carrier-explode Explode and decode carrier data GitHub About
AT&T
iOS 27.2 beta 3 image · build 73.0 beta iOS 27.2 beta 1–2 image · build 72.7.2 beta OTA iOS 27.0+ · build 72.1 current release iOS 27.0 – 27.0.1 image · build 72.0.2 iOS 27.0 beta 5–8 image · build 72.0.2 beta iOS 27.0 beta 4 image · build 71.5.35 beta iOS 27.0 beta 3 image · build 71.5.34 beta iOS 27.0 beta 2 image · build 71.5.32 beta iOS 27.0 beta image · build 71.5.27 beta iOS 26.6 – 26.6.2 image · build 70.0.1 iOS 26.5 – 26.5.2 image · build 70.0 iOS 26.5.1 image · build 70.0 iOS 26.4 – 26.4.2 image · build 69.0 iOS 26.3.1 image · build 68.0 iOS 26.3 image · build 68.0 iOS 26.2 – 26.2.1 image · build 67.0 iOS 26.1 image · build 66.0 iOS 26.0 – 26.0.1 image · build 65.0.1 iOS 26.0 image · build 65.0.1 iOS 18.6 – 18.6.2 image · build 64.0.1 iOS 18.5 image · build 64.0 iOS 18.4 – 18.4.1 image · build 63.0 iOS 18.3 – 18.3.2 image · build 62.0 iOS 18.3.1 – 18.3.2 image · build 62.0 iOS 18.2 – 18.2.1 image · build 61.0 iOS 18.1 – 18.1.1 image · build 60.0 iOS 18.0 – 18.0.1 image · build 59.0 OTA iOS 17.5+ · build 58.1 OTA iOS 15.0+ · build 47.1 OTA iOS 14.6+ · build 46.4 OTA iOS 14.5+ · build 46.1 OTA iOS 14.1+ · build 45.1 OTA iOS 14.0+ · build 42.1 OTA iOS 13.4+ · build 41.1 OTA iOS 13.2+ · build 39.1 OTA iOS 13.1+ · build 38.1 OTA iOS 12.0+ · build 33.2 OTA iOS 11.2+ · build 31.1 OTA iOS 11.1+ · build 30.2 OTA iOS 11.0+ · build 29.2 OTA iOS 10.3.2+ · build 28.6 OTA iOS 10.3+ · build 28.5 OTA iOS 10.2+ · build 27.1 OTA iOS 10.0+ · build 26.1 OTA iOS 9.3+ · build 24.2 OTA iOS 9.2+ · build 23.1 OTA iOS 8.3+ · build 19.1 OTA iOS 8.0+ · build 17.1 OTA iOS 6.1+ · build 14.2 OTA iOS 3.1+ · build 5.6 OTA iOS legacy+ · build 3.1

overrides_V53_V54_V57.der.pri Modem package.

Header
DialectQualcomm
PRI Revision0.1.162
Settings (82)

efs:/data/3gpp (1)

3GPP data dynamic config =
Per-PLMN data rules, domestic/international roaming PLMN listsefs:/data/3gpp/data_3gpp_dynamic_config.xml

efs:/data/3gpp/throttling (1)

srv_req_throt_config.txtunverified = "FAILURE_TIMER_5:20; "
Data services setting: Data services (PDN, throttling, AT commands)efs:/data/3gpp/throttling/srv_req_throt_config.txt

efs:/nv/item_files/data/3gpp (3)

3GPP MTU = 1430
Default PDN MTU in bytesefs:/nv/item_files/data/3gpp/ds_3gpp_mtu
RPM params =
Radio Policy Manager retry limits (10 bytes)efs:/nv/item_files/data/3gpp/rpm_params
RPM SIM list =
SIMs Radio Policy Manager applies toefs:/nv/item_files/data/3gpp/rpm_suppported_sim

efs:/nv/item_files/ims (2)

