1 00:00:01,370 --> 00:00:03,690 Welcome to Safe Cracking for Everyone! 2 00:00:04,210 --> 00:00:06,450 A little bit about myself, who am I? 3 00:00:06,450 --> 00:00:07,890 My name is Jared Digert. 4 00:00:07,890 --> 00:00:15,490 I'm a lock support enthusiast, gamer, rock climber, game developer, and I've been picking locks and cracking safes for about a decade now. 5 00:00:16,150 --> 00:00:26,130 So this talk is going to cover how Group 2 safe locks work, and mechanical combination safe locks are divided into two groups. 6 00:00:26,130 --> 00:00:40,870 There's Group 2s, which is your basic safe lock, no anti-manipulation features in them, also the most common type, and then there's Group 1s, which are more complicated and include various different measures to keep people from figuring out the combination. 7 00:00:41,990 --> 00:00:52,690 Now, whether you buy a $500 safe or a $5,000 safe, if it comes with a mechanical safe lock, it will most likely be a Group 2 safe lock. 8 00:00:52,710 --> 00:00:58,730 Very rarely are there Group 1 safe locks that come by default on a safe. 9 00:00:58,730 --> 00:01:07,950 Usually you have to pay hundreds of dollars extra for the lock, even more to get it installed, and this is not very common at all. 10 00:01:08,450 --> 00:01:11,590 So I'll be covering these Group 2 safe locks in this talk. 11 00:01:11,590 --> 00:01:18,890 I'll cover the flaws in this design and how to exploit them, along with specific techniques that is used to crack the combination. 12 00:01:19,670 --> 00:01:27,190 And at the end, I'll cover some slight differences between various Group 2 safe locks, since not all manufacturers create them the same way. 13 00:01:28,350 --> 00:01:30,430 First thing is knowing the parts of the lock. 14 00:01:30,430 --> 00:01:37,310 So this is the back of the lock with the back cover removed, and you can see that there is a silver lever here. 15 00:01:37,310 --> 00:01:42,030 Now, the end of this lever has a protrusion, and this protrusion is called the nose. 16 00:01:42,030 --> 00:01:45,270 This nose is resting on a brass wheel. 17 00:01:45,270 --> 00:01:52,390 The brass wheel is called a drive cam, and this drive cam, you can see, has a cutout in it. 18 00:01:52,390 --> 00:01:58,270 This space, this empty space in the drive cam, is called the contact area. 19 00:01:58,950 --> 00:02:05,630 You can see where the cutout starts on either end, and those are the contact points. 20 00:02:05,850 --> 00:02:13,550 So the cutout is the contact area, and each end of the cutout, where it starts, is the contact points. 21 00:02:14,290 --> 00:02:16,970 And this drive cam is controlled directly by the dial. 22 00:02:16,970 --> 00:02:22,650 So there's a metal rod, you can see, in the middle, and that connects it directly to the dial. 23 00:02:22,650 --> 00:02:25,010 It's locked in place with this key. 24 00:02:25,210 --> 00:02:31,490 So whenever you turn the dial, the drive cam moves at the same time with the dial. 25 00:02:32,270 --> 00:02:36,410 Behind the drive cam, you can see a larger silver wheel. 26 00:02:36,630 --> 00:02:39,610 There's three of these wheels, generally, in each lock. 27 00:02:39,610 --> 00:02:43,510 Sometimes there could be four, but most often times it's three. 28 00:02:43,670 --> 00:02:47,210 Now, this wheel that we see here is called wheel three. 29 00:02:47,210 --> 00:02:48,670 It's the third wheel. 30 00:02:48,790 --> 00:02:54,430 It's closest to the drive cam, and when you're in front of the lock, it would be furthest away from you. 31 00:02:55,530 --> 00:02:58,450 And the other two wheels are behind it. 32 00:02:58,450 --> 00:03:02,050 Now, each of these wheels are exactly the same. 33 00:03:02,050 --> 00:03:06,810 There is a cutout in each of these wheels called a gate. 34 00:03:06,830 --> 00:03:13,780 Now, these gates are part of when you dial the combination. 35 00:03:14,810 --> 00:03:27,790 The gates all line up, and there is a metal bar behind this lever, and it lines up all of these gates under the metal bar when you dial the correct combination. 36 00:03:28,710 --> 00:03:38,130 So that when you turn the dial and the drive cam, so the contact area is under the nose, everything can fall down and fit nice and easily. 37 00:03:38,910 --> 00:03:46,810 So here, you would just continue turning the dial, and that would pull in this lever, and that retracts a bolt. 38 00:03:46,810 --> 00:03:52,870 The lever is attached to the bolt, and that pulls it in so that you can turn the handle and open the safe. 39 00:03:53,190 --> 00:04:04,190 The handle of a safe just pulls in the outermost bolts around the edge of the door so that you can open it, but the lock itself only locks the handle. 40 00:04:04,190 --> 00:04:07,930 So that's basically how safes operate. 41 00:04:07,930 --> 00:04:14,450 It's a locking mechanism locks the handle, and the handle is what pulls in the bolts from the outer edge of the door. 42 00:04:15,450 --> 00:04:24,690 Now, to demonstrate that, I have a lock here, and if we look at the back, you can see the drive cam. 43 00:04:25,050 --> 00:04:30,870 Whenever I spin the dial, the drive cam moves with the dial. 44 00:04:32,150 --> 00:04:49,950 So if I were to dial in the combination, that would involve putting the gate of the first wheel under the fence, and then I would put the gate of the second wheel under the fence as well. 45 00:04:49,950 --> 00:04:53,270 I messed that up, but I will just fix it. 46 00:04:53,950 --> 00:04:59,270 And then I put the gate of the third wheel under the fence. 