Looking for info on 1998 Amsec 6032 gunsafe

[TannerFrisby]

Greetings all. Today I am the proud owner of a new-to-me safe, locked and without the combination. I've opened a handful of locks and I'm looking forward to attempting my first safe crack. Primarily, I am asking for information for non-destructive entry with an emphasis on decoding. I'd like to use this safe when I'm done.

Below is the safe (pardon the mess in the background). I called American Security to get information about it from the serial number and I've been told the following:

MFG: OCT 5, 1998
Model: "6032" gun safe
Outer Dim: 60 x 30 x 21
Weight: 555 lb
Guns: 8 14 22 (the phone connection wasn't that great and I'm not sure what these numbers correspond to).
Bolts: 10 bolts, 5 on each side
Sides: 1" thick, 12 ga steel



I've looked online and can't find this model. In addition, I can't find any model without exposed hinges! Also, what is the proper term for the handle? "Single Spoke", "L-handle", etc?

And quite possibly the most important piece: the lock.



The dial runs 0-99, has an "S&G" (Sargent and Greenleaf?) at the top, two index marks (what is the left index for?), and a keyhole.

1. What is the model of this lock? What search terms can I use to research the mechanism/vulnerabilities?
2. Is this lock a combo OR key, or is it a combo AND key? If it's the latter, then I might just give up.
3. What key blank does this lock use?
4. What purpose does the key serve? Is it opening, resetting the combo, etc?

5. If I did have the combination, what would be the opening procedure? Is it 4 full turns CCW, stop on the first number, pass the second number twice CW and stop on the third time, pass the third number once CCW and stop on the third number the second time, then turn CW until it opens? My reference: https://youtu.be/cEtmAtdnXz8
If so, how far do you have to make that last CW turn?

6. What are the normal gate tolerances? Do I have to hit the number exactly, or is there slop where +- 1/2 a mark would allow me to test 2 numbers at once?
7. Can I test multiple "3rd" numbers without doing a full reset? Or does the final partial CW turn commit the 3rd number to a point where I would have to start over to test the next possible combo?
8. Are there truly 100^3 possible combinations or are some combinations invalid (such as "can't use the same number consecutively" or "all 3 numbers must be congruent mod 2"?

9. Would this lock be susceptible to a vibration attack? If so, what angle do I need to put the safe at?
10. Are there any known (preferable non-destructive) vulnerabilities?
11. What are the recommended attacks?

Thank you for taking the time to read through my post. Any assistance will be welcomed!
-Tanner Frisby

[billdeserthills]

The cheapest, easiest way to open this safe is to find the serial number & contact AMSEC to find a locksmith registered with them who can be forwarded the combo the safe was set on when it left the factory. This doesn't work everytime because once in awhile the new owner will have the combo changed but it works often enough that it's worth a try

[TannerFrisby]

Thank you for a quick reply!

Yes, you are probably correct, that would be the fastest and easiest way to get in. I acquired this safe as a challenge though (I don't actually need the safe and I might just post it for free once I get in). I'm a mechanical engineer by trade and I get my jollies off on puzzles like these. I will get into this, eventually. And with that said, I'd appreciate any tips/insights that the community might have.

-Tanner Frisby

[Squelchtone]

Hello and welcome to the forum!

The following should get your on the right path to opening that safe.

Watch these videos in order, then read the pdf files.






















Safe cracking for everyone!
https://content.instructables.com/ORIG/FEW/I3XK/HPRIBMC5/FEWI3XKHPRIBMC5.pdf

Safecracking for the computer scientist - Matt Blaze
https://www.mattblaze.org/papers/safelocks.pdf

Feel free to ask any follow up questions, we're happy to help!

Squelchtone

[stratmando]

I would buy a new or used S&G 6730, practice with it, dialing procedure super Important, even if trying Default Combos, you may pass a working one. It is good to mount on wood or something, they sell mounts or complete assembly for practicing. Good to watch with back cover off, after dialing last number, you will need to depress the RelockerBack Cover switch, or it won't turn. Good Luck

[TannerFrisby]

Squelchtone, I'm surprised this isn't stickied on the "This Old Safe" subforum. That is a very well put together post.

