Comments on: Gentle Safe Cracker

By: Gentle safe cracker | Hack a Day Thailand

Gentle safe cracker | Hack a Day Thailand — Wed, 30 Dec 2009 19:00:26 +0000

[...] to find out what is inside? Hack it open? Smash it? Blow it up? No, the best solution is to build a robot to try brute force cracking. The robot, housed in an old power supply case, is little more than a servo and a servo controller, [...]

By: Oooli

Oooli — Tue, 10 Nov 2009 19:39:12 +0000

Hi ,i have hotel safe box around 50 pc’s and all of them locked and need to open so we can put them in the hotel rooms we buy it second hand can any body help(Elsafe) the name of the manfacture.
thanks

By: Bruce J Tarbet, CML, CPS

Bruce J Tarbet, CML, CPS — Tue, 06 Oct 2009 22:20:52 +0000

@clckwrk
This lock has 3 wheels with 0-99 or 1-100 on each wheel. That is 100 x 100 x 100 = 1,000,000 possible combinations.( 100³ ) Also someone sugested using some oil product on the lock…well just DON’T, it will gum up the fly’s in the wheels of the lock. A vital part of the wheel.
Bruce

By: Gentle Safe Cracker – The Ultimate Device to Crack Your Safe Box! - CircuitGeek

Gentle Safe Cracker – The Ultimate Device to Crack Your Safe Box! - CircuitGeek — Wed, 16 Sep 2009 18:15:00 +0000

[...] savor! Instead of break the safe box by cutting holes into it walls or removing the hinges, the Gentle Safe Cracker perhaps the best solution [...]

By: CB

CB — Tue, 11 Aug 2009 16:43:54 +0000

From Wikipedia:
“Additionally, if testing the mechanism to open the lock does not modify the state of the lock, multiple combinations can be tried sequentially, drastically reducing the brute force search time. The first two digits are entered normally once, then, starting from the second digit, the dial is rotated sequentially through the digits, testing the lock on each. If it takes three seconds to input the first digit, two seconds for the second digit, and one second for the third digit, then the normal search time for a 60-number dial with three cams would be (3 + 2 + 1) × 60³. The reduced search time would be (3 + 2 + 60) × 60², a reduction of nearly 82% from 360 hours to 65 hours. This strategy can be extended to the second digit as well, slightly reducing the search time further.” (http://en.wikipedia.org/wiki/Combination_lock)
All of the time estimates you’ve made and in the comments are fairly overestimated. You don’t need to run a sequence for 10R-30L-40R AND 10R-30L-20R. You will only need to run the first two digits (assuming you are right in your assumptions about a 3 number code), and then you can just step through the last 50 digits. Like the wiki article says, this reduces your time dramatically. Assuming ~2 second per digit with your cracker on the first two digits and maybe ~10 seconds on the last digit, you are looking at ~14 seconds to try 50 codes. This leaves you with 50×50x50 = (125,000 * 14) / 50 = 35,000 seconds = ~9.72 hours.
Cheers! You’ve inspired me to take a crack at an automated safe cracker! There are also several great articles out there on the algorithms to determine the codes for combination locks.

By: Carlitos

Carlitos — Sun, 09 Aug 2009 14:58:52 +0000

@Hoborg Hoborg, Thanks for the kind words. I will certainly post the update in here.

By: Hoborg

Hoborg — Sat, 08 Aug 2009 19:51:49 +0000

What a nice project you have started here! I will look forward to read about your next attempt to crack it.. Will you post the rest of the story here or will you do that another place? I can’t wait to see where this is going… :0)

By: Carlitos

Carlitos — Wed, 05 Aug 2009 01:17:50 +0000

@oysters
Oysters,
I have no clue. But crime and stealthy things are very interesting so I’ll hypothesize an answer. First, you get a sample video feed form the cameras on a normal day. Than, the day you want to have a go at the safe you cut the cameras and feed back the recorded signal. Then, you put a little safe cracker on the safe and wait for it to do the job. You might also want to disguise the cracker by giving it a distracted expression to his eyes. That way, people wont notice it is cracking the safe for many days on a row

By: oysters

oysters — Wed, 05 Aug 2009 01:09:59 +0000

I need to get into a safe. It’s a fairly large safe. It’s about four feet in height, probably weighs a lot. haha.
And there are cameras about. It would be dark though…possibly the cameras do not have night vision. Not for sure though.
How should I go about this?

By: Carlitos

Carlitos — Mon, 27 Jul 2009 15:10:47 +0000

Thanks again for all the comments and suggestions.

