How an IMEI becomes an unlock code—or a security master code—and why the clever part is more than a few sums.
Type in a phone’s details, click a button and out comes a number. The result is simple. The route to it is rather more interesting. Here we follow the preserved UnlockMe PHP source, from the form on the page to the small blocks of data being mixed inside it.
In this article: The three calculations · Preparing the data · DCT3 · DCT4 · Security master codes · Try the byte operations · Source notes
Archive note: This article follows the original UnlockMe PHP source. Its explanation describes those preserved calculations; handset compatibility depends on the exact model and firmware.
Original source: Expand the full-algorithm panels below to inspect the PHP used by the old site. Each panel is a separate example: some helper names overlap, so the three extracts should not be combined unchanged into one PHP file. They preserve historical PHP conventions and may need adaptation before use on current PHP.
Three calculations, two very different jobs
The network unlocker and the security-code calculator both accept an IMEI, so they can look like versions of the same tool. They are solving different problems.
| Calculation | What it produces | What the calculation needs |
|---|---|---|
| DCT3 network unlock | A ten-digit number, wrapped in a command such as #pw+…+1#. | The handset identity and the relevant network or group-lock data. |
| DCT4 network unlock | A fifteen-digit number, with a numbered command suffix. | The handset identity, network data, ASIC family, code type and box-serial parameter. |
| Security master code | A ten-digit alternative security code for supported older phones. | The handset identity, plus fixed values built into the program. No network selection. |
A network code changes which compatible SIMs a supported phone will accept. A security master code is intended to be accepted in place of the handset’s personal security code. It does not reveal the five digits the owner chose. Neither calculation removes a stolen-phone blacklist.
The central idea: these routines reproduce a fixed calculation that a supported handset’s locking system can recognise. They do not ask the mobile network for an answer, and they do not try guesses on the phone.
A serial number becomes a block of bytes
An IMEI is handled as a string of digits, rather than one enormous ordinary number. That matters: the program needs the individual digits, and leading zeroes must not disappear.
The first fourteen digits identify the device; the fifteenth is a check digit. The intended IMEI validation uses the Luhn checksum: double alternate digits in the first fourteen, add the digits of those doubled results, and choose the final digit which makes the total a multiple of ten.
That check can catch many typing errors. It does not prove the IMEI belongs to a Nokia, prove ownership, identify the correct network, or establish that the phone is supported.
Packing two digits into one byte
The routines then pack pairs of digits into bytes. A byte contains eight bits; each half, called a nibble, holds one of the digits. This is the useful idea behind binary-coded decimal.
0x35 (53 as an ordinary decimal number)0x35 and the decimal number 35 are not interchangeable. Here the hexadecimal notation preserves the two digit-shaped halves. Helpers named ASCII2HEX or str2hex perform this sort of preparation.
The DCT3 and DCT4 unlock routines explicitly read fourteen IMEI characters. The security routine initially packs the supplied string at an offset, then clears the byte which would contain the fifteenth digit. For a normal fifteen-digit input, the checksum is therefore used for validation rather than as an independent secret in the result.
DCT3: mixing the phone with the lock
The entry point is calcular_dct3(imei, network_code). Despite that second argument’s name, it can receive different kinds of lock data: the network identifier for one lock, or a group identifier such as GID1 for another.
- Prepare the inputs. Pack the network or group data. Pack the first fourteen IMEI digits into a twelve-byte working array, beginning at offset two, with the leading positions set to zero.
- Transform the IMEI material. The routine XORs positions 2–11 with
0xA5. XOR compares matching bits: the output bit is 1 when they differ. - Run the shared mixer.
permu1()performs eleven full passes. Each combines the working data with the IMEI-derived material and a fixed round value, redistributes bytes through tables, rotates four-byte groups and applies another bitwise combination. - Finish the transformation. A final mixing step uses the twelfth round value. The routine then reverses the byte order and reverses the bits inside each byte.
- Create the ten output digits. Five result bytes are adjusted so their two halves can be represented as decimal digits, then written as a ten-digit code.
Look at the original orchestration
The names are Spanish: calculo means calculation and cadena means string or sequence. This excerpt shows the repeated sequence; the helper functions contain the individual bit operations.
for ($i=0; $i<11; $i++) {
$network_code_hex = calculo1($tabla[$j], $network_code_hex, $imei_hex);
$network_code_hex = calculo2($network_code_hex, 0, 8);
$network_code_hex = calculo3($network_code_hex);
$network_code_hex = calculo2($network_code_hex, 8, 0);
$j++;
}Source: Unlock_Nokia_FREE.php, within permu1(), lines 461–477 in the inspected V3 copy.
Why could one phone need two codes?
The website wrapper can call the same calculation with the network data and attach +1#. It can call it again with GID1 data and attach +2#. The wrapper’s historical UK network rules decide when to do this.
The second code is not just another guess at the first answer: it addresses another lock category using different input data. The source also contains optional paths for GID2 and subscriber-related data. Those paths demonstrate the broader design; they are not all part of the normal form workflow.
View the full original DCT3 calculation · 275 lines
Includes calcular_dct3(), permu1() and the byte-manipulation helpers. Extracted from Unlock_Nokia_FREE.php in the original V3 archive. The calculation statements, constants and helper functions are retained; only the surrounding webpage is omitted.
