carrier-explode
Explode and decode carrier data
GitHub
About
Carriers
Countries
Features
Builds
Compare
Wiki
iOS
▾
iOS
Android
iPadOS
watchOS
Close
Carriers
Softbank_jp
iOS 26.0 – 26.0.1 image · build 65.0
▾
iOS 27.2 beta 1–2 image · build 72.7.1
beta
iOS 27.0 – 27.0.1 image · build 72.0
current release
iOS 26.5 – 26.6.2 image · build 70.0
OTA iOS 26.4+ · build 69.1
iOS 26.4 – 26.4.2 image · build 69.0
iOS 26.3.1 image · build 68.0
iOS 26.3 image · build 68.0
iOS 26.2 – 26.2.1 image · build 67.0
iOS 26.1 image · build 66.0
iOS 26.0 – 26.0.1 image · build 65.0
OTA iOS 14.5+ · build 46.1
OTA iOS 10.3+ · build 28.4
OTA iOS 10.2+ · build 27.1
OTA iOS 10.0+ · build 25.1
OTA iOS 9.3+ · build 24.3
OTA iOS 9.1+ · build 22.3
OTA iOS 9.0+ · build 21.2
OTA iOS 8.3+ · build 19.2
OTA iOS 8.0+ · build 18.1
OTA iOS 7.1+ · build 16.1
OTA iOS 7.0+ · build 15.1
OTA iOS 6.0+ · build 13.2
Overview
Settings
Modem
Files (37)
Changes
overrides_D49.der.pri
iPhone SE (3rd generation)
Header
Written for
Qualcomm modem
PRI Revision
5.0.161
Settings (58)
efs:/data/3gpp
(1)
·
3GPP data dynamic config
likely
=
show XML, 679 bytes
Per-PLMN data rules, domestic/international roaming PLMN lists
efs:/data/3gpp/data_3gpp_dynamic_config.xml
efs:/nv/item_files/ims
(1)
·
IMS enable
=
2
Enables the IMS task (VoLTE, VoWiFi, SMS over IMS)
efs:/nv/item_files/ims/IMS_enable
efs:/nv/item_files/modem/data/3gpp/ps
(2)
·
Rel-10 throttling
likely
=
1
= On
Rel-10 APN congestion back-off (T3396)
efs:/nv/item_files/modem/data/3gpp/ps/rel_10_throttling
·
set_volte_call_type
unverified
=
0
Data services setting: Data services (PDN, throttling, AT commands)
efs:/nv/item_files/modem/data/3gpp/ps/set_volte_call_type
efs:/nv/item_files/modem/data/epc
(1)
·
qmi_qos
unverified
=
0
Data services setting: Data services (PDN, throttling, AT commands)
efs:/nv/item_files/modem/data/epc/qmi_qos
efs:/nv/item_files/modem/lte/rrc/bbq
(1)
·
Fake eNodeB mitigation
likely
=
1
= On
LTE false-base-station (fake eNodeB) mitigation
efs:/nv/item_files/modem/lte/rrc/bbq/bbq_mitigation
efs:/nv/item_files/modem/lte/rrc/cap
(3)
·
blacklist_ca_combos
likely
=
hex, 65 bytes
CA combo list: LTE CA / EN-DC band-combination allow/deny list
efs:/nv/item_files/modem/lte/rrc/cap/blacklist_ca_combos
·
LTE bands without non-contiguous CA
likely
=
B1 B3 B8 B11 B26 B28 B41 B42
hex, 32 bytes
LTE bands left out of non-contiguous intra-band CA combos
efs:/nv/item_files/modem/lte/rrc/cap/blacklist_ca_combos_with_nc_combos
·
LTE bands with UL CA
likely
=
B42
hex, 32 bytes
LTE bands allowed in uplink carrier-aggregation combos
efs:/nv/item_files/modem/lte/rrc/cap/whitelist_ca_combos_with_ulca
efs:/nv/item_files/modem/lte/rrc/efs
(10)
·
LTE feature disable
likely
=
hex, 32 bytes
LTE RRC capability feature-disable bitmap
efs:/nv/item_files/modem/lte/rrc/efs/lte_feature_disable
·
LTE feature enable
likely
=
hex, 32 bytes
LTE RRC capability feature-enable bitmap; bit list unpublished
efs:/nv/item_files/modem/lte/rrc/efs/lte_feature_enable
·
disable_4l_per_band
unverified
=
hex, 32 bytes
LTE setting: LTE RRC / L1 / L2
efs:/nv/item_files/modem/lte/rrc/efs/disable_4l_per_band
·
lte_fgi_r8
likely
=
1027600639
0x3d3ff0ff
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capability
efs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r8
·
ho_neigh_cell_si_acq_params
unverified
=
0
LTE setting: LTE RRC / L1 / L2
efs:/nv/item_files/modem/lte/rrc/efs/ho_neigh_cell_si_acq_params
