---
A whole book isn't enough to cover all you need to know to learn manipulation. I'll try to explain how to start, based on my own experience.
You're going to work on your lock for many hours, so make a small investment and buy a good one.
A too worn, dirt, damaged or bad mounted lock will give you troubles and frustration. You may fail even if you're doing it right.
I suggest to buy a used combo lock from a fellow member of the forum, here or on KP, or from a trusted ebay seller. A brand new lock would be perfect, but obviously it's much more expensive.
Getting a change key is highly recommended, otherwise your lock will be usable just once: it's not fun to look for a combo you already know.
I'm not a big fan of cutaways in general, and even in this case you won't need one. If you remove the back cover you can examine the inner parts interacts while you move the dial, that's enough. And you only need to undo 2 screws...
Usually you get a lock that has been removed from a safe, so you'll need to mount it on a stand. If you're lucky enough to have a real safe skip this part.
I use a wooden stand made from two assembled pieces of wood, one 15x15 cm and one 10x15 cm. The width of the wood depends on spindle length.
To mount the lock you can follow installation instructions from the manufacturer website, for example (edit: removed dead link).
You should build something like this.
Before starting your manipulation, make sure you've understood how to dial a combination and how a lock works. It's very important to know what's happening inside the lock while you move the dial. It's impossible to hack something you don't fully understand.
The theory behind manipulation is that the wheels are not perfect, so every time the gate of the biggest wheel is under the fence, the nose can enter a bit more in the cam, and the contact area will be smaller. Hence you can identify the biggest wheel gate position. Then you should find out which wheel was indicating. Now you have one of the combination numbers. Repeat the process until the lock is open. If you're interested in learning more, I suggest you to carefully read Safecracking for the computer scientist.
I guess you're a bit lazy, so I'll try to guide you trough your first manipulation experience.
First of all you should look for the 2 contact points. Usually every lock has them at the same numbers, but don't count on this. Turn the dial left and right and try to identify the 2 numbers where the fence start touching the cam. You don't need to be very precise, the closest whole number is enough.
I've made 2 red dots to help you identify these points. The first time it could be useful to look for the contact points with the back of the lock removed, so you can see and understand what's happening. After a few minutes you'll learn to recognize these points very well even with a mounted lock.
Now you're ready to count the number of wheels in the lock. To do so turn the dial at least 4 times to a number far away from contact points area. Usually 50 is the perfect choice. Then change direction and count the number of wheels you'll pick up. You should feel a small click and some more resistance offered by the newly picked up wheel every time you pass at the number you have left them, 50 in this example. Once you have picked up all the wheels, passing at 50 would give no more feedback.
It's time to start checking contact points and log them on a graph. We are going to check differences in contact points every 2,5 numbers, while rotating all the wheels together, and mark the corresponding points on our first graph.
There are many different templates to draw your graph on, there are specialized software to assist you in this very simple task. Usually I just grab a few sheets of graph paper and draw my own. This is an example of the first graph I made to open a 3 wheels lock, similar to the one you see above. It was a Sargent & Greenleaf 6725 with 3 wheels.
First of all, you need to write the numbers on the top, from 0 to 100 in 10 increments is enough. Then you should write the numbers on the left. These are the left and right contact points, and a few adjacent numbers. In this example the contact points were at 6 for the Left contact point, and between 12 and 13 for the Right contact point.
The contact points reading requires good light, concentration, and precision. We are going to notice 1/10 number differences, so try to be very precise in your readings.
We could start by rotating the dial Right 4 complete turns, so we are sure we are moving all the wheels, and stop at 0.
Now we have all the wheels at 0, so we can rotate the dial back to check contact points: turn left until the dial is between 6 and 12, then try to move it back and forth to check where the fence touches the cam and exits the contact area. You'll find 2 numbers. I found 5,8 and 12,5, so I made 2 corresponding dots on my graph.
Then you should rotate Right until you reach the wheels you left at 0 and move them 2,5 numbers Right, to 97,5 in this case.
In theory you'll need to make 4 full turns to accomplish this. In practice, since we know where the wheels are, you can simply turn 1 time only, until you touch the wheels. You'll feel them being picked up by the dial, and move them 2,5 numbers Right. We have just saved a lot of time and turns.
Now rotate the dial Left to reach the contact area and carefully read contact points. I got 5,9 and 12,6. Mark your points on the graph.
