Status-bar 5G / 5G UW / 5G UC / 5G+ icon override logic
efs:/nv/item_files/modem/mav/disable_sa_icon_based_on_idle_l2nr_meas
·
disable_sa_icon_based_on_l2nr_mr
likely
=
1
5G icon rule: Status-bar 5G / 5G UW / 5G UC / 5G+ icon override logic
efs:/nv/item_files/modem/mav/disable_sa_icon_based_on_l2nr_mr
·
Disable SA on null SUCI
likely
=
0
= Off
Turn off 5G SA when the SUCI uses the null protection scheme (SUPI sent unconcealed)
efs:/nv/item_files/modem/mav/mav_disable_sa_if_null_suci
·
BWP switch on screen lock
likely
=
1
= On
Move to a narrower NR bandwidth part while the screen is locked
efs:/nv/item_files/modem/mav/enable_bwp_switching_screen_lock
·
Dynamic SA
likely
=
0
= Off
Turn 5G SA capability on and off with coverage (dyn_sa_* / dyn_cap_* timers and thresholds)
efs:/nv/item_files/modem/mav/enable_dyn_sa
·
Dynamic VoNR
likely
=
0
= Off
Turn VoNR on and off dynamically, alongside dynamic SA
efs:/nv/item_files/modem/mav/enable_dyn_vonr
·
Prune NR while VoLTE
likely
=
1
= On
Prune NR FR1 / FR2 capability while VoLTE is enabled
efs:/nv/item_files/modem/mav/prune_fr1_fr2_due_to_volte_enable
·
disable_sa_icon_based_on_restrict_dcnr
likely
=
0
5G icon rule: Status-bar 5G / 5G UW / 5G UC / 5G+ icon override logic
efs:/nv/item_files/modem/mav/disable_sa_icon_based_on_restrict_dcnr
efs:/nv/item_files/modem/mmode
(4)
·
SMS domain preference list
unverified
=
hex, 15 bytes
Per-RAT/PLMN SMS domain list; layout not public
efs:/nv/item_files/modem/mmode/sms_domain_pref_list
·
LTE disable duration
likely
=
60
How long LTE stays disabled when CS services are unavailable
efs:/nv/item_files/modem/mmode/lte_disable_duration
·
Voice domain preference
=
3
= IMS PS voice preferred
E-UTRAN voice domain (TS 24.301 9.9.3.44)
efs:/nv/item_files/modem/mmode/voice_domain_pref
·
NR5G disable mode
unverified
=
0
= NR5G enabled
Disables NR5G SA and/or NSA
efs:/nv/item_files/modem/mmode/nr5g_disable_mode
efs:/nv/item_files/modem/nas
(18)
·
eplmn_cell_reselect
unverified
=
1
NAS setting: NAS mobility management / PLMN selection
efs:/nv/item_files/modem/nas/eplmn_cell_reselect
·
force_esr_ndds_cust
unverified
=
1
NAS setting: NAS mobility management / PLMN selection
efs:/nv/item_files/modem/nas/force_esr_ndds_cust
·
hplmn_rat_order_ctrl
unverified
=
2
NAS setting: NAS mobility management / PLMN selection
efs:/nv/item_files/modem/nas/hplmn_rat_order_ctrl
·
mav_interlace_scan_init_timer
unverified
=
2
Apple modem option: Apple-only (Maverick) modem option; undocumented
efs:/nv/item_files/modem/nas/mav_interlace_scan_init_timer
·
Max validate SIM counter
likely
=
2
SIM validation retry limit
efs:/nv/item_files/modem/nas/max_validate_sim_counter
·
pri_fplmn
likely
=
hex, 25 bytes
PLMN list: Packed BCD MCC/MNC list (TS 31.102)
efs:/nv/item_files/modem/nas/pri_fplmn
·
HPLMN RAT order
likely
=
NR > LTE > GSM > WCDMA
hex, 12 bytes
Home-PLMN RAT search order: uint16 count, then sys_sys_mode RATs
efs:/nv/item_files/modem/nas/hplmn_rat_order
·
t3411_value_during_mmtel_call
unverified
=
2
NAS setting: NAS mobility management / PLMN selection
efs:/nv/item_files/modem/nas/t3411_value_during_mmtel_call
·
IRAT search timer
likely
=
1800000
0x1b7740
Inter-RAT search timer
efs:/nv/item_files/modem/nas/irat_search_timer
·
Ignore MT CSFB during VoLTE
=
1
= On
Ignore a mobile-terminated CSFB page while a VoLTE call is active
efs:/nv/item_files/modem/nas/lte_nas_ignore_mt_csfb_during_volte_call
·
EMM NAS items
likely
=
hex, 32 bytes
32-byte EMM configuration blob
efs:/nv/item_files/modem/nas/emm_nas_nv_items
·
mt_detach_abnormal_handling
unverified
=
1
NAS setting: NAS mobility management / PLMN selection
