Skip to content

Mastering Hayens Commands

Navigate the depths of Android's communication protocols with this extensive exploration of AT (Attention) commands, a standardized language used to communicate with modems. This guide not only introduces basic commands for querying device information and managing security settings but also delves into advanced operations like firmware management and net work configuration.

Through detailed examples, uncover the power of AT commands in executing tasks ranging from simple queries like Android version and battery status to complex adjustments such as lockscreen removal and Factory Reset Protection (FRP) bypass.

Ideal for developers, security researchers, and enthusiasts, this compilation serves as a crucial tool for harnessing the full potential of Android's underlying communication capabilities.

Dump Serial Number

AT+SERIALNO

Android Version

AT+VERSNAME

List all available AT commands

AT+CLAC

Query basic info about device

AST_POWERON
AST_POWERON
NAATD_SOCKET_IDBOOTING COMPLETED
RESET COMPLETED

Remove Lockscreen

AT+SWATD=0
AT+ACTIVATE=0,0,0
AT+SWATD=1
AT+PARALLEL=2,0,00000;
AT+DEBUGLVC=0,5
AT+PARALLEL=2,0,00000;
AT+SERIALNO=2
AT+FACTORST=0,0

Remove FRP

AT+KSTRINGB=0.3
AT+DUMPCTRL=1.0
AT+DEBUGLVC=0.5
AT+SWATD=0
AT+ACTIVATE=0,0,0
AT+SWATD=1
AT+DEBUGLVC=0.5

Firmware download mode

AT+SUDDLMOD=0,0

Phone model serial number, imei and etc

AT+DEVCONINFO

AT+SWVER

AT+GMM

AT+IMEINUM

Serial number

AT+SERIALNO

Battery information

AT+BATGETLEVEL?

Android version

AT+VERSNAME

Boot into download mode

AT+FUS?

Short info

AT+SVCIFPGM=1,1

Sends keypad keys ([0-9*#])

AT+CKPD

Reboot device

AT+CFUN=1,1

Phone reboot G3/G4/S8+

AT+CFUN=6

Phone reboot S8+

AT+CFUN=6,0

Factory reset

AT+FACTORST=0,0

Firmware download mode

AT+SUDDLMOD=0,0

Firmware download mode

AT+FUS?

Dial Number

ATD

Hangup call

ATH

Phone model, serialnumber, IMEI, and etc

AT+DEVCONINFO

Phone Model

AT+GMR

Query IMEI 1 number

AT+IMEINUM

Query Serial number

AT+SERIALNO

Filesystem partition information

AT+SIZECHECK

Android Version

AT+VERSNAME

List all available AT commands

AT+CLAC

Security Issue

Query basic info about device

AST_POWERON
AST_POWERON
NAATD_SOCKET_IDBOOTING COMPLETED
RESET COMPLETED

Remove Lockscreen

AT+SWATD=0
AT+ACTIVATE=0,0,0
AT+SWATD=1
AT+PARALLEL=2,0,00000;AT+DEBUGLVC=0,5
AT+PARALLEL=2,0,00000;AT+SERIALNO=2,
AT+FACTORST=0,0

Remove FRP

AT+KSTRINGB=0.3
AT+DUMPCTRL=1.0
AT+DEBUGLVC=0.5
AT+SWATD=0
AT+ACTIVATE=0,0,0
AT+SWATD=1
AT+DEBUGLVC=0.5

Firmware download mode

AT+SUDDLMOD=0,0

Phone model serial number, imei and etc

AT+DEVCONINFO

AT+SWVER

AT+GMM

AT+IMEINUM

Serial number

AT+SERIALNO

Battery information

AT+BATGETLEVEL?

Android version

AT+VERSNAME

Boot into download mode

AT+FUS?

