To clarify, I have a T-Mobile Tab and you must have rooted in order to do this.
I also have an AT&T tab and the same procedure works.
It also works on any GSM model.
Heres the edit points for those of you comfy with a hex editor:
0x181469 change this one byte from 01 to 00 0x18150e change this one byte to 00 if its not already
I just edit a copy of the nv_data.bin, then delete nv_data.bin and nv_data.bin.md5 in the phones /efs folder using Root Explorer, then copy my modified file back to the folder, then reboot. The nv_data.bin.md5 will be automatically regenerated for you.
I've even edited a copy of the file right on my Tab using the Hexeditor in the Market.
FYI, you can not swap nv_data.bin files from one phone to another, you get the bogus IMEI number as the file doesn't match the hardware IMEI number.
UPDATE: New easier way that doesn't involve learning how to hex edit
This requires you to be rooted and have busybox installed, which you should have but you can grab busybox installer from the market if not.
Backup the contents of the /efs folder on the phone first!!! Save your backups for at least 11.5 years.
From your computer, open an adb shell to your phone with the command:
su cd /sdcard echo "this takes about 45 seconds" if [ ! -f /sdcard/nv_data.bin.orig ]; then echo "copying file to /sdcard" cp /efs/nv_data.bin /sdcard/nv_data.bin.orig fi echo -en \\x00 > out0 dd if=nv_data.bin.orig of=out1 bs=1 count=1578089 dd if=nv_data.bin.orig of=out2 bs=1 skip=1578090 count=163 dd if=nv_data.bin.orig of=out3 bs=1 skip=1578254 cat out1 out0 out2 out0 out3 > nv_data.bin.unlocked rm out0 out1 out2 out3 rm /efs/nv_data.bin cp nv_data.bin.unlocked /efs/nv_data.bin rm /efs/nv_data.bin.md5 reboot .
Wait 45 seconds for the whole process to complete.
Thats It! your phone will reboot and its carrier unlocked!
If you can't get internet access with your new SIM its because you haven't set the APN for this carrier. For the settings you need, Google "APN setting your_carriers_name_here" and put those settings in
Settings->Wireless->Mobile Networks->Access Point Names and then select it. Done!