I used to work in a phone unlocking store in the UK, so my knowledge doesn't cover anything in the past 5 years or so, and it may be a little UK/euro-centric but I'll attempt to answer.
There are two major types of "unlocking". One is called a "carrier unlock", which allows the phone to be used on any carrier. A carrier lock is commonly used on contract phones, in order to ensure that you continue to use the device with that carrier if your contract ends. The other type is called "unbarring", which changes the IMEI of the phone so that it no longer matches one on the barred list. In the UK this is illegal, because barred phones are ones which have been reported stolen.
The IMEI is not a hash. It is a (usually) unique identifier for mobile devices which are GSM capable. When a phone is placed on the barred list, the carriers all get a copy of this list, and their towers will simply send back a "barred" rejection if a barred IMEI tries to register on the system. The hardware's support for programming the IMEI is variable, though many baseband implementations nowadays have a write lock which can't be undone once set (at least without serious trickery). The usual way in which people get around barred IMEIs is to take a non-barred donor board from another device with severe physical damage (e.g. smashed screen and case) but with an otherwise functioning mainboard. This is a legal grey area, because it can be construed as transplanting working peripheral parts from a barred phone onto an unbarred phone which was damaged. Some older phones can have their IMEI changed via programming, but that is flat out illegal. There may be ways to do this on modern devices, but I've never seen it in action.
If you're just talking about a carrier unlock, the answer is (sometimes; see comments) as simple as a firmware flash. With some phones you can do this simply by putting it into a debug mode (e.g. ADB mode on Android, DFU mode on iOS) and using freely available software to flash a stock carrier unlocked firmware onto the device. It's a five minute job. On other devices, particularly pre-smartphone where you're not running Android, iOS, but rather a custom OS for that particular phone or manufacturer, there's no USB flash support. In these cases people had to get hold of leaked schematic diagrams and build devices which could hook up to test points on the board and flash the firmware. When I worked in phone repair we had at least four different cables and devices for this purpose, each of which had a range of devices it could work on. They also used special software and the process could be quite involved, usually requiring at least two or three stages of flashing, but sometimes more; an extreme example is one of the LG phones which required you to flash a very old base firmware, then upgrade through each of the ten or so updates one by one.
The more legitimate way of performing a carrier unlock is via an NCK code. The NCK code algorithm is entirely proprietary, and where it is implemented varies entirely on the device and the carrier. Usually the NCK validation algorithm is implemented in the phone's firmware, but this doesn't necessarily mean that knowing the validation algorithm does you any good. From what I've read, modern iOS devices implement NCK using something analogous to public key cryptography, with the carrier unlock data sent via SMS.
In the olden days (we're talking Nokia 3210 era) the NCK algorithm was known and anyone could unlock them, and in some cases there were even key sequences (like
*#06#) which could be used to do a carrier unlock. In fact, going back to the mid 90s, there were even codes which stopped the "SIM clock" (not sure if that's the legit term) to make your calls entirely free, aside from the connection charge. This was, of course, fraud, but this didn't stop a lot of people from doing it.