Short info

AT+SVCIFPGM=1,1

Misc

Command Version Description
AT+CAAP 7.25 Automatic answer for eMLPP Service
AT+CACM 8.25 Accumulated call meter
AT+CAEMLPP 7.22 eMLPP Priority Registration and Interrogation
AT+CAHLD 11.1.3 Leave an ongoing Voice Group or Voice Broadcast Call
AT+CAJOIN 11.1.1 Accept an incoming Voice Group or Voice Broadcast Call
AT+CALA 8.16 Alarm
AT+CALCC 11.1.6 List current Voice Group and Voice Broadcast Calls
AT+CALD 8.38 Delete alarm
AT+CALM 8.20 Alert sound mode
AT+CAMM 8.26 Accumulated call meter maximum
AT+CANCHEV 11.1.8 NCH Support Indication
AT+CAOC 7.16 Advice of Charge
AT+CAPD 8.39 Postpone or dismiss an alarm
AT+CAPTT 11.1.4 Talker Access for Voice Group Call
AT+CAREJ 11.1.2 Reject an incoming Voice Group or Voice Broadcast Call
AT+CAULEV 11.1.5 Voice Group Call Uplink Status Presentation
AT+CBC 8.4 Battery charge
AT+CBCAP 8.59 Battery Capacity
AT+CBCHG 8.61 Battery Charger Status
AT+CBCON 8.60 Battery Connection Status
AT+CBCS 11.3.2 VBS subscriptions and GId status
AT+CBKLT 8.51 Backlight
AT+CBST 6.7 Select bearer service type
AT+CCFC 7.11 Call forwarding number and conditions
AT+CCHC 8.46 Close Logical Channel
AT+CCHO 8.45 Open Logical Channel
AT+CCLK 8.15 Clock
AT+CCUG 7.10 Closed user group
AT+CCWA 7.12 Call waiting
AT+CCWE 8.28 Call Meter maximum event
AT+CDIP 7.9 Called line identification presentation
AT+CDIS 8.8 Display control
AT+CEAP 8.47 EAP authentication
AT+CEER 6.10 Extended error report
AT+CEMODE 10.1.28 UE modes of operation for EPS
AT+CEPTT 11.1.10 Short Data Transmission during ongoing VGCS
AT+CEREG 10.1.22 EPS network registration status
AT+CERP 8.48 EAP Retrieve Parameters
AT+CFCS 7.24 Fast call setup conditions
AT+CFUN 8.2 Set phone functionality
AT+CGACT 10.1.10 PDP context activate or deactivate
AT+CGATT 10.1.9 PS attach or detach
AT+CGCLASS 10.1.17 GPRS mobile station class
AT+CGCLOSP 10.1.13 Configure local Octet Stream PAD parameters
AT+CGCMOD 10.1.11 PDP Context Modify
AT+CGCONTRDP 10.1.23 PDP Context Read Dynamic Parameters
AT+CGCS 11.3.1 VGCS subscriptions and GId status
AT+CGDATA 10.1.12 Enter data state
AT+CGDCONT 10.1.1 Define PDP Context
AT+CGDSCONT 10.1.2 Define Secondary PDP Context
AT+CGEQOS 10.1.26 Define EPS Quality Of Service
AT+CGEQOSRDP 10.1.27 EPS Quality Of Service Read Dynamic Parameters
AT+CGEREP 10.1.19 Packet Domain event reporting
AT+CGLA 8.43 Generic UICC Logical Channel access
AT+CGMI 5.1 Request manufacturer identification
AT+CGMM 5.2 Request model identification
AT+CGMR 5.3 Request revision identification
AT+CGREG 10.1.20 GPRS network registration status
AT+CGSMS 10.1.21 Select service for MO SMS messages
AT+CGSN 5.4 Request product serial number identification
AT+CGTFT 10.1.3 Traffic Flow Template
AT+CGTFTRDP 10.1.25 Traffic Flow Template Read Dynamic Parameters
AT+CHLD 7.13 Call related supplementary services
AT+CHSC 6.15 HSCSD current call parameters
AT+CHSD 6.12 HSCSD device parameters
AT+CHSR 6.16 HSCSD parameters report
AT+CHST 6.13 HSCSD transparent call configuration
AT+CHSU 6.17 HSCSD automatic user initiated upgrading
AT+CHUP 6.5 Hangup call
AT+CIMI 5.6 Request international mobile subscriber identity
AT+CIND 8.9 Indicator control
AT+CKPD 8.7 Keypad control
AT+CLAC 8.37 List all available AT commands
