Extracting MBNs from Xiaomi Firmware to Add VoLTE Carrier Profiles to Quectel EC20/EG25 Modules

In an earlier post, I wrote about using an EC20 module with Asterisk and FreePBX for SMS forwarding and VoIP. Although the EC20 can switch carrier profiles with AT+QMBNCFG, the selection built into the module is quite limited. My EC20 R06, for example, came with only four profiles: ROW, China Unicom, China Telecom, and China Mobile. Another EG25-like module had twenty profiles, but still lacked VoLTE profiles for some Hong Kong carriers.

These carrier profiles are Qualcomm MBNs, or Modem Configurations. If the firmware does not contain the VoLTE parameters required by a SIM and the carrier does not accept the parameters in the generic ROW profile, simply issuing AT+QCFG="ims",1 cannot force the module to register for VoLTE. I therefore tried extracting MBNs from Qualcomm phone firmware with a similar baseband branch and adding them to the EC20/EG25 through the module’s officially supported AT interface.

Check the MBN Profiles Built into the EC20/EG25

List the MBNs currently stored on the module:

AT+QMBNCFG="List"

My EC20 R06 originally contained only these four profiles:

ROW_Generic_3GPP
OpenMkt-Commercial-CU
OpenMkt-Commercial-CT
Volte_OpenMkt-Commercial-CMCC

A carrier name in the profile does not necessarily mean that the profile supports that carrier’s VoLTE service. The OpenMkt-Commercial-CU profile here is actually an old CSFB configuration that lacks the complete parameters for IMS registration and UT/XCAP. By contrast, the generic ROW_Generic_3GPP profile can register with China Unicom IMS on this particular EC20.

At startup, the module chooses an MBN according to the SIM’s ICCID and PLMN, then loads the NV items, APNs, and carrier policies from that profile into the baseband. The two status flags on each entry returned by AT+QMBNCFG="List" are selected and activated:

+QMBNCFG: "List",0,1,1,"ROW_Generic_3GPP",...

Only 1,1 means that the profile is actually active for the current boot.

Find a Phone with a Sufficiently Similar Baseband

The main characteristics to compare are:

1. The modem target, such as 9607_GEN or 8937_GENNS, the latter being used by the Qualcomm Snapdragon 430;
2. The MPSS branch, such as MPSS.JO.1.2 or MPSS.JO.3.0;
3. The MCFG format. The EC20 R06 uses format 3. A format 4 profile from a phone may be accepted into the list but never become activated.

The EC20 R06 baseband belongs to 9607_GEN / MPSS.JO.1.2.C1. Following nearby branches of the Qualcomm modem software family, I examined several early Xiaomi phones:

I focused on Xiaomi because firmware packages for its older phones are easy to download, NON-HLOS.bin does not have another vendor-specific wrapper around it, and each image retains Qualcomm MBNs for many regions. The Redmi 5A V10.1.1.0 image contains 90 format 3 profiles for commercial networks. Even though Xiaomi did not sell this phone in every one of those markets, the image still includes profiles for 3HK, HKT, SmarTone, AT&T, T-Mobile, Verizon, and many European carriers. The Snapdragon 430 is an old platform released in 2015, however, so Xiaomi’s final firmware updates—and the MBNs in them—mostly date from around 2019.

Download the Firmware and Extract the MBNs

Older Xiaomi firmware can be downloaded from Xiaomi Firmware Updater. I ultimately used the China release of Redmi 5A V10.1.1.0:

fw_riva_miui_HM5A_V10.1.1.0.NCKCNFI_2e5ec8a9df_7.1.zip

Extract NON-HLOS.bin:

unzip fw_riva_miui_HM5A_V10.1.1.0.NCKCNFI_2e5ec8a9df_7.1.zip \
  firmware-update/NON-HLOS.bin

The file is itself a FAT filesystem image, which can be mounted read-only on Linux:

sudo mkdir -p /mnt/riva-modem
sudo mount -o loop,ro firmware-update/NON-HLOS.bin /mnt/riva-modem

The carrier profiles are stored under:

/mnt/riva-modem/image/modem_pr/mcfg/configs/mcfg_sw/generic/

For example, the China Unicom and 3HK profiles are located at:

CHINA/CU/COMMERCI/VOLTE_OP/MCFG_SW.MBN
SEA/3HK/VOLTE/HK/MCFG_SW.MBN

The MPSS version can also be checked directly in the image:

strings -a firmware-update/NON-HLOS.bin \
  | grep -m1 -E 'MPSS\.(JO|TA).*(GEN|PACK)'

I used mbn-mcfg-tools to verify the internal hash and inspect the MCFG metadata:

mbn-tool -c MCFG_SW.MBN
mbn-tool -e MCFG_SW.MBN extracted-mbn

After extraction, check the following metadata in extracted-mbn/meta before adding a profile to the EC20:

• format_type is compatible with the module;
• operator identifies the expected carrier;
• The ICCID and MCC/MNC rules match the SIM;
• The MBN passes its internal hash check.