I had previously watched through the "Safecracking for everybody" playlist, but it didn't hurt to watch it again. I really enjoyed the S&G video, as well as the PDF by Matt Blaze.

With that said, I'm getting nothing from my dial. I'm wondering if my dial's static friction/starting-torque/stiction is greater than the detent torque felt during gate profiling. It takes a little bit to get my dial started spinning, and by the time I've got it moving I don't feel the "stopping" points. Take this all with a grain of salt as I'm not at all experienced. After watching the manipulation video series posted above, I thought this would be a cakewalk. I can't even find the first window.

I'm a fan of letting technology augment (or replace) slightly evolved monkeys in almost every task. Instead of training my monkey fingers to be a slipper-clutch/torque wrench trying to find a gate to less than 1 degree, I figured I'd make a tool to do it for me.



This is a cap that I printed to hang a weight from which should apply a constant torque.



The moment arm stays constant and a progressively larger load can be suspended until the dial just barely overcomes its static torque.



The magic torque for my dial corresponds to ~125 gram*cm. It usually holds, but if you breathe on it wrong it will start spinning.

The problem is, it never stops spinning. I tried applying a minute amount of drag immediately after it starts spinning, but it wouldn't consistently stop at the same location.

I was really bullish on this solution, and maybe some of my assumptions aren't good? Is there an obvious reason why this isn't working? I had figured the weight would barely get it moving and then the gate would stop the dial. Wham-bam, consistency with minimal training. Instead, it just unspools and accelerates (even when the static torque is infinitesimally exceeded).

Anyway, a failure for day 2. On to the next plan.

-Tanner Frisby

[Squelchtone]

Hello,

It *sounds to me* like you may be under the impression that turning the dial will allow you to feel the 3 gates and then figure out the combination. If this is the case, that is not what we are feeling for. Maybe we are just using different words to describe the same thing, I am not sure.

When you say you can't find the 1st window... just curious, how many windows do you think there are? I am assuming you mean you don't feel the Left and Right Contact Points when you turn the dial?

You should be able to turn the dial by hand at a medium speed, and find 2 spots on the dial that are about 10 numbers apart, and as you turn the dial Left, then Right, then Left again, those 2 spots should require just a little more torque to get past. Those are the Left and Right Contact Points. Contact points do not equal a gate or a number of the combination.

When you graph a safe dial from 0 to 99 in order to try and find some gates, you have to keep measuring the gap between the Left and Right contact point and watch for any changes in the distance between them..

before I write a thousand words, let us know if this is clear so far, or perhaps I misunderstood what you meant.

Thank you,
Squelchtone

[TannerFrisby]

Thank you for such a quick reply.

Yes, I was using the wrong terminology. I meant to say that I could not pick up the "contact points".

In the video, the host states to turn all wheels left to 50, then just the dial right to 0. Then "slowly spin left until [you] feel the right contact point". His right contact point was 2 and his left was 96. I (mistakenly) inferred that 0 would be between the left and right contact points and they should be around 6 or so digits apart.

I hunted about 0 for a long time, but it all "felt the same". I figured there must be a certain mastery to be able to "feel" the contact points, so I tried to make the tool shown above.

Long story short, my safe's contact points are 6 and 13 and they are very obvious when you test in the correct domain. Now I might be able to make my graph tonight and get in.

[Squelchtone]

Thank you for such a quick reply.

Yes, I was using the wrong terminology. I meant to say that I could not pick up the "contact points".

In the video, the host states to turn all wheels left to 50, then just the dial right to 0. Then "slowly spin left until [you] feel the right contact point". His right contact point was 2 and his left was 96. I (mistakenly) inferred that 0 would be between the left and right contact points and they should be around 6 or so digits apart.

I hunted about 0 for a long time, but it all "felt the same". I figured there must be a certain mastery to be able to "feel" the contact points, so I tried to make the tool shown above.

Long story short, my safe's contact points are 6 and 13 and they are very obvious when you test in the correct domain. Now I might be able to make my graph tonight and get in.

The range around 96 to 5 is when the lock body inside the safe is mounted in a certain orientation such as Right Hand, Left Hand, Vertically Up or Vertically Down, this may have been touched upon in the installation video.