<?php
function string_to_arrayDCT3($cadena)
{
for ($i = 0; $i < strlen($cadena); $i++)
$nueva[$i] = ord(substr($cadena, $i, 1));
return $nueva;
}
function char_ofDCT3($cadena, $pos)
{
return ord(substr($cadena, $pos, 1));
}
//**********************************
function convertir_byte_a_hexDCT3 ($byte)
{
if (($byte > 47) && ($byte < 58)) // '0' a '9'
return ($byte-48);
else if (($byte > 64) && ($byte < 71)) // 'A' a 'F' o otro caracter
return ($byte-55);
else
return $byte;
}
function ASCII2HEXDCT3 ($origen, $caracteres, $comienzo)
{
$j=$comienzo;
for($i=0; $i<$caracteres; $i+=2)
{
$aux1 = (convertir_byte_a_hexDCT3(base_convert($origen[$i],16,10))<<4);
if ($i+1 < $caracteres)
$aux2 = convertir_byte_a_hexDCT3(base_convert($origen[$i+1],16,10));
else
$aux2 = 0;
$destino[$j] = ($aux1 | $aux2)&0xFF;
$j++;
}
return $destino;
}
// **************
function calculo4_a ($caracter)
{
$aux1=0;
$aux2=7;
$temp=0;
for ($i=0; $i<8; $i++)
{
$aux3=$caracter;
$aux3=$aux3>>$aux2;
$aux3&=1;
$aux3=($aux3<<$aux1)&0xFF;
$temp|=$aux3;
$aux1++;
$aux2--;
}
return $temp & 0xFF;
}
function calculo4 ($cadena)
{
$temp=$cadena;
for ($i=0; $i<12; $i++)
{
$cadena[11-$i]=calculo4_a($temp[$i]);
}
return $cadena;
}
function calculo3 ($cadena)
{
$temp=$cadena;
$temp2=12;
$temp1=7;
$aux1=3;
for($i=0; $i<12; $i++)
{
$aux2=$temp1;
$aux3=$aux1;
$aux2=$temp[$aux2];
$aux2^=0xFF;
$aux2|=$temp[$aux3];
$temp2--;
$temp2&=0xFF;
if ($temp1==0)
$temp1=12;
$temp1--;
$temp1&=0xFF;
if ($aux1==0)
$aux1+=12;
$aux1&=0xFF;
$aux3=$temp2;
$cadena[$aux3]=$cadena[$aux3] ^ $aux2;
$aux1--;
$aux1&=0xFF;
}
return $cadena;
}
function calculo2_a ($cadena, $byte, $byte2)
{
if ($byte==0)
return;
for ($i=0; $i<$byte; $i++)
{
$aux1=$cadena[$byte2+3];
$aux1&=1;
$puntero=$byte2;
for ($j=0; $j<4; $j++)
{
$aux2=$cadena[$puntero];
$aux3=$aux2;
$aux2=$aux2>>1;
$aux1=($aux1<<7)&0xFF;
$aux2|=$aux1;
$aux3&=1;
$cadena[$puntero]=$aux2;
$aux1=$aux3;
$puntero++;
}
}
return $cadena;
}
function calculo2 ($cadena, $byte, $byte2)
{
$cadena = calculo2_a($cadena, 10, $byte);
$cadena = calculo2_a($cadena, 31, $byte2);
return $cadena;
}
function calculo1_a ($cadena)
{
$tabla1 = array(0x01,0x09,0x04,0x08,0x0B,0x05,0x09,0x08,0x06,0x0A,
0x01,0x03,0x0B,0x06,0x0A,0x00,0x08,0x07,0x0B,0x0A,
0x01,0x05,0x00,0x08,0x03,0x01,0x09,0x00,0x02,0x0A,
0x05,0x03,0x07,0x02,0x0A,0x00,0x04,0x03,0x0B,0x02,
0x05,0x09,0x00,0x04,0x07,0x01,0x05,0x04,0x02,0x06,
0x09,0x07,0x0B,0x02,0x06,0x04,0x08,0x03,0x07,0x06);
$tabla2 = array(0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x01,0x00,0x00,
0x01,0x00,0x01,0x01,0x01,0x00,0x01,0x00,0x01,0x01,
0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x00,0x01,
0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01);
$puntero=0;
$contador1=0;
$aux1=0;
$aux2=0;
while ($contador1<12) {
$contador2=5;
$aux2^=$cadena[$puntero];
while ($contador2>0) {
if (($tabla2[$aux1] == 0) && ($contador1 <6)) {
$variable_8c[$tabla1[$aux1]]=$cadena[$puntero];
}
else {
$variable_8c[$tabla1[$aux1]]^=$cadena[$puntero];
}
$aux1++;
$contador2--;
}
$contador1++;
$puntero++;
}
for ($contador3=0; $contador3<12; $contador3++)
$variable_8c[$contador3]^=$aux2;
return $variable_8c;
}
function calculo1 ($byte, $network_code_h, $imei_h)
{
$puntero=0;
$puntero2=0;
$contador=0;
$aux1=0;
while ($contador < 12)
{
$aux2=$aux1;
$aux2=($aux2>>1) % 3;
$aux2&=1;
$aux2*=$byte;
$aux2^=$imei_h[$puntero2];
$network_code_h[$puntero]=$network_code_h[$puntero] ^ $aux2;
$aux1++;
$puntero++;
$puntero2++;
$contador++;
}
$network_code_h = calculo1_a($network_code_h);
return $network_code_h;
}
function permu1($network_code_hex, $tabla, $imei_hex)
{
$j=0;
for ($i=0; $i<11; $i++) {
$network_code_hex = calculo1($tabla[$j], $network_code_hex, $imei_hex);
$network_code_hex = calculo2($network_code_hex, 0, 8);
$network_code_hex = calculo3($network_code_hex);
$network_code_hex = calculo2($network_code_hex, 8, 0);
$j++;
}
$network_code_hex = calculo1($tabla[11], $network_code_hex, $imei_hex);
$network_code_hex = calculo4($network_code_hex);
return $network_code_hex;
}
function calcular_dct3 ($imei, $network_code)
{
$tabla = array(0xb1,0x73,0xe6,0x5a,0xab,0x47,0x8e,0x0d,0x1a,0x34,0x68,0x0b);
$network_code_h = ASCII2HEXDCT3($network_code, strlen($network_code), 0);
$imei_h = ASCII2HEXDCT3($imei, 14, 2);
$imei_h[0]=0;$imei_h[1]=0;
for ($i=2; $i<12; $i++)
$imei_h[$i]^=0xa5;
$network_code_h = permu1($network_code_h, $tabla, $imei_h);
$j=0;
for ($i=0; $i<5; $i++)
{
$aux1=$network_code_h[$i];
if (($aux1&0x80) == 0x80)
$aux1=($aux1+0xa0)&0xFF;
if (($aux1&0x08) == 0x08)
$aux1=($aux1+0xfa)&0xFF;
$convertido=base_convert($aux1, 10, 16);
if ($convertido > 9)
$destino[$j]=$convertido;
else {
$destino[$j]=0;
$j++;
$destino[$j]=$convertido;
}
$j++;
}
return $destino;
}
DCT4: two branches, a network mix and a code format
DCT4 enters through obtener_codigo()—roughly, “obtain code”. Its core works on eight-byte blocks, rather than the twelve-byte arrays used by the DCT3 mixer.
