Medeco XT teardown

[Legion303]

I'm honestly shocked there isn't already a teardown of this one, so I sacrificed the one Mossman sent me in the name of science. I'd ordinarily put this in Advanced, but since it's just a teardown, everyone can enjoy it. <OrdinarySausageVoice>Here we goooooo!</OrdinarySausageVoice>

The subject is an SFIC-format Medeco XT core in a Mortise housing. I have no key and standard physical/[redacted for non-advanced] attacks weren't working, so NDE was out. I had to destroy the housing. To my great surprise, it had no [redacted for non-advanced]:


(RIP in peace)

After yanking out the core and removing the SFIC-specific chunk, here's the XT cylinder with the locking pin at right--the black part on the left is the front/outside of the lock:



Here's a better view of the locking pin hole with the pin removed. You can see the solenoid, which retracts when an authorized key is inserted, allowing the locking pin to drop. That tiny metal disc above the lock was in a hole in the bottom and is very likely an anti-analysis thingy that needs to complete a circuit before you can investigate the microcontroller. More on that later:



I was trying to get a better shot of the solenoid but accidentally ended up with an extremely clear shot of the microcontroller, which I believe is a Microchip PIC16F688, instead. I'll take it!


(note the obscuring resin on this and on the EEPROM chips. VERY RUDE, MEDECO)

Side view showing the end of the solenoid (you can retract it manually from here, the spring is on the other side) and a little metal tab that supplies the magnetic current necessary to repel the solenoid for an authorized opening:



Here's how the cylinder should look with the solenoid retracted and the locking pin dropped, ready to open:



Board very carefully pried away from the sticky weatherproofing. I also scraped the weatherproofing away to show solid brass underneath. I have no idea how to disassemble the rest of this cylinder nondestructively. The jumper wires soldered onto the board feed through an opening near the front and there is no obvious way to detach the front piece:



And some writing on the back of the board which I haven't tried to decipher just yet. It was fabbed in March 2010 apparently:



Overall a very good mechanical design. The non-axial solenoid completely negates existing solenoid attacks from the outside. I will be attacking the electronic side--watch Advanced for more (probably in about 4 years because I suck). The lock is currently soaking in a jar of toluene to dissolve the rest of the weatherproofing and hopefully some of the resin on the chips so I can see what the hell they are. Possibly more pics later in the week?

EDIT: This looks like the patent: https://patents.google.com/patent/US8973417B2

[jeffmoss26]

sweeeet

[Raymond]

Great photos. I have a customer who uses Medeco XT large key cylinders. He also uses captive inside thumb turns. His employee once put the released thumb turn key into the XT.

YES! it hung up and pulled out part of the electronic contacts and parts. This lock is not repairable and a new deadbolt had to be ordered. This was an expensive mistake.

Just a general warning not to use any captive thumb turn key with the cut out on the bottom in the Electronic locks.

[Legion303]

After soaking in toluene for 2 days, everything was very clean but unfortunately still no obvious way to disassemble the cylinder. I cut off the front, then cut laterally on all four sides to split the cylinder in half. I believe I damaged the motor, which can be seen in the first picture. The locking pin is upper left, the short pin that blocks it is under that, and the spring for the short pin is in the bottom half of the cylinder. The front/outside of the lock would be on the right:



This is the top of the board after scraping off the tar the toluene effectively dissolved. The "P12A" is an overvoltage protection (up to 5.375V in this case) and thermal shutdown chip, probably to prevent or mitigate fault injection attacks:



This is the bottom of the board, where the motor, ground, and data wires are soldered. The 6A256 is a Microchip EEPROM, not sure which one exactly, but IIRC they all use the same basic pin mapping:



Most of the parts on an envelope with chip info written down. Where there's a "_" character, that was something that could have been a digit but was more likely just leftover tar residue. Note that I was wrong about the locking mechanism, which is not a solenoid at all but rather a motor which turns a small lever, moving the short blocking pin and allowing the locking pin to drop and thus turn the plug. Certain attacks from the side of the lock may be effective if you're in my situation with a lock in hand and no obvious way to remove the core nondestructively, but these attacks are clearly ineffective on a mounted lock. I'm impressed by this one overall:

[Squelchtone]

Hi Legion303!

Great photos and nice write up, they sure packed a lot into a little space.

Thank you for sharing with us, and good to see you around these parts,

Squelchtone