This will alter where around the dial your contact points will show up.

On your safe your lock is probably mounted VD (Vertically Down) meaning the bolt faces downwards towards the handle.

[TannerFrisby]

I ran two of these with all wheels left. They largely agree with each other, but no anomalous regions pop out to me. I tried to be as consistent and methodical as possible, but I'm not completely confident in my results. I've bought a 600 pulse per revolution encoder (should be able to run it 2-phase at 2400 state changes per revolution) which should obviate the possible parallax and judgement calls. I think I might reintroduce my constant torque assembly to remove as much human factor as I can. I'll update when my new equipment arrives and I get it set up.

TL;DR
Day three, no dice.

[MartinHewitt]

Looks like missing persistence.

[TannerFrisby]

I can understand how it would appear this way (especially after exceeding 1 year), but I have been working on this from time to time. I ended up buying my first house shortly after I received the safe. Priorities have changed and I lapsed on reporting (especially when each report would have been "what didn't work this time").

I have a sufficient understanding of how the lock works but am failing on execution. I feel like my issue is inconsistency with "feel". I have been trying to take the human aspect out of the equation.

One of the first ways I attempted this was with the constant torque applicator from my "day 2" post. This didn't work well for the reasons already listed.

Following this, I tried to implement an ultra-low torque clutch, but it didn't really go anywhere.

More recently I mounted a fixed high-zoom camera above the dial to remove subjectivity present in viewing angle and dial rotation reading. I repeated each measurement 3 times and took the average dial position to the 10,000th of a revolution (calculated with computer vision, but I compiled a PowerPoint linked below for verifying the results manually). Results are probably closer to the 2,000th of a revolution. The only remaining appreciable variable should be my ability to consistently and correctly stop on the edges of the gate (which is why I took 3 readings at each position). Each set of readings was reasonably consistent, but I still didn't see an obvious gate signature.

That is until I found an excel typo while I was putting this post together. Here is my chart. It looks like one of the numbers could be 24. I'll have to repursue this later.



The following is a sample image of the processed high-zoom picture set. The full set is available in the PowerPoint format here: https://docs.google.com/presentation/d/1Wv93KejeR57y5LbHd3F4bLLtWZqhsUif/edit?usp=sharing&ouid=100952903254748305046&rtpof=true&sd=true:



The excel output can be found here: https://docs.google.com/spreadsheets/d/16k-h5XIvJkauOPl-T_DJsZBBRcxggh_j/edit?usp=sharing&ouid=100952903254748305046&rtpof=true&sd=true

After this, I decided to give up on manual manipulation and just brute force it. I started writing a script to sequentially dial the possibilities based on input parameters. The scope crept as I added "nice to have" features (relocking after solution, Bluetooth reporting, resume after a power interruption, etc) and ultimately I put it aside for a while. I came back to it about a month or so ago to condense it down to a "lite" version just to get the job done. I got to a hardware debugging phase and then something more pressing came up. Right now I have the magnetic servo dialer sitting on my closet floor and a lab bench power supply resting on top of the safe.





Unfinished code: https://drive.google.com/file/d/1CbxtBJDZgJUbShFIPlft3ryS15CRUQa1/view?usp=sharing
Unfinished "lite" code: https://drive.google.com/file/d/1yzW96NxuQw4C0c8VdTOYVX6IbTEhDpGF/view?usp=sharing

While motivation is occasionally the hurdle, I frequently can't find time to commit to this side hobby. With that said, I ought to wrap this up and get another iron out of the fire.

-Tanner Frisby

[MartinHewitt]

Thank you for giving is an update, even after such a long time!

The graph you have looks quite good. I am not a fan of the "gap" graph, because it hides a lot. The important part is, that your left and right graphs agree! So the CPs must be good. Yes at 24 might be a gate. I would redo the graph from 20 to 28 in steps of 1 to see the shape. And even if 24 is not a gate there is still the very low area around 8 to work with by parking wheels there. You don't write what this graph is. If it is an AWL/R then 8 would be an excellent location to park W1 and W2 and then scan only W3. Either for a complete scan of W3 or to have a close look around 24.