[mbirth]

USE THESE AT YOUR OWN RISK!

Type the codes into the phone dialer.

MMI Test (something like BBVE)

*#2886# ("AUTO")

Engineering Mode

*#*#2637643#*#* ("ANDROID")

These seem to be standard for Alcatel phones. Interestingly, they work here, too.

Engineering mode has a few settings (black font on black background - hold your finger above where the text should be for the background to become grey, making the text visible). There's also a setting "root". But I didn't try it.

[Uzi]

Nice find

[jcrutchvt2010]

USE THESE AT YOUR OWN RISK!

Type the codes into the phone dialer.

MMI Test (something like BBVE)

*#2886#

Engineering Mode

*#*#2637643#*#*

These seem to be standard for Alcatel phones. Interestingly, they work here, too.

Engineering mode has a few settings (black font on black background - hold your finger above where the text should be for the background to become grey, making the text visible). There's also a setting "root". But I didn't try it.

I've had root checked messing around with it. There are some low level device management apps like sigmakey that have been used to unlock devices with engineering mode root on. I haven't been able to enable USB Diagnostic mode yet though. Setprop doesn't work in shell commands obviously because there is no root. Next thought is temporarily modifying the build prop using build prop editor. You are able to grant it write-secure-settings via ADB and change stuff but it gets overridden by default prop and ramdisk.

[NightFire]

Hopefully fiddling around with the root settings won't ultimately set off the DTEK app.

Posted via CB10

[cribble2k]

Hopefully fiddling around with the root settings won't ultimately set off the DTEK app.

Posted via CB10

Someone should try. If DTEK doesn't warn them, it was BlackBerry BS all along.

[conite]

Someone should try. If DTEK doesn't warn them, it was BlackBerry BS all along.

It depends if a system app is actually altered.

[NightFire]

Someone should try. If DTEK doesn't warn them, it was BlackBerry BS all along.

Check this out: http://forums.crackberry.com/showthread.php?t=1113942. Obviously, I don't know if the same effect would occur. I'm not willing to try it, either.

Posted via CB10

[guizmox]

Thank you for that find. A lot of interesting things

Build date ?
(Traceability menu)

[Devhux]

Hopefully fiddling around with the root settings won't ultimately set off the DTEK app.

Posted via CB10

Be careful even in the MMI Test app. After showing someone in our KEYᴼᴺᴱ BBM group the Traceability setting, they ran a few other tests and caused DTEK to report the integrity of the OS may be compromised.

[NightFire]

Be careful even in the MMI Test app. After showing someone in our KEYᴼᴺᴱ BBM group the Traceability setting, they ran a few other tests and caused DTEK to report the integrity of the OS may be compromised.

Well, isn't that something? Thanks for that tidbit!

Posted via CB10

[allbetsareoff29]

Yup. Viewing is fine but as soon as you make any change, dtek goes off and you have to factory reset the phone

[Matt J]

Hopefully fiddling around with the root settings won't ultimately set off the DTEK app.

Posted via CB10

It does set off the DTEK app. When I used this feature, DTEK now says my OS is compromised. Don't do this!!!!!

[bokyo102]

Same here! Had to Factory Reset my Ketone.

[limety]

Cannot access Engineering Menu in Build AAR970. What OS Version is the last the works for this Eng menu? Thank you!

[hary232]

Cannot access Engineering Menu in Build AAR970. What OS Version is the last the works for this Eng menu? Thank you!

I think they took it off. it was there on Oct'17 update (AAS if i'm not mistaken, CMIIW). Just checked at AAT and its nowhere to be found.

[jcrutchvt2010]

Cannot access Engineering Menu in Build AAR970. What OS Version is the last the works for this Eng menu? Thank you!

Yep I believe TestMode.apk is gone in December builds and after. Not on Motion though...

[hary232]

Yep I believe TestMode.apk is gone in December builds and after. Not on Motion though...

One more point though. I played around with that engineering menu and found "Root" switch. Unfortunately it does nothing (i tried to install superSU without any success)

[mbirth]

One more point though. I played around with that engineering menu and found "Root" switch. Unfortunately it does nothing (i tried to install superSU without any success)

It doesn't "root" the system but gives full access to the radio firmware.

[portplayer]

So is engineering mode gone? No way to turn on "root" on anymore?

[hary232]

It doesn't "root" the system but gives full access to the radio firmware.

Bummer... different "root" meaning

So is engineering mode gone? No way to turn on "root" on anymore?

i tried to toy around engineering menu last week, no success.

The furthest that I can go so far are:

1. Enable QPST interface
2. Checking OEM commands available on fastboot. Unfortunately most of them are locked.

Anyone else interested to play around with this device?

[jcrutchvt2010]

Bummer... different "root" meaning



i tried to toy around engineering menu last week, no success.

The furthest that I can go so far are:

1. Enable QPST interface
2. Checking OEM commands available on fastboot. Unfortunately most of them are locked.

Anyone else interested to play around with this device?

QXDM and QPST still seem to be accessible with the qualcomm drivers so long as your are in modem mode. Doesn't do a lot of good though since it isn't recognized in Fastboot or "EDL" mode. You can still pass commands, edit NV items, etc., but no emmc dl or dumps. Mine shows as usb gadget device in "diagnostic" mode (hold down volume up and volume down while simultaneously plugging in usb until solid LED shows and the screen is black). There may be a way to enumerate that further but I haven't figured it out.

[hary232]

QXDM and QPST still seem to be accessible with the qualcomm drivers so long as your are in modem mode. Doesn't do a lot of good though since it isn't recognized in Fastboot or "EDL" mode. You can still pass commands, edit NV items, etc., but no emmc dl or dumps. Mine shows as usb gadget device in "diagnostic" mode (hold down volume up and volume down while simultaneously plugging in usb until solid LED shows and the screen is black). There may be a way to enumerate that further but I haven't figured it out.

i was thinking to edit NV items to change LTE frequency preference, but flashing EMEA modem solved my reception issue.

i'll try that combination later. thanks

[High Grade Films]

Has anyone tried editing the build.prop for accessing the camera 2 api?

Would love to know if it's possible to make use of true manual camera controls

I have a Keyone BE looking to upgrade to Key2 in future

[chetmanley]

Using an app from F-droid called Chairlock, I was able to access a number of interesting hidden menus on my Key2, including MMI Test, Engineering Mode, ARDA which as a number of interesting cellular, wifi calling and GPS settings, a conference call screen and some dormant device setup screens including one for Verizon.

Under Android System I found a notification log which had interesting detail on each notification and when it occurred.

Also shown below are the screens associated with the TCL Tempcontrol app: com.tct.tempcontrol I used Google to try and translate the Chinese text.

I also found a screen which appears to be used to encrypt the device but I don't think this is functional because it's encrypted by default.

[chetmanley]

I re-enabled Blackberry Telemetry packages like com.blackberry.ddt, com.blackberry.dm, com.blackberry.ddt.bugreporter and was able to access the following menu through Chairlock under com.blackberry.ddt

I'm not sure if this menu actually does anything because If I try toggling on a particular setting, some of them reset when I return to that menu.

But certainly interesting none the less.