Car opening follow up: the BMW 2 track decoder

Lambert, a Toool Eindhoven member, was kind enough to send me a DVD
with the German RTL item I announced but missed myself. It covers some
interesting car opening techniques. One of them is decoding a brand
new BWM X3. I also demonstrated this German tool at hope number six. I
assume most of you missed that presentation so I combined some video
and mixed in some fresh close ups from the tool. See for yourself:
 http://blackbag.toool.nl/video/bmw.wmv (WMV 76 Mb )

bmw 2 track decoder

The problem with these wafer locks is that they have sloppy
tolerances. Theoretical each individual lever could be in four
different positions. If this really was the case all eight levers in
the lock would create a keyspace of 65.536 possible keys. The big
weakness is that if you cut a key to ‘one and a half’ it will open
both a 1 and a 2 cut. And a key cut to ‘three and a half’ will open
both levers 3 and 4. So instead of four combinations we now have only
two, limiting the total keyspace to a lousy 256 possible keys. To make
things worse each side of the key will only operate four levers
instead of eight. Normally four levers would be good for 256 different
combinations but now that is reduced to 16. This is why it is possible
to have a set of 16 setup keys simulate all key combinations possible
on this specific BMW lock.

21 Responses to “Car opening follow up: the BMW 2 track decoder”

  1. seanrox says:

    Thank you again Barry for another great video presentation.

    It’s amazing that a high end car company like BMW would have such a badly designed lock.

    BMW claims to be the ultimate driving machine, which in their defense the cars do drive nice but after watching the video, it would seem they need to do some work on designing better locks to secure the cars.

    Side note, what type of camera do you use for your videos? I’m looking for a nice method of doing videos for my site.

  2. André says:

    Great Video!
    I guess you will bring this tool with you to cologne? I would love trying this tool on my own BMW-Locks.

  3. Barry says:

    André: Unfortunately I had to give back the tool to it’s original
    owner today . Maybe I will be able to borrow it some other time but it
    is a fact I will not bring this tool to Koln next week. That I why I
    was busy till last night 03:30 to finish the video clip. I am glad
    you have enjoyed the result of this labour.

  4. Barry says:

    Seanrox: Thanks again for the compliment. I use an ordinary Sony DV
    camera. A not too modern type but one I know inside out. When I bought
    it I paid attention of it being light sensitive. I think any modern
    camera will do for this type of home made video’s.

  5. p1ckf1sh says:

    Interesting. Does anyone have breakdowns pictures of those BMW locks? And what is going on in Cologne/Köln next week?

    Regarding the TV report… it sure is scary that BMW locks open that easily. But considering all the other factors that regard automotive security, I think it would not really make sense to implement higher security locks.

    What I found totally weird is the fact that even the really recent MercedesBenz/DaimlerChrysler high-end models do not implement deadlocking. My 10 year old VW has that… but a Daimler that is about 6-8x the price does not? Hmmm…

  6. p1ckf1sh says:

    Forget my inquiry about breakdown pics. I was typing that when I was just downloading the video. Turns out that the BMW lock shown is exactly the locks VAG used up until 2002. Were those made by the same supplier?

    I have not fully understood why they needed a laptop to figure out the X3 code in the video. I understand that the 2004+ BMW locks are “different” and from my experience with the 2002+ VAG locks I suppose BMW not has implemented their “asymmetrical” wafer layout that puts a end to the traditional decoder because the wafers have to move into two directions. is that the reason for the laptop? Using it to “guess” the undecodable wafers?

  7. André says:

    Barry: It’s a pity that you cannot bring the decoder with you. But can you tell us what the people from Wendt did with the computer? I hope it was more than dividing numbers from 1 to 4 by 2 🙂

    p1ckf1sh: In almost every spring and autumn there is the “SSDeV Frühjars- / Herbsttrainingslager in Köln Kalk”. There the Members of the SSDeV meet and talk 3 days about news in Lockpicking. Last time I met Han Fey there, his lectures are always an enrichment to the meeting.
    http://www.ssdev.org/lockpicking/work.php (Not quite up-to-date…)

  8. p1ckf1sh says:

    Andre, thanks for clarifying on that training camp thing. I expected this to be some kind of inside/member thing, now I know for sure.

    Regarding the BMW they opened on video, it was a model newer then 2004. IIRC Barry mentioned that this exact kind of device is aimed towards models before 2004. And it was mentioned that post-2004 locks are different in a way. I believe it is an implementation of the same system VW uses since 2002. The basic diff in those VAG locks before and after 2002 is the introduction of “reversed” wafers and a new alignment of the slots. This boils down to the fact that 2 wafers per side have to be pushed up and two have to be pushed down. The regular decoders will not work on this system anymore. So I believe that the laptop is quickly calculation possibilities when a few of the wafer measurements are missing and then gives you a list of keycombos to try out.

    But this is just my guess, as I have never seen the actual tool or any BMW lock.

