2-in-1 for Abus, that barely works.

January 8th, 2022

Lishi 2-in-1 have been around for a long time, both for automotive and more recently for pin tumbler locks. Sadly, these tools are quite costly as they are keyway specific. Furthermore, this type of tool can’t be made for some locks as the keyways are too tight. Or so I thought, as of writing there are several 2-in-1 for sale for the paracentric Yale keyway. As I was intrigued, I’ve bought an off brand 2-in1 for CISA. In testing the tool, I’ve found various limitations that might impact the usefulness of this tool.

Let’s start from the beginning, Lishi is the brand name of a series of lockpicking tools designed and made by Zhi Qin Li. The Lishi company split up and Zhi Qin Li still sells his 2-in-1 under the brand Original Lishi, while another company sells them under the brand Genuine Lishi.

Original Lishi sells a variety of tools, the one generally referred to as a Lishi is a 2-in-1 lockpick that both applies a turning force and a tool for picking individual elements. The tool can also be used to decode the lock once the lock is open, and a key can be cut in the field with another of Li’s tools.

Lishi for the Schlage SC4 keyway.

So, what does a Lishi 2-in-1 lockpick do? The tool consists of two parts; the body that is used as a turning tool and the thin feeler that’s used as a lockpick. This in itself would not be too useful, however, the body has a chart of where the lockpick is in the lock. You move the pointer to the desired element, indicated by the vertical lines, and push down lightly on the pointer. This in turn moves the lockpick, pushing down on the element in the lock. You can feel if the element is binding or not. And just as lockpicking, you go through the lock, pin by pin, and feel for the binders. Then you set each binder and search for the next one, until all elements are set. Click on one, click on three… Open!

From y2k these tools have been available for automotive locks as the combination of open keyways, many wafers, and typically low tolerances work very well for this tool. 2015 was the year 2-in-1 picks became available for pin tumbler lock for the USA market. (Schlage, Kwikset, and Master). Most of these locks have wide keyways, low tolerance, and very few security pins.

I’ve played with a few of these tools, but didn’t find them too useful. I’m not a locksmith, not in the USA. For me, they would be mostly a novelty. But the pick I’m about to show can be a game changer as it targets European locks I’m familiar with.

In December, I was notified a seller on AliExpress sells 2-in-1 (not a Lishi!) for the paracentric Yale keyway. The consensus under lockpickers is that this tool could not exist, because the keyway is too tight and has no straight access to the pins. I was curious enough to fork over €50, and bought one for CISA as it’s very close if not identical to the Abus C83, the lock we use for impressioning championships.

The seller is quite open about the tool’s limitations and wrote on the lever “80% coverage. Without pin 8 or 9”. While this sounds like it’ll open 80% of locks, but it doesn’t seem to be the whole story, as we will find out. The biggest concern with a tool that works on a subsection of locks is if the user can detect the tool does not work, instead of user error or lack of skill. I suspect so, but it will be far from easy. In short, a lock will not work with one or more cuts deeper than a 7 and therefore this pin will always be overset and this you can detect.

Small sub section of factory cut Abus C83 keys, I’ve a modest collection of them.

As I was curious about the 80% claim, I’ve spent an evening measuring my Abus C83 keys. While these are not CISA, they are close, and I happen to have a modest collection of these keys. 92 out of 283 of the measured keys have no cuts deeper than 5.5mm, the size of the tool. This means the tool will only work on 30% of my Abus C83. This is consistent with a statistics sanity check. For this, we assume every lock has a uniform distribution of cuts, ignoring MACS. This came to be (7/9)^5 = 28.4%.

I’m considering this 30% an upper bound, as Abus C83 and CISA aren’t shipped with standard pins. The old locks are shipped with mostly spool pins, and the new ones have serrated, spool, and T-pin key pins and the same for the drivers.

Abus C83 old style vs new style pins.

Besides the theoretical usability and security pins, what other flaws would make this tool suboptimal? The picking tip snags while moving from pin to pin. Furthermore, picking in the counterclockwise direction binds the picking tip, and it makes it difficult to differentiate between a binding pin and a binding picking tip.

Randomly pinned lock with standard pins, decoded to 52452.

Let’s wrap it up, this tool is sold at €50 and promises quite a lot. However, theoretical, it will only open 30% of all the locks it was designed for. Furthermore, the limitations of security pins and rotation direction will limit the functionality even more. A practiced lockpicker might be-able to overcome some limitations, or detect the tool will not work. A tool that only opens a very small subset of locks is not a very useful tool, and I can’t recommend it to pick these locks. However, as new pickers always struggle to find the binders, and this tool enables them to actually ‘see’ what they are doing, it could be a game changer for teaching.