IMS enable = 2
Enables the IMS task (VoLTE, VoWiFi, SMS over IMS)efs:/nv/item_files/ims/IMS_enable
IMS media service configunverified =
IMS media (codec/RTP) service config; no public schemaefs:/nv/item_files/ims/media_service_config

efs:/nv/item_files/modem (1)

LTE connection controlunverified = 1
efs:/nv/item_files/modem/lte_connection_control

efs:/nv/item_files/modem/data/3gpp (1)

Call before PS attach = 0= Off
Allow data-call origination before PS attachefs:/nv/item_files/modem/data/3gpp/call_orig_allowed_before_ps_attach

efs:/nv/item_files/modem/data/3gpp/ps (2)

Service request throttle behaviour = 1
Service-request throttling behaviourefs:/nv/item_files/modem/data/3gpp/ps/ser_req_throttle_behavior
3gpp_rel_version = 5
3GPP release: Signalled 3GPP releaseefs:/nv/item_files/modem/data/3gpp/ps/3gpp_rel_version

efs:/nv/item_files/modem/data/3gpp/ps/apn_reject (1)

APN reject name = "reject_apn:ims; "
APN whose rejection triggers carrier throttlingefs:/nv/item_files/modem/data/3gpp/ps/apn_reject/apn_reject_name.txt

efs:/nv/item_files/modem/lte/L2/mac (1)

lte_mac_enable_aasunverified = 0
LTE setting: LTE RRC / L1 / L2efs:/nv/item_files/modem/lte/L2/mac/lte_mac_enable_aas

efs:/nv/item_files/modem/lte/ML1 (1)

cdrx_opt_infounverified = 257
LTE setting: LTE RRC / L1 / L2efs:/nv/item_files/modem/lte/ML1/cdrx_opt_info

efs:/nv/item_files/modem/lte/rrc/bbq (1)

Fake eNodeB mitigation = 1= On
LTE false-base-station (fake eNodeB) mitigationefs:/nv/item_files/modem/lte/rrc/bbq/bbq_mitigation

efs:/nv/item_files/modem/lte/rrc/cap (4)

whitelist_ca_combos =
CA combo list: LTE CA / EN-DC band-combination allow/deny listefs:/nv/item_files/modem/lte/rrc/cap/whitelist_ca_combos
blacklist_ca_combos =
CA combo list: LTE CA / EN-DC band-combination allow/deny listefs:/nv/item_files/modem/lte/rrc/cap/blacklist_ca_combos
whitelist_ca_combos_with_laa =
CA combo list: LTE CA / EN-DC band-combination allow/deny listefs:/nv/item_files/modem/lte/rrc/cap/whitelist_ca_combos_with_laa
LTE bands with UL CA = B2 B5 B12 B14 B30 B48 B66
LTE bands allowed in uplink carrier-aggregation combosefs:/nv/item_files/modem/lte/rrc/cap/whitelist_ca_combos_with_ulca

efs:/nv/item_files/modem/lte/rrc/efs (12)

lte_conn_ctrl_barring_optimz_paramsunverified = 1
LTE setting: LTE RRC / L1 / L2efs:/nv/item_files/modem/lte/rrc/efs/lte_conn_ctrl_barring_optimz_params
LTE feature enable =
LTE RRC capability feature-enable bitmap; bit list unpublishedefs:/nv/item_files/modem/lte/rrc/efs/lte_feature_enable
disable_4l_per_bandunverified =
LTE setting: LTE RRC / L1 / L2efs:/nv/item_files/modem/lte/rrc/efs/disable_4l_per_band
LTE band priority list =
Prioritised band list for LFS/FFS scans (uint16 array)efs:/nv/item_files/modem/lte/rrc/efs/band_priority_list_v2
lte_rrc_sub_feature_enableunverified = "@"
LTE setting: LTE RRC / L1 / L2efs:/nv/item_files/modem/lte/rrc/efs/lte_rrc_sub_feature_enable
lte_connection_ctrl_paramsunverified =
LTE setting: LTE RRC / L1 / L2efs:/nv/item_files/modem/lte/rrc/efs/lte_connection_ctrl_params
LTE feature disable =
LTE RRC capability feature-disable bitmapefs:/nv/item_files/modem/lte/rrc/efs/lte_feature_disable
lte_fgi_r8 = 21013424620x7d3ff0fe
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capabilityefs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r8
lte_fgi_r10 = 14142
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capabilityefs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r10
lte_fgi_r10_tdd = 14142
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capabilityefs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r10_tdd
lte_fgi_r8_tdd = 21013424620x7d3ff0fe
LTE Feature Group Indicators: 3GPP TS 36.331 Annex B featureGroupIndicators sent in UE-EUTRA-Capabilityefs:/nv/item_files/modem/lte/rrc/efs/lte_fgi_r8_tdd
EPS fallback controlunverified = 171884591485920xfa200007530
VoNR to EPS fallback controlefs:/nv/item_files/modem/lte/rrc/efs/eps_fallback_control