47 00:04:59,430 --> 00:05:08,330 I simply turn the drive cam so everything can fall in, and then that will retract this bolt when I continue turning. 48 00:05:14,360 --> 00:05:26,000 Now the way that it works is each of these wheels has a protrusion on one side, and that fits into a groove of the next wheel. 49 00:05:26,000 --> 00:05:41,100 Now this protrusion will ride in this groove as the wheel spins until it hits this metal piece of the next wheel, at which point this next wheel will start to spin along with the previous wheel. 50 00:05:41,880 --> 00:06:03,920 And this wheel also has a protrusion which rides in a groove of the wheel next to it, and then after a whole rotation it will hit this metal bit, and then the next wheel will start to spin along with the rest of the wheels, essentially picking up each wheel after each rotation. 51 00:06:04,620 --> 00:06:11,000 So the drive cam has that sort of protrusion as well. 52 00:06:11,000 --> 00:06:26,860 So right now everything is spinning together, but if I were to spin the other way, you can see it is only the drive cam spinning until I make one full rotation, and then this third wheel, the wheel closest to the drive cam, starts spinning with it. 53 00:06:26,860 --> 00:06:38,980 So the third wheel gets picked up first, and then after another full rotation, you can see that the second wheel starts to get picked up as well, and it is spinning along with it. 54 00:06:38,980 --> 00:06:45,540 After another rotation, then this third wheel, or this first wheel, gets picked up as well. 55 00:06:45,540 --> 00:06:50,980 And the wheels are named this way because the first wheel corresponds to the first number in the combination. 56 00:06:50,980 --> 00:06:57,560 Since it is the last to get picked up, then it is set first. 57 00:06:58,300 --> 00:07:06,720 So then you can freely mess about with the other two wheels without upsetting the position of that first one. 58 00:07:06,880 --> 00:07:13,680 So the third wheel gets picked up first, corresponding to the third number in the combination, then the second wheel, and then the first wheel. 59 00:07:18,770 --> 00:07:29,590 Now the standard opening procedure for a lock is to spin four times with left rotation to the first number, which means you pass the first number three times, and you stop on the fourth. 60 00:07:29,610 --> 00:07:35,910 Then you reverse directions, because if you were to keep going, it would mess up the position of the first wheel. 61 00:07:36,230 --> 00:07:46,070 So you reverse direction, spin three times with right rotation, so now we are turning clockwise to the second number. 62 00:07:46,410 --> 00:07:48,630 And then you do that three times. 63 00:07:48,630 --> 00:07:58,170 So you pass the second number twice, stop on the third time, and then twice with counterclockwise rotation, so we are reversing rotation again to the final number. 64 00:07:58,170 --> 00:08:01,590 We pass it once, and then we stop on the second time. 65 00:08:01,670 --> 00:08:04,650 Then we turn right until the bolt is retracted. 66 00:08:05,310 --> 00:08:11,550 Now the reason for this is because you have to spin three times to ensure all the wheels are picked up. 67 00:08:12,330 --> 00:08:22,630 You don't know the state of this wheel pack when you approach the lock, so it could be someone spun it to the right all the way before you approached it. 68 00:08:22,690 --> 00:08:37,890 So you want to make sure you spin one full rotation will pick up that third wheel, two full rotations picks up the second wheel, and then three full rotations ensures that that first wheel gets picked up. 69 00:08:37,890 --> 00:08:41,630 So we just pass the first number in the combination three times. 70 00:08:41,630 --> 00:08:48,090 So now we have to go to it and stop on the fourth time. 71 00:08:48,090 --> 00:08:52,710 We reverse directions because otherwise it would mess up the position of that first wheel. 72 00:08:52,710 --> 00:09:07,030 So we do one full rotation, pick up the third wheel, two full rotations, now we pick up the second wheel, and so we pass the second number twice, and we stop on the third time. 73 00:09:07,030 --> 00:09:09,330 And I overshot it again. 74 00:09:10,130 --> 00:09:16,390 Reverse directions, one full rotation picks up the third wheel, and then we stop on the second time. 75 00:09:16,390 --> 00:09:22,350 And then we can turn right so everything drops in and the bolt retracts. 76 00:09:26,630 --> 00:09:28,970 Here's a really bad drawing. 77 00:09:28,970 --> 00:09:30,150 I mislabeled this. 78 00:09:30,150 --> 00:09:31,650 This is wheel two in the middle. 79 00:09:31,650 --> 00:09:48,950 So the dial will turn the drive cam until this protrusion picks up wheel three, and then after rotating for some time, wheel three will pick up wheel two, and then wheel two after rotating will pick up wheel one, and so then they'll all start spinning together. 80 00:09:49,930 --> 00:09:53,290 There's a lot of vulnerabilities in this design. 