I got the activation/unlock record of a French unlocked iPhone. The field looks like “UnlockCode” = “NO=111111111111111&”; with the 1′s replaced by the code. “NO” is the lock type. There are fifteen digits, so I’m pretty sure the NCK length is 15.

This definitely renders the brute force NCK hopeless, 10×15 is too large to enumerate. If we could find some patterns in the iPhone NCK, we might reduce the count and shorten the time to brute force it, but so far, there’ s no light on this. There’s also a speculation that there is some relationship between the IMEI (or Device ID) and iPhone NCK, however, this can not be further examined without some known IMEI/DeviceID and NCK’s.

iPhone Brute Force Exploit Update:

German ones use “SP” instead of “NO”. Also the two German NCK’s …both start with the number 3 …the algorithm used to verify the NCK on the phone is known and is not even close to reversible. Brute force is capable at 100,000 k/s, so the initial idea of finding a pattern in the NCK’s is to lower the time required for the brute force theoretical NCK generation, this has no basis in anything anyone has discovered by IMEI.