How To Guide How to Enable All Bands Through Service Menu on US/CA S23 series (including Sub-6 and mmWave) - Samsung Galaxy S23 Ultra

What is this?
This is a guide on how to enable all LTE and 5G bands on the US or Canadian S23 series phones by going through the service menu. This guide is a copy of my S22U guide, which is mostly based on this S20U guide by mellojosh, but has been adapted for the S23U phone with more information added.
Who needs this?
Different countries and carriers use different 5G frequency bands, so the phone's software limits 5G bands to your model's country and carrier even though the phone hardware supports more bands. Here are some cases when unlocking all 5G bands could be useful:
You live outside the US/Canada but bought a US/Canadian model and want to use 5G in your country that uses different 5G bands than US/Canadian carriers.
You live in the US/Canada but are travelling to a different country and want to use their 5G service which uses different 5G bands than US/Canada.
You live in the US/Canada but think your carrier is limiting your 5G service for some reason and think that you can optimize it better.
Which bands can be enabled this way?
All bands the phone supports in hardware can be enabled through the service menu. For the US S23 Ultra, that includes all Sub-6 bands like n78, and mmWave bands, as well as 5G SA bands, as shown in this screenshot below. For the Canadian S23 Ultra, this method will unlock all the same bands as the US model except mmWave (might be a hardware or firmware limitation).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Which phones does this method support?
This method has been confirmed to work on:
Samsung S23 Ultra (S918U, S918U1, S918W).
Samsung S22 Ultra (S908U, S908U1, S908W).
Galaxy Z Fold 4 and Z Flip 4. Thanks @Abaddon and @otteporihs.
This method works on both Android 12 (One UI 4.1) or Android 13 (One UI 5.0, 5.1).
This method requires your device be on the US firmware (XAA or other US CSC), so as long as you can Odin flash XAA firmware on your device (such as Canadian variant), you should be able to do this.
If you get this method working on your phone that isn't in the known list, post it here and I will add it to the list above.
How To Guide
You will need a Windows computer (or VM) and the Samsung USB Driver installed to do the following steps. Install the USB driver from here before proceeding if you do not have it installed.
A. Flash US Firmware
First, your device must be on US firmware (XAA or other CSC). You can skip this step and go to B if your device is already on US firmware.
If you're not on a US firmware because you have another Snapdragon variant (like Canadian), follow the steps below to flash XAA firmware. Note this will WIPE and FACTORY RESET your device. ALL DATA WILL BE LOST. So backup if you need to.
Download Odin 3.14.4 or latest version.
Download US XAA U1 firmware for your device from SamMobile.com or SamFw.com. For example, for the S23 Ultra, download the XAA firmware for S918U1. Extract the contents of the firmware to somewhere on your computer. You should have 5 files (BL, AP, CP, CSC, HOME_CSC). We won't use HOME_CSC.
Restart your phone and go into download mode. On the S23 Ultra, hold all three power and up + down volume at the same time until the phone starts, then press the up volume key to get into download mode.
Open Odin and connect your phone to your computer with a USB. Odin should say your phone was added.
Click each of the BL, AP, CP, CSC buttons and select the corresponding files from the firmware zip you extracted. For CSC, use the file that starts with CSC and not HOME_CSC (we won't be using HOME_CSC). Do not load anything into USERDATA.
Click start and let it flash the firmware (see the picture below). If it flashed correctly, your phone will be on XAA firmware after it restarts and you will have to set it up again from scratch.
Set up your phone and verify it is on XAA firmware by going to Settings -> About Phone -> Software information -> check that it says XAA/XAA,XAA/OOO under "Software provider software version". OOO here will be your phone's original CSC like XAC which you cannot change and do not need to.
B. Unlock Service Menu Secret Codes
The next step is we need to unlock access to the service menu. Usually this is locked by default, but it might already be unlocked for you.
First check if you can access the service menu by trying each of these ways:
Open dialer and enter *#27663368378# to try to get directly into the service mode main menu. The menu should open after you press the last # character, you shouldn't have to press call.
Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
If either of the above ways works for you to get to the service mode main menu, then you can skip the below steps to unlock the menu and go directly to instructions C.
If you cannot access the menu with the above codes, then follow these instructions to unlock the secret codes.
Enable USB Debugging in Developer menu.
Download SamFW FRP tool 4.0 or latest version from here.
Open SamFW FRP tool and connect your phone to the computer with a USB.
Using SamFW FRP tool, go to MTP tab and click on "Enable Secret Code for Verizon". See the picture below. Note it works on any US CSC even though it says "for Verizon".
