[00:01.370 --> 00:07.230] Welcome to Safe Cracking for Everyone! A little bit about myself, who am I? My name is Jared [00:07.230 --> 00:12.650] Digert. I'm a lock support enthusiast, gamer, rock climber, game developer, and I've been picking [00:12.650 --> 00:19.370] locks and cracking safes for about a decade now. So this talk is going to cover how Group 2 safe [00:19.370 --> 00:27.270] locks work, and mechanical combination safe locks are divided into two groups. There's Group 2s, [00:27.270 --> 00:33.170] which is your basic safe lock, no anti-manipulation features in them, also the most common type, [00:33.170 --> 00:37.750] and then there's Group 1s, which are more complicated and include various different [00:37.750 --> 00:44.730] measures to keep people from figuring out the combination. Now, whether you buy a $500 safe [00:44.730 --> 00:51.910] or a $5,000 safe, if it comes with a mechanical safe lock, it will most likely be a Group 2 safe [00:51.910 --> 00:59.570] lock. Very rarely are there Group 1 safe locks that come by default on a safe. Usually you have [00:59.570 --> 01:06.570] to pay hundreds of dollars extra for the lock, even more to get it installed, and this is not [01:06.570 --> 01:12.290] very common at all. So I'll be covering these Group 2 safe locks in this talk. I'll cover the [01:12.290 --> 01:17.590] flaws in this design and how to exploit them, along with specific techniques that is used to [01:17.590 --> 01:23.150] crack the combination. And at the end, I'll cover some slight differences between various Group 2 [01:23.150 --> 01:29.390] safe locks, since not all manufacturers create them the same way. First thing is knowing the [01:29.390 --> 01:34.610] parts of the lock. So this is the back of the lock with the back cover removed, and you can see that [01:34.610 --> 01:40.590] there is a silver lever here. Now, the end of this lever has a protrusion, and this protrusion is [01:40.590 --> 01:48.250] called the nose. This nose is resting on a brass wheel. The brass wheel is called a drive cam, [01:48.650 --> 01:55.730] and this drive cam, you can see, has a cutout in it. This space, this empty space in the drive cam, [01:55.730 --> 02:04.270] is called the contact area. You can see where the cutout starts on either end, and those are the [02:04.270 --> 02:11.910] contact points. So the cutout is the contact area, and each end of the cutout, where it starts, is the [02:11.910 --> 02:19.190] contact points. And this drive cam is controlled directly by the dial. So there's a metal rod, you [02:19.190 --> 02:23.770] can see, in the middle, and that connects it directly to the dial. It's locked in place with [02:23.770 --> 02:31.490] this key. So whenever you turn the dial, the drive cam moves at the same time with the dial. [02:32.270 --> 02:38.790] Behind the drive cam, you can see a larger silver wheel. There's three of these wheels, generally, [02:38.790 --> 02:44.550] in each lock. Sometimes there could be four, but most often times it's three. Now, this wheel that [02:44.550 --> 02:51.130] we see here is called wheel three. It's the third wheel. It's closest to the drive cam, and when [02:51.130 --> 02:57.770] you're in front of the lock, it would be furthest away from you. And the other two wheels are behind [02:57.770 --> 03:04.810] it. Now, each of these wheels are exactly the same. There is a cutout in each of these wheels [03:04.810 --> 03:13.780] called a gate. Now, these gates are part of when you dial the combination. [03:14.810 --> 03:24.550] The gates all line up, and there is a metal bar behind this lever, and it lines up all of these [03:24.550 --> 03:30.930] gates under the metal bar when you dial the correct combination. So that when you turn the dial [03:30.930 --> 03:37.150] and the drive cam, so the contact area is under the nose, everything can fall down and fit nice [03:37.150 --> 03:45.150] and easily. So here, you would just continue turning the dial, and that would pull in this lever, [03:45.150 --> 03:50.530] and that retracts a bolt. The lever is attached to the bolt, and that pulls it in so that you [03:50.530 --> 03:58.350] can turn the handle and open the safe. The handle of a safe just pulls in the outermost bolts around [03:58.350 --> 04:04.610] the edge of the door so that you can open it, but the lock itself only locks the handle. So that's [04:04.610 --> 04:10.870] basically how safes operate. It's a locking mechanism locks the handle, and the handle is [04:10.870 --> 04:18.190] what pulls in the bolts from the outer edge of the door. Now, to demonstrate that, [04:18.930 --> 04:24.690] I have a lock here, and if we look at the back, you can see the drive cam. [04:25.050 --> 04:30.870] Whenever I spin the dial, the drive cam moves with the dial. [04:32.150 --> 04:40.930] So if I were to dial in the combination, that would involve