Archive for the ‘Locks’ Category

RKS Combo Change

Monday, March 15th, 2021

( Post by Tom Eklöf )

So what do you do with a really rare collectable lock that comes with no documentation, has no documentation and practically nobody knows anything about? YOU GUT THE HELL OUT OF IT.

I’m not going to be going over RKS basics in this doc; check out Han Fey’s “RKS Robo-Key System” doc from 2007. But long story short is that it’s a cam lock with 5 wheel combination lock guts, and it’s meant to be dialed with an electronic dialer but can be dialed with a manual “emergency dialer” as well.

Note that the latest generation locks (IV) detailed in Han Fey’s doc are different than what I have. How exactly? Beats the hell out of me. Let’s find out!

RKS core cutaway.
RKS core cutaway.

I’ve been told that the core’s in a repurposed Protec cam, and it does look familiar.

Core’s easy to plop out, just remove the nut in the endplug and that’s it. The sidebar’s not attached to anything so be careful it doesn’t fall off.

Endplug screws.
Endplug screws.

There’s 4 hex screws inset in the endplug that a 1.5mm key was too big for and that’s the smallest one I have, so I figured I’d leave them alone if I can.


You can see that one of them was loose; it promptly fell out when I tilted the core. Welp. As far as I can tell they hold the part with the threads to the rest of the endplug.

Sidebar.
Sidebar.
Sidebar removed.
Sidebar removed.

The sidebar’s got springs on both ends, attached the sidebar. The endplug is attached to the plug casing with 3 screws with PH000 heads (although PH00 will probably do too.) Note that those screws were only very weakly magnetic, so don’t trust them to stay on a magnetized screwdriver.

Disk pack ahoy!

That pin you see on the drive disk sits on a spring. Two washers although it looks like just one.

Disk pack.
Disk pack.

Showing drive pin holes in drive disk, with gate pointing to the upper left, although obviously no pin on this side.

Drive pin holes.
Drive pin holes.

The disks sit pretty snugly in the casing, and they’re proving hard to remove. Trying to nudge them from the side just tilts them so the sides snag.

Then I thought to push at the drive shaft from the dialer side with a screwdriver, which got got things moving. This disk pack is now going places!

Dial-side drive shaft.
Dial-side drive shaft.

Your friendly neighbourhood drive disk and their trusty pin.


Note that in some of the subsequent comments I’ll be talking about “top” and “bottom” pins. They refer to the orientation the lock is in, in the picture below, so “keyway” (dialerway?) down, and the wide part of the disk goes “down.”


Before I even started taking this apart I was thinking that my smallest screwdriver might not have a thin enough head. It didn’t. And no way am I doing anything to those pins without better tweezers.

Drive disk.
Drive disk.

Circlip washers from hell. Getting those back on will be interesting, but if I manage the pins these should feel like a walk in the park.

Circlip.
Circlip.
Disks.
Disks.

Disks. You can see that the gates are always 90° apart and the pin positions are 45° apart and at the edges of the gates. All disks except 1 (lower right) have 2 pins, and disk 1 only has the top pin (it’s top down in the picture).


The drive pin screws are 1.2mm wide at the head and they’re around 1.9mm long but they’re nontrivial to measure.


The disks were about 1.2cm at the widest part. Unfortunately I forgot to write down the measurements and only realized this after I’d reassembled the lock. Oh well.

Drive disk.
Drive disk.

Looking at the pins got me wondering if the combo change is supposed to be done so that you can change the positions of both of the pins, or is the top pin fixed? Why I thought it’d be the top pin (i.e. the one sticking up towards the drive disk in this orientation) was that the drive disk only has a bottom disk and it has pin holes, so its pin likely isn’t fixed.

7 gate positions per disk sounds very small compared to the RKS doc, though, but who knows if that applies to this version. The other option would be that both pins are actually movable, but I’m not entirely sure how much that’d increase the keyspace. We’ll hopefully find out once I get my grubby mitts on a smaller
screwdriver.

Closeup of a disk.
Close-up of a disk.

Closeup of a disk, “bottom” side up. The lock is currently on a “factory default” pinning where both pins are next to the gate.

When you go all disks left / right and spin the core, you can see that the gates just follow each other at regular intervals, i.e. each separated by two drive pin widths. That’s actually surprisingly hard to see when not moving the core because you generally see at most 3 gates and even then one of them’s under the side bar, so it took me a while to realize the gates were just sequential even after having figured out the combination.

Intermission

“But obrotund, how could you not notice a rising sequence? Shouldn’t it be obvious if it’s something like L0 R6 L12 … ?”.