AT+CLAE 8.31 Language Event
AT+CLAN 8.30 Set Language
AT+CLCC 7.18 List current calls
AT+CLCK 7.4 Facility lock
AT+CLIP 7.6 Calling line identification presentation
AT+CLIR 7.7 Calling line identification restriction
AT+CLVL 8.23 Loudspeaker volume level
AT+CMAR 8.36 Master Reset
AT+CMEC 8.6 Mobile Termination control mode
AT+CMEE 9.1 Report mobile termination error
AT+CMER 8.10 Mobile Termination event reporting
AT+CMOD 6.4 Call mode
AT+CMOLR 8.50 Mobile Originated Location Request
AT+CMOLRE 9.1 Report mobile originated location request error
AT+CMOLRE 9.3 Mobile termination error result code
AT+CMTLR 8.57 Mobile Terminated Location Request notification
AT+CMUT 8.24 Mute control
AT+CMUX 5.7 Multiplexing mode
AT+CNAP 7.30 Calling name identification presentation
AT+CNUM 7.1 Subscriber number
AT+COLP 7.8 Connected line identification presentation
AT+COLR 7.31 Connected line identification restriction status
AT+COPN 7.21 Read operator names
AT+COPS 7.3 PLMN selection
AT+COTDI 11.1.9 Originator to Dispatcher Information
AT+CPAS 8.1 Phone activity status
AT+CPBF 8.13 Find phonebook entries
AT+CPBR 8.12 Read phonebook entries
AT+CPBS 8.11 Select phonebook memory storage
AT+CPBW 8.14 Write phonebook entry
AT+CPIN 8.3 Enter PIN
AT+CPLS 7.20 Selection of preferred PLMN list
AT+CPNET 7.27 Preferred network indication
AT+CPNSTAT 7.28 Preferred network status
AT+CPOL 7.19 Preferred PLMN list
AT+CPOS 8.55 Positioning Control
AT+CPOSR 8.56 Positioning Reporting
AT+CPPS 7.23 eMLPP subscriptions
AT+CPROT 8.42 Enter protocol mode
AT+CPSB 7.29 Current Packet Switched Bearer
AT+CPUC 8.27 Price per unit and currency table
AT+CPWC 8.29 Power class
AT+CPWD 7.5 Change password
AT+CR 6.9 Service reporting control
AT+CRC 6.11 Cellular result codes
AT+CREG 7.2 Network registration
AT+CRLA 8.44 Restricted UICC Logical Channel access
AT+CRLP 6.8 Radio link protocol
AT+CRMC 8.34 Ring Melody Control
AT+CRMP 8.35 Ring Melody Playback
AT+CRSL 8.21 Ringer sound level
AT+CRSM 8.18 Restricted SIM access
AT+CSCC 8.19 Secure control command
AT+CSCS 5.5 Select TE character set
AT+CSDF 6.22 Settings date format
AT+CSGT 8.32 Set Greeting Text
AT+CSIL 6.23 Silence Command
AT+CSIM 8.17 Generic SIM access
AT+CSNS 6.19 Single numbering scheme
AT+CSQ 8.5 Signal quality
AT+CSSAC 7.32 Service Specific Access Control restriction status
AT+CSSN 7.17 Supplementary service notifications
AT+CSTA 6.1 Select type of address
AT+CSTF 6.24 Settings time format
AT+CSVM 8.33 Set Voice Mail Number
AT+CTFR 7.14 Call deflection
AT+CTZR 8.41 Time Zone Reporting
AT+CTZU 8.40 Automatic Time Zone Update
AT+CUAD 8.49 UICC Application Discovery
AT+CUSD 7.15 Unstructured supplementary service data
AT+CVHU 6.20 Voice Hangup Control
AT+CVIB 8.22 Vibrator mode
AT+CVMOD 6.4 Voice Call Mode
AT+FCLASS C.2.1 Select mode
AT+VBT C.2.2 Buffer threshold setting
AT+VCID C.2.3 Calling number ID presentation
AT+VGR C.2.4 Receive gain selection
AT+VGT C.2.5 Transmit gain selection
AT+VIP C.2.6 Initialise voice parameters
AT+VIT C.2.7 Inactivity timer
AT+VLS C.2.8 Line selection
AT+VRX C.2.9 Receive data state
AT+VSM C.2.10 Select compression method
AT+VTD C.2.12 Tone duration
AT+VTS C.2.11 DTMF and tone generation
AT+VTX C.2.13 Transmit data state 
!!! Example "`/bin/at_distributor`"