putting the gate of the first wheel [04:41.890 --> 04:50.190] under the fence, and then I would put the gate of the second wheel under the fence as well. I messed [04:50.190 --> 05:00.010] that up, but I will just fix it. And then I put the gate of the third wheel under the fence. I simply [05:00.010 --> 05:07.270] turn the drive cam so everything can fall in, and then that will retract this bolt when I continue [05:07.270 --> 05:21.900] turning. Now the way that it works is each of these wheels has a protrusion on one side, and [05:21.900 --> 05:29.920] that fits into a groove of the next wheel. Now this protrusion will ride in this groove as the wheel [05:29.920 --> 05:37.460] spins until it hits this metal piece of the next wheel, at which point this next wheel will start [05:37.460 --> 05:45.380] to spin along with the previous wheel. And this wheel also has a protrusion which rides in a groove [05:46.020 --> 05:54.560] of the wheel next to it, and then after a whole rotation it will hit this metal bit, and then the [05:54.560 --> 06:00.880] next wheel will start to spin along with the rest of the wheels, essentially picking up each wheel [06:00.880 --> 06:07.560] after each rotation. So the drive cam has that sort of [06:09.920 --> 06:15.160] protrusion as well. So right now everything is spinning together, but if I were to spin the other [06:15.160 --> 06:21.620] way, you can see it is only the drive cam spinning until I make one full rotation, and then this third [06:21.620 --> 06:28.200] wheel, the wheel closest to the drive cam, starts spinning with it. So the third wheel gets picked [06:28.200 --> 06:35.700] up first, and then after another full rotation, you can see that the second wheel starts to get [06:35.700 --> 06:42.920] picked up as well, and it is spinning along with it. After another rotation, then this third wheel, [06:42.920 --> 06:48.600] or this first wheel, gets picked up as well. And the wheels are named this way because the first [06:48.600 --> 06:53.980] wheel corresponds to the first number in the combination. Since it is the last to get picked up, [06:53.980 --> 07:03.780] then it is set first. So then you can freely mess about with the other two wheels without upsetting [07:04.380 --> 07:10.020] the position of that first one. So the third wheel gets picked up first, corresponding to the third [07:10.020 --> 07:20.110] number in the combination, then the second wheel, and then the first wheel. Now the standard opening [07:20.110 --> 07:25.310] procedure for a lock is to spin four times with left rotation to the first number, which means [07:25.310 --> 07:31.470] you pass the first number three times, and you stop on the fourth. Then you reverse directions, [07:31.470 --> 07:37.050] because if you were to keep going, it would mess up the position of the first wheel. So you reverse [07:37.050 --> 07:45.290] direction, spin three times with right rotation, so now we are turning clockwise to the second [07:45.290 --> 07:51.150] number. And then you do that three times. So you pass the second number twice, stop on the third [07:51.150 --> 07:56.750] time, and then twice with counterclockwise rotation, so we are reversing rotation again [07:56.750 --> 08:02.890] to the final number. We pass it once, and then we stop on the second time. Then we turn right until [08:02.890 --> 08:10.010] the bolt is retracted. Now the reason for this is because you have to spin three times to ensure all [08:10.010 --> 08:16.550] the wheels are picked up. You don't know the state of this wheel pack when you approach the lock, [08:16.550 --> 08:23.150] so it could be someone spun it to the right all the way before you approached it. So you want to [08:23.150 --> 08:31.690] make sure you spin one full rotation will pick up that third wheel, two full rotations picks up the [08:31.690 --> 08:38.510] second wheel, and then three full rotations ensures that that first wheel gets picked up. So we just [08:38.510 --> 08:45.910] pass the first number in the combination three times. So now we have to go to it and stop on the [08:46.550 --> 08:51.890] fourth time. We reverse directions because otherwise it would mess up the position of that [08:51.890 --> 08:58.670] first wheel. So we do one full rotation, pick up the third wheel, two full rotations, now we pick up the [08:58.670 --> 09:08.210] second wheel, and so we pass the second number twice, and we stop on the third time. And I overshot [09:08.210 --> 09:15.190] it again. Reverse directions, one full rotation picks up the third wheel, and then we stop on the second [09:15.190 --> 09:27.370] time. And then we can turn right so everything drops in and the bolt retracts. Here's a really [09:27.370 --> 09:33.490] bad drawing. I mislabeled this. This is wheel two in the middle. So the dial will turn the drive cam [09:33.490 --> 09:40.870] until