July 16, 2022, 11 p.m.

ZTE MF286RA Openline (Unlock) and Change IMEI Guide

Simple steps for unlocking and changing IMEI on ZTE 286RA

BABALA: HINDI BINEBENTA ANG TUTORIAL NA ITO! KAPAG IKAW AY NAGBAYAD, HUMINGI NG REFUND! LIBRE LANG ANG TUTORIAL NA ITO AT ANG FILES.

HUWAG MAGING BIKTIMA! FILES ARE PROPERTY OF R1BNC AND BACKSPACE TEAM!

Unlock the ZTE MF286RA

SSH into 192.168.255.1 using the root user ssh root@192.168.255.1. Password is admin
run strings /NVM/TTPCom_NRAM2_MEP_ZTE_FIX.gki and get the 16 character code
run serial_atcmd AT+ZNCK="<insert 16 digit code>"
Enjoy

Alternatively, You can skip 2 and 3 and just use this one liner, Credits to 1Conan:

serial_atcmd AT+ZNCK="`strings /NVM/TTPCom_NRAM2_MEP_ZTE_FIX.gki | grep -E '[0-9]{16}'`"

Credits to r1bnc, 1Conan and the Backspace Team

Change the IMEI of ZTE MF286RA
1. SSH into 192.168.255.1 using the root user ssh root@192.168.255.1. Password is admin
2. Run the following:

serial_atcmd AT*PROD=2
serial_atcmd AT*MRD_IMEI=D
serial_atcmd AT*MRD_IMEI=W,0101,01NOV2012,IMEICODE
serial_atcmd AT*PROD=0

Change IMEICODE to your preferred numerical IMEI. Be sure to power on/off the ZTE.
3. Check the IMEI again by logging in via SSH and executing this command, serial_atcmd AT+CGSN
4. Enjoy

BABALA: HINDI BINEBENTA ANG TUTORIAL NA ITO! KAPAG IKAW AY NAGBAYAD, HUMINGI NG REFUND! LIBRE LANG ANG TUTORIAL NA ITO AT ANG FILES.

HUWAG MAGING BIKTIMA! FILES ARE PROPERTY OF R1BNC AND BACKSPACE TEAM!

Credits to r1bnc, 1Conan and the Backspace Team

Go join backspace now! https://discord.gg/C43625u

Video guide:

Donation to R1BNC (optional, will be used for buying modems for research):

Donation:
https://ganknow.com/r1bnc/donate

Except where otherwise noted, this work is licensed under Creative Commons Attribution-ShareAlike 4.0 International License (http://creativecommons.org/licenses/by-sa/4.0/).