This question already has an answer here:

What is the procedure unlockers follow to get providers unlocking code using IMEI.

I know providers themselves offer to unlock phones which may make sense but how on earth people on sites like eBay offer service to provide unlock codes using IMEI.

Is IMEI like a hash that they crack ?

marked as duplicate by André Borie, Xander, Rory Alsop Aug 16 '16 at 18:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • There's no one standard way to do this. It could be an HMAC of the IMEI or a look up in a one-to-one database or whatever strange algorithm that the manufacturer come up with. – billc.cn Aug 16 '16 at 16:00

I used to work in a phone unlocking store in the UK, so my knowledge doesn't cover anything in the past 5 years or so, and it may be a little UK/euro-centric but I'll attempt to answer.

There are two major types of "unlocking". One is called a "carrier unlock", which allows the phone to be used on any carrier. A carrier lock is commonly used on contract phones, in order to ensure that you continue to use the device with that carrier if your contract ends. The other type is called "unbarring", which changes the IMEI of the phone so that it no longer matches one on the barred list. In the UK this is illegal, because barred phones are ones which have been reported stolen.

The IMEI is not a hash. It is a (usually) unique identifier for mobile devices which are GSM capable. When a phone is placed on the barred list, the carriers all get a copy of this list, and their towers will simply send back a "barred" rejection if a barred IMEI tries to register on the system. The hardware's support for programming the IMEI is variable, though many baseband implementations nowadays have a write lock which can't be undone once set (at least without serious trickery). The usual way in which people get around barred IMEIs is to take a non-barred donor board from another device with severe physical damage (e.g. smashed screen and case) but with an otherwise functioning mainboard. This is a legal grey area, because it can be construed as transplanting working peripheral parts from a barred phone onto an unbarred phone which was damaged. Some older phones can have their IMEI changed via programming, but that is flat out illegal. There may be ways to do this on modern devices, but I've never seen it in action.

If you're just talking about a carrier unlock, the answer is (sometimes; see comments) as simple as a firmware flash. With some phones you can do this simply by putting it into a debug mode (e.g. ADB mode on Android, DFU mode on iOS) and using freely available software to flash a stock carrier unlocked firmware onto the device. It's a five minute job. On other devices, particularly pre-smartphone where you're not running Android, iOS, but rather a custom OS for that particular phone or manufacturer, there's no USB flash support. In these cases people had to get hold of leaked schematic diagrams and build devices which could hook up to test points on the board and flash the firmware. When I worked in phone repair we had at least four different cables and devices for this purpose, each of which had a range of devices it could work on. They also used special software and the process could be quite involved, usually requiring at least two or three stages of flashing, but sometimes more; an extreme example is one of the LG phones which required you to flash a very old base firmware, then upgrade through each of the ten or so updates one by one.

The more legitimate way of performing a carrier unlock is via an NCK code. The NCK code algorithm is entirely proprietary, and where it is implemented varies entirely on the device and the carrier. Usually the NCK validation algorithm is implemented in the phone's firmware, but this doesn't necessarily mean that knowing the validation algorithm does you any good. From what I've read, modern iOS devices implement NCK using something analogous to public key cryptography, with the carrier unlock data sent via SMS.

In the olden days (we're talking Nokia 3210 era) the NCK algorithm was known and anyone could unlock them, and in some cases there were even key sequences (like *#06#) which could be used to do a carrier unlock. In fact, going back to the mid 90s, there were even codes which stopped the "SIM clock" (not sure if that's the legit term) to make your calls entirely free, aside from the connection charge. This was, of course, fraud, but this didn't stop a lot of people from doing it.

  • Are you sure smartphone unlocking is as easy as installing new firmware? I think locking is enforced by the modem which has its own firmware & storage, and even if you update its firmware the lock status is just a flag set in memory which can't be toggled without an NCK code (or an exploit - that's how most unofficial unlocks work). – André Borie Aug 16 '16 at 15:26
  • @AndréBorie - Yeah, it's easy. I've rooted a lot of android firmwares, some of which requires you to flash before putting certain files on the internal drives and kernel. – iZodiac Aug 16 '16 at 15:27
  • @iZodiac That's not quite the point. The baseband has its own separate firmware which handles the NCK unlock stuff. – Polynomial Aug 16 '16 at 15:28
  • Also, modern iOS no longer uses NCK codes - the locking is enforced by the OS and it knows which networks it's locked on when it first talks to Apple during the "activation" procedure (where it gets credentials for notifications, FaceTime, etc). The configuration file is transmitted over TLS and is itself signed, so it's pretty hard to forge an "unlock" file. – André Borie Aug 16 '16 at 15:29
  • @Polynomial - I see. But the concept stays the same? – iZodiac Aug 16 '16 at 15:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.