    ```bash
    1|p3s:/ # find /bin/ -type f -print0 | xargs -0 strings | grep -E 'AT[\+\*][A-Z]{2,10}([^A-Z]|$)'                                                                                           
    AT+SWVER
    AT+IMEINUM
    AT+INITTEST=
    AT+REACTIVE=
    AT+FRPUNLCK=
    AT+DEVROOTK=
    AT+ENGMODES=
    AT+SOCFIOTK=
    AT+FUS?
    AT+GMM
    AT+GSN
    AT+DEVCONINFO
    AT+PROF=
    AT+DEVAUTH
    AT+CERTKEY
    AT+SECUKEY
    AT+AUTHKEY=
    AT+SUDDLMOD=
    AT+DISSTRNO=
    AT+SIZECHECK=
    AT+SVCIFPGM=
    AT+FACTORST=0,0
    AT+SYNCML=MOBEXSTART
    AT+CFUN=1,1
    AT*GET*ESN
    AT+SYSSCOPE=1,0
    AT+CSS
    AT+CPIITEST
    AT+CBLTH
    AT+CCALD
    AT+CCLGS
    AT+CDUR
    AT+CDVOL
    AT+CSHM
    AT+CEMAIL
    AT+CBCAST
    AT+CWAP
    AT+CDCONT
    AT+CSYNC
    AT+CALRM
    AT+CTMRV
    AT+CVRCD
    AT+CIMI
    AT+CNUM
    AT+CGSN
    AT+CTASK
    AT+CTACT
    AT+CSMCT
    AT+CNPAD
    AT+CMSG
    AT+CTBCPS
    AT+WPROTECT
    AT+CVCMD
    AT+WIFIVALUE
    AT+GPSVALUE
    AT+BTVALUE
    AT+NFCVALUE
    AT+USBDEBUG
    AT+USBMODEM
    AT+IMSVAL
    AT+AMBSSYNC
    AT+PRECONFG=
    AT+CAMETEST=
    AT+CAMEAUTO=
    AT+SYSDUMP=
    AT+DUMPCTRL
    AT+ACTIVATE
    AT+DEBUGLVC=
    AT+SETTESTNV=
    AT+GETTESTNV=
    AT+FAILDUMP=
    AT+FUNCTEST=
    AT+MULFUNCF=
    AT+MULFUNCS=
    AT+FAILHIST=
    AT+VERSNAME=3,2
    AT+DISPTEST=
    AT+LEDLAMPT=
    AT+POWRESET=
    AT+FUELGAIC=
    AT+ICCCINFO=1,0,0
    AT+SERIALNO
    AT+HEADINFO=
    AT+CBC
    AT+FSBUILDC
    AT+NADCHECK
    AT+RGBPDISP
    AT+SETENGLISH=
    AT+FENRIRCN=
    AT+SCAMPARA=
    AT+UBCTTEST=
    AT+NCAMTEST=
    AT+ABSTACHK=
    AT+SWATD
    AT+SWATD=0
    AT+SWATD=2
    AT+SWATD=1
    AT+INITTEST
    AT+SUDDLMOD=
    Invalid number for AT+INITTEST
    AT+SYSSCOPE=1,0
    AT+CSS
    AT+CPIITEST
    AT+CBLTH
    AT+CCALD
    AT+CCLGS
    AT+CDUR
    AT+CDVOL
    AT+CSHM
    AT+CEMAIL
    AT+CBCAST
    AT+CWAP
    AT+CDCONT
    AT+CSYNC
    AT+CALRM
    AT+CTMRV
    AT+CVRCD
    AT+CTASK
    AT+CTACT
    AT+CSMCT
    AT+CNPAD
    AT+CMSG
    AT+CTBCPS
    AT+CVCMD
    AT+WIFIVALUE
    AT+GPSVALUE
    AT+BTVALUE
    AT+NFCVALUE
    AT+CFUN=1,1
    AT+FACTORST=0,0
    AT+USBMODEM
    AT+IMSVAL