efs:/nv/item_files/modem/mav (9)

LTE CA combos per PLMN = 1= On
Prune the advertised LTE CA combos per PLMN from /policyman/band_combos_per_plmn.xmlefs:/nv/item_files/modem/mav/lte_ca_xml_generation
enable_fblte_based_bwp_configunverified = 1
Apple modem option: Apple-only (Maverick) modem option; undocumentedefs:/nv/item_files/modem/mav/enable_fblte_based_bwp_config
mav_dmc_enabledunverified = 1
Apple modem option: Apple-only (Maverick) modem option; undocumentedefs:/nv/item_files/modem/mav/mav_dmc_enabled
mav_monitor_enable_nr5g_uwb_based_on_motion_state_no_uli_case = 0
5G icon rule: Status-bar 5G / 5G UW / 5G UC / 5G+ icon override logicefs:/nv/item_files/modem/mav/mav_monitor_enable_nr5g_uwb_based_on_motion_state_no_uli_case
sa_depri_td_bwp_thresh_val = 30
Smart data mode: Apple SDM: turns NR / SA off or deprioritises SA when it does not pay offefs:/nv/item_files/modem/mav/sa_depri_td_bwp_thresh_val
mav_avoid_pco_for_agingunverified = 1
Apple modem option: Apple-only (Maverick) modem option; undocumentedefs:/nv/item_files/modem/mav/mav_avoid_pco_for_aging
mav_monitor_mm_mb_replace_nr5g_with_nr5guwb = 1
5G icon rule: Status-bar 5G / 5G UW / 5G UC / 5G+ icon override logicefs:/nv/item_files/modem/mav/mav_monitor_mm_mb_replace_nr5g_with_nr5guwb
mav_ignore_high_bw_checkunverified = 1
Apple modem option: Apple-only (Maverick) modem option; undocumentedefs:/nv/item_files/modem/mav/mav_ignore_high_bw_check
sdm_nsa_icon_override = 0
Smart data mode: Apple SDM: turns NR / SA off or deprioritises SA when it does not pay offefs:/nv/item_files/modem/mav/sdm_nsa_icon_override

efs:/nv/item_files/modem/mmode (6)

SMS domain preference listunverified =
Per-RAT/PLMN SMS domain list; layout not publicefs:/nv/item_files/modem/mmode/sms_domain_pref_list
LTE band preference = 1781208836341750xa1fffffeffff
LTE band bitmap (bit n = band n+1)efs:/nv/item_files/modem/mmode/lte_bandpref
LTE disable duration = 0
How long LTE stays disabled when CS services are unavailableefs:/nv/item_files/modem/mmode/lte_disable_duration
Voice domain preference = 3= IMS PS voice preferred
E-UTRAN voice domain (TS 24.301 9.9.3.44)efs:/nv/item_files/modem/mmode/voice_domain_pref
nrdc_modeunverified = 1
Multimode setting: Call manager / system determinationefs:/nv/item_files/modem/mmode/nrdc_mode
NR5G disable modeunverified = 0= NR5G enabled
Disables NR5G SA and/or NSAefs:/nv/item_files/modem/mmode/nr5g_disable_mode

efs:/nv/item_files/modem/nas (7)