this protrusion picks up wheel three, and then after rotating for some time, wheel three [09:40.870 --> 09:47.070] will pick up wheel two, and then wheel two after rotating will pick up wheel one, and so then they'll [09:47.070 --> 09:55.290] all start spinning together. There's a lot of vulnerabilities in this design. So you can see here [09:55.290 --> 10:02.310] when none of the numbers are dialed in correctly, and then we turn the drive cam, we turn the dial [10:02.310 --> 10:09.890] so that the contact area is under the nose. That allows the fence to drop down onto the [10:09.890 --> 10:16.590] wheel pack, essentially testing it for the correct combination. But the thing is, these wheels, [10:16.590 --> 10:22.530] they're not perfectly circular, and they're not the same size as each other. Some will be bigger, [10:22.530 --> 10:27.330] some will be smaller, and some will have bumps and dips, and that's because of manufacturing [10:27.330 --> 10:35.830] tolerances. It's basically impossible to get rid of these imperfections. What this means is, [10:35.830 --> 10:42.550] since one of these wheels is bigger, the fence is not going to be resting on all of the wheels at [10:42.550 --> 10:50.450] the same time. You can see here, between wheel three and the fence, there's actually a bit of space. [10:50.450 --> 10:58.150] It's not touching. Wheel two here, you can see, is larger than wheel three and wheel one. This fence [10:58.150 --> 11:06.650] is only touching wheel two. Now, we can also see that this contact area, where the contact points [11:06.650 --> 11:15.370] are on either end, it is sloped to go down. And that means there is less wiggle room, so to speak, [11:15.370 --> 11:22.810] between the sides of the contact area the further down you go. So let's assume that wheel two, [11:22.810 --> 11:29.770] let's pretend that the wheel two combination is valid, that the gate for wheel two is now under [11:30.490 --> 11:35.710] this fence. Well, what would happen? Well, this fence would not rest on wheel two anymore. It would [11:35.710 --> 11:42.570] drop down ever so slightly and rest on wheel three. That means this nose would be lower in the [11:42.570 --> 11:51.630] contact area and there's less wiggle room between the contact points. The really cool thing about [11:51.630 --> 12:04.410] this is you can feel this on the dial. So if I were to reset this, you can see that the nose drops [12:04.410 --> 12:10.790] into the contact area when it's over the contact area and that allows the fence to rest onto [12:11.610 --> 12:22.170] the wheel pack. So if the largest wheel has the gate under the fence, this nose is lower. And so [12:22.170 --> 12:27.430] this wiggle room, you can feel this bit of resistance. You can feel each contact point [12:28.010 --> 12:38.290] from the dial. That wiggle room would be less. So the contact points, about 96 for the left one, [12:38.290 --> 12:47.090] we name it from viewing the dial. So the more sloped side here on the left in this view [12:47.090 --> 12:51.790] is the right contact point because from the front of the safe, that's the right. [12:52.530 --> 13:00.570] Oops. So this left contact point is about 96 and the right contact point is about 3. [13:00.910 --> 13:08.510] But if perhaps two of the wheels were dialed with the gate under the fence, we might feel this at [13:08.510 --> 13:18.970] 98 and 2. Thus the closer contact points, less wiggle room. So that is a major vulnerability [13:18.970 --> 13:26.650] and the main thing we use in order to determine the combination. So we can know through this [13:26.650 --> 13:33.090] when one of the gates, when the gate of the largest wheel is under the fence simply because [13:33.090 --> 13:40.610] there will be less wiggle room between the contact points. So the first step is finding [13:41.050 --> 13:48.210] a number in the combination with this information that we now have. So what we do is we have to take [13:48.670 --> 13:56.010] a series of test combinations every two or two and a half numbers. The tolerances of these locks [13:56.010 --> 14:02.590] sometimes allow you to go every two and a half, but generally it is safer just to go every two [14:02.590 --> 14:11.310] numbers. And there are two contact points, the left and the right, but as shown earlier the right [14:11.310 --> 14:20.050] contact point is more sloped. So there will be a greater change in the amount of wiggle room [14:21.170 --> 14:26.890] from the right contact point. The left will move in a little bit, but not as much as the right. [14:27.250 --> 14:32.550] So we really only need to know what the right contact point is at any given time. [14:32.550 --> 14:39.810] And you can graph this as well. So if I get my graph paper right here, [14:40.830 --> 14:47.990] you can see this is a basic layout of a graph. So along the top we have 