The ASIC setting chooses one pair of fixed eight-byte tables. Separate tables depend on which numbered code is requested. These settings are part of the calculation, not labels added after the answer has been found.
| Stage | What the code does | Why it matters |
|---|---|---|
| IMEI branch A | XOR the packed IMEI with one ASIC table; use that as input to permutacion(), starting from the first code-type table. | Builds one handset- and code-type-dependent block. |
| IMEI branch B | Use the other ASIC table and the second code-type table to run another transformation. | Builds a second block with different starting values. |
| Combine | XOR the two results together. | Brings the two branches into one state. |
| Network stage | XOR the ASIC table with packed network data and run permutacion() on the combined block. | Ties the result to the selected lock information. |
| Format | Select and mask result bytes, combine them with the box serial, then emit fifteen digit characters. | Turns internal data into the number used in the keypad command. |
What happens inside permutacion()?
Its name sounds like a shuffle, but it does more than change positions. Each call runs eight rounds containing XOR, addition, substitution through fixed tables, arithmetic between byte positions and rearrangement of positions. It ends with one more input-dependent mixing stage.
Another helper, calculo(), derives the values used along the way from an input byte, a rotation and a fixed table entry. Inside this implementation that supplies 136 mixing values per transformation: sixteen in each of eight rounds, plus eight at the end.
Repeated substitutions change byte values; mixing spreads information between positions. Together they make the relationship between the input and output much harder to see than a simple sum or rearrangement of IMEI digits.
Two small lines which explain much of the behaviour
$cadena2[$j] = $cadena2[$j] ^ calculo($aux1, $cadena1);
$cadena2[$j] = ($cadena2[$j] + calculo($aux1, $cadena1)) & 0xFF;These appear in alternate branches of the first mixing pass, not as two consecutive operations on every byte. The first XORs a value into a byte. The second adds a value and keeps only eight bits, so the result stays between 0 and 255.
Source: Unlock_Nokia_FREE.php, permutacion(), lines 611–674.
The interesting truth about “box serial”
In this source the box serial is a six-character digit string packed into three bytes. It is used after the main three transformations, when the final output is constructed. The code takes five high nibbles from the transformed result, subtracts box-serial digits with decimal wraparound, and combines them with other selected digits.
So changing the box serial can change the final code without changing the core handset-and-network transformation. It is not a fresh random password, and the visitor does not have to own a hardware box.
This explains the parameter’s place in the preserved software. It does not, on its own, prove the old forum theories about exactly how many official Nokia dongles existed or how their identities were managed.
Why generate seven codes and recommend one?
The underlying function accepts code types 1–7. The old wrapper calls it for each type, wraps each result in #pw+…+n#, then applies handset/network rules to highlight a suggested one.
The suffix is a lock/code selector, not a ranking of seven increasingly good guesses. Which code is useful depends on the supported handset and lock configuration. Producing seven strings is not evidence that all seven should be entered.
View the full original DCT4 calculation · 379 lines
Includes all fixed tables, obtener_codigo(), permutacion() and their helper functions. Extracted from Unlock_Nokia_FREE.php in the original V3 archive. The calculation statements, constants and helper functions are retained; only the surrounding webpage is omitted.
<?php
function string_to_array($cadena)
{
for ($i = 0; $i < strlen($cadena); $i++)