Continue your readings every 2,5 numbers until you reach 0. You'll end up with your first graph.
Now that you have completed your readings, you should look for some narrow areas in the graph, these narrow areas represent the wheel gates. I clearly see one at 50 in my graph. If you have more than one narrow area, choose the smallest one, the one with steepest borders, just a few numbers wide, which can resemble a gate.
We just checked every 2,5 numbers to speed up the process, so now we should amplify our indications by reading contact points at every number around our newly found gate.
Prepare a small graph by writing at least 5 numbers before and after our gate. You can see the one I made on the bottom part of the page. Write down contact numbers also.
Turn all the wheels Right and stop 5 numbers before your gate. I stopped at 55: since we are reading Right, 55 is found before 50.
Read contact points and mark them on the graph. Then proceed with 54 and so on. When you have drawn the small graph, you should see a distinct narrow area. This is the gate, mark its centre, it's one of your combination numbers!
I got 51 in my example, so I knew 51 was one of my combination numbers, but which one? 51-x-x, x-51-x, or x-x-51?
You'll find out this by trial and error: dial some test combinations, check contact points with each one, and you'll identify which wheel that number belongs to.
Choose a high test number, by adding 10 to yours, and a low test number, by subtracting 10 to yours.
Dial the 3 possible combinations with your number on 2 wheels and the high test number on another wheel. Check contact points to see which wheel, if on a wrong number, changes the contact area the most. This is the wheel with the gate you've found.
To double check, do the same with the low test number.
To avoid confusion, I found useful to fill in a template from The National Locksmith Guide To Manipulation.
In my example I have 51, so my test numbers are 41 and 61.
I've dialled 41-51-51, 51-41-51 and 51-51-41. The results were uncertain: as you can see on the left part of the schema attached below, I got the same variations on second and third wheels.
Then I dialled 61-51-51, 51-61-51 and 51-51-61. I could clearly see that if the third wheel was far from 51, the contact area was increased a lot.
Hence I found out that my combination was x-x-51.
By now you should have found one of your combination numbers, so you should be very proud of yourself.
We have found our first number, the most difficult part. Now we just need the others two and we have done our job.
We are going to repeat the first test to look for another gate, but instead of moving all the wheels together, we'll use the known number on its wheel and test the others.
The process is almost the same. The only difference is that we need to dial a two numbers combo instead of moving all the wheels together (in the previous example we dialled a one number combo).
In my case I had 51 on wheel number 3, so I've checked wheels 1 and 2 Around Left, and kept wheel 3 at Right 51.
In order to efficiently accomplish this task, I started with 4 full turns Left and stopped at 50. Then turned Right one turn plus one number, to put wheel three at 51. Then went left to check contact points.
Next step was to turn left, pick up wheel three at 51 and continue to turn, picking up wheels 1 and 2 at 50 and move them 2,5 numbers forward, to 47,5. Then made one turn Right to pick up wheel three and moved it to 51. Then checked contact points.
If you don't want to think about how to efficiently move the wheels, you're welcome to make many more turns and waste much more time.
This is not a big deal during your first experience, but it will become a huge waste of time every time you try to manipulate a lock.
As you can see in graph number two, I got more than one narrow area. I decided to amplify all the possible gates and made an accurate reading of the narrow areas (graphs on the bottom of the page).
I spent a lot of time in this process, but since I had no evidence of the gate position, I had to do so. No guessing allowed while you manipulate.
By analysing the graphs, I choose 11 as gate centre. Look at its shape: it's steep and resembles a gate. The area around 35 is wider and has high and low points. The area around 60 is too wide and smooth to indicate a gate.
Then I had to check which wheel, between one and two, had the gate at 11. As I did before, I tried a high and a low test numbers to see which wheel, if moved from its gate, would have made the contact points wider. My high test combos were 21-11-51 and 11-21-51. My low test combos 1-11-51 and 11-1-51. I found out the gate at 11 was on wheel one. So my combo was 11-x-51.
Once you have two out of three numbers, it's quicker to brute force the last number rather than reading the contact points to draw a graph. So just dial all the combos, with 2,5 step increments, to open the lock. My lock opened when wheel 2 was at 32,5. The emotion you feel when the fence enters the gate it's like picking a hundred of locks!
To get the actual combo I tried 11-32-51 and it didn't work. Then I tried 11-33-51, it was the working combo
Remember, the most important things are: patience, precision, practice.
Good luck