0 to 100, and then here I [14:47.990 --> 14:54.930] put the closest whole number to the left contact point, one above and one below. Same thing with [14:54.930 --> 15:01.390] the right contact point, one above and one below. And as I mentioned, you don't really need the left [15:01.390 --> 15:08.470] contact point, but it is good supporting evidence if the right contact point is not really giving [15:08.470 --> 15:15.130] clear readings, which we will cover later. So you can graph both of the contact points like this. [15:15.130 --> 15:25.350] So first thing is you want to turn the dial left three times to pick up all of the wheels, [15:25.350 --> 15:32.110] and then stop on the first reading. So we can just say we're going to try zero. Now the reason [15:32.110 --> 15:39.470] we spin left and we pick up all the wheels with left rotation is because the combination is found [15:39.470 --> 15:45.150] or is dialed with left, right, and then left rotation. So left to the first number, right to [15:45.150 --> 15:53.530] the second, and then left to the third. So if we find a number, it's kind of random. We don't really [15:53.530 --> 15:58.090] know which wheel is going to be at first, right? We just know one of the wheels is larger than the rest, [15:58.090 --> 16:06.690] and we want to figure out when that wheel has a gate under the fence. So it's just, [16:07.210 --> 16:11.810] you know, statistics that it's going to be more likely the first and the third rather than [16:11.810 --> 16:19.270] the second. Also, because of the way the locks are designed, wheel three would generally be larger or [16:19.270 --> 16:25.590] would be the wheel that makes contact with the fence first. So that's more evidence to start with [16:25.590 --> 16:33.910] more reason to start with left rotation first. So what we do is we spin the dial, pick up all the [16:33.910 --> 16:39.210] wheels with left rotation, and then we stop at our first test combination. So in this case that would [16:39.210 --> 16:45.390] be zero, zero, zero. So we stop at zero. And then what we do is we want to reverse directions because [16:45.390 --> 16:50.070] if we were to keep going that would mess up the position of the wheels. So we reverse directions [16:50.070 --> 16:57.670] until we get within the contact area. So remember our contact points are 96 and 3, so we want to [16:57.670 --> 17:02.610] spin left until we're within that. We don't want to pass zero, because remember after one full [17:02.610 --> 17:11.650] rotation we pick up the third wheel. So we just want to go between zero and three, and then you [17:11.650 --> 17:18.330] just spin. I accidentally passed it but we'll ignore that for now. You want to gently spin the dial [17:18.330 --> 17:24.450] left until you hit the contact point. And you don't want to ride up on it. You don't want the nose to [17:24.450 --> 17:33.690] ride up onto the drive cam. You just want to go lightly and stop when you feel that bit of [17:33.690 --> 17:44.530] resistance. And then you can record that. So on the graph at zero down to three, let's say we feel at [17:45.380 --> 17:54.130] two and seven eighths. Then you can mark that from here two and seven eighths for zero. Okay so that [17:54.130 --> 18:02.050] can be about here. And that is also really important, is you want to be able to differentiate [18:02.690 --> 18:09.990] between one eighth of an increment. And that's really hard to show on camera here for this [18:09.990 --> 18:15.450] because it's not really precise, and also the resolution of the camera. But you want to be able [18:15.450 --> 18:22.490] to look at the dial and know whether it is showing like a two and seven eighths, or a three, or a 35 [18:22.490 --> 18:29.310] and one eighth, or a 35 and two eighths. And you want to be able to accurately record that. [18:29.310 --> 18:35.350] Because what we're looking for is a change of a one quarter increment. So we want to make sure [18:35.350 --> 18:40.810] that our measurements are taken with a precision of one eighth of an increment just to be safe. [18:48.280 --> 18:51.860] So we're going to pretend that we did this for the entire [18:56.180 --> 19:05.480] I guess all the numbers of the of the safe. So if I were just to fill it in just with some [19:07.860 --> 19:24.330] random points, and I'm just putting a generic reading here. And as stated earlier, you can [19:24.330 --> 19:30.150] record the left contact point here as well. It's just that it's not going to be as much of a variation. [19:31.410 --> 19:38.950] So here, essentially what we're doing is we are taking the overall shape of all the wheels of [19:38.950 --> 19:47.530] the wheel pack, and we're just laying it out in a line. So if this were to be cut into a strip of paper [19:48.030 --> 19:53.850] and put into a circle, this is what the wheel pack would look like on