Samsung CSC Change Using Modem Commands

This is a brief brain dump, so I can recall it when needed.

Each time I get a new Samsung phone I have to figure out a way to change the Country Service Code (CSC) to a country that allows automated call recordings, for example, Indonesia (XID). Previously, approximately 5 years ago, it was quite straight forward: you needed to download the HOME_CSC image for the region you are interested in, ensure that it was for the same bootloader version, and flash it to the CSC partition.

However, something changed in recent years (and I was not paying attention to the developments in Samsung world). I just recently purchased Samsung ZFold 7 and the trick with flashing did not work, so I started to investigate. Firstly, I discovered that the modern Samsung devices come with a multi-CSC configuration, so everything is already pre-installed on the device – one just needs to change the setting to set the desired CSC for the device. Secondly, the articles on the net on the change of CSC were all pointing to the SamFW tool, but I do have an issue with using that tool: for starters, it is a Windows x86_64 tool and I don’t have any Intel based devices to run Windows x86_64. So, I started to research on how SamFW was doing the change of the CSC. According to what I gathered, the tool was using the Serial-over-USB to perform the change.

Below are the steps I took to successfuly change the CSC on my phone from XSA (Australia) to XID (Indonesia).

You need to enable the “Developer options” menu on your Samsung device: go to Settings -> About phone -> Software information and tap on the “Build number” line 7 times.
In the “Developer options” menu make sure that you enable the following options:

a) “Stay awake” – this is optional, but you need to ensure that the phone is awake and not locked while you are going to communicate with it via USB, so it is easier to turn this option on and once the changes are done to turn it back off;

b) “USB debugging” – I am not really sure whether this is strictly needed, but in my session it was enabled;

c) “3GPP AT commands” – This will enable the interface we are going to use to issue modem commands;

d) “Default USB configuration”, select “Transferring files” – this is important since we are going to land on the debug screen that would not allow us to access notifications, so there is no way to change the USB configuration on the fly. You may want to change to your preferred setting after the CSC change is applied, though.

Launch the dialler application and enter *#0*#, the screen will change to a white background with lots of square buttons for diagnostic purposes. I believe this step is essential to enable some of the proprietary commands in the modem interface.
Connect your phone to your computer. Mine is Apple Macbook M4, so it runs macOS. Yours may run Linux or Windows. It does not really matter, except with Windows you will need to install serial drivers for Samsung (e.g. if you install any official Samsung tools like KIES, you already should have the necessary drivers installed). For macOS and Linux, it is much easier – you don’t need to install anything, the Serial-over-USB should be supported out of the box.
Locate the modem endpoint on your operating system. On macOS, use ls -l /dev/cu.usbmodem* to locate it. On Linux, I would suggest to do dmesg | tail -30 after connecting the device, you should be able to see which /dev/tty* has been assigned for the Serial-over-USB. For Windows, check your Device Manager to see which COM* port was assigned.
Use your favourite communication program to connect to the endpoint. On macOS, I prefer to use cu, which is included with the operating system and my examples below will use it. On Linux, you have myriad of options, but I would use either screen or minicom. On Windows, I think, HyperTerminal is still included with the operating system by default, but last time I have seen Windows up close was years ago. Anyhow, you need to connect your communication program to the located endpoint, set the baudrate to 115200, and you should be all set.
Now is the magic :). Below is my terminal session on macOS with my comments after the snippet:
```
galaxy@galaxy ~ $ sudo -i            
Password:

root@galaxy ~ # ls -la /dev/cu.*                    
crw-rw-rw-  1 root  wheel  0x9000003 Aug 26 10:39 /dev/cu.Bluetooth-Incoming-Port
crw-rw-rw-  1 root  wheel  0x9000001 Aug 26 10:38 /dev/cu.debug-console
crw-rw-rw-  1 root  wheel  0x9000005 Oct  9 14:03 /dev/cu.usbmodemXXXXXXXXXXXX
Eris:~ root# cu -l /dev/cu.usbmodemXXXXXXXXXXXX -s 115200
Connected.
AT
OK
ATI
Manufacturer: SAMSUNG ELECTRONICS CORPORATION
Model: SM-F966B
Revision: F966BXXU4AYI1
SVN: 01
IMEI: IIIIIIIIIIIIIII
+GCAP: +CGSM

OK
AT+DUMPCTRL=1,0

+CME Error:PACM(AP),PROTECTED_NO_TOK

OK
AT+SWATD=0
[DR]: CHANGE TO DDEXE[ATD]: CHANGE TO DDEXE

OK
AT+ACTIVATE=0,0,0

+CME Error:PACM(AP),UNREGISTED

OK
AT+SWATD=1
[DR]: CHANGE TO ATD[ATD]: CHANGE TO ATD

OK
AT+PRECONFG=2,XID
+PRECONFG:2,OK

OK
AT+CFUN=1,1
+CFUN=1,1:NA

OK
~.

Disconnected.
root@galaxy ~ #
```
I used AT at the beginning of the session to confirm that the modem interface is active (I got an OK, so it was active). Then I used ATI to ensure that I am actually talking to the desired device (it was indeed SM-F966B).

From this point on, all commands I am using are AT+ and, moreover, they all come from the Application Processor (AP) module.

AT+DUMPCTRL=1,0 is needed to enable the following AT+SWATD= commands to work.

AT+ACTIVATE=0,0,0 is a weird one. There is not too much information on the net regarding this command, but it seems that every single occurrence is related to enabling something in the firmware to allow the privileged settings to be changed, like we do with the very next command.

AT+PRECONF=2,nnn is the primary command we want to execute. The command sets the CSC of the device, where nnn is a three letter CSC used by Samsung. In my case it was XID for Indonesia. You can get a list of all available/known CSC from SamFW (the site is really heavy on ads, though, so beware).

AT+CFUN=1,1 is supposed to reboot the device. In my case, it did not, so I rebooted it manually.
Once you rebooted your device, go to Settings -> About phone -> Software information and look at the “Service provider software version” section. Mine looks like the following (after the change):
```
XID/XID,XID/XSA,OPS
```
Somewhere on the net you could find the format of this string, but basically it means that I have a dual-SIM enabled device with XID (Indonesia) CSC enabled for both SIMs, that the custom CSC is XID, but factory one is XSA (Australia). In your case, you should see your selected CSC in that line, if everything worked out correctly.

This is basically it. Enjoy! :)