$nueva[$i] = ord(substr($cadena, $i, 1));
return $nueva;
}
function char_of($cadena, $pos)
{
return ord(substr($cadena, $pos, 1));
}
//**********************************
$tabla_1 = array(0x00,0x03,0x06,0x01,0x04,0x07,0x02,0x05,0x00,0x03,0x06,0x01,0x04,0x07,0x02,0x05,0x00);
$tabla_2 = array(0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x16,0x73,0x3B,0x1E,0x8E,0x70,0xBD,0x86,
0x47,0x7E,0x24,0x56,0xF1,0x77,0x88,0x46,0xB1,0xBA,0xA3,0xB7,0x10,0x0A,0xC5,0x37,
0xC9,0x5A,0x28,0xAC,0x64,0xA5,0xEC,0xAB,0xC6,0x67,0x95,0x58,0x0D,0xF8,0x9A,0xF6,
0x66,0xDC,0x05,0x3D,0xD3,0x8A,0xC3,0xD8,0x6A,0xE9,0x36,0x49,0x43,0xBF,0xEB,0xD4,
0x9B,0x68,0xA0,0x65,0x5D,0x57,0x92,0x1F,0x71,0x5C,0xBB,0x22,0xC1,0xBE,0x7B,0xBC,
0x63,0x94,0x5F,0x2A,0x61,0xB8,0x34,0x32,0xFD,0xFB,0x17,0x40,0xE6,0x51,0x1D,0x41,
0x8F,0x29,0xDD,0x04,0x80,0xDE,0xE7,0x31,0x7F,0x01,0xA2,0xF7,0x39,0xDA,0x6F,0x23,
0xFE,0x3A,0xD0,0x1C,0xD1,0x30,0x3E,0x12,0xCD,0x0F,0xE0,0xA8,0xAF,0x82,0x59,0x2C,
0x7D,0xAD,0xB2,0xEF,0xC2,0x87,0xCE,0x75);
$tabla_3 = array(0x01,0x2D,0xE2,0x93,0xBE,0x45,0x15,0xAE,0x78,0x03,0x87,0xA4,0xB8,0x38,0xCF,0x3F,
0x08,0x67,0x09,0x94,0xEB,0x26,0xA8,0x6B,0xBD,0x18,0x34,0x1B,0xBB,0xBF,0x72,0xF7,
0x40,0x35,0x48,0x9C,0x51,0x2F,0x3B,0x55,0xE3,0xC0,0x9F,0xD8,0xD3,0xF3,0x8D,0xB1,
0xFF,0xA7,0x3E,0xDC,0x86,0x77,0xD7,0xA6,0x11,0xFB,0xF4,0xBA,0x92,0x91,0x64,0x83,
0xF1,0x33,0xEF,0xDA,0x2C,0xB5,0xB2,0x2B,0x88,0xD1,0x99,0xCB,0x8C,0x84,0x1D,0x14,
0x81,0x97,0x71,0xCA,0x5F,0xA3,0x8B,0x57,0x3C,0x82,0xC4,0x52,0x5C,0x1C,0xE8,0xA0,
0x04,0xB4,0x85,0x4A,0xF6,0x13,0x54,0xB6,0xDF,0x0C,0x1A,0x8E,0xDE,0xE0,0x39,0xFC,
0x20,0x9B,0x24,0x4E,0xA9,0x98,0x9E,0xAB,0xF2,0x60,0xD0,0x6C,0xEA,0xFA,0xC7,0xD9,
0x00,0xD4,0x1F,0x6E,0x43,0xBC,0xEC,0x53,0x89,0xFE,0x7A,0x5D,0x49,0xC9,0x32,0xC2,
0xF9,0x9A,0xF8,0x6D,0x16,0xDB,0x59,0x96,0x44,0xE9,0xCD,0xE6,0x46,0x42,0x8F,0x0A,
0xC1,0xCC,0xB9,0x65,0xB0,0xD2,0xC6,0xAC,0x1E,0x41,0x62,0x29,0x2E,0x0E,0x74,0x50,
0x02,0x5A,0xC3,0x25,0x7B,0x8A,0x2A,0x5B,0xF0,0x06,0x0D,0x47,0x6F,0x70,0x9D,0x7E,
0x10,0xCE,0x12,0x27,0xD5,0x4C,0x4F,0xD6,0x79,0x30,0x68,0x36,0x75,0x7D,0xE4,0xED,
0x80,0x6A,0x90,0x37,0xA2,0x5E,0x76,0xAA,0xC5,0x7F,0x3D,0xAF,0xA5,0xE5,0x19,0x61,
0xFD,0x4D,0x7C,0xB7,0x0B,0xEE,0xAD,0x4B,0x22,0xF5,0xE7,0x73,0x23,0x21,0xC8,0x05,
0xE1,0x66,0xDD,0xB3,0x58,0x69,0x63,0x56,0x0F,0xA1,0x31,0x95,0x17,0x07,0x3A,0x28);
$tabla_4 = array(0x80,0x00,0xB0,0x09,0x60,0xEF,0xB9,0xFD,0x10,0x12,0x9F,0xE4,0x69,0xBA,0xAD,0xF8,
0xC0,0x38,0xC2,0x65,0x4F,0x06,0x94,0xFC,0x19,0xDE,0x6A,0x1B,0x5D,0x4E,0xA8,0x82,
0x70,0xED,0xE8,0xEC,0x72,0xB3,0x15,0xC3,0xFF,0xAB,0xB6,0x47,0x44,0x01,0xAC,0x25,
0xC9,0xFA,0x8E,0x41,0x1A,0x21,0xCB,0xD3,0x0D,0x6E,0xFE,0x26,0x58,0xDA,0x32,0x0F,
0x20,0xA9,0x9D,0x84,0x98,0x05,0x9C,0xBB,0x22,0x8C,0x63,0xE7,0xC5,0xE1,0x73,0xC6,
0xAF,0x24,0x5B,0x87,0x66,0x27,0xF7,0x57,0xF4,0x96,0xB1,0xB7,0x5C,0x8B,0xD5,0x54,
0x79,0xDF,0xAA,0xF6,0x3E,0xA3,0xF1,0x11,0xCA,0xF5,0xD1,0x17,0x7B,0x93,0x83,0xBC,
0xBD,0x52,0x1E,0xEB,0xAE,0xCC,0xD6,0x35,0x08,0xC8,0x8A,0xB4,0xE2,0xCD,0xBF,0xD9,
0xD0,0x50,0x59,0x3F,0x4D,0x62,0x34,0x0A,0x48,0x88,0xB5,0x56,0x4C,0x2E,0x6B,0x9E,
0xD2,0x3D,0x3C,0x03,0x13,0xFB,0x97,0x51,0x75,0x4A,0x91,0x71,0x23,0xBE,0x76,0x2A,
0x5F,0xF9,0xD4,0x55,0x0B,0xDC,0x37,0x31,0x16,0x74,0xD7,0x77,0xA7,0xE6,0x07,0xDB,
0xA4,0x2F,0x46,0xF3,0x61,0x45,0x67,0xE3,0x0C,0xA2,0x3B,0x1C,0x85,0x18,0x04,0x1D,
0x29,0xA0,0x8F,0xB2,0x5A,0xD8,0xA6,0x7E,0xEE,0x8D,0x53,0x4B,0xA1,0x9A,0xC1,0x0E,
0x7A,0x49,0xA5,0x2C,0x81,0xC4,0xC7,0x36,0x2B,0x7F,0x43,0x95,0x33,0xF2,0x6C,0x68,
0x6D,0xF0,0x02,0x28,0xCE,0xDD,0x9B,0xEA,0x5E,0x99,0x7C,0x14,0x86,0xCF,0xE5,0x42,
0xB8,0x40,0x78,0x2D,0x3A,0xE9,0x64,0x1F,0x92,0x90,0x7D,0x39,0x6F,0xE0,0x89,0x30);
$tabla_asic2 = array(0x4a,0x33,0x78,0x90,0x11,0xaf,0xf2,0x3c);
$tabla_asic2a = array(0x30,0x49,0x02,0xea,0x6b,0xd5,0x88,0x46); //xor con 0x7A
$tabla_asic5 = array(0x54,0xa1,0x3b,0x22,0x9d,0xa8,0x11,0x77);
$tabla_asic5a = array(0xc5,0x30,0xaa,0xb3,0x0c,0x39,0x80,0xe6); //xor con 0x91
$tabla_asic6 = array(0x56,0xD4,0xD2,0x9F,0x9D,0xDC,0xEE,0x3D);