81 00:09:53,570 --> 00:10:05,990 So you can see here when none of the numbers are dialed in correctly, and then we turn the drive cam, we turn the dial so that the contact area is under the nose. 82 00:10:05,990 --> 00:10:14,190 That allows the fence to drop down onto the wheel pack, essentially testing it for the correct combination. 83 00:10:14,870 --> 00:10:21,570 But the thing is, these wheels, they're not perfectly circular, and they're not the same size as each other. 84 00:10:21,570 --> 00:10:28,150 Some will be bigger, some will be smaller, and some will have bumps and dips, and that's because of manufacturing tolerances. 85 00:10:28,150 --> 00:10:33,970 It's basically impossible to get rid of these imperfections. 86 00:10:34,250 --> 00:10:43,870 What this means is, since one of these wheels is bigger, the fence is not going to be resting on all of the wheels at the same time. 87 00:10:43,910 --> 00:10:50,450 You can see here, between wheel three and the fence, there's actually a bit of space. 88 00:10:50,450 --> 00:10:51,730 It's not touching. 89 00:10:52,410 --> 00:10:57,670 Wheel two here, you can see, is larger than wheel three and wheel one. 90 00:10:57,670 --> 00:11:00,350 This fence is only touching wheel two. 91 00:11:01,470 --> 00:11:10,950 Now, we can also see that this contact area, where the contact points are on either end, it is sloped to go down. 92 00:11:11,950 --> 00:11:20,330 And that means there is less wiggle room, so to speak, between the sides of the contact area the further down you go. 93 00:11:20,830 --> 00:11:31,690 So let's assume that wheel two, let's pretend that the wheel two combination is valid, that the gate for wheel two is now under this fence. 94 00:11:31,890 --> 00:11:32,910 Well, what would happen? 95 00:11:32,910 --> 00:11:35,390 Well, this fence would not rest on wheel two anymore. 96 00:11:35,390 --> 00:11:39,950 It would drop down ever so slightly and rest on wheel three. 97 00:11:39,950 --> 00:11:48,250 That means this nose would be lower in the contact area and there's less wiggle room between the contact points. 98 00:11:48,850 --> 00:11:54,790 The really cool thing about this is you can feel this on the dial. 99 00:11:55,350 --> 00:12:13,070 So if I were to reset this, you can see that the nose drops into the contact area when it's over the contact area and that allows the fence to rest onto the wheel pack. 100 00:12:14,790 --> 00:12:22,010 So if the largest wheel has the gate under the fence, this nose is lower. 101 00:12:22,010 --> 00:12:25,850 And so this wiggle room, you can feel this bit of resistance. 102 00:12:25,850 --> 00:12:29,350 You can feel each contact point from the dial. 103 00:12:29,390 --> 00:12:32,130 That wiggle room would be less. 104 00:12:32,750 --> 00:12:40,770 So the contact points, about 96 for the left one, we name it from viewing the dial. 105 00:12:41,810 --> 00:12:51,790 So the more sloped side here on the left in this view is the right contact point because from the front of the safe, that's the right. 106 00:12:52,530 --> 00:12:53,890 Oops. 107 00:12:54,250 --> 00:13:00,570 So this left contact point is about 96 and the right contact point is about 3. 108 00:13:00,910 --> 00:13:10,950 But if perhaps two of the wheels were dialed with the gate under the fence, we might feel this at 98 and 2. 109 00:13:10,950 --> 00:13:15,890 Thus the closer contact points, less wiggle room. 110 00:13:16,310 --> 00:13:23,490 So that is a major vulnerability and the main thing we use in order to determine the combination. 111 00:13:23,590 --> 00:13:38,070 So we can know through this when one of the gates, when the gate of the largest wheel is under the fence simply because there will be less wiggle room between the contact points. 112 00:13:38,870 --> 00:13:45,410 So the first step is finding a number in the combination with this information that we now have. 113 00:13:45,530 --> 00:13:53,650 So what we do is we have to take a series of test combinations every two or two and a half numbers. 114 00:13:54,170 --> 00:14:03,590 The tolerances of these locks sometimes allow you to go every two and a half, but generally it is safer just to go every two numbers. 115 00:14:05,630 --> 00:14:13,970 And there are two contact points, the left and the right, but as shown earlier the right contact point is more sloped. 116 00:14:13,970 --> 00:14:22,670 So there will be a greater change in the amount of wiggle room from the right contact point. 117 00:14:22,670 --> 00:14:26,890 The left will move in a little bit, but not as much as the right. 118 00:14:27,250 --> 00:14:32,550 So we really only need to know what the right contact point is at any given time. 119 00:14:32,550 --> 00:14:34,930 And you can graph this as well. 120 00:14:35,990 --> 00:14:43,590 So if I get my graph paper right here, you can see this is a basic layout of a graph. 121 00:14:43,590 --> 00:14:53,810 So along the top we have 0 to 100, and then here I put the closest whole number to the left contact point, one above and one below. 122 00:14:54,150 --> 00:14:57,830 Same thing with the right contact point, one above and one below. 123 00:14:58,870 --> 00:15:11,630 And as I mentioned, you don't really need the left contact point, but it is good supporting evidence if the right contact point is not really giving clear readings, which we will cover later. 