Sophie’s safecracking simulator

May 9th, 2021

A few weeks ago on twitter I read a tweet by Sophie and they were working on a safecracking simulator. I was intrigued and joined the conversation. Both to comment (and compliment) on the progress and add ideas for even more realism!

https://sophieh.itch.io/sophies-safecracking-simulator

So what’s the game? They designed a safe lock simulator and the game is to crack the safe! The lock from the fictional brand Safe and Sound (S&S). It acts as an average group 2 safe lock with three wheels (4xCCW, 3xCW, 2x CCW, and 1x CW). You input the combination with your arrow keys: Left and right arrow for moving the dial and control/shift to control the dialing speed. The simulated lock works just as you might expect, you can feel and hear the contact points and you can manipulate and graph it just like any other group 2 safe lock.

Cracking a safe

I’ve bought the game as soon as it was available and spend a couple hours cracking my first virtual safe.

Cracked the safe with manipulation. The transparancy is on for the screenshot.
Safe manipulation graph.

I like to start with getting a rough idea for the lock and do this by dialing all wheels left (AWL) with 20 number increments. I noticed the wheels are almost perfectly round requiring a full AWL graph and find one number at the time. I graphed AWL with 2,5 count increments and found the gate between 80 and 85. I set the number to 82 and tested the wheels. I found the number was on wheel three.

Then graphed W1 and W2 left and parked the W3 to 82 and graphed it with 5 count increment. Wheel one was at about 7. Figuring out what wheel it is was actually tricky as the simulated safe does not have flies and this means LRL is not the same as RLR for this lock. This also means you can find a number that’s impossible to dial without some calculating.

Lastly I graphed the last number 7-X-82 and found the combo 7-78-82. The dial stopped at 80 indicating I opened the lock. In the version I played it wasn’t possible to open the safe. I claimed being the first one to open the virtual safe on twitter shortly thereafter.

What else can the simulator so?

Once you have mastered the three wheel, why not try a twenty wheel lock? This lock will take 21 times right, 20 times left, 19 times… Or was it 21 times left, 20 times right. at what number was I again? In total it would take 231 moves to just open it with the combination. I can’t imagine how fun it would be to graph this one!

Not all hope is lost as the safecracker gets a handful of tools to simplify the process: Gyroscope angular measurement, camera to amplify vision, sound spectrum analyzer, and X-ray vision. You can also use advanced keyboard shortcuts to spin the dial exactly one rotation, simplifying the safecracking process.

Suggestions to Sophie

The project is very cool and certainly a functional game. These are a few suggestions for added realism:

  • I feel the current shape of the wheels is too perfectly round. Real life safe wheels are sometimes oval or egg shaped. They sometimes have an offset from the wheel center as well. This feature is only beneficial when the wheels are closer matched in size. Currently it’s very hard to find what wheel is the largest and thus the one you want to isolate.
  • As far as tolerances I think the game does very well. Yes, you can make it more tight but then you can easily make the safe impossible to manipulate. It’ll not be bad to have a setting you can play with to make the lock a lot harder.
  • Currently the safe does not have flies. It’s hard to explain what it is or how it works; It’s a small movable element that ensures you can dial two numbers on consecutive wheels to the same number. If it’s worth the effort for this extra realism, I won’t know.
  • Lastly there are a lot of ways you can go to with this project. As a simulator it works but it would be very cool to have a ‘spot the fault’ puzzle game. I.E. The combination is 10-20-30 and it only opens sometimes. Then the player could learn about failure modes like when fly is stuck or the wheel slipped. You can use the trouble shooting guide for a S&G as inspiration. In the PDF it starts at page 9.

Conclusion

The game is very much what I expected from it and it captures the nuances very well. I will certainly recommend it to people that are looking into safecracking. I will use the the simulator as training material as well. (Every participant buys their own copy.) I think it can be a very useful teaching tool.

I don’t think I would play much with the simulator myself, mostly as I have played with and have access to the real locks. The game captures the tediousness of safecracking very well and that’s amazingly impressive 🙂

Cellular CyberKey

April 30th, 2021

A friend knows I’m into electronic locks and gave me this CyberKey key as a present. He did not have the locks to share so you will have to do with pictures of the key. Let’s just admire the construction and not worry about all the ways you would break an electronic access system like this.

Note: Click the pictures for the full size image.