$tabla_asic6a = array(0xD5,0x57,0x51,0x1C,0x1E,0x5F,0x6D,0xBE); // xor con 0x83
$tabla_asic7 = array(0x9c,0xd7,0xe4,0xa9,0xa4,0x36,0x72,0x92);
$tabla_asic7a = array(0xfd,0xb6,0x85,0xc8,0xc5,0x57,0x13,0xf3); //xor con 0x61
$tp1 = array(0x3F,0x00,0x7F,0x20,0x6F,0x07,0xFF,0xFF);
$tp2 = array(0x3F,0x00,0x7F,0x20,0x6F,0x3E,0xFF,0xFF);
$tp3 = array(0x3F,0x00,0x7F,0x20,0x6F,0x3F,0xFF,0xFF);
$tp4 = array(0x3F,0x00,0x7F,0x20,0x6F,0x07,0xFF,0xFF);
$tp5 = array(0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA);
$tp6 = array(0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA);
$tp7 = array(0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA);
$tp_a1 = array(0xFC,0x00,0x01,0x00,0x00,0x00,0x00,0x00);
$tp_a2 = array(0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00);
$tp_a3 = array(0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00);
$tp_a4 = array(0x03,0xFF,0x01,0x00,0x00,0x00,0x00,0x00);
$tp_a5 = array(0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00);
$tp_a6 = array(0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00);
$tp_a7 = array(0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00);
$tabla_op = array(1,0,0,1,1,0,0,1);
$tabla_cambio = array(1,0,3,2,5,4,7,6,2,0,6,4,3,1,7,5,4,0,5,1,6,2,7,3);
$tabla_cambio2 = array(0,1,2,3,4,5,6,7,0,2,4,6,1,3,5,7,0,4,1,5,2,6,3,7);
function permutacion($cadena1, $cadena2)
{
global $tabla_1;
global $tabla_2;
global $tabla_3;
global $tabla_4;
global $tabla_op;
global $tabla_cambio;
global $tabla_cambio2;
$aux1=0;
$i=0;
while ($i < 8) {
for ($j = 0; $j < 8; $j++) {
if ($tabla_op[$j] == 1)
$cadena2[$j] = $cadena2[$j] ^ calculo ($aux1, $cadena1); // xor
else
$cadena2[$j] = ($cadena2[$j] + calculo ($aux1, $cadena1)) & 0xFF; // suma
$aux1++;
}
for ($j = 0; $j < 8; $j++) {
if ($tabla_op[$j] == 1)
$cadena2[$j] = ($tabla_3[$cadena2[$j]] + calculo ($aux1, $cadena1)) & 0xFF; // suma
else
$cadena2[$j] = $tabla_4[$cadena2[$j]] ^ calculo ($aux1, $cadena1); // xor
$aux1++;
}
// ******************************************************** //
for ($j = 0; $j < 24; $j++)
$cadena2[$tabla_cambio[$j]] = ($cadena2[$tabla_cambio2[$j]] + $cadena2[$tabla_cambio[$j]]) & 0xFF;
$valor1=$cadena2[1];
$valor2=$cadena2[2];
$valor3=$cadena2[4];
$cadena2[1]=$valor3;
$cadena2[2]=$valor1;
$cadena2[4]=$valor2;
$valor1=$cadena2[3];
$valor2=$cadena2[5];
$valor3=$cadena2[6];
$cadena2[3]=$valor2;
$cadena2[5]=$valor3;
$cadena2[6]=$valor1;
$i++;
}
for ($i = 0; $i < 8; $i++) {
$valor1=calculo ($aux1, $cadena1);
$aux1++;
if ($tabla_op[$i] == 1)
$cadena2[$i] = $cadena2[$i] ^ $valor1;
else
$cadena2[$i] = ($cadena2[$i] + $valor1) & 0xFF;
}
return $cadena2;
}
function calculo ($cadena1, $cadena2)
{
global $tabla_1;
global $tabla_2;
global $tabla_3;
global $tabla_4;
if ($cadena1 < 0x88) {
$temp2=$cadena1;
$temp3=$cadena2[$temp2 & 0x07];
$valor1=movimiento_bytes($temp2, 3);
$temp1=$tabla_1[$valor1 & 0x1F];
$valor2=$temp3;
for ($i=0; $i<$temp1; $i++)
$valor2 = movimiento2_bytes ($valor2, 1);
$temp3=$valor2;
$temp3=$temp3+$tabla_2[$temp2];
return $temp3 & 0xFF;
}
else {
return 0;
}
}
function movimiento_bytes ($byte1, $byte2)
{
$temp1 = ($byte1 << (8-$byte2));
$temp2 = ($byte1 >> $byte2);
return (($temp1 | $temp2) & 0xFF);
}
function movimiento2_bytes ($byte1, $byte2)
{
$temp1 = ($byte1 >> (8-$byte2));
$temp2 = ($byte1 << $byte2);
return (($temp1 | $temp2) & 0xFF);
}
function xor_de_8_bytes($cadena1, $cadena2)
{
for ($i = 0; $i < 8; $i++) {
$resultado[$i]=$cadena1[$i] ^ $cadena2[$i];
}
return $resultado;
}
function convertir_byte_a_hex ($byte)
{
if (($byte > 47) && ($byte < 58)) // '0' a '9'
return ($byte-48);
else if (($byte > 64) && ($byte < 71)) // 'A' a 'F' o otro caracter
return ($byte-55);
else
return $byte;
}
function ASCII2HEX ($origen, $caracteres)
{
$j=0;
for($i=0; $i<$caracteres; $i+=2)
{
$aux1 = (convertir_byte_a_hex($origen[$i])<<4);
if ($i+1 < $caracteres)
$aux2 = convertir_byte_a_hex($origen[$i+1]);
else
$aux2 = 0;
$destino[$j] = ($aux1 | $aux2)&0xFF;
$j++;
}
return $destino;
}
function obtener_codigo($codigo_a_sacar, $asic, $IMEI_ASCII, $network_code_ASCII, $box_serial)