a very fine scale. [19:54.330 --> 19:59.790] Because remember, they're not perfectly circular. So on a very fine scale, there's a lot of bumps [19:59.790 --> 20:09.650] and ridges and whatnot. Now if you remember, I'll show the picture again of the close-up. [20:11.190 --> 20:20.190] When the gate of the largest wheel is under the fence, that causes a drop, right? There's less [20:20.190 --> 20:25.250] wiggle room. That right contact point moves in, so it gets lower. The left contact point would get [20:25.250 --> 20:30.430] higher. So that's essentially what we're looking for on the graph. We're looking for where the [20:30.430 --> 20:37.350] right contact point drops down for maybe a number or two, and then goes back up. Because the gate [20:37.350 --> 20:41.670] would be under the fence, and then you would go past it, and it would not be under the fence [20:41.670 --> 20:45.990] anymore. So it would drop down and go up. So essentially, you want to look for the shape of a gate [20:46.630 --> 20:52.650] in this reading. Now you can see there's a drop here, but it goes on for a little while before [20:52.650 --> 21:00.770] going up, so that's probably not it. That would be really wide for a gate. But here, you can see [21:00.770 --> 21:08.590] it drops down for a quarter of an increment for two readings, and then drops back up. The thing [21:08.590 --> 21:14.310] about these safe locks is you don't have to be precise in dialing. That is also [21:14.310 --> 21:20.390] why we go every two numbers. You go from 0, 2, and then 4, every line here on this graph. [21:20.490 --> 21:30.150] So if the combination is 16, 28, 40, you can dial 17 or maybe 18, 28, 40, and it would still open. [21:30.710 --> 21:37.340] So you want to look for the shape of the gate in the graph, and that will tell you... [21:38.420 --> 21:44.960] The middle of that gate will tell you one of the numbers in the combination. [21:48.390 --> 21:54.230] Now we're going to assume that the number we found is 40. So at this point, we know that [21:54.230 --> 22:02.710] the largest wheel in the lock has a combination of 40 associated with it. [22:02.890 --> 22:07.570] But we don't know which wheel yet. We just know that one of the wheels in the lock is larger than [22:07.570 --> 22:16.630] the others, and the point at which the contact area goes closer together and then further apart [22:16.630 --> 22:25.090] centers around 40. So we do something called the high load test. We put 10 numbers lower [22:25.880 --> 22:31.820] on the first wheel, and then we put the other two wheels on the correct number. So we found... [22:31.820 --> 22:40.540] We're pretending we found 40 as the correct number. So we will throw the first wheel off by 10, 10 numbers lower. [22:41.820 --> 22:48.920] Now we found 40 with left rotation. So whenever we put one of the wheels on 40, it always has to be [22:48.920 --> 22:57.060] with left rotation. So the first number, we will use right rotation to 30. We pick up the wheels, [22:57.060 --> 23:04.400] all the wheels, so four rotations to 30 with right rotation. And then we spin left three times to 40. [23:04.400 --> 23:11.680] So that would put the second and third wheel on 40. And we will measure the contact area here. And here [23:11.680 --> 23:15.940] it is important to take both left and right contact points. And then what you want to do [23:15.940 --> 23:23.480] is figure out the space between them. So if it is at 96 and 3, that is a 7 number difference. [23:23.480 --> 23:29.620] So we would write down 7. And we would record that down. And then we do the same with the second wheel. [23:29.700 --> 23:37.400] We put the first number on the correct number. So left to 40. Left four times to 40. [23:37.400 --> 23:44.200] And then go right three times to 30. Putting the second wheel, throwing it off by 10 lower to the [23:44.200 --> 23:51.640] wrong number. And then left to 40 on the third wheel. Record the space between the contact points. [23:51.640 --> 23:54.960] How many numbers there are. And then write that down. [23:56.720 --> 24:04.620] Now we do that again for the third wheel. Left rotation four times to 40. And right twice to 30. [24:05.060 --> 24:12.080] That ensures that only one number is off. The other two wheels are on the correct number. [24:12.820 --> 24:17.800] And then you can repeat with 50 as well instead of 30. So that would be the high test. [24:18.820 --> 24:27.900] Now the test combination with the widest contact area is the one that 40 belongs to. [24:28.400 --> 24:33.460] So for instance, we did three test combinations here for this low test. [24:33.640 --> 24:45.300] If for this last sequence that we dialed, 40, 40, 30. If that has the contact area with the most space [24:45.300 --> 24:52.380] between it. Now normally before we were looking for closer contact points, but here we're