先恢复出厂设置，浏览器输入下面网址开启adb，显示successful后，重启。
http://192.168.20.1/reqproc/proc_post?goformId=SET_DEVICE_MODE&debug_enable=1

打开adb命令行
adb shell

进入adb shell后逐行执行
mount -o remount,rw /
nv set mqtt_host=127.0.0.1
nv set fota_updateMode=0
nv set os_url=http://127.0.0.1
nv set lpa_trigger_host=127.0.0.1
nv set safecare_hostname=http://127.0.0.1
nv set safecare_mobsite=http://127.0.0.1
nv set band_select_enable=1
nv set dns_manual_func_enable=1
nv set tr069_func_enable=1
nv set ussd_enable=1
nv set terminal_mgmt_enable=0
nv set nofast_port=
nv set HOST_FIELD='Host: 127.0.0.1'
nv set TM_SERVER_NAME=127.0.0.1
nv set alk_sim_select=1
nv set alk_sim_current=1
nv save
mv /sbin/tc_tbf.sh /sbin/tc_tbf.sh.bak
cp /etc_ro/default/default_parameter_ro /etc_ro/default/default_parameter_ro.bak
sed -i '/test/d' /etc_ro/default/default_parameter_ro
sed -i '/alk/d' /etc_ro/default/default_parameter_ro
mv /bin/vsim /bin/vsim.bak
cp /etc/rc /etc/rc.bak
sed -i '/vsim/d' /etc/rc
reboot



后台超级密码
factoryAdmin

开adb链接
http://192.168.0.1/goform/goform_set_cmd_process?goformId=SET_DEVICE_MODE&debug_enable=1

设备连接电脑，检测adb是否连接成功
adb devices

去控制nv命令
adb shell
mount -o remount,rw /
nv set mqtt_host=127.0.0.1
nv set fota_updateMode=0
nv set os_url=http://127.0.0.1
nv set lpa_trigger_host=127.0.0.1
nv set safecare_hostname=http://127.0.0.1
nv set safecare_mobsite=http://127.0.0.1
nv set band_select_enable=1
nv set dns_manual_func_enable=1
nv set tr069_func_enable=1
nv set ussd_enable=1
nv set terminal_mgmt_enable=0
nv set nofast_port=
nv set HOST_FIELD='Host: 127.0.0.1'
nv set TM_SERVER_NAME=127.0.0.1
nv save

AT命令
查询IMEI AT+READIMEI?
修改IMEI AT+MODIMEI=xxxxxx

ipv6 apn
PDP: IPv4v6
APN: ctnet
鉴权方式: PAP

频段锁LTE Band3

切换外置sim卡
sim卡解锁密码 az952#