{
global $tabla_asic2;
global $tabla_asic2a;
global $tabla_asic5;
global $tabla_asic5a;
global $tabla_asic6;
global $tabla_asic6a;
global $tabla_asic7;
global $tabla_asic7a;
global $tabla_1;
global $tabla_2;
global $tabla_3;
global $tabla_4;
global $tp1;
global $tp2;
global $tp3;
global $tp4;
global $tp5;
global $tp6;
global $tp7;
global $tp_a1;
global $tp_a2;
global $tp_a3;
global $tp_a4;
global $tp_a5;
global $tp_a6;
global $tp_a7;
for ($i = 0; $i < strlen($network_code_ASCII); $i++) {
$network_code[$i] = char_of($network_code_ASCII, $i);
}
switch ($asic)
{
case 2:
$tabla_asic=$tabla_asic2;
$tabla_asic_a=$tabla_asic2a;
break;
case 5:
$tabla_asic=$tabla_asic5;
$tabla_asic_a=$tabla_asic5a;
break;
case 6:
$tabla_asic=$tabla_asic6;
$tabla_asic_a=$tabla_asic6a;
break;
case 7:
$tabla_asic=$tabla_asic7;
$tabla_asic_a=$tabla_asic7a;
break;
}
switch ($codigo_a_sacar)
{
case 1:
$tabla_permutacion1_HEX=$tp1;
$tabla_permutacion2_HEX=$tp_a1;
break;
case 2:
$tabla_permutacion1_HEX=$tp2;
$tabla_permutacion2_HEX=$tp_a2;
break;
case 3:
$tabla_permutacion1_HEX=$tp3;
$tabla_permutacion2_HEX=$tp_a3;
break;
case 4:
$tabla_permutacion1_HEX=$tp4;
$tabla_permutacion2_HEX=$tp_a4;
break;
case 5:
$tabla_permutacion1_HEX=$tp5;
$tabla_permutacion2_HEX=$tp_a5;
break;
case 6:
$tabla_permutacion1_HEX=$tp6;
$tabla_permutacion2_HEX=$tp_a6;
break;
case 7:
$tabla_permutacion1_HEX=$tp7;
$tabla_permutacion2_HEX=$tp_a7;
break;
}
//pasar a HEX IMEI, codigo red, box serial,
$IMEI_HEX = ASCII2HEX(string_to_array($IMEI_ASCII), 14);
$IMEI_HEX[7]=0;
$network_code_HEX = ASCII2HEX($network_code, 16);
$box_serial_HEX = ASCII2HEX(string_to_array($box_serial), 6);
$tabla_permutacion2_HEX[7]=$tabla_permutacion2_HEX[2];
$tabla_permutacion2_HEX[2]=0;
$permu1 = xor_de_8_bytes ($tabla_asic_a, $IMEI_HEX);
$permu2 = $tabla_permutacion1_HEX;
$permu2 = permutacion($permu1, $permu2);
$permu3 = $permu2;
$permu1 = xor_de_8_bytes($tabla_asic, $IMEI_HEX);
$permu2 = $tabla_permutacion2_HEX;
$permu2 = permutacion($permu1, $permu2);
$permu4 = $permu2;
$permu5 = xor_de_8_bytes($permu3, $permu4);
$permu1 = xor_de_8_bytes($tabla_asic, $network_code_HEX);
$permu2 = $permu5;
$permu2 = permutacion($permu1, $permu2);
$permu6 = $permu2;
$codigo_liberacion_HEX[0] = $box_serial_HEX[0];
$codigo_liberacion_HEX[1] = $box_serial_HEX[1];
$codigo_liberacion_HEX[2] = $box_serial_HEX[2];
$codigo_liberacion_HEX[3] = ($permu6[5] & 0x77);
$codigo_liberacion_HEX[4] = ($permu6[1] & 0x77);
$codigo_liberacion_HEX[5] = ($permu6[6] & 0x77);
$codigo_liberacion_HEX[6] = ($permu6[3] & 0x77);
$codigo_liberacion_HEX[7] = ($permu6[7] & 0x77);
// --------
for ($i=3; $i<8; $i++)
$codigo_liberacion_HEX[5+$i] = (($codigo_liberacion_HEX[$i] & 0xF0) >> 4);
$aux[0] = $codigo_liberacion_HEX[0] & 0x0F;
$aux[1] = ($codigo_liberacion_HEX[1] & 0xF0) >> 4;
$aux[2] = $codigo_liberacion_HEX[1] & 0x0F;
$aux[3] = ($codigo_liberacion_HEX[2] & 0xF0) >> 4;
$aux[4] = $codigo_liberacion_HEX[2] & 0x0F;
for ($i=0; $i<5; $i++) {
if ($aux[$i] <= $codigo_liberacion_HEX[8+$i])
$codigo_liberacion_HEX[8+$i]=$codigo_liberacion_HEX[8+$i]-$aux[$i];
else
$codigo_liberacion_HEX[8+$i]=(10-$aux[$i])+$codigo_liberacion_HEX[8+$i];
}
$codigo_liberacion_HEX[0]=($codigo_liberacion_HEX[0] & 0xF0) | $codigo_liberacion_HEX[8];
$codigo_liberacion_HEX[1]=($codigo_liberacion_HEX[9] << 4) | $codigo_liberacion_HEX[10];
$codigo_liberacion_HEX[2]=($codigo_liberacion_HEX[11] << 4) | $codigo_liberacion_HEX[12];
$destino_codigo_liberacion[0]=chr(($codigo_liberacion_HEX[0] & 0x0F) + 0x30);
$j=1;
for ($i=1; $i<=7; $i++) {
$destino_codigo_liberacion[$j]=chr(($codigo_liberacion_HEX[$i] >> 4) + 0x30);
$j++;
$destino_codigo_liberacion[$j]=chr(($codigo_liberacion_HEX[$i] & 0x0F) + 0x30);
$j++;
}
return $destino_codigo_liberacion;
}
A master code, not your forgotten PIN
master.php centres on SecCode(IMEI). It needs no mobile-network input because it is addressing the phone’s security-code mechanism rather than its network restriction.