    AT+AMBSSYNC
    AT+DUMPCTRL
    AT+ACTIVATE
    AT+USBDEBUG
    AT+ICCCINFO=1,0,0
    AT+DISSTRNO=
    AT+CIMI
    AT+SUDDLMOD=
    AT+GMM
    AT+CGMM
    AT+GSN
    AT+SWVER
    AT+IMEINUM
    AT+SERIALNO
    AT+SVCIFPGM=
    AT+WPROTECT
    AT+FUS?
    AT+DEVCONINFO
    AT+CBC
    AT+FSBUILDC=
    AT+SIZECHECK=
    AT+INITTEST=
    AT+PRECONFG=
    AT+VERSNAME=3,2,2
    AT+VERSNAME=3,2,3
    AT+SETENGLISH=
    AT+FENRIRCN=
    AT+FAILDUMP
    AT+SWATD
    AT+SWATD=0
    AT+FAILHIST
    AT+NCAMTEST
    AT+FUNCTEST
    AT+FUELGAIC
    AT+CAMETEST
    AT+MODECHAN=0,6
    AT+MODECHAN=0,2
    AT+MULFUNCF
    AT+DISPTEST
    AT+SWATD=2
    AT+MULFUNCS
    AT+LIGHTEST
    AT+CAMEAUTO
    AT+SCAMPARA
    AT+SWATD=1
    AT+LEDLAMPT
    AT+SETTESTNV
    AT+HEADINFO
    AT+RGBPDISP
    AT+GETTESTNV
    AT+POWRESET
    AT+SCAPTURE
    AT+UBCTTEST
    AT+NADCHECK
    AT+MSLSECUR
    AT+AKSEEDNO
    AT+LVOFLOCK
    AT+DETALOCK
    AT+TFSTATUS
    AT+IMEITEST
    AT+LOCKREAD
    AT+MITSRFTS
    AT+LOCKINFO
    AT+FACTORST
    AT+FAILDUMP
    AT+SIMLOCKU
    AT+BLOBSIGN
    AT+CPLDUCFG
    AT+CHIPIDTT
    AT+NETMODEC
    AT+SYSSLEEP
    AT+MAXPOWER
    AT+SIMDETEC
    AT+CALIDATE
    AT+BANSELCT
    AT+PRODCODE
    AT+SCMMONIT
    AT+READRSSI
    AT+SECNRSSI
    AT+TESTMODE
    AT+GPSSTEST
    AT+LIFETIME
    AT+TEMPTEST
    AT+VERSNAME
    AT+GRIPSENS
    AT+KSTRINGB
    AT+RECONDIT
    AT+IMEICERT
    AT+IMEISIGN
    AT+MIPITEST
    AT+FEEDBACK
    AT+MIPIREAD
    AT+RFBKOFFC
    AT+RFNVCHKS
    AT+RFBYCODE
    AT+BAUDRATE
    AT+LDUSTCHK
    AT+RFEVTAIT
    AT+RFMIPITT
    AT+RTSARCHK
    AT+SSUCONFG
    AT+LMODETEST
    AT+LSYNC
    AT+LTXSENDREQ
    AT+LFBRPROC
    AT+HSPATMEND
    AT+HDLSYNC
    AT+HDELULCHAN
    AT+NRPATHCF
    AT+AOTKEYWR
    AT+CHNSELCT
    AT+BAKUPCHK
    AT+MEIDAUTH
    AT+NAMCHECK
    AT+PRLVERIF
    AT+ERITTEST
    AT+OBDMTEST
    AT+XGENDATA
    AT+CFUN
    AT+CHCMDINT
    AT+XRXDIV
    AT+CALLCONN
    AT+SVCBANDB
    AT+COPS
    AT+XL1SET
    AT+XLOG
    AT+TRACE
    AT+XSYSTRACE
    AT+MODECHAN
    AT+FACTOLOG
    AT+EFSSYNCC
    AT+SARCOMPK
    AT+ASDIVTES
    AT+ACLTESTT
    AT+HOPATHCK
    AT+HNSSTOP
    AT+LTEPOWER
    AT+NRPOWERT
    AT+NRFEEDBK
    AT+NMIPIREAD
