How to get available network operators? (using RIL and non-API methods)

Disclaimer - I know how calling non-API methods can affect my application. It's not going to be published on Google Play, I'm creating it just for personal use.

Task - get available network operators on rooted phone (Android 2.3.3). Model is known.

What have I tried

A lot of reflection:

Tried to get PhoneFactory, get default Phone (getDefaultPhone) or GSMPhone. I've received an actual reference to PhoneProxy and was able to call getAvailableNetworks which returned an CommandException - RADIO_NOT_AVAILABLE
Tried to instantinate RIL directly. Tried to call getAvailableNetworks here with the same result (RADIO_NOT_AVAILABLE). Tried to call registerForAvaiable which never sends message back to Handler.
Tried to connect LocalSocket to "rild". Getting IOException: Permission denied

I've tried everything above with my app stored at /system/app/ - results are same.

Question

Is it even possible to access RIL methods without signing my app with system key or using custom Android build?
Maybe I can overcome this issues by building app directly for Linux?
Any advice on this problem is highly appreciated.

Solution

You can build you own RIL implementatiion. You can tell Android to load your library by setting the android propety rild.lib. On a rooted phone you can do

getprop | grep ril

to see your current used rild library.

There are opensource ril implementations for sierra gsm dongles / huawei dongles etc. You will get an idea.

But not everything is easily possible. With this mechanism you can only implement the call backs that android is making to you. E.g. it does not allow you to make a data roaming connection. That is still controlled by the android framework.

To change your current rild library to your own you can set

setprop rild.lib \system\modules\yourlibrary.so