Fix for excessive "Cell standby" battery drain on Android with b-mobile data-only SIMs

THIS POST IS OUT OF DATE. SEE: http://www.japanmobiletech.com/2013/08/improved-fix-for-docomo-mvno-data-only.html

Can you tell which of these phones has a data-only SIM?

We figured that the fix for the infamous signal bars/battery drain issue was probably trivial, once someone figured out exactly what needed to be fixed. That someone is best known simply as "oov" and prefers not be called a developer because he only started tinkering with Android a few months ago. If you read Japanese, hop over to his site for a description of the patch, a windows batch file to execute, and a list of handsets confirmed compatible. Even if you don't read Japanese, I provided an English localization of the patch - select English when running.

For those unfamiliar with the problem, JCI was instrumental in the opening (though government arbitration) of NTT Docomo's FOMA network to MVNOs. The results are readily seen as an explosion of innovative cellular data products that even Docomo has began copying. However, while the SIMs that are distributed by DCM to MVNOs appear identical to a standard FOMA SIM card, they lack certain components that Android expects. This makes it appear to the OS in some (but not all) handsets that there is no cell signal when there actually is. As a result, power is boosted to radio, and "Cell standby" quickly drains the battery.

Give up? the data-only SIM is in the left screenshot (note the erroneous "G" - HTC Desire)

I've personally confirmed that the patch works on an unlocked Softbank HTC Desire (X06HT II) running both CyanogenMod 7.1 Stable and a beta version of ICS. The fix has also been reported to work on a number of other HTC phones including the Nexus One. It also seems to work for Samsung Galaxy series phones, such as the Galaxy S and S2, the Nexus S, and the Galaxy Nexus. Motorola Droid and Atrix phones are also reported fixed, as are various Xperia handsets. Patched files are hardware/software specific. You cannot use a patch for one model phone on a different model or OS version.

Requirements

The perquisites to doing this will void your warranty. Do this at your own risk. Do not do this to a phone that uses voice+data SIMs. If you change to a voice+data SIM, push back the original framework.jar file that is made in the patching process using the "recovery.bat" file.

• A data-only SIM from an MVNO using NTT Docomo's FOMA network
• Root
• S-Off (Nand security off)
• Custom Recovery (such as ClockworkMod)
• A nandroid backup of your current ROM (in case it doesn't work).
• Windows with a Java Developer Kit if you can't compile and decompile the necessary files.

Procedure

To do this manually, see the description below. Before pushing the patched file back to the phone, you'll need to mount the system partition as writable. If you can't get the batch file to push the patched file, you can find it in the same directory and push it yourself.

Step 0. Download the zip with batch files to patch and backup your system.

Step 1. open a command line and mount your system partition as readable. With an S-OFF bootloader this should be done as adb remount with the phone booted normally. If you get a permission denied error, try doing it while booted into recovery. If you still can't do it, you're going to have to look into how to mount the system partition for your particular phone and bootloader.

Step 2. Run the batch file. Select English.

Step 3. Choose your Android version (or in the case of gingerbread, the closest version)

Step 4. Choose the mode for the patch. See the table below for suggestions. Only use 99 if the other options didn't work.

I'm aware of the typo. I blame Nicholas for not catching it.

Step 5. Choose whether you want the "emergency calls only" dialog to go away.

Step 6. Create a patched framework.jar file based on the above conditions. The compiling and decompiling will take some time. Just let it sit. It isn't doing anything to your phone at this time.

Step 7. Push the patched file to your phone. (This can be done manually if it should fail for whatever reason.)

Step 8. Boot into recovery and wipe Dalvik cache and the cache partition.

Patch Modes

I've copied the list here, but it is better to check the original site. These settings are primarily sourced from comments of people who have successfully patched their phones.