    AT+HMSRRXRSSI
    AT+HWINDICK
    AT+APCHIPTT
    AT+PROVCASS
    AT+CPMGCASS
    AT+LOCKFLAG
    AT+SIMSWITC
    AT+CPSTACHK
    AT*MTEST
    AT*MDSPTST
    AT*MCAPITST
    AT*MSTACKTST
    AT*MSPML
    AT*MNVGET
    AT*MNVSET
    AT*MEMDUMP
    AT*MRESET
    AT*MQPV
    AT*MVERS
    AT*MPROF
    AT*MPROC
    AT*MAUDTUNE
    AT*MAUDLEVEL
    AT*MAUDTST
    AT*MAUDLOG
    AT*MAUDMODE
    AT*MAUDVOL
    AT*MSLEEP
    AT*MCATE
    AT*APN
    AT*IPIFSTATUS
    AT*MTESTMMTCM
    AT*STAT
    AT*MSTACKTST4G
    AT*TDTEST
    AT*MSMS
    AT*MECSIM
    AT*MCUSA
    AT*MBTSAP
    AT*MSIMIF
    AT*MQCFI
    AT*MUPAS
    AT*MHDK
    AT*MSTTY
    AT*MVMIND
    AT*MVMSC
    AT*MVTS
    AT*MPGS
    AT*MDTMF
    AT*MKEYTONE
    AT*MSNU
    AT*MQSPN
    AT*MBSEL
    AT*MCAM
    AT*MQSSIG
    AT*MMGSR
    AT*MMGQ
    AT*MSTPTN
    AT*MTRES
    AT*MEDL
    AT*MTMENU
    AT*MSIMTST
    AT*MPLMN
    AT*MQSC
    AT*MQPIN
    AT*MDNPN
    AT*MSALS
    AT*MICID
    AT*MCNFG
    AT*MIMSCFG
    AT*MDBCF
    AT*MTZ
    AT*MCSQ
    AT*MTREPORT
    AT*MSETSIM
    AT*MSTKIF
    AT*PCO
    AT*MCAL
    AT*MLPM
    AT+HEADINFO
    AT+RTCCTEST
    AT+SETTESTNV
    AT+GETTESTNV
    AT+LOGERASE
    AT+SETFDATA
    AT+GETFDATA
    AT+MODECHAN
    AT+FACTOLOG
    AT+FACTORST
    AT+LIFETIME
    AT+MITSRFTS
    AT+BAKUPCHK
    AT+SYSSLEEP
    AT+PRODCODE
    AT+PRECONFG
    AT+IMEITEST
    AT+SKUCODEC
    AT+CPRMTEST
    AT+DTCPTEST
    AT+SECUREOS
    AT+CBLKFTDF
    AT+SERIALNO
    AT+SIMDETEC
    AT+BAUDRATE
    AT+SCODCHAN
    AT+HWPARAMD
    AT+ACTIVEID
    AT+ALERTDIS
    AT+SDISPCBR
    AT+MTKEDLBK
    AT+VIBRTEST
    AT+CPDUMPEN
    AT+NETMODEC
    ``` 

### Tested

```bash
AT+ICCCINFO=1,0,0
+ICCCINFO:1,1,1,1,0
OK

AT+MEIDAUTH
+MEIDAUTH:255,NG

AT+USBDEBUG=1
OK
+USBDEBUG:1,NG_NONE

AT+PRODCODE

12-15 17:53:37.719  1382  1382 D IcccManagerService: command: AT+ICCCINFO=1,0,0
12-15 17:53:37.721 17876 17876 W SVCAgent: FenrirDecoder | isFenrirCommand - Received FENRIR AT Command - AT+ICCCINFO=1,0,0 is invalid!

AT+DUMPCTRL
+USB  READY


AT+CALLCONN


AT+WPROTECT
+WPROTECT=1,NONE

Set Baudrate

AT+BAUDRATE=115200

AT+AOTKEYWR
+AOTKEYWR:NA

AT+PROVCASS
+PROVCASS:255,NA

AT+NAMCHECK
OK

AT+CSS
: 1080,2190

Good References