From: Larry Margolis <margoli@watson.ibm.com>
Subject: Manipulation (was Re: interest.. combination locks.)
Date: Sat, 11 Apr 1992 06:49:12 GMT
Reply-To: margoli@watson.IBM.com
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: The Village Waterbed

In  <ku53i2INNqj5@utkcs2.cs.utk.edu>  mccaugha@hydra1a.cs.utk.edu (William Douglas ( Doug ) - The Juggler ( me ) writes:
> In article <1992Apr07.223544.33236@watson.ibm.com>, Larry Margolis <margoli@wats
> |>
> |> Safes are fun.  Manipulation involves more feeling than hearing.
>
> Hmm. Ok, how does the manipulation work.

OK, *very* briefly.  First, some nomenclature.  (Easier with pictures,
but I'm not even going to *try* using ASCII graphics for this...)

Dial - this is the thing with the numbers on it that you turn.
Spindle - this is what's attached to the dial and goes into the
Lock case - this is attached to the inside of the safe door, and contains
    all the working parts of the combination lock.
Drive cam - connected to the other end of the spindle.  It contains a
Gate - the gate is the notch in the drive cam and the wheels.
Wheel - there's a bunch of them (usually 3 to 6) in a wheel pack.  Each
   wheel represents one number in the combination.  The last wheel is
   driven by the drive cam, and each previous wheel is driven by the wheel
   after it; wheel #1 is the one furthest from the drive cam and represents
   the first number of the combination.
Lever - the part that operates the bolt.  The *nose* rides around the
   outside of the drive cam.  When the nose drops into the drive cam's
   gate and the drive cam is rotated, the lever withdraws or extends the
   bolt.  The lever also has a *fence* which rides above the outside of the
   wheels and prevents the nose from dropping into the drive cam's gate
   unless all the wheels' gates are also lined up.
Bolt - this is the actual locking part.  It can either lock into the safe
   or cabinet frame directly, or can enter a notch that locks a mechanism
   driving a number of heavier bolts and operated by a handle on the outside
   of the safe.

Theory:  Just as pin cylinder lock picking is made possible by the slight
misalignment of the pin stacks, manipulation is made possible by the fact
that the wheels are not perfectly round.  We use our knowledge of how the
combination lock works to map the high and low points on the wheels.  The
lowest point on each wheel is going to be the location of the gate.

How can we map the high and low points?  When we turn the drive cam so that
its gate is under the nose of the lever, the fence lowers until it rests on
top of the outside of the highest wheel.  (Theoretically all the same
diameter, but due to manufacturing tolerences, not exactly.)  As we turn
the dial back and forth slightly, we can feel and hear the nose tap against
either side of the drive cam gate.  The lower the nose goes in the gate,
the less rotation required to hit either side.  If we divide the space
between each number on the dial into tenths, and record the difference
between where we feel either side of the gate after dialing all three
wheels to the same number, for each number around the dial, then the
combination number that gave the smallest difference is the lowest point
and most likely represents the gate on the highest wheel.

An example would probably help here.  Say the drop-in point (the point at
which the nose would drop in to the drive cam gate if there were no wheels)
is between 5 and 15.  We turn the dial 4 times around to 0 (assuming 3
wheels), then back to the drop-in point.  We note that we feel a tap at
5.2 and 13.8, for a difference of 8.6.  We now turn the dial 4 times around
to 5, then back to the drop-in and note a difference of 8.4.  This means that
the lever is slightly lower here.

Once we've found a gate, we have to determine which wheel it's on.  We
do this by trying one combination for each wheel; in each combination,
wheel n is set to the number we decided on and the other wheels are set
to something different, and we map the difference for each as above.

Now that we know the correct number for one wheel, we repeat the above but
instead of dialing all the wheels to the same number, we dial the known one
to the known number.  E.g., if the known number was 25 on wheel #1, we'd
try 25-0-0, 25-5-5, etc.

Repeat until you have all the numbers.

Larry Margolis, MARGOLI@YKTVMV (Bitnet), margoli@watson.IBM.com (Internet)