CC-BY-4.0 Jan-Willem Markus Toool Blackbag

Lock pin collection

March 19th, 2021

In a previous blog post Jan-Willem’s pin collection was mentioned. In this post the pictures of the pins and keys are shared.

There is no epic conclusions to this project. At this moment it’s is just a collection of photos of locks and pins. Shared with the world. Hopefully it’ll be a resource for new pickers that would like to know what they are up against. Maybe future research will use it. Where someone clever uses the fact some spools are different than others to decode the lock. Sputnik comes to mind and we think the possibilities are not exhausted yet. (If you are working on something I’m happy to assist.)

New pickers, don’t be intimidated by the key or keyway. If you look through the collection much of the pins are underwhelming. Where a Evva is known to be difficult lock it was not expected to find all standards or one spool pin. When struggling with a lock just take it apart and see what’s in there. For the next time you encounter the same lock you will know Nemef has a spool on position two (insider joke).

This collection has a few obvious biases:

  • The collection only contains basic pin tumblers.
  • Most locks are from Europe, and are from well known lock brands.
  • The locks are not too expensive and are usually old. Therefore it lacks fancy pins like gins and Christmas trees.
  • Pins/locks that are too similar are rejected. There are some duplicates as well.
  • This is a snapshot in time. The pinning of the locks change every few years. A good example is DOM RN with two different types of pins in this collection.

If you have specific knowledge on these locks. Please share, we are open to learning more about locks. Find us on Discord, leave a comment or send us an email.

The photos are: key, pins, key, pins. The photos of pins are arranged with the brand and number. The keys have ‘key’ in the name. The Titan with a key engraved D5474 will have the pictures: TitanD5474-1key-1-scaled.jpg and TitanD5474-1-1-scaled.jpg.

The pictures are by Jan-Willem Markus. CC BY 3.0. https://creativecommons.org/licenses/by/3.0/
In short: you are free to use, modify and share these photos as long as you give attribution. If you plan on selling them or using hem in a blog/paper/book please notify us.

The end.

RKS Combo Change

March 15th, 2021

( Post by Tom Eklöf )

So what do you do with a really rare collectable lock that comes with no documentation, has no documentation and practically nobody knows anything about? YOU GUT THE HELL OUT OF IT.

I’m not going to be going over RKS basics in this doc; check out Han Fey’s “RKS Robo-Key System” doc from 2007. But long story short is that it’s a cam lock with 5 wheel combination lock guts, and it’s meant to be dialed with an electronic dialer but can be dialed with a manual “emergency dialer” as well.

Note that the latest generation locks (IV) detailed in Han Fey’s doc are different than what I have. How exactly? Beats the hell out of me. Let’s find out!

RKS core cutaway.
RKS core cutaway.

I’ve been told that the core’s in a repurposed Protec cam, and it does look familiar.

Core’s easy to plop out, just remove the nut in the endplug and that’s it. The sidebar’s not attached to anything so be careful it doesn’t fall off.

Endplug screws.
Endplug screws.

There’s 4 hex screws inset in the endplug that a 1.5mm key was too big for and that’s the smallest one I have, so I figured I’d leave them alone if I can.


You can see that one of them was loose; it promptly fell out when I tilted the core. Welp. As far as I can tell they hold the part with the threads to the rest of the endplug.

Sidebar.
Sidebar.
Sidebar removed.
Sidebar removed.

The sidebar’s got springs on both ends, attached the sidebar. The endplug is attached to the plug casing with 3 screws with PH000 heads (although PH00 will probably do too.) Note that those screws were only very weakly magnetic, so don’t trust them to stay on a magnetized screwdriver.

Disk pack ahoy!

That pin you see on the drive disk sits on a spring. Two washers although it looks like just one.

Disk pack.
Disk pack.

Showing drive pin holes in drive disk, with gate pointing to the upper left, although obviously no pin on this side.

Drive pin holes.
Drive pin holes.

The disks sit pretty snugly in the casing, and they’re proving hard to remove. Trying to nudge them from the side just tilts them so the sides snag.

Then I thought to push at the drive shaft from the dialer side with a screwdriver, which got got things moving. This disk pack is now going places!

Dial-side drive shaft.
Dial-side drive shaft.

Your friendly neighbourhood drive disk and their trusty pin.