mav_pssi_reg_unblock_hplmn_max_reg_failure = 1
PSSI registration rule: Apple PLMN search / system-selection (PSSI) registration tuningefs:/nv/item_files/modem/nas/mav_pssi_reg_unblock_hplmn_max_reg_failure
mav_pssi_reg_unblock_hplmn_voice_not_avail_based_on_motion_st = 1
PSSI registration rule: Apple PLMN search / system-selection (PSSI) registration tuningefs:/nv/item_files/modem/nas/mav_pssi_reg_unblock_hplmn_voice_not_avail_based_on_motion_st
ISR = 1= On
Idle-mode Signalling Reduction (TS 23.401)efs:/nv/item_files/modem/nas/isr
Reject LTE null ciphering = 1= On
Reject an LTE NAS Security Mode Command that selects null ciphering (EEA0)efs:/nv/item_files/modem/nas/mav_lte_reject_smc_null_ciphering
SRVCC support = 1= On
SRVCC capability indication from E-UTRAN to UTRAN (TS 23.216)efs:/nv/item_files/modem/nas/nas_srvcc_support
Reject NR null ciphering = 1= On
Reject a 5G NAS Security Mode Command that selects null ciphering (NEA0)efs:/nv/item_files/modem/nas/mav_nr_reject_smc_null_ciphering
CSG support = 1
Closed Subscriber Group (femtocell) supportefs:/nv/item_files/modem/nas/csg_support_configuration

efs:/nv/item_files/modem/nr5g/RRC (12)

cap_control_4cc_ulca_fr2 = 1
NR UE capability: NR RRC UE-capability toggleefs:/nv/item_files/modem/nr5g/RRC/cap_control_4cc_ulca_fr2
NR band capability =
NR band feature-capability list; proprietary layoutefs:/nv/item_files/modem/nr5g/RRC/cap_feature_band_nr
cap_add_bw =
NR UE capability: NR RRC UE-capability toggleefs:/nv/item_files/modem/nr5g/RRC/cap_add_bw
cap_csi_rs_32_port_control =
NR UE capability: NR RRC UE-capability toggleefs:/nv/item_files/modem/nr5g/RRC/cap_csi_rs_32_port_control
cap_control_dl_256qam = 257
NR UE capability: NR RRC UE-capability toggleefs:/nv/item_files/modem/nr5g/RRC/cap_control_dl_256qam
cap_control_mrdc_f_plus_t_band_combos = 0
NR band-combo class control: Enables an NR-CA / NR-DC / MR-DC band-combination class in the UE capabilityefs:/nv/item_files/modem/nr5g/RRC/cap_control_mrdc_f_plus_t_band_combos
cap_control_nrca_3x_f_plus_t_band_combos = 168430090x1010101
NR band-combo class control: Enables an NR-CA / NR-DC / MR-DC band-combination class in the UE capabilityefs:/nv/item_files/modem/nr5g/RRC/cap_control_nrca_3x_f_plus_t_band_combos
cap_control_nrca_4x_f_plus_t_band_combos = 657930x10101
NR band-combo class control: Enables an NR-CA / NR-DC / MR-DC band-combination class in the UE capabilityefs:/nv/item_files/modem/nr5g/RRC/cap_control_nrca_4x_f_plus_t_band_combos
cap_control_nrca_f_plus_f_band_combos = 257
NR band-combo class control: Enables an NR-CA / NR-DC / MR-DC band-combination class in the UE capabilityefs:/nv/item_files/modem/nr5g/RRC/cap_control_nrca_f_plus_f_band_combos
cap_control_nrca_f_plus_t_band_combos = 1
NR band-combo class control: Enables an NR-CA / NR-DC / MR-DC band-combination class in the UE capabilityefs:/nv/item_files/modem/nr5g/RRC/cap_control_nrca_f_plus_t_band_combos
NR TDD+FDD combo control = 7
Enables NR-CA/NR-DC TDD+FDD band-combo classesefs:/nv/item_files/modem/nr5g/RRC/cap_control_t_plus_f_band_combos
cap_disable_ul_256qam = 257
NR UE capability: NR RRC UE-capability toggleefs:/nv/item_files/modem/nr5g/RRC/cap_disable_ul_256qam

efs:/nv/item_files/modem/qmi/cat (1)