If you go ADL to 0 and then continue left, the gate for each disk (from the drive down to 1) will be at roughly L0, L6, L12, L17, L23, L29 – fairly obvious they’re sequential when done like that. Since the lock came with no instructions or anything, I eyeballed the correct combo to be 6x L29 5x R40 4x L17 3x R19 2x L6 R0; that didn’t exactly scream “sequential” at me.

To see how much of an effect the stacking of drive pins has on something with 6 wheels we can go ADL 0 and then start dialing right so that we note the index where each disk gets picked up, and get something like:

d5: R2
d4: R5, after going around once, of course. So already at d4, pickup is happening 5 indices earlier because there’s now a bunch of drive pins there
d3: R10
d2: R15
d1: R20

So the difference is 20 increments at the last disk, which is about 30% of the dial’s range of 0 – 63. To drive the point home, the correct combination but starting from R is 6x R49 5x L23 4x R30 3x L12 2x R10 L0.

Act II, the Screws

So, now I was ready to actually start dealing with the drive pin screws. Note that if you happen to have an RKS or manage to get your hands on one, this probably won’t be as difficult for you, but I’ve got a tremor that makes dealing with screws this small a bit of a challenge. Luckily for me I enjoy challenges, so I headed over to a hardware store and bought a set with the smallest screwdrivers they had, some tweezers, and a “helping hand” that I knew to have a fantastically useless base but with alligator clips and such that I could put to use.

Note that you’ll really want to have good angled tweezers; you likely won’t be using them for the drive pin screws, but the washers between disks and then the 3 . The ones in the picture were cheap but extremely annoying to use and stuff had a tendency of slipping out of them, and ended up getting Tamiya’s angled tweezers the next day.

You’ll definitely want a magnetized screwdriver; I used a neodymium magnet I had lying around.

Easy part’s done, so now for the hard part. I held the disk in locking tweezers and somehow managed to get the screw in on the first try. Victory!

Armed with a false sense of confidence, I attacked the next disk. The same locking tweezer technique failed to work. I tried it a few times and after almost losing the screw because the disk had a tendency of starting to slip from the tweezers, I changed tactics.

Tools.
Tools.
Disk with screw.
Disk with screw.

Helping hand time. As said, the base is absolute crap so I duct taped it to the desk. That worked about as well as you’d expect.

Helping hand.
Helping hand.

Helping hand.
Helping hand.

I was extremely paranoid about losing parts, so I kept everything in minigrip bags that I made sure to close.

Bags.
Bags.

OK, so that was a no-go. I headed over to Discord to see if anybody had any advice.

NKT gave me the idea of using something cylindrical for stablizing the screwdriver, and I gave that a go. I grabbed my Revolver, stuck it to the table with some two-sided mounting tape and tried the concept out – this could work.

Narrator: “it didn’t.”


At that point I gave up for the day and put the screw in the naughty box.

Revolver.
Revolver.
Naughty box.
Naughty box.

On Monday I headed over to a hobby store, and the guy there suggested drilling a hole into a piece of plastic and then using that as a screw holder, and it sounded like it might work so I decided to give it a go. I got a 1.6mm thick rod of plastic, a 1.2mm drill bit and a handle for it, and the Tamiya tweezers.

After some experimenting it looked like the plastic was just a bit too thick (should have gone with eg. 1.2mm) and it was hard to see if I was anywhere near the screw hole, so I thinned it a bit with a file and rounded the head. In hindsight I should probably have taken even more of the head off. While it was easy to get the screw onto the plastic “handle”, getting the screw positioned properly was a pain and the screw had a tendency of falling out, but I suspect a 1.1mm bit would have already been too small. I tried different ways of clamping the disk in place but eventually gave up. I was starting to doubt I’d get this done.

Plastic screw holder.
Plastic screw holder.

Act III, Rustling up Some Screws

On Tuesday I asked around on Discord if people had any further ideas, and legendofthesamurai suggested using thin copper wire to make a lasso around the threads of the screw and then using that wire as a handle. That’d solve the problem of not being able to see where I was putting the screw, and I could use the plastic tool to hold the currently detached screw for lassoing.

After I had the screw in the lasso, it was downright easy to get it in the disk.

Success.
Success.

OK, not so easy that I wanted to do all disks so I left one at the default position, but I did change the pin on the drive disk, which was challenging due to the drive shaft.

Getting the washers back in took me a while, and I don’t think I could have done it without two tweezers, but I eventually got there. The last step was tightening those 3 screws in the plug casing, but they were big enough that I could hold them with the tweezers to screw them in, so that was an absolute breeze. Used a 1.3mm hex head to reattach the loose screw on the endplug, and plopped the sidebar back on.