If in the program output you see it's getting stuck on "Waiting for DIAG", then dial *#0808# on your phone to open USB settings and select "DM + MODEM + ADB" then press OK. The program should then complete the step and then get stuck on "Disabling DIAG". When it does, using the *#0808# menu again, select "MTP + ADB" this time and press OK. Now the program should complete the step and say that secret codes was unlocked.
Now you should be able to use *#73# for RF test, or *#27663368378#* to go directly to service menu. Test it to make sure at least one of the codes works and the service menu is opening.
C. METHOD 1: Use the Service Menu to Unlock All Bands
Enter the service menu using either way.
Open dialer and enter *#27663368378# to get directly into the service mode main menu.
Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
Use the service mode to set the following options. Note you can go back between screens with three dots -> back for quicker navigation, but I am just starting each option below from the main menu so it's easy to read.
Enable all LTE and 5G bands.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> SYSTEM -> Next page 4 times -> SET LTE BAND CONFIG -> SET DEFAULT LTE BAND.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> PRUNE STATUS -> REMOVE NR5G PRUNE.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> GCF -> REMOVE ONLY NR WHITELIST.
Optional if you need to enable mmWave bands on US model: Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Sub6/mmWave -> ALL ENABLE.
Optional if you have issues going from LTE to LTE+ (carrier aggregation not working properly): Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> DISABLE CA COMBO CHECK -> DISABLE ON.
Enable 5G NR features (DSS & CDRX) if needed. These options might already be enabled for you by default.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page -> NR CDRX CONTROL -> NR CDRX ENABLE. NR CDRX is 5G power saving mode.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> AS -> Next Page 2 times -> NR DSS CONTROL -> NR DSS ENABLE. NR DSS is 5G Dynamic Spectrum Sharing.
Enable 5G SA if you're lucky enough to have a carrier with standalone 5G networks. This option might be enabled by default already.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> SA/NSA Mode Control -> SA/NSA ENABLE.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> SA/NSA Mode Control -> Remove SA permit list.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> NRDC -> NRDC ENABLE. NRDC is for dual connectivity with Sub6 + mmWave bands in parallel. Only applies to 5G SA networks and only if your carrier uses it.
Restart your phone, then dial *#73# to get into RF Test Mode. Click Band Selection -> Sim 1 or Sim 2 (whichever you use). On this screen if you scroll down, you'll see a list of enabled NR5G bands. Make sure all bands are enabled. See my picture below.
NOTE: Band selection won't be reset with a reboot, but might be reset after a CSC update (or a software update that includes a CSC update). You will have to re-do the service menu settings every update or re-flash of a CSC.
NOTE: If you use an eSIM or a dual-SIM phone with a 2nd SIM, you need to change the NR5G stack before changing the NR5G related options above. Change the NR5G stack to Stack 2 with the following setting first.
Service Mode Main Menu -> UE SETTING & INFO -> SETTING -> PROTOCOL -> NR5G -> Stack Selection -> Select STACK 2.
OPTIONAL: Now that all bands are enabled and usable, you can use the Band Selection menu under *#73# to selectively disable certain bands if you need to. This is not covered here but that menu is self-explanatory.
If this method isn't working, try METHOD 2 below. You do not need to try METHOD 2 if this method ended up working for you.
D. METHOD 2: Unlock all bands via Protocol Simulation menu.
If METHOD 1 above didn't work or not all bands were unlocked, you can try to unlock all bands by simulating a change in your CSC to GCF (Global Certification Forum). This won't actually change your CSC to GCF, but will change the options in the service menu as if you were on GCF CSC, which should give you access to all SA and NSA bands. Credits to @wr3cckl3ss1 for figuring out this method.
To do this method, first enter the service mode main menu using either of the following ways.
Open dialer and enter *#27663368378# to get directly into the service mode main menu.
Open dialer and enter *#73# to get into RF Test mode. Press Band Selection. Press three dots on top right -> Back. Repeat three dots -> back three more times until you get to the service mode main menu.
Using the service menu, change the following options
Go to: Service Mode Main Menu -> PROTOCOL STATE -> PROTOCOL SIMULATION -> IMEI PRE CFG SIMULATION.
In this menu, click [1] AP, then click GCF (last option). Then click [2] NET1 and change it to GCF as well. Do the same for [3] NET2. All GCF.
Press [4] Write. Then restart phone.
Check if all SA bands were unlocked. If not, repeat the band unlocking instructions from METHOD 1 above and then restart the phone and check again.
Enjoy your unlocked LTE and 5G bands!
I have personally tested this on a Canadian S23 Ultra (S918W) on US XAA firmware to enable all bands. I reflashed Canadian firmware after I unlocked the service menu and the service menu stayed accessible even on Canadian firmware. So the trick is to always start out on US firmware and unlock the menu there first.
CREDITS
@mellojosh for his guide on service menu band options on the S20U1.
@wr3cckl3ss1 for instructions on protocol simulation.