·
lte_fgi_r10
likely
=
2040
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capability
efs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r10
·
lte_fgi_r9
likely
=
1
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capability
efs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r9
·
lte_fgi_r10_tdd
likely
=
6140
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capability
efs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r10_tdd
·
lte_fgi_r8_tdd
likely
=
557838463
0x213ff07f
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capability
efs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r8_tdd
·
lte_fgi_r9_tdd
likely
=
1
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capability
efs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r9_tdd
efs:/nv/item_files/modem/mav
(4)
·
LTE CA combos per PLMN
likely
=
1
= On
Prune the advertised LTE CA combos per PLMN from /policyman/band_combos_per_plmn.xml
efs:/nv/item_files/modem/mav/lte_ca_xml_generation
·
cap_prune_efs_version
unverified
=
769
Apple modem option: Apple-only (Maverick) modem option; undocumented
efs:/nv/item_files/modem/mav/cap_prune_efs_version
·
Dynamic SA
likely
=
0
= Off
Turn 5G SA capability on and off with coverage (dyn_sa_* / dyn_cap_* timers and thresholds)
efs:/nv/item_files/modem/mav/enable_dyn_sa
·
Dynamic VoNR
likely
=
0
= Off
Turn VoNR on and off dynamically, alongside dynamic SA
efs:/nv/item_files/modem/mav/enable_dyn_vonr
efs:/nv/item_files/modem/mmode
(4)
·
follow_tot
unverified
=
1
Multimode setting: Call manager / system determination
efs:/nv/item_files/modem/mmode/follow_tot
·
UE usage setting
likely
=
0
= Voice centric
TS 24.301 UE usage setting
efs:/nv/item_files/modem/mmode/ue_usage_setting
·
SMS domain preference list
unverified
=
hex, 15 bytes
Per-RAT/PLMN SMS domain list; layout not public
efs:/nv/item_files/modem/mmode/sms_domain_pref_list
·
NR5G emergency support
unverified
=
0
= Off
NR5G emergency-call support
efs:/nv/item_files/modem/mmode/nr5g_emc_support
efs:/nv/item_files/modem/mmode/sd
(1)
·
e911_prioritize_cs
unverified
=
0
Multimode setting: Call manager / system determination
efs:/nv/item_files/modem/mmode/sd/e911_prioritize_cs
efs:/nv/item_files/modem/nas
(2)
·
SRVCC support
=
1
= On
SRVCC capability indication from E-UTRAN to UTRAN (TS 23.216)
efs:/nv/item_files/modem/nas/nas_srvcc_support
·
Force LAU on LAI change (emergency)
likely
=
0
= Off
Force a location-area update on LAI change during an emergency call
efs:/nv/item_files/modem/nas/nas_lai_change_force_lau_for_emergency
efs:/nv/item_files/modem/nr5g/RRC
(8)
·
cap_prune
likely
=
"b1A[2]A[1]-b3A[2]-n77A[2]A[1];b1A[2]-b3A[2]A[1]-n77A[2]A[1];b1A[2]A[1]-b28A[2]-n77A[2]A[1];b1A[2]-b28A[2]A[1]-n77A[2]A[1];b1A[2]A[1]-b42A[2]-n77A[2]A[1];b1A[2]A[1]-b42C[2,2]-n77A[2]A[1];b3A[2]A[1]-b28A[2]-n77A[2]A[1];b3A[2]-b28A[2]A[1]-n77A[2]A[1];b3A[2]A[1]-b42A[2]-n77A[2]A[1];b3A[2]A[1]-b42C[2,2]-n77A[2]A[1];b28A[2]A[1]-b42A[2]-n77A[2]A[1];b28A[2]A[1]-b42C[2,2]-n77A[2]A[1];b1A[2]A[1]-b8A[2]-n77A[2]A[1];b1A[2]-b8A[2]A[1]-n77A[2]A[1];b3A[2]A[1]-b8A[2]-n77A[2]A[1];b3A[2]-b8A[2]A[1]-n77A[2]A[1];b8A[2]A[1]-b11A[2]-n77A[2]A[1];b1A[2]A[1]-b3A[2]-n28A[2]A[1];b1A[2]-b3A[2]A[1]-n28A[2]A[1];b1A[2]A[1]-b42C[2,2]-n28A[2]A[1];b3A[2]A[1]-b42C[2,2]-n28A[2]A[1];b1A[2]A[1]-b8A[2]-n3A[2]A[1];b1A[2]-b8A[2]A[1]-n3A[2]A[1];b1A[2]A[1]-b42C[2,2]-n3A[2]A[1];"
NR UE capability: NR RRC UE-capability toggle
efs:/nv/item_files/modem/nr5g/RRC/cap_prune