124 00:15:11,970 --> 00:15:15,130 So you can graph both of the contact points like this. 125 00:15:15,130 --> 00:15:28,530 So first thing is you want to turn the dial left three times to pick up all of the wheels, and then stop on the first reading. 126 00:15:28,530 --> 00:15:30,910 So we can just say we're going to try zero. 127 00:15:30,910 --> 00:15:43,350 Now the reason we spin left and we pick up all the wheels with left rotation is because the combination is found or is dialed with left, right, and then left rotation. 128 00:15:43,350 --> 00:15:48,930 So left to the first number, right to the second, and then left to the third. 129 00:15:49,330 --> 00:15:53,090 So if we find a number, it's kind of random. 130 00:15:53,090 --> 00:15:55,770 We don't really know which wheel is going to be at first, right? 131 00:15:55,770 --> 00:16:05,010 We just know one of the wheels is larger than the rest, and we want to figure out when that wheel has a gate under the fence. 132 00:16:05,310 --> 00:16:13,230 So it's just, you know, statistics that it's going to be more likely the first and the third rather than the second. 133 00:16:13,250 --> 00:16:23,050 Also, because of the way the locks are designed, wheel three would generally be larger or would be the wheel that makes contact with the fence first. 134 00:16:23,490 --> 00:16:28,590 So that's more evidence to start with more reason to start with left rotation first. 135 00:16:30,070 --> 00:16:38,050 So what we do is we spin the dial, pick up all the wheels with left rotation, and then we stop at our first test combination. 136 00:16:38,050 --> 00:16:40,530 So in this case that would be zero, zero, zero. 137 00:16:40,530 --> 00:16:41,730 So we stop at zero. 138 00:16:42,670 --> 00:16:48,290 And then what we do is we want to reverse directions because if we were to keep going that would mess up the position of the wheels. 139 00:16:48,290 --> 00:16:53,950 So we reverse directions until we get within the contact area. 140 00:16:53,950 --> 00:16:59,650 So remember our contact points are 96 and 3, so we want to spin left until we're within that. 141 00:16:59,650 --> 00:17:05,290 We don't want to pass zero, because remember after one full rotation we pick up the third wheel. 142 00:17:05,290 --> 00:17:12,870 So we just want to go between zero and three, and then you just spin. 143 00:17:12,970 --> 00:17:15,670 I accidentally passed it but we'll ignore that for now. 144 00:17:15,910 --> 00:17:21,490 You want to gently spin the dial left until you hit the contact point. 145 00:17:21,630 --> 00:17:23,330 And you don't want to ride up on it. 146 00:17:23,330 --> 00:17:27,170 You don't want the nose to ride up onto the drive cam. 147 00:17:27,170 --> 00:17:34,230 You just want to go lightly and stop when you feel that bit of resistance. 148 00:17:34,230 --> 00:17:35,670 And then you can record that. 149 00:17:35,670 --> 00:17:46,910 So on the graph at zero down to three, let's say we feel at two and seven eighths. 150 00:17:46,910 --> 00:17:53,270 Then you can mark that from here two and seven eighths for zero. 151 00:17:53,670 --> 00:17:57,190 Okay so that can be about here. 152 00:17:57,950 --> 00:18:05,570 And that is also really important, is you want to be able to differentiate between one eighth of an increment. 153 00:18:05,670 --> 00:18:14,250 And that's really hard to show on camera here for this because it's not really precise, and also the resolution of the camera. 154 00:18:14,250 --> 00:18:26,830 But you want to be able to look at the dial and know whether it is showing like a two and seven eighths, or a three, or a 35 and one eighth, or a 35 and two eighths. 155 00:18:26,830 --> 00:18:29,310 And you want to be able to accurately record that. 156 00:18:29,310 --> 00:18:34,470 Because what we're looking for is a change of a one quarter increment. 157 00:18:34,470 --> 00:18:40,810 So we want to make sure that our measurements are taken with a precision of one eighth of an increment just to be safe. 158 00:18:48,280 --> 00:18:51,860 So we're going to pretend that we did this for the entire 159 00:18:56,180 --> 00:19:01,220 I guess all the numbers of the of the safe. 160 00:19:01,220 --> 00:19:09,720 So if I were just to fill it in just with some random points, 161 00:19:13,490 --> 00:19:21,930 and I'm just putting a generic reading here. 162 00:19:21,990 --> 00:19:26,990 And as stated earlier, you can record the left contact point here as well. 163 00:19:26,990 --> 00:19:30,150 It's just that it's not going to be as much of a variation. 164 00:19:31,410 --> 00:19:44,330 So here, essentially what we're doing is we are taking the overall shape of all the wheels of the wheel pack, and we're just laying it out in a line. 165 00:19:44,330 --> 00:19:53,850 So if this were to be cut into a strip of paper and put into a circle, this is what the wheel pack would look like on a very fine scale. 166 00:19:54,330 --> 00:19:56,650 Because remember, they're not perfectly circular. 167 00:19:56,650 --> 00:20:02,010 So on a very fine scale, there's a lot of bumps and ridges and whatnot. 168 00:20:02,410 --> 00:20:09,650 Now if you remember, I'll show the picture again of the close-up. 169 00:20:11,190 --> 00:20:19,670 When the gate of the largest wheel is under the fence, that causes a drop, right? 