Combination Master Locks Cracking

[unbreakable]

I learned this trick from an oldschool guide on how to open a safe via the sound and feel method .

All you have to do is turn the dial four turns counterclockwise (to the left) to the number zero . Then you turn the dial clockwise (to the right), until you feel a distinct added weight on the dial, accompied with a small click(while doing this DO NOT pull on the shackle or the dial will simply jam). SImply stop on the exact number that you felt the addded resistance or weight on. This is the last number of the combination.

From here, all you have to do is plug this number into a generator that will automatically calculate all of the 100 possible combinations for the lock. You can download an excel spreadsheet or the widget version of the combination cracker at the bottom of this page http://www.sahaskatta.com/html/hacks_2.html

I find this method a lot easier than recording then recording all of the individual sticking points, then calculating which ones are false.

I've only had the oppurtunity to try this on 2 Combination Master Locks, and it's worked on both of them. Please try this on your own lock, even if you know th combo, and pleasetell me if it works on your lock.


Unbreakable

[illusion]

Actualy, if you pull up on the shackle, and turn the dial, it will stick at the last number of the combo on the first turn. This is because the last disc is larger than the others, and hence the bar will fall into the gate first.

Stick the number into a calculator, and you get 100 posibilities. Because of the way they are made, the correct number of the combo is in this list - it's up to you to try every one out.

My combo lock is a Squire, and due to the tollerances being a possible 1 digit out, either side of the true number it potentialy leaves me with 300 combos to try... Not fun....

[unbreakable]

Actually, that dosen't seem to work on Combination Master locks, since they have so many false gates or notches in the disk.

Unbreakable

[unbreakable]

EDIT: Revised way of finding the last number

I learned this trick from an oldschool guide on how to open a safe via the sound and feel method .

All you have to do is turn the dial four turns counterclockwise (to the left) to the number zero . Then you turn the dial clockwise (to the right), until you feel a distinct added weight on the dial, accompied with a small click(while doing this DO NOT pull on the shackle or the dial will simply jam). SImply stop on the exact number that you felt the addded resistance or weight on. This is the last number of the combination. To double check this, repeat all of the above steps, then stop on the number that you feel the added weight on. Pull up on the shackle. Now try turning the dial side to side. You should find it to be stuck in a groove, this is good. The number that the dial sticks in between is the last number (so if my lock sticks inbetween 1.5 and 2.5, my number is 2).

From here, all you have to do is plug this number into a generator that will automatically calculate all of the 100 possible combinations for the lock. You can download an excel spreadsheet or the widget version of the combination cracker at the bottom of this page
http://www.sahaskatta.com/html/hacks_2.html

I find this method a lot easier than recording then recording all of the individual sticking points, then calculating which ones are false.

I've only had the oppurtunity to try this on 2 Combination Master Locks, and it's worked on both of them. Please try this on your own lock, even if you know the combo, and please tell me if it works on your lock.


Unbreakable

[Gundanium]

Pulling on the shackle is generally a good thing I found out, you can figure out a bunch of locks by adding pressure to the mechnisim while you're tinkering around, and that doesn't work on some more expensive ($12) locks, I've opened them just from listening not knowing whats going on inside the lock, now I do, and there are a bunch of ways of listening, that old school method works on some locks.

[TOWCH]

Are you saying that the fly pick up will indicate the gate?

[zeke79]

Are you saying that the fly pick up will indicate the gate?

I am skeptical of that also TOWCH.

[unbreakable]

I was skeptical too, but it seems to work on both of my locks, as long as I start at zero.

Unbreakable

[hzatorsk]

Any chance these locks have a combination ending in '8'?

If so... The click is the nearby second wheel being picked up from the dial wheel.

If not... well... I'd say you have coincidental wear as it certainly is not characteristic for this line of locks.

[unbreakable]

No, the combo dosen't end in an eight, i can distinctly feel it pickup at 2, the last number of my combo. I'm anxious to know if anyone else has had any success with their locks?

I also tried this on my Dudley padlock- with no initial success. The second dial picked up at 52, and my real numbers 22. The total number of numbers on a Dudley padlock are 60, and thats when I realized that if I went four turns counterclockwise to 30, and then began my rotation, it should pickup at my real number. And it does. I feel the pickup at 22, my last number.


I really anxious to have you guys try this. Maybe I just have two odd coincidences of locks on my hands, but I'm going to try this on some friends lokers, to see if I can find out their last number. Unfourtanately, I dont get back to school for another 2 weeks. Now I almost want to go back.


Unbreakable

[linty]

i don't really know much about combination padlocks but if the mechanism is anything like a safe mechanism which i suspect it must be, the added weight indicates a wheel being picked up but should not be related in any way to the location of a gate.

[rayman452]

Dudely only has a 20-20-15 numbers, instead of the 60 you see. The first 2 disks haev a 3 digit tolerance, and the last false wheel is a 4 digit tolerance.

[jeremy]

Well, I agree that you're contacting the fly of wheel 2 with the drive pin of wheel 3. If that's what you're feeling, it really does have no relation (other than coincidental) to any number of the combination. If you find this method consistently successful, however, then it's clear that you're actually feeling something else. In that case, please fill us in on what you find.

Now, let's go over how the combination to a Master combination padlock can be quickly determined. This applies to Master padlocks that look like this:
(This includes the cute Sphero padlocks.)