And there we have it. 3 days later I have an assembled lock again.

It does seem like there’s a little more friction than there used to be; I think I dinged some of the circlip washers as I was putting them back in, but there’s
no way I’m popping it open in a while and not much I could do about those washers anyhow. I put very small amounts of PTFE-based lock oil between the disks which helped a lot.

Drive shaft challenge.
Drive shaft challenge.
Reassembled.
Reassembled.
RKS core.
RKS core.

Album for storing a pin collection

Thursday, March 11th, 2021

In 2019 Jan-Willem started with am odd collection. Not the locks, nor the keys, just the pins from a pin tumbler. Pins are in a lock and make them function. However, the pins are only observable when the owner decides to gut the lock or create a cutaway. The idea was simple: Create a collection/archive of pin tumbler pins and their keys. This required a proper way to store the pins.

To store the pins many different boxes have been tried. After many failed attempts Jan-Willem stumbled upon a hobby not to dissimilar from our own: coin collecting! The value of one €2 coin is just €2 to a consumer. While the collector is looking for a 1st edition misprint from Monaco, and not just any coin.

Coins are often stored in albums, either with or without protection. The lowest quality coins protection are two pieces of plastic film and a cardboard cutout. Often glued or stapled together. While the high end coins are with a certificate sealed in an acrylic case. Leuchtturm makes coin boxes in between the two, and at a reasonable price and the inserts are DIY, lasercut acrylic.

First attempt with Leuchtturm boxes.

To store these boxes it was decided to use business card holders, this did not go as plan and required custom holders. First made from acrylic and the second version from wood. Fifty sets of pins are created and thirty are added to the album. This is where the project was stuck for a year.

Pins in album v1

Last week was a good time to continue this project. A proper pleader album was bought. And the pins are added.
This is the result this far:

Abus E90 pins in a box.
Leuchtturm album.
Demonstrating how the Leuchtturm album is used to store pins.
Pins neatly stored in the album.

The album has 48 pins and about 30 more sets are ready to be archived. Acrylic is ordered and the inserts will be created when a lasercutter is accessible again. The photos will be published here on Blackbag. For now you can find one key a day on twitter: https://twitter.com/hashtag/microkeys?src=hashtag_click&f=live

The coin boxes, album, and inserts are sold under the name Leuchtturm and Lighthouse. These boxes are available on eBay. Link to a Dutch web shop: https://www.knm.nl/leuchtturm-quadrum-capsules-14-mm/nl/product/2741/

The files are available under creative commons, share alike with attribution, commercial use is allowed.

S&G cutaway

Sunday, November 10th, 2019

A while ago, we talked about a very nice cutaway lock made by l0ckcr4ck3r, see https://blackbag.toool.nl/?p=2613. That was a Mul-T-Lock MT5+. He has been busy on a new lock lately, the Sargent and Greenleaf Environmental Padlock 0881.

S&G 0881

I must admit I did not know the lock, aklthough it is apparantly well-known in the USA. The lock is made to especially withstand harsh weather for prolonged periods and still open without problems,

L0ckcr4ck3r has worked his magic to cut the lock open and this is the result:

More pictures can be found at https://drive.google.com/drive/folders/1DKNmLTOpDM12dxdGNW-kbYIPNJRx2vEX?usp=sharing.

Toool is not affiliated with l0ckcr4ck3r, we just want to show nice pictures of nice locks.

(Post by Walter)

Attacking masterkeyed systems

Tuesday, August 6th, 2019

A couple of years ago one of our members, Jos Weyers, came up with a novel method to attack masterkeysystems. If you know Jos, it’s probably not at all surprising that this method mainly consists of impressioning. Attacking masterkeyed systems that way has several distinct advantages; no need to take a lock apart, no need for huge numbers of blanks, no need to have access to a working key, no guessing if your new key is indeed the master you are looking for, to name just a few. After keeping this knowledge within a rather small community for some time, it is now out in the open due to a talk Jos did at OzSecCon in Melbourne this year.Which off course includes live demo’s right there on stage.

https://twitter.com/kylieengineer/status/1139694231964938240

(masterkeysystem supplied and pinned up by Holly Poer , “southpark-esque lock animations” by JanWillem Markus)

Opening a vintage lock

Sunday, February 3rd, 2019

A while back, somebody visited one of our Toool meetings. This gentleman brought with him a punch clock device. I am not sure in what setting it was used, but found one example on the internet of such a clock being used in a prison, where the warden would register their rounds through the facility

Punch clock

The keys were lost, so we were asked to try to open it without damage. The lock looked easy enough..