170 00:20:19,670 --> 00:20:21,230 There's less wiggle room. 171 00:20:21,230 --> 00:20:24,030 That right contact point moves in, so it gets lower. 172 00:20:24,030 --> 00:20:26,050 The left contact point would get higher. 173 00:20:26,610 --> 00:20:29,710 So that's essentially what we're looking for on the graph. 174 00:20:29,710 --> 00:20:36,270 We're looking for where the right contact point drops down for maybe a number or two, and then goes back up. 175 00:20:36,470 --> 00:20:42,150 Because the gate would be under the fence, and then you would go past it, and it would not be under the fence anymore. 176 00:20:42,150 --> 00:20:43,310 So it would drop down and go up. 177 00:20:43,310 --> 00:20:48,210 So essentially, you want to look for the shape of a gate in this reading. 178 00:20:48,810 --> 00:20:54,590 Now you can see there's a drop here, but it goes on for a little while before going up, so that's probably not it. 179 00:20:54,590 --> 00:20:57,790 That would be really wide for a gate. 180 00:20:58,810 --> 00:21:08,130 But here, you can see it drops down for a quarter of an increment for two readings, and then drops back up. 181 00:21:08,130 --> 00:21:13,790 The thing about these safe locks is you don't have to be precise in dialing. 182 00:21:13,790 --> 00:21:15,890 That is also why we go every two numbers. 183 00:21:15,890 --> 00:21:20,390 You go from 0, 2, and then 4, every line here on this graph. 184 00:21:20,490 --> 00:21:30,150 So if the combination is 16, 28, 40, you can dial 17 or maybe 18, 28, 40, and it would still open. 185 00:21:30,710 --> 00:21:37,340 So you want to look for the shape of the gate in the graph, and that will tell you... 186 00:21:38,420 --> 00:21:44,960 The middle of that gate will tell you one of the numbers in the combination. 187 00:21:48,390 --> 00:21:53,010 Now we're going to assume that the number we found is 40. 188 00:21:53,010 --> 00:22:02,710 So at this point, we know that the largest wheel in the lock has a combination of 40 associated with it. 189 00:22:02,890 --> 00:22:04,130 But we don't know which wheel yet. 190 00:22:04,130 --> 00:22:18,690 We just know that one of the wheels in the lock is larger than the others, and the point at which the contact area goes closer together and then further apart centers around 40. 191 00:22:18,710 --> 00:22:21,110 So we do something called the high load test. 192 00:22:21,110 --> 00:22:30,750 We put 10 numbers lower on the first wheel, and then we put the other two wheels on the correct number. 193 00:22:30,750 --> 00:22:31,820 So we found... 194 00:22:31,820 --> 00:22:34,540 We're pretending we found 40 as the correct number. 195 00:22:34,660 --> 00:22:40,540 So we will throw the first wheel off by 10, 10 numbers lower. 196 00:22:41,820 --> 00:22:44,720 Now we found 40 with left rotation. 197 00:22:44,720 --> 00:22:51,120 So whenever we put one of the wheels on 40, it always has to be with left rotation. 198 00:22:51,340 --> 00:22:55,260 So the first number, we will use right rotation to 30. 199 00:22:55,260 --> 00:23:01,340 We pick up the wheels, all the wheels, so four rotations to 30 with right rotation. 200 00:23:01,460 --> 00:23:04,400 And then we spin left three times to 40. 201 00:23:04,400 --> 00:23:07,540 So that would put the second and third wheel on 40. 202 00:23:08,440 --> 00:23:11,180 And we will measure the contact area here. 203 00:23:11,180 --> 00:23:15,060 And here it is important to take both left and right contact points. 204 00:23:15,060 --> 00:23:17,720 And then what you want to do is figure out the space between them. 205 00:23:17,720 --> 00:23:23,480 So if it is at 96 and 3, that is a 7 number difference. 206 00:23:23,480 --> 00:23:24,720 So we would write down 7. 207 00:23:24,720 --> 00:23:26,740 And we would record that down. 208 00:23:27,440 --> 00:23:29,620 And then we do the same with the second wheel. 209 00:23:29,700 --> 00:23:33,840 We put the first number on the correct number. 210 00:23:33,840 --> 00:23:35,460 So left to 40. 211 00:23:35,520 --> 00:23:37,400 Left four times to 40. 212 00:23:37,400 --> 00:23:39,980 And then go right three times to 30. 213 00:23:40,880 --> 00:23:45,220 Putting the second wheel, throwing it off by 10 lower to the wrong number. 214 00:23:45,480 --> 00:23:48,360 And then left to 40 on the third wheel. 215 00:23:48,720 --> 00:23:51,640 Record the space between the contact points. 216 00:23:51,640 --> 00:23:53,360 How many numbers there are. 217 00:23:53,580 --> 00:23:54,960 And then write that down. 218 00:23:56,720 --> 00:23:59,840 Now we do that again for the third wheel. 219 00:23:59,840 --> 00:24:02,080 Left rotation four times to 40. 220 00:24:02,260 --> 00:24:04,620 And right twice to 30. 221 00:24:05,060 --> 00:24:08,700 That ensures that only one number is off. 222 00:24:08,700 --> 00:24:12,080 The other two wheels are on the correct number. 223 00:24:12,820 --> 00:24:15,900 And then you can repeat with 50 as well instead of 30. 224 00:24:15,900 --> 00:24:17,800 So that would be the high test. 225 00:24:18,820 --> 00:24:27,900 Now the test combination with the widest contact area is the one that 40 belongs to. 226 00:24:28,400 --> 00:24:33,460 So for instance, we did three test combinations here for this low test. 227 00:24:33,640 --> 00:24:39,660 If for this last sequence that we dialed, 40, 40, 30. 