Block SMS-PP envelope = 0= Off
Block SIM Toolkit SMS-PP (data download) envelopes, per subscriptionefs:/nv/item_files/modem/qmi/cat/qmi_cat_block_sms_pp_env_per_sub

efs:/nv/item_files/modem/sms (1)

Refresh vote OK = 0= Off
Vote TRUE for SIM REFRESHefs:/nv/item_files/modem/sms/mmgsdi_refresh_vote_ok

efs:/nv/item_files/modem/uim/mmgsdi (4)

override_opl_pnn_lookup_for_non_rplmnunverified = 2
SIM setting: UIM / SIM manager / SIM Toolkitefs:/nv/item_files/modem/uim/mmgsdi/override_opl_pnn_lookup_for_non_rplmn
SIM refresh retry =
SIM REFRESH retry parameters (4 x uint32)efs:/nv/item_files/modem/uim/mmgsdi/refresh_retry
slot_features_status_list__mav_overrideunverified = 266
Apple override: Apple override of the Qualcomm item of the same nameefs:/nv/item_files/modem/uim/mmgsdi/slot_features_status_list__mav_override
ens_slot_enabledunverified = 1
SIM setting: UIM / SIM manager / SIM Toolkitefs:/nv/item_files/modem/uim/mmgsdi/ens_slot_enabled

efs:/nv/item_files/modem/uim/uimdrv (1)

nv_pdown_uim_consecutive_techproblemsunverified = 769
SIM setting: UIM / SIM manager / SIM Toolkitefs:/nv/item_files/modem/uim/uimdrv/nv_pdown_uim_consecutive_techproblems

efs:/nv/item_files/wcdma/rrc (1)

WCDMA to LTE PS handover = 0= Off
WCDMA->LTE PS handover supportefs:/nv/item_files/wcdma/rrc/wcdma_rrc_wtol_ps_ho_support

efs:/policyman (1)

Carrier policy =
PolicyMan rules keyed on MCC/PLMN: RAT capability, RF bands, UE modeefs:/policyman/carrier_policy.xml

nv (5)

PRI revision = 10617088= 0.1.1620xa20100
Packed PRI Revision headernv:62005
ENS Enabled = 1= On
Enhanced Network Selectionnv:3461
UMTS AMR Codec Preference Config = 5
nv:6850
Call Manager Feature Group
2 of 25 flags setnv:62012
0123456789101112131415161718192021222324
Feature Group (unnamed, tag 9f83e453)unverified
1 of 25 flags setnv:62035
0123456789101112131415161718192021222324
3: The modem checks it in its geo-MCC attach logic, alongside a home-network check (medium confidence)

pri (3)

Legacy NV item list =
Legacy NV items the modem may take from this file; with a value here: 62012, 6850, 3461, 62005, 62035.pri:nv-list
NV path schema index =
348 NV paths the PRI format knows (MAVZ); not overrides.pri:schema
pri:9fa710 = 178
Unidentified field, 1 time, 2 bytes: small binary blob that precedes the NV item list.
Band combos

What the iOS 26.0 Qualcomm X80 · Mav25 package advertises on this carrier's networks.

ATT default bundle on 310-150 310-280 310-380 310-410 313-100
PlatformsCombosEN-DCNRLTENR-DCMax CCNR bandsLTE anchors
P1P4P5P6 4592062530265n2 n5 n66 n77
FR2 n258 n260		B2 B5 B12 B14 B29 B30 B66
Modem defaults this file replaces

Files the package ships at the EFS paths this bundle's .der.pri writes.

EFS pathPackage copy
/policyman/carrier_policy.xmlbbcfg.mbn P1P4P5P6 Compare
/data/3gpp/data_3gpp_dynamic_config.xmlbbcfg.mbn P1P4P5P6 Compare