---

If anyone gets this working on a US S23 Ultra, please post the full unlocked band list as in the first screenshot (which is an older screenshot from my US S22U). My Canadian S23 Ultra doesn't have mmWave bands, so I want a screenshot with mmWave bands enabled with the US S23 Ultra model. Thanks!

---

Can you just flash U firmware using Home CSC to keep the data?
Which US CSC enables spam protection and/or visual voicemail on a Canadian SIM card?

---

Thanks for this. I was curious if it was possible to enable all the things on my U1 I'm picking up tomorrow. Unfortunately it seems to confirm no n70 but hopefully Samsung and Dish can come to an agreement to add it but even if they don't, I'm just happy to have lower band n77 since that's all the midband AT&T can use here til 2024 (Pixel 7 Pro doesn't support it, a key reason for my upgrading other than the screen keeps failing lol)

---

tangnt said:
Can you just flash U firmware using Home CSC to keep the data?
Which US CSC enables spam protection and/or visual voicemail on a Canadian SIM card?
Click to expand...
Click to collapse
In my experience , if you're switching from W to U/U1, you cannot use HOME_CSC. It will end up saying there's a boot up error and you'll need to factory reset.
Once you unlock the service menu with US firmware, you can then flash Canadian W firmware again and the service menu will still stay unlocked (with *#73# method), so you can still unlock bands on W firmware. You don't need to stay on US firmware.
I haven't been able to find any US CSC that works with Visual Voicemail in Canada. But for spam protection, any US CSC other than XAA should work (you'll need to change it through SamFW and disable cidmanager with ADBAppControl so it doesn't revert back to XAA).

---

EtherealRemnant said:
Thanks for this. I was curious if it was possible to enable all the things on my U1 I'm picking up tomorrow. Unfortunately it seems to confirm no n70 but hopefully Samsung and Dish can come to an agreement to add it but even if they don't, I'm just happy to have lower band n77 since that's all the midband AT&T can use here til 2024 (Pixel 7 Pro doesn't support it, a key reason for my upgrading other than the screen keeps failing lol)
Click to expand...
Click to collapse
Are you in the US with an AT&T SIM and going to use U1 phone? The phone should already have the bands for your carrier. I don't see why you would have to unlock anything?

---

i have SM-G996B (S21+ Exynos) and i changed my CSC (INU) to DBT for getting oneui5.1 update. After CSC change i got FOTA update but 5G not working in DBT CSC, so i switch back to INU but nothing change. I cant flash INU fw because Samsung not release oneui5.1 update for Indian user. Final word is My 5G not working after csc change.....can anyone help me

---

peacey8 said:
Are you in the US with an AT&T SIM and going to use U1 phone? The phone should already have the bands for your carrier. I don't see why you would have to unlock anything?
Click to expand...
Click to collapse
I am in the US but I'm using a T-Mobile MVNO (Tello) for calls and texts and Dish Network's postpaid service, Boost Infinite, for my data. Boost Infinite is currently using AT&T exclusively but they'll be sending us new SIM cards some time this quarter or next that change us to their network as the primary, AT&T as the secondary, and T-Mobile as the third priority with automatic switching between them a la Google Fi. Dish uses n29, n48, n66, n70, n71, n262, and if they buy it from T-Mobile, n26. This phone supports everything but n70. I'm hoping that Samsung will add it later as the modem supports it (in fact the iPhone 14 Pro/Max with the year older X65 supports n70 and so do a few other non-flagships from last year like the Moto G Stylus 5G so it doesn't require a flagship modem).

---

I tried these steps and more from the s21 and s22 guides multiple times a few days ago. On my T-Mobile SM-918U running the out of the box T-Mobile firmware. Didn't work for me.
Edit: If in the program output you see it's getting stuck on "Waiting for DIAG", then dial *#0808# on your phone to open USB settings and select "DM + MODEM + ADB" then press OK. The program should then complete the step is where it gets stuck. Regardless of what USB Setting is selected, it still sits on Waiting for DIAG.