228 00:24:40,060 --> 00:24:46,700 If that has the contact area with the most space between it. 229 00:24:46,700 --> 00:24:53,880 Now normally before we were looking for closer contact points, but here we're looking for furthest apart. 230 00:24:54,340 --> 00:25:05,540 And the reason for that is because we have the correct number on the wheel, on two of the wheels, and the wrong one on one of the wheels. 231 00:25:05,540 --> 00:25:12,480 So if the wrong one is on, let's say here, let's say the third wheel has 40. 232 00:25:12,480 --> 00:25:18,740 So if we're intentionally putting on the wrong number, it's going to be a wider contact point. 233 00:25:18,740 --> 00:25:22,500 But seeing these two, it's got the correct number, so it'll be closer. 234 00:25:22,520 --> 00:25:35,020 So this allows us to figure out which wheel that 40 belongs to, simply by putting the correct number on each wheel twice, and then having it off on one of these. 235 00:25:35,020 --> 00:25:48,700 So if this wheel, if wheel three has 30, and it's wider here than the other two tests, then we can successfully conclude that 40 belongs to the third wheel, the third number in the combination. 236 00:25:49,420 --> 00:25:55,900 And then you can, you know, repeat with 50 just to really be sure that your readings are correct. 237 00:25:55,980 --> 00:26:00,860 So we're going to assume that 40 here is the third number in the combination. 238 00:26:01,500 --> 00:26:03,180 And then yeah, check your rotation. 239 00:26:03,180 --> 00:26:11,420 Anytime you dial to a correct number, you want to make sure you always use the correct rotation. 240 00:26:13,060 --> 00:26:18,000 Now we found one of the numbers in the combination, and we know it's the third wheel. 241 00:26:18,000 --> 00:26:27,220 So in order to find the other numbers, we essentially just repeat the same step with this new information added in. 242 00:26:27,460 --> 00:26:36,500 So we run the other two wheels through every two increments, but we have the third wheel on 40 whenever we read the contact point. 243 00:26:36,960 --> 00:26:46,940 So the way that this is done is we know that the third wheel, right, the first wheel that gets picked up, that means we have to set it last. 244 00:26:46,940 --> 00:26:48,940 That is with left rotation to 40. 245 00:26:49,400 --> 00:27:02,900 So what we want to do is we want to pick up all the wheels with right rotation now, and then we'll say let's start at zero, and then we spin left for one rotation. 246 00:27:02,960 --> 00:27:08,420 So that picks up just the third wheel, and we stop on 40. 247 00:27:08,420 --> 00:27:10,440 So now we have left rotation on 40. 248 00:27:12,020 --> 00:27:19,500 Now going to zero isn't going to affect any of the wheels now, remember, because we have to pick up the third wheel in order to affect the rest. 249 00:27:19,500 --> 00:27:25,980 So we can safely move around here without fear of disturbing the other wheels. 250 00:27:25,980 --> 00:27:28,300 So we can read the contact point again. 251 00:27:28,420 --> 00:27:35,080 Going from inside the contact area, we can read the right contact point and then graph it. 252 00:27:35,080 --> 00:27:48,460 So we just do this graph, and at the top we can maybe just write wheel 3 left 40, just so we know that we're doing this graph with wheel 3 on 40 with left rotation. 253 00:27:49,240 --> 00:27:53,620 And then what you can do now is you turn right until you reach 40. 254 00:27:53,620 --> 00:27:55,360 Now that picks up the third wheel. 255 00:27:57,040 --> 00:28:10,140 Go to zero where the other two wheels are resting together, and that picks up wheels 2 and wheels 1 at the same time, because remember we had everything picked up together. 256 00:28:10,140 --> 00:28:13,880 We only messed up wheel 3 in order to put it on 40 by itself. 257 00:28:13,880 --> 00:28:27,240 You can turn two numbers over, spin left again one full rotation to 40, go to the contact area, and report it down again. 258 00:28:27,240 --> 00:28:30,540 And we just go do that the whole way around. 259 00:28:32,560 --> 00:28:36,480 So here we can repeat the same high-low exercise. 260 00:28:36,480 --> 00:28:45,060 So we're going to pretend we found a drop in the graph and then a rise back up centered around 80. 261 00:28:45,060 --> 00:28:48,220 So we found 80 with right rotation now. 262 00:28:48,260 --> 00:28:51,920 So what we're going to do here is a low test. 263 00:28:52,160 --> 00:28:58,860 We're going to start with wheel 2, and we're going to throw it off by 10 onto 70. 264 00:28:58,900 --> 00:29:02,960 So wheel 1 we put it on the correct number, 80, with right rotation. 265 00:29:02,960 --> 00:29:07,400 So that means we spin right, picking up all the wheels, stopping on 80. 266 00:29:07,400 --> 00:29:12,220 Then we spin left, picking up wheels 3 and 2. 267 00:29:12,220 --> 00:29:14,460 So we go three times to 70. 268 00:29:15,180 --> 00:29:19,140 And then here's where it gets interesting. 269 00:29:19,140 --> 00:29:28,580 We need to go to 40 now with left rotation because we found 40 as the correct number with left rotation for wheel 3. 270 00:29:28,580 --> 00:29:35,660 But if we were to continue past 70 left into 40, it would mess up wheel 2. 