Note that in some of the subsequent comments I’ll be talking about “top” and “bottom” pins. They refer to the orientation the lock is in, in the picture below, so “keyway” (dialerway?) down, and the wide part of the disk goes “down.”


Before I even started taking this apart I was thinking that my smallest screwdriver might not have a thin enough head. It didn’t. And no way am I doing anything to those pins without better tweezers.

Drive disk.
Drive disk.

Circlip washers from hell. Getting those back on will be interesting, but if I manage the pins these should feel like a walk in the park.

Circlip.
Circlip.
Disks.
Disks.

Disks. You can see that the gates are always 90° apart and the pin positions are 45° apart and at the edges of the gates. All disks except 1 (lower right) have 2 pins, and disk 1 only has the top pin (it’s top down in the picture).


The drive pin screws are 1.2mm wide at the head and they’re around 1.9mm long but they’re nontrivial to measure.


The disks were about 1.2cm at the widest part. Unfortunately I forgot to write down the measurements and only realized this after I’d reassembled the lock. Oh well.

Drive disk.
Drive disk.

Looking at the pins got me wondering if the combo change is supposed to be done so that you can change the positions of both of the pins, or is the top pin fixed? Why I thought it’d be the top pin (i.e. the one sticking up towards the drive disk in this orientation) was that the drive disk only has a bottom disk and it has pin holes, so its pin likely isn’t fixed.

7 gate positions per disk sounds very small compared to the RKS doc, though, but who knows if that applies to this version. The other option would be that both pins are actually movable, but I’m not entirely sure how much that’d increase the keyspace. We’ll hopefully find out once I get my grubby mitts on a smaller
screwdriver.

Closeup of a disk.
Close-up of a disk.

Closeup of a disk, “bottom” side up. The lock is currently on a “factory default” pinning where both pins are next to the gate.

When you go all disks left / right and spin the core, you can see that the gates just follow each other at regular intervals, i.e. each separated by two drive pin widths. That’s actually surprisingly hard to see when not moving the core because you generally see at most 3 gates and even then one of them’s under the side bar, so it took me a while to realize the gates were just sequential even after having figured out the combination.

Intermission

“But obrotund, how could you not notice a rising sequence? Shouldn’t it be obvious if it’s something like L0 R6 L12 … ?”.

If you go ADL to 0 and then continue left, the gate for each disk (from the drive down to 1) will be at roughly L0, L6, L12, L17, L23, L29 – fairly obvious they’re sequential when done like that. Since the lock came with no instructions or anything, I eyeballed the correct combo to be 6x L29 5x R40 4x L17 3x R19 2x L6 R0; that didn’t exactly scream “sequential” at me.

To see how much of an effect the stacking of drive pins has on something with 6 wheels we can go ADL 0 and then start dialing right so that we note the index where each disk gets picked up, and get something like:

d5: R2
d4: R5, after going around once, of course. So already at d4, pickup is happening 5 indices earlier because there’s now a bunch of drive pins there
d3: R10
d2: R15
d1: R20

So the difference is 20 increments at the last disk, which is about 30% of the dial’s range of 0 – 63. To drive the point home, the correct combination but starting from R is 6x R49 5x L23 4x R30 3x L12 2x R10 L0.

Act II, the Screws

So, now I was ready to actually start dealing with the drive pin screws. Note that if you happen to have an RKS or manage to get your hands on one, this probably won’t be as difficult for you, but I’ve got a tremor that makes dealing with screws this small a bit of a challenge. Luckily for me I enjoy challenges, so I headed over to a hardware store and bought a set with the smallest screwdrivers they had, some tweezers, and a “helping hand” that I knew to have a fantastically useless base but with alligator clips and such that I could put to use.

Note that you’ll really want to have good angled tweezers; you likely won’t be using them for the drive pin screws, but the washers between disks and then the 3 . The ones in the picture were cheap but extremely annoying to use and stuff had a tendency of slipping out of them, and ended up getting Tamiya’s angled tweezers the next day.

You’ll definitely want a magnetized screwdriver; I used a neodymium magnet I had lying around.

Easy part’s done, so now for the hard part. I held the disk in locking tweezers and somehow managed to get the screw in on the first try. Victory!

Armed with a false sense of confidence, I attacked the next disk. The same locking tweezer technique failed to work. I tried it a few times and after almost losing the screw because the disk had a tendency of starting to slip from the tweezers, I changed tactics.