Pictures CCBY4.0 Jan-Willem Toool Blackbag

HITB CyberWeek 2021, UAE

January 3rd, 2022

At the end of November, Jos, Walter, Rob, and me (Jan-Willem) went to Abu Dhabi to teach lockpicking at HITB CyberWeek 2021. We brought close to eighty kilograms of gear, including a hundred locks, plenty lockpicks, impressioning gear, safe locks, and more.

Photo of our first trip to Abu Dhabi in 2019

Why fly all the way to the UAE for a lockpicking village? Toool has run many lockpicking villages, some years more than a dozen. When the Hack in the Box conference came to The Netherlands in 2010, Toool was there with a village and ever since we’ve run Lockpicking Villages at HITB Amsterdam. In 2019, we were invited to run the Lockpicking Village at HITB CyberWeek in the United Arabic Emirates. As it was a great success, we accepted the invitation without hesitation when we got it again this year.

Getting to the UAE was fairly straight forward, even with all the measures. We send in our documents, including vaccination history. Travel was slightly terrifying as we required a tested before the flight, and a positive result would cancel the trip. Luckily, all results were negative, and we were allowed to fly. The flight itself was 6h, and we arrived at Abu Dhabi near midnight.

The first day was to relax and recover from the trip. After breakfast, we explored part of the city. It’s hard to convey the scale to which Abu Dhabi is build. The buildings are large and the space between them are usually three lane roads. It doesn’t help that even in November, it was 30 degrees Celsius outside. We found the ATM, grocery store, and the Abu Dhabi National Exhibition Centre, even though it took most of the morning. We spent the rest of the day at the rooftop swimming pool of the hotel and the welcome reception in the evening.

The conference started early the next day. As always, setting up the village was rather quick. We created a few different areas within the village, one focussed on lockpicking, and another on impressioning and safe cracking.

Even through this was my 20th lockpicking village, it never gets boring. I was very excited to try out a few new things. For this trip, I’ve created a large set of progressive locks, with multiple brands, and pin styles. I’ve also brought multiple new slide decks on lockpicking, impressioning, and safe manipulation. Walter brought a variety of combination locks, from a small padlock to a dial safe lock, and we also brought a full impressioning kit, as it’s a great joy to demonstrate the technique.

We tried to gather people in small groups as much as possible, as it’s a lot more efficient. From early the first day, the lockpicking village was packed. Some attendees stayed for ten minutes and had a great time by learning the basics. While some stayed for hours and opened ever challenging locks. Most notable were the participants that kept returning to the village throughout the event, it was very clear they got the bug. We have taught between two hundred and three hundred people, and between five and fifteen people at the time.

After we packed our gear at the end of the event. We decided to take another dive in the swimming pool, before heading out to the after party at the Hyatt Capital Gate. I’ve cut the party short as our flight back was early in the morning.

The casualties of this event, insert lock pick and twist.

Wrapping up, we had a great time at the HITB CyberWeek 2021. For the next one, I’m likely to take more days of holiday and do more sightseeing and other activities in Abu Dhabi. Even as a midweek, it was well worth the time.

We would like to thank the HITB crew for inviting us and arranging everything. Furthermore, we had a great time at the event and hope to see you again at HITB Amsterdam.

Mandatory impressioning opens.

Blog by Jan-Willem Markus. Photo CCBY4.0 Toool Blackbag.

The Vault below the Nutshuis, The Hague

December 4th, 2021

Hidden in plain sight are the obsolete vaults in old bank buildings. What do you do with them when they no longer serve their purpose? Tearing down the vault is usually out of the question, as the buildings are cultural significant and therefore protected. But you can make it in something useful again, as long the main structure remains intact.

Most bank building conversions are quite dramatic, as where others leave the vaults mostly intact. Walter send me the suggestion to show a famous geocache: GC2JV5X, van “Kluis tot Kookhuis”, this bank building is converted into a shop for high-end cookware. One of the deposit boxes in the basement is the geocache.

In this case, I wasn’t looking for a vault, but with just dumb luck I came across one while giving trainings. Specifically, I was in The Hague at the Nutshuis named after the Nutsspaarbank, this savings bank that used it as headquarters from 1921 to 1992. While staying in an old bank building is kinda crazy, the ‘nut’ in either building and bank is the Dutch word for utility.

The host was very kind and let me in the vault to take pictures, hopefully these will give you a nice insight in the 1920s vault technology. Most of the building and vault is still original, they removed most of the safe deposit boxes to make the room function in its new purpose as a movie room. To enter the vault there are originally three heavy doors of which two are prodded open and one is permanently closed.

Inside the movie Vault.

This is the door on the right side of the building. The door is heavy and impressive and clearly designed to intimidate, as it has many more locking bolts than necessary and large handle and gearing on the outside. This door has three locks: One keyed safe lock, one Chubb/Lips vault combination lock, and one Kromer time lock, similar to one I’ve in my collection.

