Safe Combinations - Minimizing Combinations? Formulas?

Hey guys,

Not sure if you recall, but about a week or so ago I asked the list about a Gardall Safe that I was trying to open, without drilling, just for fun (and having no locksmithing experience).

The thread is here:

formatting link
Well anyway, I decided to take a fun and perhaps ridiculous approach. Since I have more expertise in software and computer development, I figured I might as well apply what I know. I'm going to build a machine that will brute force all possible combinations. :P Once completed, I'll probably set up a little web site with a webcam so people can review the progress.

Anyway, here's the questions I've got for you guys:

  1. In combination entering, is there a tolerance for being 'close' but not directly on a combination? For example, if the number is 66, will
67 or 65 suffice?

  1. As far as combinations themselves go, I know that masterlocks have formulas that can be applied to deduce a number of possible combinations. Are there any similar formulas for safes? My safe is a Gardall 1612/2 (I believe.) Link here:
    formatting link

  1. Are things like duplicate numbers allowed in safe combinations? (I.E. is 22-22-22 valid? 22-22-12?)

Doing a little math, in the absolute worst case with no minimizations, assuming 30 seconds per attempt, it'll take around 347 days. Which I'm fine with - once its set up it will just run with no interruptions.

Thanks again guys. I'll be sure to post my progress if you guys are interested.

-Umbrae

Reply to
Umbrae
Loading thread data ...

1, its been built already.. commercially available.. and a 3 number wheel set can be opened in..24 hours I believe?? 4 number takes a LOT longer..

there ARE some new 'toys' that have opened a 3 number wheel pack in under a minute without any drilling or forcing..

--Shiva--

Reply to
me

Well that takes the fun out of it. I'd probably make the specs and source freely (as in beer and speech) available, and I guess build it out of Lego Mindstorms so that anyone can make it. 24 hours? That averages out to 700 combinations a minute. Which means that there are DEFINITELY some minimization techniques out there. Anyone have any ideas? I'm still interested.

-Umbrae

P.S. Thanks for the info, Shiva. Any idea what the product is called?

Reply to
Umbrae

ITL2000II AUTO DIALER ITL-2000IIT

Can Cover The Million Conceivable Combinations Of A Standard 3 Number Combination Lock In Under 30 Hours. The advantages of electronic technology are here. Simply setup the ITL-2000IIT on any standard combination lock (dials right-left-right) with the easy-to-follow instructions and watch as the computer and drive motor go to work for you. Soon, the automatic dialer will have the lock open, saving time, materials and excess labor costs.

Roger

see:

formatting link

Reply to
Roger Cann

have to know the EXACT tolerance of the lock.. IE- I need to dial 63, will 62 or 64 work? on some it will-cuts greatly down on the number of possibilities.. any forbidden numbers on the lsat number? that ALSO cuts down.. Its an auto dialer.

--Shiva--

Reply to
me

You (an autodialer) don’t have to dial all the combinations from scratch. You can, for example, dial 50-80 then try opening on 3rd number

80; go back left to 81, try opening; 82, try.... – try all the 50-80- combinations. At the end of the 50-80- tests you can dial right(?) to 79 resetting the 2nd number (50-79-) and try 3rd number 79, 80, 81... I think the description is right, but I’m not a locksmith (and don’t play one on TV). The basic idea comes from Nobel prize winner Richard Feynman, who was a lock nut (and is mentioned in the Matt Blaze “safecracking” article in Al's post). You need a good grasp of what is actually happening in the lock. And need to know where the dial stops when the bolt is retracted and how to detect that the bolt has been retracted (Legos break apart from extra torque?).

Also in the "safecracking" article is a physical manupulation technique that might be interesting to try.

A lot of hackers (in the old sense before the media destroyed the word) were interested in locks, picking, ....

Reply to
Bud--

There is no reliable way other than MAYBE x-ray attack which has been around for years and isn't "new" to open any of the modern 3 wheel safe locks in under a minute, unless you try '50' and the lock is set to '50' etc. It isn't possible. Even computerized manipulators like soft drill will take 1/2 hour or more, when they work at all.

Reply to
Steve

formatting link

That's called an auto dialer.

:P Once

One or the other MAY but it's very unlikely that both will. In Practice it has a lot to do with the tolerances of the individual lock and exactly what numbers or fractions there of were dialed when the combo was set. A half number either way will usually work but you have to remember that whoever set the combo may well not have set it exactly on a number. They may have thought they were setting 10 and really set 10.5 or 10.25 or whatever. 10 will work but 9.5 may not.

Somebody already gave you a link to info on manipulating, but there is no relationship between combo digits on most safe locks like with master locks. The combo can be set to anything with a few narrow exceptions.

My safe is a

formatting link

Yes although the last numbers are close or in the forbidden zone, depending on the splining for an S&G 6730 and many other locks. Even numbers in the forbidden zone can be and frequently are used in practice either by people who don't know any better or by people who know exactly what they are doing and know what numbers are REALLY in the forbidden zone and which one's are just advertised to be, for the lock in question, so if you leave them out you may well miss the actual combo.