Tools.
Tools.
Disk with screw.
Disk with screw.

Helping hand time. As said, the base is absolute crap so I duct taped it to the desk. That worked about as well as you’d expect.

Helping hand.
Helping hand.

Helping hand.
Helping hand.

I was extremely paranoid about losing parts, so I kept everything in minigrip bags that I made sure to close.

Bags.
Bags.

OK, so that was a no-go. I headed over to Discord to see if anybody had any advice.

NKT gave me the idea of using something cylindrical for stablizing the screwdriver, and I gave that a go. I grabbed my Revolver, stuck it to the table with some two-sided mounting tape and tried the concept out – this could work.

Narrator: “it didn’t.”


At that point I gave up for the day and put the screw in the naughty box.

Revolver.
Revolver.
Naughty box.
Naughty box.

On Monday I headed over to a hobby store, and the guy there suggested drilling a hole into a piece of plastic and then using that as a screw holder, and it sounded like it might work so I decided to give it a go. I got a 1.6mm thick rod of plastic, a 1.2mm drill bit and a handle for it, and the Tamiya tweezers.

After some experimenting it looked like the plastic was just a bit too thick (should have gone with eg. 1.2mm) and it was hard to see if I was anywhere near the screw hole, so I thinned it a bit with a file and rounded the head. In hindsight I should probably have taken even more of the head off. While it was easy to get the screw onto the plastic “handle”, getting the screw positioned properly was a pain and the screw had a tendency of falling out, but I suspect a 1.1mm bit would have already been too small. I tried different ways of clamping the disk in place but eventually gave up. I was starting to doubt I’d get this done.

Plastic screw holder.
Plastic screw holder.

Act III, Rustling up Some Screws

On Tuesday I asked around on Discord if people had any further ideas, and legendofthesamurai suggested using thin copper wire to make a lasso around the threads of the screw and then using that wire as a handle. That’d solve the problem of not being able to see where I was putting the screw, and I could use the plastic tool to hold the currently detached screw for lassoing.

After I had the screw in the lasso, it was downright easy to get it in the disk.

Success.
Success.

OK, not so easy that I wanted to do all disks so I left one at the default position, but I did change the pin on the drive disk, which was challenging due to the drive shaft.

Getting the washers back in took me a while, and I don’t think I could have done it without two tweezers, but I eventually got there. The last step was tightening those 3 screws in the plug casing, but they were big enough that I could hold them with the tweezers to screw them in, so that was an absolute breeze. Used a 1.3mm hex head to reattach the loose screw on the endplug, and plopped the sidebar back on.


And there we have it. 3 days later I have an assembled lock again.

It does seem like there’s a little more friction than there used to be; I think I dinged some of the circlip washers as I was putting them back in, but there’s
no way I’m popping it open in a while and not much I could do about those washers anyhow. I put very small amounts of PTFE-based lock oil between the disks which helped a lot.

Drive shaft challenge.
Drive shaft challenge.
Reassembled.
Reassembled.
RKS core.
RKS core.

Album for storing a pin collection

March 11th, 2021

In 2019 Jan-Willem started with am odd collection. Not the locks, nor the keys, just the pins from a pin tumbler. Pins are in a lock and make them function. However, the pins are only observable when the owner decides to gut the lock or create a cutaway. The idea was simple: Create a collection/archive of pin tumbler pins and their keys. This required a proper way to store the pins.

To store the pins many different boxes have been tried. After many failed attempts Jan-Willem stumbled upon a hobby not to dissimilar from our own: coin collecting! The value of one €2 coin is just €2 to a consumer. While the collector is looking for a 1st edition misprint from Monaco, and not just any coin.

Coins are often stored in albums, either with or without protection. The lowest quality coins protection are two pieces of plastic film and a cardboard cutout. Often glued or stapled together. While the high end coins are with a certificate sealed in an acrylic case. Leuchtturm makes coin boxes in between the two, and at a reasonable price and the inserts are DIY, lasercut acrylic.

First attempt with Leuchtturm boxes.

To store these boxes it was decided to use business card holders, this did not go as plan and required custom holders. First made from acrylic and the second version from wood. Fifty sets of pins are created and thirty are added to the album. This is where the project was stuck for a year.