Originally, these locks had no false gates. This made it extremely easy to determine the last number of the combination. Pull out on the shackle while rotating the dial. The shackle will pull out in only one dial position. While holding it out, rotate the dial back and forth as far as it can easily go (just a few numbers). Consider the integer closest to the middle of that range to be the last number of the combination. In the math below, this is 'g[3]'. (This method of determining the last number of the combination applies to all direct entry combination locks without false gates. This includes some safe locks but not most.)

(Note: These locks have 3 wheels and thus 3 numbers to the combination. The 3rd number of the combination corresponds to wheel 3. The dial is connected to wheel 3 and drives it directly. Wheel 3 sometimes drives wheel 2. Wheel 2 sometimes drives wheel 1.)

Since most of these locks have false gates, it becomes slightly more complicated. I'll talk about that in a future post.

These locks seem to follow the following mathematical rules 97% of the time:

g[1] mod 4 = g[3] mod 4
g[2] mod 4 = (g[3] + 2) mod 4

(Where 'g[n]' means the number on the dial that corresponds to the gate of wheel 'n', and where "a mod b" means the *remainder* when 'a' is divided by 'b'. More on modular arithmetic.)

This gives 100 possible combinations when 'g[3]' is known. Learning a little math never hurt anyone, and it certainly comes in handy when dealing with combination locks. But to clarify:

The ten possible values of g[1] are: g[3], and the sum of g[3] and any multiple of 4. For example, if g[3] = 15, then g[1] could be 3, 7, 11, 15, 19, 23, etc.

The ten possible values of g[2] are centered between the possible values of g[1]: For the previous example, g[2] could be 1, 5, 9, 13, 17, etc.

[jeremy]

Now, about those false gates. I have in front of me a lock that has them.


Wheel 3 has only one true gate but has 11 false gates to throw you off. These 12 gates on this particular lock are found at the following locations:

1.1 - 2
4.5 - 5.2
7.8 - 8.5
11.1 - 11.9
14.7 - 15.4
17.2 - 19
21 - 31.8
24.3 - 25.1
27.6 - 28.5
31 - 31.7
34.3 - 35.1
37.8 - 38.7

The false gates in this lock range in width from .7 to .9 (measured in dial increments). The real gate, at 17.2 - 19, has a width of 1.8. Although it is not always quite this obvious, it often IS with Master combination padlocks. Anyway, the integer closest to the center of this gate is the third number of the combination (g[3]). The possible combinations --assuming that this lock follows the mathematical rules outlined previously, as an estimated 97% do-- are calculated as follows:

g[3] = 18
g[1] mod 4 = g[3] mod 4 --> g[1] mod 4 = 2
--> g[1] = {2, 6, 10, 14, 18, 22, 26, 30, 34, 38}
g[2] mod 4 = (g[3] + 2) mod 4 --> g[2] mod 4 = 20 mod 4 = 0
--> g[2] = {0, 4, 8, 12, 16, 20, 24, 28, 32, 36}

[jeremy]

Now let's discuss a method of quickly dialing all the combinations in the narrowed-down list. The complete dialing sequence is not necessary for each attempt. I'll continue with the previously used example.

Let's start with the first possible value of g[1]: 2. We'll use abbreviated dialing to dial all combinations that fit the following:
g[1] = 2
g[2] = {0, 4, 8, 12, 16, 20, 24, 28, 32, 36} (Start above g[1], at 4.)
g[3] = 18

Dial 3XR to 2.
(Wheel 1 is parked at 2 and left there for all attempts where g[1] = 2.)
Dial 2XL to 4; 1XR to 18. Pull shackle.
Dial 1XL to 8; 1XR to 18. Pull.
Dial 1XL to 12; 1XR to 18. Pull.
Dial 1XL to 16; 1XR to 18. Pull.
Dial 2XL to 20; 1XR to 18. Pull. <-- * SEE NOTE BELOW
Dial 1XL to 24; 1XR to 18. Pull.
Dial 1XL to 28; 1XR to 18. Pull.
Dial 1XL to 32; 1XR to 18. Pull.
Dial 1XL to 36; 1XR to 18. Pull.
Dial 1XL to 0; 1XR to 18. Pull.

* Notice that when we progressed g[2] beyond g[3], we had to go 2XL rather than 1XL. (Up to that point, we had been approaching 18 (g[3]) in our progression of wheel 2. When that progression passed 18, the next value for g[2] (20) is slightly on the other side of g[3]. At this part of the sequence, we'll reach 20 when dialing to the right before wheel 3 will actually pick up wheel 2. It is wheel 2 that we must park at g[2], so we must rotate till we pick up that wheel. (I dial left until I get to 16 where I pick up wheel 2, and continue on to 20 from there.)

That was a lot less dialing than if I had dialed the entire combination every time. There are 90 combinations left. We now dial the ten combinations that fit the following:

g[1] = 6
g[2] = {0, 4, 8, 12, 16, 20, 24, 28, 32, 36} (Start above g[1], at 8.)
g[3] = 18

And so on, until we're out of values for g[1] or, more likely, the lock opens when pulled.

AVOID DIALING MORE THAN IS NECESSARY.
DIAL ACCURATELY. (Any bozo can dial quickly but fruitlessly.)