271 00:29:36,300 --> 00:29:40,020 So there's actually a clever way to fix this. 272 00:29:40,020 --> 00:29:50,200 So we spin right, picking up all the wheels, and then we stop on 80, which is what we found to be one of the other numbers. 273 00:29:50,200 --> 00:30:01,100 We can spin left, one rotation, picking up wheel 3, another rotation, picking up wheel 2, and we want to put wheel 2 with left rotation on 70. 274 00:30:01,100 --> 00:30:03,460 So that is 10 lower. 275 00:30:04,360 --> 00:30:07,580 And then we want to go to 40 now for the third wheel. 276 00:30:07,580 --> 00:30:11,960 But if we were to keep going, it would mess up wheel 2 on 70. 277 00:30:11,960 --> 00:30:24,680 So what we do is we can reverse directions here, pick up wheel 3 from 70, go to 40, but remember this is not the correct rotation. 278 00:30:24,680 --> 00:30:25,640 We're turning right. 279 00:30:25,640 --> 00:30:27,100 We need to be turning left. 280 00:30:27,100 --> 00:30:44,460 So we just go past it, let's say to 30, and then we can go left, picking up at 30, setting wheel 3 on 40, at which point we take our contact point readings, or our high-low test. 281 00:30:44,820 --> 00:30:53,080 And then again, you would write down the number of increments, the space between each of the contact points. 282 00:30:53,540 --> 00:30:56,920 And then do that with the first wheel. 283 00:30:56,920 --> 00:30:58,660 We throw the first wheel off by 10. 284 00:30:58,660 --> 00:31:04,980 So we go left to 70 for the first wheel, picking up all the wheels, and then right three times to 80, and then left to 40. 285 00:31:05,860 --> 00:31:08,720 So we write down the numbers. 286 00:31:08,720 --> 00:31:20,740 Again, we look at what is the widest contact area, and that will give us where our second number lies, which wheel it belongs to. 287 00:31:21,540 --> 00:31:23,320 And usually locks will read this way. 288 00:31:23,320 --> 00:31:26,740 It will read third wheel first, and then the second wheel, and then the first. 289 00:31:26,820 --> 00:31:29,400 But sometimes it can go other ways. 290 00:31:29,400 --> 00:31:33,420 But following this method, it doesn't really matter which wheel reads first. 291 00:31:33,420 --> 00:31:42,460 As long as you know how to dial in these numbers, then you can still do it just fine, no matter which wheel reads first. 292 00:31:42,460 --> 00:31:45,480 And then here, we have two of the numbers in combination. 293 00:31:45,480 --> 00:31:47,940 So let's pretend that 80 belongs to wheel 2. 294 00:31:47,940 --> 00:31:50,520 So it's a question mark for wheel 1. 295 00:31:50,600 --> 00:31:56,640 We know 80 is right rotation to wheel 2, and then 40 is left rotation to wheel 3. 296 00:31:57,360 --> 00:32:01,880 And the last wheel, you can graph it, but generally you just brute force it. 297 00:32:01,880 --> 00:32:08,140 You would just try 2, 80, 40, or 0, 80, 40, 2, 80, 40, 4, 80, 40, until it opens. 298 00:32:08,960 --> 00:32:18,920 When you're starting out, it is actually a good idea to graph that last wheel as well, just in case you messed up on the first two and you did not find the correct number. 299 00:32:19,540 --> 00:32:22,400 It is useful to have that extra information. 300 00:32:24,500 --> 00:32:27,180 Now there's different group 2 locks. 301 00:32:27,580 --> 00:32:36,900 The one I am using here that I have shown is what is called a Sargent and Greenleaf and S&G 6730. 302 00:32:36,900 --> 00:32:41,780 There's two major variations of 6730 and 6741. 303 00:32:41,780 --> 00:32:47,320 They operate the same way, work the same, you cannot tell by looking at it which one it is. 304 00:32:47,320 --> 00:32:59,880 It's just that the 6730 has slightly tighter manufacturing tolerances, which is why I recommend going every two increments on your graph rather than every two and a half. 305 00:32:59,880 --> 00:33:18,180 But if you know you have a 6741, if it is labeled a 6741, then you can get away with going every two and a half increments because those tolerances in the manufacturing are not as tight and you will be able to find the correct number by going every two and a half increments. 306 00:33:20,220 --> 00:33:24,460 Now another popular brand is Lagarde, the Lagarde 3330. 307 00:33:24,460 --> 00:33:45,960 They have slightly oval wheels and the reason for that is because of the way that inside the wheels work, there's a certain mechanism that allows you to change the combination and that puts pressure on the wheels in certain ways and that just makes it slightly more oval shaped, 308 00:33:45,960 --> 00:33:51,340 which means the wheels can essentially mask the gates on other wheels. 309 00:33:51,340 --> 00:34:10,620 Maybe none of the the wheels are, you know, bigger than the others but they can be aligned that when they're all picked up and they're all moving together, the oval shape covers, essentially becomes the biggest part of the wheel pack in that location and that gate is never going to be, 310 00:34:10,620 --> 00:34:17,620 is never going to allow the fence to drop lower because one of the other wheels will be larger in that area. 311 00:34:18,240 --> 00:34:25,100 And so it can be rather difficult to work with a Lagarde 3330 so I do not recommend starting out with that. 312 00:34:25,220 --> 00:34:37,140 There is also a divold which is a lock with a drive cam where instead of having one side that's more slanted, it will be a U-shape, more uniform U-shape. 