- Start with twelve zeroed bytes. Pack the IMEI into the array from offset two, then clear position nine.
- Use fixed mixing material. Supply a twelve-value seed table and another fixed twelve-byte array to
permu1(). - Run the DCT3-style mixer. The same sequence of eleven full passes, a final mixing step and bit reversal is used here, with different inputs from network unlocking.
- Keep five bytes and apply
0x77. Format each masked byte as two hexadecimal characters, preserving leading zeroes. The result is ten digit characters.
The revealing output line
for ($i = 0; $i < 5; $i++)
$code .= sprintf("%02X", ($cIMEI[$i] & 0x77));Source: master.php, SecCode(), lines 172–194. Whitespace is normalised here; the operations are unchanged.
Why hexadecimal formatting for a code containing only numbers? The mask clears the top bit of each four-bit half. Each surviving half must be between 0 and 7, so formatting it in hexadecimal cannot produce A–F—or even 8 or 9. For example, 0xAB & 0x77 becomes 0x23, which is displayed as 23.
That is a small but revealing detail: this implementation’s ten-digit master codes use only digits 0–7. They are not arbitrary ten-digit decimal numbers.
The source names one fixed array $hash. That name does not mean it calls MD5 or SHA-1. The examined function feeds those fixed bytes into its own mixing routine.
What it cannot tell you: the chosen five-digit security code is never an input, so this program cannot recover it. It derives another code which compatible handsets may accept. Acceptance depends on the actual model, firmware and security behaviour—not merely on the calculation producing ten digits.
View the full original security master-code calculation · 241 lines
Includes SecCode(), its fixed seed values, IMEI packing and the shared mixing helpers. Unused network-unlocking routines from that file are omitted. Extracted from master.php in the original V3 archive. The calculation statements, constants and helper functions are retained; only the surrounding webpage is omitted.
<?php
function SecCode( $IMEI )
{
$MSID_TABLE_SIZE = 12;
$MSIDencodeseeds =
array( 0xB1, 0x73, 0xE6, 0x5A, 0xAB, 0x47, 0x8E, 0x0D, 0x1A, 0x34, 0x68, 0x0B );
$hash = array( 0x62, 0x34, 0x92, 0x58, 0x13, 0x76, 0x97, 0x25, 0x28, 0x56, 0x13, 0x68 );
memset( $cIMEI, 0, $MSID_TABLE_SIZE );
str2hex( $cIMEI, $IMEI, 2 );
$cIMEI[ 9 ] = 0;
// cryptMSID( $cIMEI, $MSIDencodeseeds, $hash );
$cIMEI = permu1( $cIMEI, $MSIDencodeseeds, $hash);
for( $i = 0; $i < 5; $i++ )
$code .= sprintf( "%02X", ( $cIMEI[ $i ] & 0x77 ));
return $code;
}
function memset( &$dst, $byte, $count )
{
for( $i = 0; $i < $count; $i++ )
$dst[ $i ] = $byte;
}
function str2hex( &$dst, $src, $shift = 0 )
{
$length = strlen( $src );
for( $i = 0; $i < $length; $i++ )
{
if(( $i & 1 ) ^ 1 )
$dst[ ( $i >> 1 ) + $shift ] = 0;
$data = base_convert( $src[ $i ], 16, 10 );
$dst[ ( $i >> 1 ) + $shift ] |= $data << ( 4 * (( $i & 1 ) ^ 1 ));
}
}
function calculo4_a ($caracter)
{
$aux1=0;
$aux2=7;
$temp=0;
for ($i=0; $i<8; $i++)
{
$aux3=$caracter;
$aux3=$aux3>>$aux2;
$aux3&=1;
$aux3=($aux3<<$aux1)&0xFF;
$temp|=$aux3;
$aux1++;
$aux2--;
}
return $temp & 0xFF;
}
function calculo4 ($cadena)
{
$temp=$cadena;
for ($i=0; $i<12; $i++)
{
$cadena[11-$i]=calculo4_a($temp[$i]);
}
return $cadena;
}
function calculo3 ($cadena)
{
$temp=$cadena;
$temp2=12;
$temp1=7;
$aux1=3;
for($i=0; $i<12; $i++)
{
$aux2=$temp1;
$aux3=$aux1;
$aux2=$temp[$aux2];
$aux2^=0xFF;
$aux2|=$temp[$aux3];
$temp2--;
$temp2&=0xFF;
if ($temp1==0)
$temp1=12;
$temp1--;
$temp1&=0xFF;
if ($aux1==0)
$aux1+=12;
$aux1&=0xFF;
$aux3=$temp2;
$cadena[$aux3]=$cadena[$aux3] ^ $aux2;
$aux1--;
$aux1&=0xFF;
}
return $cadena;
}
function calculo2_a ($cadena, $byte, $byte2)
{
if ($byte==0)
return;
for ($i=0; $i<$byte; $i++)
{
$aux1=$cadena[$byte2+3];
$aux1&=1;
$puntero=$byte2;
for ($j=0; $j<4; $j++)
{
$aux2=$cadena[$puntero];
$aux3=$aux2;
$aux2=$aux2>>1;
$aux1=($aux1<<7)&0xFF;
$aux2|=$aux1;
$aux3&=1;
$cadena[$puntero]=$aux2;
$aux1=$aux3;
$puntero++;
}
}
return $cadena;
}
function calculo2 ($cadena, $byte, $byte2)
{
$cadena = calculo2_a($cadena, 10, $byte);
$cadena = calculo2_a($cadena, 31, $byte2);
return $cadena;
}
function calculo1_a ($cadena)
{
$tabla1 = array(0x01,0x09,0x04,0x08,0x0B,0x05,0x09,0x08,0x06 ,0x0A,
0x01,0x03,0x0B,0x06,0x0A,0x00,0x08,0x07,0x0B,0x0A,
0x01,0x05,0x00,0x08,0x03,0x01,0x09,0x00,0x02,0x0A,
0x05,0x03,0x07,0x02,0x0A,0x00,0x04,0x03,0x0B,0x02,
0x05,0x09,0x00,0x04,0x07,0x01,0x05,0x04,0x02,0x06,
0x09,0x07,0x0B,0x02,0x06,0x04,0x08,0x03,0x07,0x06) ;
$tabla2 = array(0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x01,0x00 ,0x00,
0x01,0x00,0x01,0x01,0x01,0x00,0x01,0x00,0x01,0x01,
0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x00,0x01,
0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,
0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01,0x01) ;
$puntero=0;
$contador1=0;
$aux1=0;
$aux2=0;
while ($contador1<12) {
$contador2=5;
$aux2^=$cadena[$puntero];
while ($contador2>0) {
if (($tabla2[$aux1] == 0) && ($contador1 <6)) {
$variable_8c[$tabla1[$aux1]]=$cadena[$puntero];
}
else {
$variable_8c[$tabla1[$aux1]]^=$cadena[$puntero];