As suggested by a few of you, I plan on trying even (or maybe multiples of 3) combinations first and hope for it to work. Since this lock doesn’t look particularly sophisticated, it should allow some play.

As for the gearing, The backlash should not have that much effect (because of the play the lock may allow) but as soon as I get a stepper motor, I won’t need any gears whatsoever.

Also, I was planing to put a switch on the lid aligned with the gap between the body and the lid. The This would allow to stop the operations as soon as the safe opens and to retrieve the combination.

BTW, I really appreciate all the comments about safes and tumblers and preloading the lock. I am not particularly knowledgeable in those areas so I feel I’m learning a lot.

Finally, for the record, I tried to listen to the clicks. I could hear some but most of the time I miss them. I tried hooking up a microphone (since I don’t know any hot nurses with stethoscopes) and to crank the volume to the max but it did not work. That is why I decided a robot was the way to go.

By: creid

creid — Mon, 27 Jul 2009 12:54:45 +0000

For the mechanicals can i make a couple suggestions? Those look like cheap printer etc gears. You’re going to get tons of back(and forward!)lash. Try a gear/belt/gear system. Even with those it might work. You can buy a good system ( few bucks per gear plus a same for the belts) pretty cheap. Cant think of the company but its stpi or something that has what you need.

Use steppers. Bipolar if you can.

By: RudyDanielle

RudyDanielle — Sun, 26 Jul 2009 16:56:11 +0000

Just a thought, have you considered contacting the manufacturer or even a code source program like this one ……. http://www.hpcworld.com/Software/w_cscd.htm

By: AM

AM — Fri, 24 Jul 2009 19:14:14 +0000

Just a thought. Did you make sure the locking mechanism actually works? If it doesn’t click at all when you turn it, the dial may be broken off from the rest of the mechanism.

By: Jarkman

Jarkman — Fri, 24 Jul 2009 08:47:16 +0000

@Alex
No, I don’t think that’s a Manifoil. For a start, the dial only goes to 50.

The Manifoil is a reasonably fancy lock, and doesn’t have any kind of a click to indicate when each number is reached. Nothing touches the wheels (to test if they are in the right position) until the very end of the unlocking sequence. Here’s a nice set of internal pics of one:
http://www.timwarriner.com/manifoil/page2.html

I believe that good combination locks are actually defended against these brute-force attacks – they are built to wear out more quickly than they can be brute-forced. But I don’t think Carlito’s lock is one of those!

By: Kyle Vogt

Kyle Vogt — Fri, 24 Jul 2009 02:29:09 +0000

Awesome project! Great use of simple tools to get the job done.

Reminds me of the safe cracker I made at MIT a few years back: http://web.mit.edu/kvogt/www/safecracker.html

By: Z

Fri, 24 Jul 2009 01:19:15 +0000

make sure to put some sort of switch so you can get teh combo after you are done

By: Piero Giorgi

Piero Giorgi — Thu, 23 Jul 2009 17:49:26 +0000

Problem is the lack of torque due to the gearing, right?

Remove the lock on the servo, and you WILL have a VERY powerful and rather precise motor. I suggest Futaba or JR servos, though, given that the Hitec have a tendency to lose the “zeroing” capacity rather quickly.
(I’ve been a modeler for over 30 years)

Also… look into the RC sail winches.

Good luck (And let me know, please)

By: Alex

Alex — Thu, 23 Jul 2009 11:34:31 +0000

Hi, That looks like a Mk4 Manifoil lock that are used here in the UK primerially by the MOD / Army. This : http://www.codesmiths.com/shed/locks/manifoil.htm
gives you some idea. Indeed the last turn to the left pulls the catch back and by hanging the safe you are preloading it and your motor will stall. Many a day sat at a desk staring at these made me think of similar things to what you are doing. You can simplify matters by knowing the ground rules for the lock, I.E no numbers within 2 or 3 digits of each other, first number must be below 75 (or something) and so on…
I suggest a stepper or a servo with positional feedback. look into CNC programs, something that gives you degrees control (turboCNC for instance) and code a g code program as used on a CNC machine to brute force it bit by bit…
good luck!

By: clckwrk

clckwrk — Wed, 22 Jul 2009 17:46:18 +0000

@Carlitos Thank for clearing that up with proper decorum, unlike some of the other comments. Good luck with it! Still think it's a neat project.

By: Ronald_55

Ronald_55 — Wed, 22 Jul 2009 13:17:51 +0000

Carlitos

So what type of motor do you need to re-try this? We might be able to make short work of you finding one if we know what you need. Feel free to email me directly.

BTW have you looked at http://tgimboej.org/ ? Sounds like you might love to be in on it.

Ronald