Yes and you could find this information

You need to aim a little higher.Commericial auto dialers can do it in a little over a day. Commercial manipulators like soft drill can do it in a few hours or less when they work.

Reply to
Steve

The maximum tolerance for your puposes should be assumed to be no more than

  • or - .75 and .50 would be safer espceially when errors in the mechanical dialing accuracy of your homemade device are factored in.
Reply to
Steve

I definitely plan to AIM higher - From the information on this thread and figuring out how fast each dial will take, I've already brought it down to 10 days or so. A large improvement. I'll just have to see how quickly I can dial with a Lego Mindstorms machine (I plan to release this to the public, so using something easily available to everyone would be nice).

Thanks all for the help. It's been hugely useful.

Reply to
Umbrae

1 of the 2 trade mags ran a report on it..used microphones.. will NOT work on certain locks, but the man tested several older safes and it worked surprisingly well.. and i have not heard anything further regarding it, lately. (but also havent looked) --Shiva--
Reply to
me

What publication and issue? Think about it. What are you going to hear with a mic that you can't feel? Typically for example you can feel contact points much more accurately than you hear them. Try listening and getting within the 1/8th or so of a graduation you need to to really be able to manipulate reliably. Good luck.

On top of that unless you have a lock where the fence is actually dragging the wheels (some Gary's and a few others do come to mind) you are going to have to move the wheels and return to drop in to get any feedback then you are going to have to park the highest wheel and move the other two and so on. How are you going to do that in 1 minute or less? To open a combo lock in less than a minute by dialing you are going to need a direct entry fence that can be forced against wheels with lousy tolerances, with no false gates and a lot of luck, even then a minute is pushing it. There are a couple combo padlocks that can be opened in about 30 seconds like that but very very few safes of any sort size or description. As far as any of the modern safe locks forget it, it ain't happening. It's holywood stuff. Soft drill is the most practical and sophisticated auto manipulator out there and it can't do a plain old 6730 in anything like a minute.

Reply to
Steve

No offense but if you are going to take the time to design something why create something that is available from a number of different manufacturers and has been for years? Auto dialers freqeuently take too long in practice. Even if a dialer could open a lock in 24 hours that's still 24 hours you have to leave your expensive equipment on somebody elses property in many real life lockouts. If you really want a challenge design a manipulator that will reliably manipulate the common modern safe locks in say, under 2 hours, that can be mass produced and sold for under $2000.00. If you do you will make very good money from your efforts.

Reply to
Steve

If you are talking about 'most locks' you can get for under $1.99 maybe, otherwise not even close.

but the "resistant" ones

Nope. That isn't what makes them resistant.

Not severely. Usually no more than 20 numbers. Some of which can actually be used with no problem.

Reply to
Steve

within 18 months I think, but, dont have access to the issures at the moment, and it might have been a SAVTA..

I cant feel NUTHING.. 10 years of a previous job made finger tips numb.. and a WELL insulated from outside noise mike will pick up a lot more than normal folks can..

Like I said, havent seen any update to it recently.. if I get my destroyed yard and 2 outbuildings fixed sometime soon, will try to find it again.. we got thousands of cubic yards of trees here being burned off, literally no place to stack the damaged , and just today, my street was cleaned off so we can se the yards again.. be patient

--Shiva--

Reply to
me

In most cases you aren't going to hear much of anything you can't feel through the dial. A mic may be useful to you because you have limited sensation but you still aren't going to do anything with it that an equally skilled person can't do by touch and sight. It takes more than a minute to manipulate any real safe lock even with really good contact points and sloppy tolerances.

Tornado?

Reply to
Steve

Ice.. January ice storm., covered an area about 50ish by 80 miles in size... the only trees NOT damaged were either small, very small, or already dead.. One article in the paper said they think at one dump site they got 50,000 cubic yards of trees hauled in so far and they just started hauling from a part of one town. They are looking at haul off lasting a month to 6 weeks from now My neighbors walnut came out of the ground and crushed 2 out buildings of mine, an depending on the absolute location where you lived, no power was on for from 4 days to 2 weeks. Tree guy came by yesterday, to look at the 6 trees I need topped/trimmed and give me a price.. He has no ideas when he can make it back but I am now on the list anyway. --Shiva--

Reply to
me

No offense taken.

Like I said before, this isn't really for profitability, business, etc. It's completely for fun. My own spare time, just to challenge myself and see if I can build it. The satisfaction would be far lesser if I just went out and hired someone to hook up an autodialer to it or manipulate it themselves.

As they say, the journey is far more valuable than the goal.

-Umbrae

Reply to
Umbrae

Sounds interesting if you have the time.

I don't think it was prviously posted - you likely need a stepper motor to accurately position the dial. A multiple of 100 steps per revolution would be good. They should be available cheap as salvage. Gears would introduce backlash.

Reply to
Bud--

PolyTech Forum website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.