efs:/nv/item_files/modem/nas/mt_detach_abnormal_handling
·
Reject NR null ciphering
likely
=
0
= Off
Reject a 5G NAS Security Mode Command that selects null ciphering (NEA0)
efs:/nv/item_files/modem/nas/mav_nr_reject_smc_null_ciphering
·
mav_lte_steady_camp_duration
unverified
=
180
Apple modem option: Apple-only (Maverick) modem option; undocumented
efs:/nv/item_files/modem/nas/mav_lte_steady_camp_duration
·
mav_k_deep_sleep_rounds_chg_nr_bandscan2acqdb
unverified
=
4
Apple modem option: Apple-only (Maverick) modem option; undocumented
efs:/nv/item_files/modem/nas/mav_k_deep_sleep_rounds_chg_nr_bandscan2acqdb
·
Predefined NR ARFCNs
likely
=
hex, 26 bytes
NR channels to try first per PLMN: uint16 count, then {MCC, MNC, NR-ARFCN, band, flag} records
efs:/nv/item_files/modem/nas/mav_nr_predef_narfcn
·
mav_nr_prio_sub_band_per_plmn
likely
=
hex, 54 bytes
Band priority per PLMN: Per-PLMN band / sub-band (ARFCN range) scan priority
efs:/nv/item_files/modem/nas/mav_nr_prio_sub_band_per_plmn
·
is_x_to_nr_enabled
unverified
=
65793
0x10101
NAS setting: NAS mobility management / PLMN selection
efs:/nv/item_files/modem/nas/is_x_to_nr_enabled
efs:/nv/item_files/modem/nr5g/RRC
(5)
·
cap_srs_tx_switch_control
likely
=
3
NR UE capability: NR RRC UE-capability toggle
efs:/nv/item_files/modem/nr5g/RRC/cap_srs_tx_switch_control
·
NR band capability
likely
=
0
NR band feature-capability list; proprietary layout
efs:/nv/item_files/modem/nr5g/RRC/cap_feature_band_nr
·
cap_control_mrdc_t_plus_t_band_combos
likely
=
0
NR band-combo class control: Enables an NR-CA / NR-DC / MR-DC band-combination class in the UE capability
efs:/nv/item_files/modem/nr5g/RRC/cap_control_mrdc_t_plus_t_band_combos
·
NR TDD+FDD combo control
likely
=
7
Enables NR-CA/NR-DC TDD+FDD band-combo classes
efs:/nv/item_files/modem/nr5g/RRC/cap_control_t_plus_f_band_combos
·
cap_control_nrca_t_plus_t_band_combos
likely
=
0
NR band-combo class control: Enables an NR-CA / NR-DC / MR-DC band-combination class in the UE capability
efs:/nv/item_files/modem/nr5g/RRC/cap_control_nrca_t_plus_t_band_combos
efs:/nv/item_files/modem/qmi
(1)
·
mav_fws_gsm_key_signature_bitmask
unverified
=
31115
Apple modem option: Apple-only (Maverick) modem option; undocumented
efs:/nv/item_files/modem/qmi/mav_fws_gsm_key_signature_bitmask
efs:/nv/item_files/modem/qmi/cat
(1)
·
Block SMS-PP envelope
likely
=
0
= Off
Block SIM Toolkit SMS-PP (data download) envelopes, per subscription
efs:/nv/item_files/modem/qmi/cat/qmi_cat_block_sms_pp_env_per_sub
efs:/nv/reg_files/modem/lte/rrc/csp
(1)
·
pref_freq_list
unverified
=
hex, 44 bytes
LTE setting: LTE RRC / L1 / L2
efs:/nv/reg_files/modem/lte/rrc/csp/pref_freq_list
efs:/policyman
(1)
·
Carrier policy
likely
=
show XML, 3214 bytes
PolicyMan rules keyed on MCC/PLMN: RAT capability, RF bands, UE mode
efs:/policyman/carrier_policy.xml
nv
(2)
·
PRI revision
=
10551301
= 5.0.161
0xa10005
Packed PRI Revision header
nv:62005
▾
Call Manager Feature Group
1 of 25 flags set
nv:62012
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
14
: Set for iPhone 12 and 13; a file sets this or flag 20, rarely both
pri
(3)
·
Legacy NV item list
=
show list, 35 entries
Legacy NV items the modem may take from this file; with a value here: 62012, 62005.
pri:nv-list
·
NV path schema index
=
show list, 260 entries
260 NV paths the PRI format knows (raw); not overrides.
pri:schema
·
pri:9fa710
=
178
Unidentified field, 1 time, 2 bytes: small binary blob that precedes the NV item list.
iOS 27.2 beta 1–2 image · build 72.7.1 beta 
iOS 26.5 – 26.6.2 image · build 70.0 
OTA iOS 16.4+ · build 54.1.0