The two profiles used in this test reported:

Add an MBN to the EC20/EG25

Before uploading anything, stop Asterisk or ModemManager so that it does not hold the AT port, and record the original state:

ATI
AT+QMBNCFG="List"
AT+QMBNCFG="AutoSel"
AT+QCFG="ims"
AT+COPS?
AT+QNWINFO
AT+CGDCONT?
AT+CGACT?

Quectel provides QFUPL, which can upload a file directly into the module’s RAM:

AT+QFUPL="RAM:carrier.mbn",<file size in bytes>,60
CONNECT
<immediately send the raw MBN bytes without any text conversion>
+QFUPL: <file size in bytes>,<checksum>
OK

A small pyserial script is convenient for this step: send QFUPL, wait for CONNECT, write every raw byte from the file, then wait for +QFUPL and OK. Once the upload finishes, add the MBN:

AT+QMBNCFG="Add","RAM:carrier.mbn"
AT+QMBNCFG="List"

The uploaded file under RAM: disappears after a reboot, so Add must be issued before restarting the module. Once added to the MBN list, the profile is stored persistently.

For the first test, disable automatic selection and choose the newly added profile manually:

AT+QMBNCFG="AutoSel",0
AT+QMBNCFG="Select","3HK_HongKong"
AT+QCFG="ims",1
AT+CFUN=1,1

Immediately after Select, the list will usually show 1,0. It should change to 1,1 only after the module reboots and the baseband comes back online. Once the candidate activates reliably, and its ICCID/PLMN rules are correct, automatic selection can be enabled again:

AT+QMBNCFG="AutoSel",1
AT+CFUN=1,1

For the 3HK profile, I did not issue Select manually. I simply left AutoSel=1 enabled and rebooted. The module automatically marked 3HK_HongKong as selected and activated, confirming that its automatic matching rules worked.

Verify That VoLTE Has Actually Registered

First, confirm that the profile is active:

AT+QMBNCFG="List"
+QMBNCFG: "List",20,1,1,"3HK_HongKong",0x0501360D,...

Next, check whether the MBN actually created the carrier APN and inspect the IMS bearer:

AT+CGDCONT?
AT+CGACT?
AT+CGPADDR

With the 3HK profile, the module established an ims.lte.three.com.hk bearer and obtained an IP address. This proves that the MBN executed as far as the IMS bearer layer, but it does not prove that IMS registration succeeded.

Finally, check:

AT+QCFG="ims"

The result means:

+QCFG: "ims",1,1    IMS is enabled and registered
+QCFG: "ims",1,0    IMS is enabled but not registered

Only a second value of 1 means that IMS has actually registered. Ideally, place a test call as well and confirm that the module remains on LTE during the call with working audio in both directions.

In this test, the Redmi 5A 3HK MBN automatically activated on a QDC507/EG25-like module and established an IMS bearer. The SIM was roaming outside Hong Kong at the time, however, and the account may not have had an active voice package, so IMS remained at 1,0. This confirms that the MBN is compatible with the module, but it does not confirm that 3HK VoLTE was provisioned on the account.

The China Unicom CU_VoLTE profile was likewise selected and activated on the EC20 R06 and wrote its APNs, but it did not establish IMS registration when used across the MPSS.JO.3.0 and JO.1.2 branches.

Delete an MBN When It Is No Longer Needed

First switch back to the known-working ROW profile and reboot:

AT+QMBNCFG="AutoSel",0
AT+QMBNCFG="Select","ROW_Generic_3GPP"
AT+CFUN=1,1

After the module comes back, confirm that ROW shows 1,1, then delete the candidate:

AT+QMBNCFG="Delete","3HK_HongKong"
AT+QMBNCFG="List"

Finally, restore AutoSel and IMS to the values recorded before the test instead of blindly copying a fixed setting:

AT+QMBNCFG="AutoSel",<original value>
AT+QCFG="ims",<original value>

Also note that if two MBNs use the same carrier ID, adding a newer version may replace the old profile. Deleting the candidate does not necessarily bring the original one back automatically. It is therefore a good idea to keep a copy of the original MBN from the stock firmware before testing, so it can be added again if necessary.

Summary

VoLTE support on the EC20/EG25 is not determined solely by the AT+QCFG="ims" switch. An MBN contains many carrier-specific parameters as well. When looking for a candidate, compare the modem target, MPSS branch, and MCFG format before considering the carrier name. Firmware for older Qualcomm-based Xiaomi phones is relatively easy to obtain, which is why I used it here as an example. The same method can be used to extract a profile for another carrier, preferably from a phone based on MSM8937 or another SoC with a Qualcomm X6-class modem. The format 3 profile library in the Android 7.1 firmware for the Redmi 5A is a particularly useful source of candidates for the EC20/EG25.

An MBN addresses only the device configuration side of the problem. Successful IMS registration still depends on baseband compatibility, VoLTE provisioning on the SIM account, the home or roaming network, carrier authentication, and network-side policy. The final success criteria remain the same: AT+QCFG="ims" must return 1,1, followed by a successful real-world VoLTE call.

References

• Quectel BG96 MBN Application Note
• Quectel EC2x/EG9x/EG2x-G/EM05 AT Commands Manual
• mbn-mcfg-tools
• Xiaomi Firmware Updater
• Enabling China Telecom, China Unicom, and China Mobile LTE on a Pixel 1 Without a Factory Reset