·
cap_srs_tx_switch_control
likely
=
0
NR UE capability: NR RRC UE-capability toggle
efs:/nv/item_files/modem/nr5g/RRC/cap_srs_tx_switch_control
·
NR band capability
likely
=
512
NR band feature-capability list; proprietary layout
efs:/nv/item_files/modem/nr5g/RRC/cap_feature_band_nr
·
cap_per_plmn_limit_bw
likely
=
hex, 3649 bytes
NR UE capability: NR RRC UE-capability toggle
efs:/nv/item_files/modem/nr5g/RRC/cap_per_plmn_limit_bw
·
cap_add_bw
likely
=
hex, 772 bytes
NR UE capability: NR RRC UE-capability toggle
efs:/nv/item_files/modem/nr5g/RRC/cap_add_bw
·
cap_feature_pdcp
likely
=
1
NR UE capability: NR RRC UE-capability toggle
efs:/nv/item_files/modem/nr5g/RRC/cap_feature_pdcp
·
cap_feature_mac
likely
=
1103806595329
0x10100000101
NR UE capability: NR RRC UE-capability toggle
efs:/nv/item_files/modem/nr5g/RRC/cap_feature_mac
·
cap_disable_ul_256qam
likely
=
1
NR UE capability: NR RRC UE-capability toggle
efs:/nv/item_files/modem/nr5g/RRC/cap_disable_ul_256qam
efs:/nv/item_files/modem/uim/mmgsdi
(1)
·
slot_features_status_list__mav_override
unverified
=
277
Apple override: Apple override of the Qualcomm item of the same name
efs:/nv/item_files/modem/uim/mmgsdi/slot_features_status_list__mav_override
efs:/nv/item_files/wcdma/rrc
(5)
·
WCDMA to LTE PS handover
likely
=
0
= Off
WCDMA->LTE PS handover support
efs:/nv/item_files/wcdma/rrc/wcdma_rrc_wtol_ps_ho_support
·
WCDMA to LTE-TDD PS handover
likely
=
0
= Off
WCDMA->LTE TDD PS handover support
efs:/nv/item_files/wcdma/rrc/wcdma_rrc_wtol_tdd_ps_ho_support
·
wcdma_ppac_support
unverified
=
1
WCDMA setting: WCDMA RRC
efs:/nv/item_files/wcdma/rrc/wcdma_ppac_support
·
rrc_fe_fach_support
unverified
=
0
WCDMA setting: WCDMA RRC
efs:/nv/item_files/wcdma/rrc/rrc_fe_fach_support
·
WCDMA RRC feature
likely
=
0
WCDMA RRC feature mask
efs:/nv/item_files/wcdma/rrc/wcdma_rrc_feature
efs:/policyman
(1)
·
Carrier policy
likely
=
show XML, 2079 bytes
PolicyMan rules keyed on MCC/PLMN: RAT capability, RF bands, UE mode
efs:/policyman/carrier_policy.xml
nv
(10)
·
HS Based Plus Dial Setting
likely
=
1
nv:4960
·
Roaming preference
=
255
= Automatic
Roaming Preference
nv:442
·
PRI revision
=
10551301
= 5.0.161
0xa10005
Packed PRI Revision header
nv:62005
·
AAGPS Positioning Modes Supported
likely
=
1323
nv:1920
·
CGPS UMTS PDE Server Address URL
=
"e-slp.supl22.mb.softbank.jp:7275"
SUPL H-SLP server host:port
nv:4703
·
AAGPS Use Transport Security
likely
=
1
= On
Enable user-plane (SUPL) secure transport
nv:3758
·
GNSS SUPL Version
likely
=
131072
= 2.0.0
0x20000
nv:6792
·
Band preference bits 16-31
=
46847
= GSM 450, GSM 480, GSM 750, GSM 850, GSM railways 900, GSM PCS 1900, WCDMA B1 2100, WCDMA B2 1900, WCDMA B4 1700, WCDMA B5 850, bit 12, bit 13, bit 15
Expand Band Preference 16 To 32 Bits
nv:946
·
NV 58021
unverified
=
244
nv:58021
▾
Call Manager Feature Group
1 of 25 flags set
nv:62012
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
0
: Set only by SoftBank, Y!mobile and Iusacell, on older iPhones
pri
(3)
·
Legacy NV item list
=
show list, 35 entries
Legacy NV items the modem may take from this file; with a value here: 4960, 62012, 442, 58021, 1920, 946, 4703, 6792, 3758, 62005.
pri:nv-list
·
NV path schema index
=
show list, 260 entries
260 NV paths the PRI format knows (raw); not overrides.
pri:schema
·
pri:9fa710
=
178
Unidentified field, 1 time, 2 bytes: small binary blob that precedes the NV item list.