looking [24:52.380 --> 25:01.400] for furthest apart. And the reason for that is because we have the correct number on the wheel, [25:01.400 --> 25:08.820] on two of the wheels, and the wrong one on one of the wheels. So if the wrong one is on, let's say [25:09.700 --> 25:16.640] here, let's say the third wheel has 40. So if we're intentionally putting on the wrong number, [25:16.640 --> 25:21.200] it's going to be a wider contact point. But seeing these two, it's got the correct number, [25:21.200 --> 25:27.840] so it'll be closer. So this allows us to figure out which wheel that 40 belongs to, simply by [25:27.840 --> 25:35.520] putting the correct number on each wheel twice, and then having it off on one of these. So if [25:36.700 --> 25:43.180] this wheel, if wheel three has 30, and it's wider here than the other two tests, then we can [25:43.180 --> 25:48.700] successfully conclude that 40 belongs to the third wheel, the third number in the combination. [25:49.420 --> 25:55.900] And then you can, you know, repeat with 50 just to really be sure that your readings are correct. [25:55.980 --> 26:02.300] So we're going to assume that 40 here is the third number in the combination. And then yeah, [26:02.300 --> 26:09.020] check your rotation. Anytime you dial to a correct number, you want to make sure you always [26:09.020 --> 26:17.240] use the correct rotation. Now we found one of the numbers in the combination, and we know it's the [26:17.240 --> 26:24.040] third wheel. So in order to find the other numbers, we essentially just repeat the same step [26:24.620 --> 26:31.700] with this new information added in. So we run the other two wheels through every two increments, [26:31.700 --> 26:39.420] but we have the third wheel on 40 whenever we read the contact point. So the way that this is done is [26:40.840 --> 26:46.100] we know that the third wheel, right, the first wheel that gets picked up, that means we have to [26:46.100 --> 26:51.840] set it last. That is with left rotation to 40. So what we want to do is we want to pick up [26:51.840 --> 26:59.300] all the wheels with right rotation now, and then we'll say let's start at zero, and then we spin [26:59.300 --> 27:09.100] left for one rotation. So that picks up just the third wheel, and we stop on 40. So now we have left [27:09.100 --> 27:15.660] rotation on 40. Now going to zero isn't going to affect any of the wheels now, remember, because [27:15.660 --> 27:23.660] we have to pick up the third wheel in order to affect the rest. So we can safely move around here [27:23.660 --> 27:28.300] without fear of disturbing the other wheels. So we can read the contact point again. [27:28.420 --> 27:35.300] Going from inside the contact area, we can read the right contact point and then graph it. So we [27:35.300 --> 27:41.520] just do this graph, and at the top we can maybe just write wheel 3 left 40, just so we know [27:41.520 --> 27:50.640] that we're doing this graph with wheel 3 on 40 with left rotation. And then what you can do now [27:50.640 --> 27:55.360] is you turn right until you reach 40. Now that picks up the third wheel. [27:57.040 --> 28:04.200] Go to zero where the other two wheels are resting together, and that picks up wheels 2 and [28:04.200 --> 28:10.620] wheels 1 at the same time, because remember we had everything picked up together. We only [28:10.620 --> 28:16.600] messed up wheel 3 in order to put it on 40 by itself. You can turn two numbers over, [28:16.600 --> 28:18.740] spin left again one full rotation [28:20.840 --> 28:30.540] to 40, go to the contact area, and report it down again. And we just go do that the whole way around. [28:32.560 --> 28:38.500] So here we can repeat the same high-low exercise. So we're going to pretend we found [28:39.740 --> 28:46.880] a drop in the graph and then a rise back up centered around 80. So we found 80 with right [28:46.880 --> 28:55.560] rotation now. So what we're going to do here is a low test. We're going to start with wheel 2, [28:55.560 --> 29:01.100] and we're going to throw it off by 10 onto 70. So wheel 1 we put it on the correct number, [29:01.100 --> 29:06.180] 80, with right rotation. So that means we spin right, picking up all the wheels, [29:06.180 --> 29:14.460] stopping on 80. Then we spin left, picking up wheels 3 and 2. So we go three times to 70. [29:15.180 --> 29:21.960] And then here's where it gets interesting. We need to go to 40 now with left rotation because [29:21.960 --> 29:30.400] we found 40 as the correct number with left rotation for wheel 3. But if we were to continue [29:30.400 --> 29:40.300] past 70 left into 40, it would mess up wheel 2. So there's actually a clever way to fix this. So [29:40.300 --> 29:47.860] we spin right, picking up all the wheels, and then we stop on 80, which is what we found to be [29:48.420 --> 29:56.900] one of the