    Here are some breakdown pics of two VAG locks, one old style and one new style to give you an idea of the changes made by VAG.

    http://i61.photobucket.com/albums/h77/p1ckf1sh/tracklockbreakdown/d02.jpg
    http://i61.photobucket.com/albums/h77/p1ckf1sh/tracklockbreakdown/d03.jpg
    http://i61.photobucket.com/albums/h77/p1ckf1sh/tracklockbreakdown/d12.jpg
    http://i61.photobucket.com/albums/h77/p1ckf1sh/tracklockbreakdown/d13.jpg
    This shows the wafer alignment and a glance into the keyway on an newer model lock.

    http://i61.photobucket.com/albums/h77/p1ckf1sh/tracklockbreakdown/i02.jpg
    http://i61.photobucket.com/albums/h77/p1ckf1sh/tracklockbreakdown/i04.jpg
    This is the old model. Compare the distribution of the wafer slots and the alignment of the “wafer stubs” inside the keyway to the new model to understand what I mean with my assumption.

    There are more pics showing the wafers if you go straight to the folder on photobucket:

    http://s61.photobucket.com/albums/h77/p1ckf1sh/tracklockbreakdown/

    Hope that works.

  9. the_master says:

    Very nice tool, I am impressed by it, and I find it very weird coming from BMW. I guess they concentrated more on the car’s quality, then on it’s own security.

    Very nice work like usual Barry, it’s well appreciated.

  10. martin says:

    great video thanks for sharing,nice piece of equipment,keep it up

  11. Barry says:

    André: The software is needed on newer models because the wafers in
    these locks can no longer be accurately measured. Sometimes it is
    plain impossible to feel the difference between a two or a three
    wafer. But you are always only one number off, so a wafer one can not
    be mistaken for a code four. Meaning that if you doubt between a one
    and a two there is no worry, the ‘one and a half cut’ in the setup key
    will open it anyhow. But if you doubt between a two and a three you
    have a problem. The software just calculates all possible combinations
    of set up keys that must be tried to brute force these ‘hard to decode
    wafers’. You could also create this list by hand on a piece of paper.
    The laptop and software are just quick and convenient…

  12. Martin_X3 says:

    Very nice tool.Can we start and drive the car whit this instrument?

  13. David says:

    I have the VAG decoder and first impressions are not so good my first attempt, was to overcome different styles of locks in the VAG range once this was done by adjusting the measuring device, my first lock to practice on was an Audi A4 ‘1998’ model with the door lock stripped down to a bare barrel with wafers, I quickly did decode the lock however, the bottom wafer #8 did not align correctly and there is a slight mis alignment which leaves the tool useless for opening this lock, now I may have been unlucky as I have coming in the next few days more vag locks to practice on first.
    I will keep you informed.

  14. David says:

    OK I now have taken a VW Caddy year 2000 van lock and stripped it down to the barrel with wafers again, on examining the original key there is a descrepancy with a few of the wafers sticking out a little here and there.
    So decoding the lock again was easy, and hey presto the kit form worked this time, I was impressed but not totally convinced it opens all VAG locks, however I think sucess will be mainly due to the following: –

    1. The lock is given a good squirt of lube to flush out muck in the barrel, and to help minor variations to pass.

    2. The lock is used frequently by a key, obviously the more worn the lock a higher sucess rate will follow, I don’t hold much hope for people who have used the remote to lock unlock all the time.

    I guess i’m going to keep the lockout kit now 🙂 and I am starting to compile a book with the differant cars and the combinations I get from the locks, who knows maybe after decoding the same car over and over it turns out that just maybe 8 variations open these locks per style of car?

  15. David says:

    Martin_X3 Says:
    November 1st, 2006 at 19:00
    Very nice tool.Can we start and drive the car whit this instrument?

    Martin there would be a posibility that the key could be made to turn in the ignition, but will not start it, for this you will have to have a programmer for the chip also, my interest in getting into the vehicles is for my job as a roadside technician, for people who like to lock their keys in the boot :(, also this could come in handy if access is needed to release a handbrake or take out of gear or undo the steering so it can be steered in a Police recovery where the vehicle has been stolen.

  16. BudWiser says:

    hello

    Now where we can get something like that; thing to start the engine (or we must got some conections for buying it)…or it’s like tiger paper for me? I hope you understood me.

    and sory for my bed ang.

  17. jakub says:

    EMERGENCY!

    Hi,
    I found this site by desperately looking at possibilities to open my car. I locked myself out by dropping the keys in the trunk and shutting it (yes I feel pretty stupid!)
    I ordered a key from the BMW dealer here in the Netherlands but it does not work ?
    (probably the last owner changed the locks or so)

    So the only thing I can do is brake the window and dismantle the back seat and get in the trunk. But I rather use this tool on the sit.
    (I contacted the Dutch distributor but they cannot tell me who buys this from them)

    Can anybody help me with this or do you know somebody with this decoding tool ?

    Desperately seeking

    Jakub010@hotmail.com

  18. Alanj says:

    Hi,

    I saw this tool in

    http://www.decoderkit.com

    I think they are the inventors of this tools

    regards
    Alan

  19. Rob Reynolds says:

    B. I would like to post a link to your video on some of the us locksmith sites and in our own technical reference software. If this is ok please let me know.

  20. Kelly says:

    Would like to buy Bmw 2 Tracker Tool it looks helpful in this business

  21. Kelly says:

    Send me the info. to order this tool. Thank You-Bigkatz2001@hotmail.com