313 00:34:37,140 --> 00:34:46,020 And so in the case of a divold group 2, you want to take both contact points into account since there will be less variation. 314 00:34:46,020 --> 00:34:52,780 You want to take both into account and look at the left going up and the right contact point going down. 315 00:34:54,300 --> 00:34:55,420 Whoops. 316 00:34:56,660 --> 00:35:02,300 Now some final tips is you want to be really precise in dialing. 317 00:35:02,300 --> 00:35:08,840 You want to not just read it in one-eighth of an increment, but you want to dial to one-eighth of an increment. 318 00:35:08,840 --> 00:35:17,560 You want to make sure you're not accidentally dialing 16 and one-eighth or 16 and one-fourth because you're going every two increments. 319 00:35:17,560 --> 00:35:20,020 So maybe the combination is 15. 320 00:35:20,120 --> 00:35:26,100 You don't want to go 16 and one-eighth and have it not open, but maybe on 16 you can detect it. 321 00:35:26,100 --> 00:35:29,780 You can detect that it's the correct number but not 16 and one-eighth. 322 00:35:29,920 --> 00:35:35,160 You want to make sure you're reading the dial from the same angle each time. 323 00:35:35,160 --> 00:35:40,260 So if you're looking at the safe lock, you want to make sure you are reading from the same angle. 324 00:35:40,260 --> 00:35:42,800 Let's say you're reading it from this angle this time. 325 00:35:42,800 --> 00:35:50,800 You don't want to look at it like this as that will change where you think that contact point is. 326 00:35:50,900 --> 00:35:56,500 So you want to make sure you're really consistent, especially also with the amount of force that you use. 327 00:35:56,500 --> 00:36:01,360 You want to make sure it's the lightest possible and you want to make sure it is the same each time. 328 00:36:01,660 --> 00:36:04,360 So you want to be really consistent in everything you do. 329 00:36:05,520 --> 00:36:08,100 You can also try it with a known combination. 330 00:36:08,220 --> 00:36:12,020 You can, let's say you know the combination is 20, 40, 60. 331 00:36:12,100 --> 00:36:16,680 Well you can test at 20, 40, and 60. 332 00:36:16,680 --> 00:36:19,880 You don't have to graph the entirety of the dial. 333 00:36:19,940 --> 00:36:40,640 So just to be able to detect how the contact point feels when one of the gates is under the fence and how it feels when it's not, you can graph from let's say 10 to 30 and then like you know 10 above and 10 below each of the numbers 20, 40, and 60 so that you can tell how the graph is supposed to look. 334 00:36:40,640 --> 00:36:44,940 And that is a very very useful practice to do. 335 00:36:45,440 --> 00:36:54,420 You can also remove the back cover of the lock so that you know exactly what's happening and you can really correlate what you're feeling with what is happening inside the lock. 336 00:36:54,420 --> 00:36:57,420 And then if all else fails you can buy my book. 337 00:36:57,460 --> 00:36:59,860 Well not really, I put it online for free. 338 00:36:59,860 --> 00:37:06,060 So it is on Amazon but I don't recommend it unless you really want a hard copy. 339 00:37:06,320 --> 00:37:15,840 There's a PDF I have uploaded at this link down here and you can download it and basically just do whatever you want with it. 340 00:37:15,860 --> 00:37:17,020 I don't care. 341 00:37:17,940 --> 00:37:22,200 Now on YouTube I have a video series that follows a book. 342 00:37:22,200 --> 00:37:26,900 It's similar to this talk but it's a lot more in-depth. 343 00:37:26,900 --> 00:37:43,000 So it covers different sections that I have covered here in this talk but with much greater detail and I also cover additional more advanced techniques in order to figure out the combination faster and with greater precision. 344 00:37:43,380 --> 00:38:01,280 There's online forums such as this link at the bottom here it points to keypicking.com and they are very welcoming to newcomers as long as you are able to show that you are not trying to use this knowledge for criminal activities and you are interested in this as a hobby. 345 00:38:01,280 --> 00:38:03,240 I mean people are very welcoming. 346 00:38:03,240 --> 00:38:06,260 On ebay you can buy locks on ebay. 347 00:38:06,360 --> 00:38:12,560 I highly recommend sng6730 or 6741. 348 00:38:12,680 --> 00:38:17,060 You can also just search up sng6700 series. 349 00:38:17,910 --> 00:38:19,400 And just practice. 350 00:38:19,400 --> 00:38:22,820 I mean practice is the best way to learn. 351 00:38:22,820 --> 00:38:34,240 I mean you can read and watch all the content on safecracking and understand everything that's happening but you cannot develop the touch for feeling the contact point. 352 00:38:34,240 --> 00:38:39,680 You don't develop the sight for reading the contact point unless you actually practice. 353 00:38:40,120 --> 00:38:44,200 And I also just remember I forgot to mention this picture here. 354 00:38:44,200 --> 00:39:00,580 So in order to read the contact points and dial it more accurately you can take a piece of paper or maybe a needle or anything and tape it onto the dial and the dial ring just to be able to more precisely pinpoint what is on the dial. 355 00:39:01,580 --> 00:39:04,380 And that is the end of this presentation.