Still, we could not open it fully.

In the end, Jos took it home to look at it a bit further and in the end he was able to open it. We had not expected a three lever lock when we started.

Finally, we had a nice view of the insides, where you can see the mechanism to transport a paper tape and an ink ribbon.

Toool on the BBC (again)

Sunday, December 9th, 2018

At LockCon, we had some guests who were shooting footage for the BBC. They followed a few British lockpickers, including Nigel and made an item for the One Show.

It aired last week and you can view it below.

FIOPS forensic tests

Thursday, November 1st, 2018

At LockCon 2017 (so last year), the good people from FIOPS were present. FIOPS is an internationalorganization founded to create a platform for forensic specialists in the field of physical security.

This is an interesting field, that also interests many of the attendees at LockCon. By looking at traces left inside a lock, it is possible to tell a lot, e.g. if it was just opened with a key, or if also picking tools were inserted. It is possible to differentiate between standard pick tools, pick guns, bump keys etc. because all leave different traces that can be seen by disassembling the lock and having a close look with a microscope.

The folks from FIOPS asked our help to provide real traces in locks, to help build a library of locks opened with different (but known) techniques. For this reason, they installed a real door in which cylinders were placed to be opened, every time a new one. Recordings were made of the opening.

I was one of the people opening one of the locks (lock 24), and my method was picking. Since members of Toool never pick locks in doors as it does not make sense but makes it harder, I expected to need quite a lot of time. Imagine my surprise when I opened in 20 seconds, even if I had never picked the lock before!

Here’s a video of me opening:

Enjoy!
Walter.

Showing a sliding seal padlock at a regular Toool Amsterdam meeting

Wednesday, March 22nd, 2017

Toool NL has biweekly meetings in Amsterdam and Eindhoven. During those, people will discuss locks, pick them and socialize. The next video gives a glimpse of such a meeting. Jos had just brought some locks over and is showing the sliding seal lock on camera.

Chinese locks

Wednesday, December 14th, 2016

After winning the lockpicking competition in 2014, the folks of Toool US were kind enough to sponsor a plane ticket to the event in de USA in 2015. Since I couldn’t use it, they said they would get me something else instead. That finally arrived in the form of a small suitcase labeled “Thank you for LockCon 2016”. Jos got a similar case. Thanks guys!

Case with Chinese locks

Case with Chinese locks

In it is a collection of Chinese locks. The first one (marked AFA) has two rows of dimples, 10 in total, and a wavy line. The lock is typical Chinese in that it comes with two keys that are used during construction, and several (in this case 5) user keys that are seperetely packaged. A special programming key is used to disable the construction keys and enable the user keys.

Case with Chinese locks

The second one does not seem to be reprogrammable. It comes with six keys and it is one of these Chinese locks that has a free spinning plug. The key connects the two parts of the plug, allowing the lock to operate.

Case with Chinese locks

The next lock is a padlock with a ‘smiley’ key profile. There are pins on both sides.

Case with Chinese locks

The next lock is a cilinder that again has two construction keys and a closed box that holds the (six) user keys. There is no reprogramming key: any user key will do. The construction keys have a slit at the end of the key, the user keys do not. This cilinder has a quite nice looking anti-breaking element, as has the free spinning lock. On the key we read “safety is derived from technology, Kailusidun”.

Case with Chinese locks

The last lock is a padlock made by Zhongxin. The key has two rods and the lock has two holes. The key does not rotate, it needs to be inserted after which a button on the lock can be pushed to unlock it. Removing the key locks the lock again.

Case with Chinese locks

Security Essen

Friday, September 30th, 2016

Although many locks now feature electronic features, at the Security Essen fair, enough interesting fully mechanical locks could be seen. Some companies, like Iseo, have decided to focus solely on electronics at this event. Other companies show that new mechanical features can still be invented. Evva showcased the new 4KS which is a continuation of the 3KS. I found the ICS with Temporary Access Function more interesting from a mechanical standpoint. This cylinder comes with two user keys, of which one only works after putting the lock in temporary access mode with a change key. Mottura showed cylinders with a magnet in the key, to defeat lockpicking. DOM has a new cylinder that has keys that are even harder to duplicate. Abus showed a really neat new modular system that makes it very easy to change the length of any of their cylinders without using special tools, not even a screwdriver. A very simple and elegant solution that works really well.

The company Master showed an impressioning key for single row dimple locks, that uses a metal wire to impression in. It needs quite a bit of force to impression, hence a tool is used for that. In the video you can see it in action.

Now off to LockCon 2016!