Handsets confirmed working with Mode: 0

• Samsung Galaxy S2 (SC-02C, HyperDroid)
• Samsung Galaxy Nexus (GT-i9250)
• Samsung Galaxy Note
• Samsung Galaxy Tab (probably GT-P1000)
• Samsung Galaxy S (GT-i9000, Onecosmic's ICS Port Android 4.0.3 RC3.1)
• Samsung Galaxy Nexus S (GT-i9020T, aokp 4.0.3)
• Samsung Captivate Glide (SGH-I927, I927UCKI3)
• HTC Desire HD (001HT SIMUnlocked)
• HTC Desire HD (UK版 SIMFree, CyanogenMod7)
• HTC Desire Z (CyanogenMod7.1, some reports of failure as well)
• HTC Desire (X06HT, X06HTII, CyanogenMod 7.1), (X06HTII, Sandvold's ICS BETA 0.3.9 and 0.4.3 may show "G" for GPRS, even though it has 3G/H connectioin)
• HTC myTouch 4G slide (1.28.531.10)
• HTC HT-03A (CyanogenMod 6)
• ZTE Blade (003Z, CyanogenMod 7.1)
• Nexus One (2.3.3)
• LG Optimus 2X (LG-P990, CyanogenMod 7)

Handsets confirmed working with Mode: 1

• Sony Ericsson Xperia PLAY
• Sony Ericsson Xperia mini pro (SK17a)
• Sony Ericsson Xperia ray
• Sony Ericsson Xperia pro (MK16a 4.0.2)
• Sony Ericsson Xperia neo (MT15i, 2.3.4)
• Sony Ericsson Xperia mini (ST15a), (ST15i)
• Sony Ericsson Xperia Active (ST17i)
• Sony Ericsson Xperia arc (SO-01C)
• Sony Ericsson mini (S51SE)

Handsets confirmed working with Mode: 2

• Motorola DROID Pro (XT610 3.8.7 / 4.6.4), (CyanogenMod7 )
• Motorola DROID 3 (XT862 5.6.890)
• Motorola Atrix
• Motorola Photon (ISW11M, CyanogenMod 7)

Handsets confirmed working with Mode: 99

• Sony Ericsson Xperia acro (SO-02C, 2.3.4)
• HTC Sensation (Android Revolution HD, not confirmed with mode 0, XE？)

Some Xperia handsets fail with changing to not display "emergency calls only" If so, change to 0 - "don't change"

Confirmed working data-only SIMs:

• b-mobile Fair
• b-mobile 1GB Flat Rate
• b-mobile U300
• b-mobile SIM (Aeon)
• so-net モバイル 3G
• ぷららモバイル
• MiFi
• IIJmio高速モバイル/Dサービス
• BIGLOBE 3G

Behind the Scenes

This is the general procedure (J) done by the batch file. adb is used to pull /system/framework/framework.jar to your local computer. From there, classes.dex is extracted and then decompiled with baksmali. In the output directory, the text file out/com/android/internal/telephony/gsm/GsmServiceStateTracker.smali is edited, classes.dex is recompiled and reinserted into framework.jar, which is pushed back to the phone.

The portion that is edited is just slightly below this entry: .method private regCodeToServiceState(I)I.

:pswitch_data_22
    .packed-switch 0x0
        :pswitch_1c ← Edit point for Motorola DROID Prom, DROID 3, Atrix, etc.
        :pswitch_1d ← See here.
        :pswitch_1c ← Xperia also needs to be edited here
        :pswitch_1d ← Here :pswitch_1c is changed to :pswitch_1d
        :pswitch_1c
        :pswitch_1f
        :pswitch_5
        :pswitch_5
        :pswitch_5
        :pswitch_5
        :pswitch_1c
        :pswitch_5
        :pswitch_1c ← Xperia also needs to be edited here
        :pswitch_1d ← Here :pswitch_1c is changed to :pswitch_1d
        :pswitch_1c
    .end packed-switch

The description in the batch file is counting lines starting at 0 from the first occurrence of :pswitch. For example, Xperia edits are at 2 and 12.