other numbers. We can spin left, one rotation, picking up wheel 3, another rotation, [29:56.900 --> 30:03.460] picking up wheel 2, and we want to put wheel 2 with left rotation on 70. So that is 10 lower. [30:04.360 --> 30:09.560] And then we want to go to 40 now for the third wheel. But if we were to keep going, [30:09.560 --> 30:16.200] it would mess up wheel 2 on 70. So what we do is we can reverse directions here, [30:16.200 --> 30:25.020] pick up wheel 3 from 70, go to 40, but remember this is not the correct rotation. We're turning [30:25.020 --> 30:33.240] right. We need to be turning left. So we just go past it, let's say to 30, and then we can go left, [30:33.240 --> 30:42.540] picking up at 30, setting wheel 3 on 40, at which point we take our contact point readings, [30:42.540 --> 30:49.920] or our high-low test. And then again, you would write down the number of increments, [30:49.920 --> 30:57.220] the space between each of the contact points. And then do that with the first wheel. We throw [30:57.220 --> 31:02.120] the first wheel off by 10. So we go left to 70 for the first wheel, picking up all the wheels, [31:02.120 --> 31:09.080] and then right three times to 80, and then left to 40. So we write down the numbers. Again, [31:09.080 --> 31:17.620] we look at what is the widest contact area, and that will give us where our second number lies, [31:17.620 --> 31:24.680] which wheel it belongs to. And usually locks will read this way. It will read third wheel first, [31:24.680 --> 31:30.040] and then the second wheel, and then the first. But sometimes it can go other ways. But following [31:30.040 --> 31:35.720] this method, it doesn't really matter which wheel reads first. As long as you know how to dial in [31:35.720 --> 31:43.960] these numbers, then you can still do it just fine, no matter which wheel reads first. And then here, [31:43.960 --> 31:48.300] we have two of the numbers in combination. So let's pretend that 80 belongs to wheel 2. So it's [31:48.440 --> 31:55.000] a question mark for wheel 1. We know 80 is right rotation to wheel 2, and then 40 is left rotation [31:55.000 --> 32:02.060] to wheel 3. And the last wheel, you can graph it, but generally you just brute force it. You would [32:02.060 --> 32:09.840] just try 2, 80, 40, or 0, 80, 40, 2, 80, 40, 4, 80, 40, until it opens. When you're starting out, [32:09.840 --> 32:15.320] it is actually a good idea to graph that last wheel as well, just in case you messed up on the [32:15.320 --> 32:22.400] first two and you did not find the correct number. It is useful to have that extra information. [32:24.500 --> 32:32.780] Now there's different group 2 locks. The one I am using here that I have shown is what is called [32:33.260 --> 32:41.780] a Sargent and Greenleaf and S&G 6730. There's two major variations of 6730 and 6741. [32:41.780 --> 32:47.320] They operate the same way, work the same, you cannot tell by looking at it which one it is. [32:47.320 --> 32:54.140] It's just that the 6730 has slightly tighter manufacturing tolerances, which is why I [32:54.140 --> 33:01.120] recommend going every two increments on your graph rather than every two and a half. But if you know [33:01.120 --> 33:07.900] you have a 6741, if it is labeled a 6741, then you can get away with going every two and a half [33:07.900 --> 33:14.180] increments because those tolerances in the manufacturing are not as tight and you will [33:14.180 --> 33:18.180] be able to find the correct number by going every two and a half increments. [33:20.220 --> 33:27.620] Now another popular brand is Lagarde, the Lagarde 3330. They have slightly oval wheels and [33:27.620 --> 33:35.040] the reason for that is because of the way that inside the wheels work, there's a certain [33:35.040 --> 33:41.200] mechanism that allows you to change the combination and that puts pressure on the wheels in certain [33:41.200 --> 33:48.560] ways and that just makes it slightly more oval shaped, which means the wheels can essentially [33:48.560 --> 33:55.440] mask the gates on other wheels. Maybe none of the the wheels are, you know, bigger than the others [33:56.060 --> 34:01.340] but they can be aligned that when they're all picked up and they're all moving together, the [34:01.340 --> 34:08.060] oval shape covers, essentially becomes the biggest part of the wheel pack in that location and that [34:08.060 --> 34:14.700] gate is never going to be, is never going to allow the fence to drop lower because one of the other [34:14.700 --> 34:21.720] wheels will be larger in that area. And so it can be rather difficult to work with a Lagarde 3330 [34:21.720 --> 34:30.020] so I do not recommend starting out with that. There is also a divold which is a lock with a [34:30.020 --> 34:35.760] drive cam where instead of having one side that's more slanted, it will be a U-shape, [34:35.760 --> 34:42.780] more uniform U-shape. And so in the case of a divold group 2, you want to take both contact [34:42.780 --> 34:48.000] points into account since there will be less variation. You want to take both into account [34:48.000 --> 34:52.780] and look at the left going up and the right contact point going down. [34:54.300 --> 35:03.200] Whoops. Now some final tips is you want to be really precise in dialing. You want to [35:03.860 --> 35:08.840] not just read it in one-eighth of an increment, but you want to dial to one-eighth of an increment. [35:08.840 --> 35:15.240] You want to make sure you're not accidentally dialing 16 and one-eighth or 16 and one-fourth [35:15.240 --> 35:20.980] because you're going every two increments. So maybe the combination is 15. You don't want to [35:20.980 --> 35:26.960] go 16 and one-eighth and have it not open, but maybe on 16 you can detect it. You can detect [35:26.960 --> 35:31.560] that it's the correct number but not 16 and one-eighth. You want to make sure you're reading [35:31.560 --> 35:37.400] the dial from the same angle each time. So if you're looking at the safe lock, you want to [35:37.400 --> 35:41.840] make sure you are reading from the same angle. Let's say you're reading it from this angle [35:41.840 --> 35:47.620] this time. You don't want to look at it like this as that will change where you [35:47.620 --> 35:54.120] think that contact point is. So you want to make sure you're really consistent, especially also [35:54.120 --> 35:59.180] with the amount of force that you use. You want to make sure it's the lightest possible and you [35:59.180 --> 36:04.360] want to make sure it is the same each time. So you want to be really consistent in everything you do. [36:05.520 --> 36:10.720] You can also try it with a known combination. You can, let's say you know the combination is [36:10.720 --> 36:19.880] 20, 40, 60. Well you can test at 20, 40, and 60. You don't have to graph the entirety of the dial. [36:19.940 --> 36:26.740] So just to be able to detect how the contact point feels when one of the gates is under [36:26.740 --> 36:33.020] the fence and how it feels when it's not, you can graph from let's say 10 to 30 and then like [36:33.020 --> 36:38.040] you know 10 above and 10 below each of the numbers 20, 40, and 60 so that you can tell [36:38.040 --> 36:46.000] how the graph is supposed to look. And that is a very very useful practice to do. You can also [36:46.000 --> 36:50.900] remove the back cover of the lock so that you know exactly what's happening and you can really [36:50.900 --> 36:55.500] correlate what you're feeling with what is happening inside the lock. And then if all else [36:55.500 --> 37:02.400] fails you can buy my book. Well not really, I put it online for free. So it is on Amazon but I don't [37:02.400 --> 37:09.780] recommend it unless you really want a hard copy. There's a PDF I have uploaded at this link down [37:09.780 --> 37:17.020] here and you can download it and basically just do whatever you want with it. I don't care. [37:17.940 --> 37:25.080] Now on YouTube I have a video series that follows a book. It's similar to this talk but it's a lot [37:25.080 --> 37:33.020] more in-depth. So it covers different sections that I have covered here in this talk but with [37:33.880 --> 37:39.500] much greater detail and I also cover additional more advanced techniques in order to figure out [37:39.500 --> 37:45.640] the combination faster and with greater precision. There's online forums such as this link at the [37:45.640 --> 37:52.120] bottom here it points to keypicking.com and they are very welcoming to newcomers as long as you [37:52.120 --> 37:59.380] are able to show that you are not trying to use this knowledge for criminal activities and you [37:59.380 --> 38:05.380] are interested in this as a hobby. I mean people are very welcoming. On ebay you can buy locks on [38:05.380 --> 38:17.060] ebay. I highly recommend sng6730 or 6741. You can also just search up sng6700 series. [38:17.910 --> 38:25.160] And just practice. I mean practice is the best way to learn. I mean you can read and watch all [38:25.160 --> 38:30.520] the content on safecracking and understand everything that's happening but you cannot [38:30.520 --> 38:36.380] develop the touch for feeling the contact point. You don't develop the sight for reading the contact [38:36.380 --> 38:43.380] point unless you actually practice. And I also just remember I forgot to mention this picture [38:43.380 --> 38:48.720] here. So in order to read the contact points and dial it more accurately you can take a piece of [38:48.720 --> 38:56.000] paper or maybe a needle or anything and tape it onto the dial and the dial ring just to be able [38:56.000 --> 39:04.380] to more precisely pinpoint what is on the dial. And that is the end of this presentation.