For many older ZTE modems (MF112, MF180, MF627), NCK =
f(IMEI, seed) where seed is found in firmware at offset 0x1FBC0.
A Python pseudocode:
def generate_nck(imei):
# stripped-down ZTE algorithm
imei_digits = [int(x) for x in imei if x.isdigit()]
s = sum(imei_digits[-8:]) * 13 + 0x5F
nck = str(s % 100000000)
return nck.zfill(8)
Note: Modern ZTE devices use stronger crypto. zte modem unlock tool
Unlocking usually involves changing specific NV (Non-Volatile) items (e.g., item 833, 946, 4382 on ZTE). For many older ZTE modems (MF112, MF180, MF627),
AT+ZSNT → Get lock status
AT+ZOPRT=? → Check operator lock
AT+ZCLCK="NCK",<code> → Enter unlock code
AT+CRSM → Access SIM/EFS
Example response for a locked modem:
AT+ZSNT
+ZSNT: 1,234,01 (1=locked, 234=UK, 01=Vodafone)