Pins in album v1

Last week was a good time to continue this project. A proper pleader album was bought. And the pins are added.
This is the result this far:

Abus E90 pins in a box.
Leuchtturm album.
Demonstrating how the Leuchtturm album is used to store pins.
Pins neatly stored in the album.

The album has 48 pins and about 30 more sets are ready to be archived. Acrylic is ordered and the inserts will be created when a lasercutter is accessible again. The photos will be published here on Blackbag. For now you can find one key a day on twitter: https://twitter.com/hashtag/microkeys?src=hashtag_click&f=live

The coin boxes, album, and inserts are sold under the name Leuchtturm and Lighthouse. These boxes are available on eBay. Link to a Dutch web shop: https://www.knm.nl/leuchtturm-quadrum-capsules-14-mm/nl/product/2741/

The files are available under creative commons, share alike with attribution, commercial use is allowed.

Toool Discord server invite

March 9th, 2021

Toool NL has created a Discord server to keep in touch with other lockpickers in The Netherlands and meet new people in locksport. If you are interested in joining Toool or just want to chat about locks, please join and meet us on the Discord server.

Discord is a text based platform similar to IRC and Slack. It is not a forum where discussions are grouped into subjects and threads. Discord uses categories and channels instead. The style suits better suited for ongoing conversations or for fast pase communication than in depth discussion on a topic. Discord is not limited to text and can also be used as video chat or sharing photos.

Toool UK has a Discord server for several years with great success. The Toool NL server is live from January and is now open to the public.

Link: https://discord.gg/4exGbZm3QC
Create a Discord account. Click the invite link. Complete the CAPTCHA and write a short introduction in #introduction. The member role will be added manually, please be patient as we are not on Discord 24/7. Toool members are asked to register and send a mail to the board with the full Discord username. You can call it a 2FA.

On the server we have different roles and privileges. From member, trusted member, board, and admin. It is not the goal to gate keep but it is useful to limit accessibility to some content for newly joined. This will for instance protect against bots, scraping or spamming the server.

Do keep in mind Toool does not host the server. Do not post things on the internet that should not be on the internet. Not limited to: Personal details or secret research.

Hope to see you on the Discord!

:(

May 10th, 2020
🙁

TL;DR : lockcon 2020 is cancelled
The slightly longer version:
With conferences being cancelled left-and-right in these current covid-times it wont surprise you that the ToooL.nl board has rather extensively been looking at options.
The dutch government has drafted, a rather ambitious, timetable to battle the current crisis.
According to this schedule, September 1st would be the first point in time to give an actual go/no-go for lockcon2020. Mind you, this is in a rather best-case scenario. That would give us a bit less than two months to get organized, AND for our guests to sort out vacation days and (international) travelplans.
This currently seems unfeasible to us.

By interpreting the rules to the letter, there might be loopholes to be found to legally be allowed to organize and run the event as originally planned. And yes, we really would like to run the event, but we would like it even more if our lockpick community members would stay healthy.

Jan-Willem (co-chair)
Tom (finance)
Jos (chair)

Classic car ignition lock

March 9th, 2020

Once in a while people bring very interesting locks to our meetups. In this case an ignition lock from a classic car. The task was clear: impression a key for this lock. Taking this lock apart would pose serious challenge and risks.

As the ‘job’ was not announced in advance we had to make do with what was on hand: steel blanks, imperfect magnification, and an old file.

Complete ignition lock.
The back of the lock.
A working key!

Do you want to learn how to impression a lock? By special request we can bring the impressioning gear to the meetup. It’s not something we carry standard because of volume and weight.

MKS impressioning at Hackerhotel

February 27th, 2020

On the Valentines weekend 400 Hackers met at a hotel in Garderen. There was the conference: Hackerhotel 2020. It felt like a huge hackerspace meetup with talks and workshops. I’ve followed the hardware hacking workshop by @Jilles_com and learned for to extreme read!

Jos was asked to do his talk om Master Keyed Systems and how to defeat them using impressioning. Summary: “Privilege escalation attack? You are doing it wrong! Use impressioning to your advantage. :)”

If you can’t figure it out from the summary you can find his talk on YT here.

LockCon 2020 dates are known!

December 30th, 2019

29th of October up until 1st of November 2020 we will be again hosting our yearly conference in  “de Berckt castle” in Baarlo, The Netherlands. Prepare for some spooooky picking!

Registration is not open yet, but we wanted to give our community an early heads-up to lock in any vacation-days or international travel.