---

peacey8 said:
In my experience , if you're switching from W to U/U1, you cannot use HOME_CSC. It will end up saying there's a boot up error and you'll need to factory reset.
Once you unlock the service menu with US firmware, you can then flash Canadian W firmware again and the service menu will still stay unlocked (with *#73# method), so you can still unlock bands on W firmware. You don't need to stay on US firmware.
I haven't been able to find any US CSC that works with Visual Voicemail in Canada. But for spam protection, any US CSC other than XAA should work (you'll need to change it through SamFW and disable cidmanager with ADBAppControl so it doesn't revert back to XAA).
Click to expand...
Click to collapse
I recently flashed 5.0 U firmware on my 4.0 S20 with Home CSC and it didn't wipe the data. I will try and report.

---

jcsww said:
I tried these steps and more from the s21 and s22 guides multiple times a few days ago. On my T-Mobile SM-918U running the out of the box T-Mobile firmware. Didn't work for me.
Edit: If in the program output you see it's getting stuck on "Waiting for DIAG", then dial *#0808# on your phone to open USB settings and select "DM + MODEM + ADB" then press OK. The program should then complete the step is where it gets stuck. Regardless of what USB Setting is selected, it still sits on Waiting for DIAG.
Click to expand...
Click to collapse
It works perfectly fine for other people on S22 so there must be something you're doing wrong or a driver issue.
Make sure you have Samsung USB drivers installed, or reinstall them. If it still doesn't work, try to change your CSC to XAA or VZW then try again.
Also let's keep this thread about S23U, use the S22U guide to post your issues for S22 there.

---

tangnt said:
I recently flashed 5.0 U firmware on my 4.0 S20 with Home CSC and it didn't wipe the data. I will try and report.
Click to expand...
Click to collapse
It didn't wipe the data when you went from U to W firmware or vice versa? Well maybe S20 is different, but for S22 and up it will flash but will end up saying there's an error when booting your phone and you have to factory reset in recovery to make it work.

---

peacey8 said:
It works perfectly fine for other people on S22 so there must be something you're doing wrong or a driver issue.
Make sure you have Samsung USB drivers installed, or reinstall them. If it still doesn't work, try to change your CSC to XAA or VZW then try again.
Also let's keep this thread about S23U, use the S22U guide to post your issues for S22 there.
Click to expand...
Click to collapse
I have an s23 Ultra. ADB works fine because I have used that to remove the few Facebook apps and other social media trash I don't want on my device. I won't be converting to the XAA until I get the SIM lock removed. To remove the SIM lock, the device must be on the TMB U.

---

jcsww said:
I have an s23 Ultra. ADB works fine because I have used that to remove the few Facebook apps and other social media trash I don't want on my device. I won't be converting to the XAA until I get the SIM lock removed. To remove the SIM lock, the device must be on the TMB U.
Click to expand...
Click to collapse
Try to reinstall the Samsung drivers (ADB might work because of Android drivers instead of Samsung) or try a different cable. Some people have reported a similar issue but it worked for them after reinstalling the Samsung drivers or using a different cable. At the least you should be able to get past Waiting for DIAG.

---

can anyone with a German or European S23 say if this is useful for us?

---

i have the S918U1 stock firmware i am new to samsung, i believe this is the US version already correct? if so the *# codes do not work and i am unable to find the correct firmware for this phone from sammobile the U1 shows no match when searched for on sammobile.

---

Jerreth said:
i have the S918U1 stock firmware i am new to samsung, i believe this is the US version already correct? if so the *# codes do not work and i am unable to find the correct firmware for this phone from sammobile the U1 shows no match when searched for on sammobile.
Click to expand...
Click to collapse
Yeah it seems like a lot of the codes are disabled on the U1. I can't even read my CSC using the *#1234# code that I found when searching the web, just doesn't do anything. *#0011# still works and that's primarily what I would be using anyway so that's good at least but I have to find a new way to read the CSC code.

---

TeeKay35 said:
can anyone with a German or European S23 say if this is useful for us?
Click to expand...
Click to collapse
I would like to know this too. Even though 5G isn't widespread in EU (no mmWave etc.), I'd like to enable it if the phone supports this but is limited/unabled for no reason.

---

Jerreth said:
i have the S918U1 stock firmware i am new to samsung, i believe this is the US version already correct? if so the *# codes do not work and i am unable to find the correct firmware for this phone from sammobile the U1 shows no match when searched for on sammobile.
Click to expand...
Click to collapse
Did you follow the guide to unlock the codes with SamFW FRP Tool? You have to do that for the codes to work first...

---

TeeKay35 said:
can anyone with a German or European S23 say if this is useful for us?
Click to expand...
Click to collapse
Mozie said:
I would like to know this too. Even though 5G isn't widespread in EU (no mmWave etc.), I'd like to enable it if the phone supports this but is limited/unabled for no reason.
Click to expand...
Click to collapse
No unfortunately this method is for US/Canadian phones only.