}
$aux1++;
$contador2--;
}
$contador1++;
$puntero++;
}
for ($contador3=0; $contador3<12; $contador3++)
$variable_8c[$contador3]^=$aux2;
return $variable_8c;
}
function calculo1 ($byte, $network_code_h, $imei_h)
{
$puntero=0;
$puntero2=0;
$contador=0;
$aux1=0;
while ($contador < 12)
{
$aux2=$aux1;
$aux2=($aux2>>1) % 3;
$aux2&=1;
$aux2*=$byte;
$aux2^=$imei_h[$puntero2];
$network_code_h[$puntero]=$network_code_h[$puntero] ^ $aux2;
$aux1++;
$puntero++;
$puntero2++;
$contador++;
}
$network_code_h = calculo1_a($network_code_h);
return $network_code_h;
}
function permu1($network_code_hex, $tabla, $imei_hex)
{
$j=0;
for ($i=0; $i<11; $i++) {
$network_code_hex = calculo1($tabla[$j], $network_code_hex, $imei_hex);
$network_code_hex = calculo2($network_code_hex, 0, 8);
$network_code_hex = calculo3($network_code_hex);
$network_code_hex = calculo2($network_code_hex, 8, 0);
$j++;
}
$network_code_hex = calculo1($tabla[11], $network_code_hex, $imei_hex);
$network_code_hex = calculo4($network_code_hex);
return $network_code_hex;
}
Try one byte from the machinery
This demonstration uses the actual bit-operation rules discussed above. It is not a handset-code generator. Move the value or choose an operation to see how one byte changes.
The mask clears bits 7 and 3, leaving two nibble values between 0 and 7.
The operations themselves are ordinary programming tools. The specialised work lies in reproducing the exact tables, constants, order and lock-specific parameters. A tiny mismatch can produce a plausible-looking number which the handset will reject.
Where my practical work sits
In the combined unlocker, a clear comment marks START OF MY CODE. Below it are the practical decisions which turn calculation routines into a usable website: select the handset family, choose the ASIC setting, adapt the historical network data, pick a box serial, calculate results and recommend a code.
For instance, the source maps the 6310i to the default ASIC 2 path, the 7650 to ASIC 5 and the 7600 to ASIC 7. It also contains specific rules for combinations such as the 6600 on Vodafone and some 6111 variants. Those are preserved software rules, not fresh compatibility recommendations.
That layer matters. The underlying mathematics cannot compensate for a wrong network identifier, the wrong hardware-family setting or an unsupported model. Making the right choices for visitors was a substantial part of making the tool useful.
Both core calculations are deterministic: identical complete inputs and settings give the same result. The examined routines do not use random numbers, a network API or an unlock-code database. A separate older dct4.php does contain an append-to-file log; recording a result is different from looking one up.
What this inspection establishes
The numerical details above come from the preserved UnlockMe website archive, specifically the original V3 PHP files. The following map lets a later technical review go straight to the relevant routines.
| Preserved source | Relevant area |
|---|---|
Unlock_Nokia_FREE.php | DCT3 preparation and output: calcular_dct3(), lines 479–512. Shared mixing helpers: lines 282–477. |
Unlock_Nokia_FREE.php | DCT4 tables: lines 539–609. Mixing engine: permutacion() and helpers, lines 611–751. Full DCT4 assembly: obtener_codigo(), lines 753–900. |
Unlock_Nokia_FREE.php | Website rules and output handling: from the “START OF MY CODE” comment, through the DCT3/DCT4 display paths. |
master.php | SecCode(), lines 172–194; str2hex(), lines 202–212; shared mixer permu1(), lines 394–410. |
dct4.php | Separate earlier DCT4 calculator; append-to-file logging around lines 576–578. |
A note about old PHP and unfinished edges
These files preserve their period’s programming style. They include unquoted array keys, obsolete string-offset syntax and reliance on loosely initialised data. In the combined file, the checksum function takes $imei but reads $IMEI; those are different variables in PHP. The older master-code page also contains obsolete checksum indexing. These should not be treated as modern, ready-to-run reference programs.
The model rules include unfinished comments and questionable entries, including an explicit uncertainty about a BB5 model. This study follows the core transformations and explains the intended checksum method. It does not endorse every archived branch or claim that the archive works unchanged on current PHP.
Verification: control-flow inspection checked the twelve-value DCT3/security seed sequence, the three DCT4 transformations, the eight-round inner loop and final mixing, and the output formatting. Small independent checks confirmed digit packing and tested the 0x77 nibble property for all 256 possible byte values. No physical handset acceptance test was performed.
Attribution: the routines belong to the wider historical Nokia calculator community. The presence of code in the UnlockMe archive establishes its use by the site, not authorship of the underlying discovery. Fixed arrays reveal how this implementation works; they do not establish the full story of how the original algorithms were obtained.