Vault door two is less impressive looking and has a completely different style: it has a flat, unimpressive looking door with two keyed safe locks and a normal size handle. What locks they are, we can only guess at.

The third door is similar in style to the first door in the list. However, the day gate was still in place, and they removed the back cover from the safe. From the picture, we can see the same Kromer time lock and a Chubb/Lips vault combination lock.

Here are a few links I’ve promised. While the pages are largely uninspiring and the photos aren’t as clear. These will give some idea of what is out there and the hidden treasures there are to discover.

Amsterdam’s Archive: http://www.lucvandelagemaat.nl/category/voice-over/
Deventer, Carlos in huis: Furniture and living https://carlosinhuis.nl/winkel/
The Hague, Nutshuis filmkluis: https://nutshuis.nl/zaal-huren/filmkluis-en-foyer/#et_pb_dp_oc_custom_0_3
Den Bosch, Robbies concept store: https://www.verwersstraat.nl/robbies/

I’ll finish this post with a these safe deposit boxes used as props throughout the basement.

Article and pictures CCBY4.0 Jan-Willem Markus at Toool Blackbag.

forensic research impressioning during lockcon’17

October 23rd, 2021

As Walter stated in https://blackbag.toool.nl/?p=2746, the good people from FIOPS have asked the participants of LockCon to open some locks in various ways. These locks would then be forensically analyzed to figure out what actually happened to them. Of course I opted for impressioning (because me). It felt weird to impression while standing up (i never impressioned a lock that was mounted in a door before) and walking back and forth between the door and the table also felt rather novel.
(As this all took place late late at night during LockCon, “some” alcohol might have impacted my opening as well)

This is the video shot by FIOPS of my opening attempt;

Lock Picking Forensics

October 6th, 2021

I (Walter) have created a geocache that requires some RSA hacking and subsequently lockpicking. I bought an Abus Titalium 64TI/40 padlock to be picked. Several people were able to find it by teaming up together. The feedback I got was that people spent considerable time on the lock, sometimes several hours (in separate sessions).

Geocacher #15 was unable to lockpick the lock, even though he had practiced on an identical lock at home. I offered to go with him to give advice. He couldn’t open it. Also I couldn’t (quickly) open it. I took the original key and that would not open it. By not fully inserting the key and wiggling, I succeeded in opening. (I let the geocacher pick his own lock and allowed him to log the cache.)

Once home, I decided to take a look at the lock. Although only a very limited number of people had worked on it, it was completely shot. I took a video comparing showing a new padlock and then the one from the cache:

I’ve taken apart the lock to have a look at the pins. We always say that picking a lock will leave tiny traces on the pins (and other parts of the lock) that can be found during a forensic investigation. Well, in this case, the naked eye was enough to see the abuse.

Here’s the plug with the key inserted. Note how the pins have shortened. This causes the key to no longer work.

This also explains why taking out the key a bit and wiggling opened it.

Here’s a view of the pins:

There’s now a new padlock in place. You can’t really tell from the picture here, but the pins are made out of aluminium, which kind of explains the wear on them. I bought the lock as it is marketed as being weather proof. But resisting weather is different from resisting lockpicks.

Photos/video CCBY4.0 Walter Belgers

Book review: Little Black Book of Lockpicking

September 30th, 2021

Two weeks ago Alexandre “FrenchKey” Triffault published the book Little Black Book of Lockpicking on NDE techniques for Red teams and security professionals. The book has 171 pages with a broad variety of lock types and opening methods, from lockpicking to impressioning, and from making cutaways to decoding combination padlocks.

Whenever there is a new book about lockpicking I pick up a copy especially when it’s written by a friend. It sold for €35 Amazon that does the printing and distribution of this book. The book is a good read and is a continuation of the OFC guide to lockpicking (free pdf) that’s also written by Alex and translated by MrAnybody. The OFC guide is all about lockpicking while this book includes many more topics including bumping and impressioning, both topics I’ve paid extra attention to.

The first thing I noticed was the many high detailed graphics used. Alex modeled the locks, lockpicks and other tools and included 3D renderings in the book as virtual cutaways. The style works very well for this book. It does not just write about a concept but also shows how it is done.

The book is 27 chapters and on average six pages for each subject, this inevitably means there is not too much room for details or nuances. This is a pity as Alex has the ability to give insights I would never think of.

I want to mention that the advanced topics in the book like (self) impressioning will take a long time to get good at. For me, I’ve experienced it takes many failed attempts to do these attacks, even in a controlled environment. Attacks like self-impressioning took me a very long time to make work. I can only imagine how it would be to attack doors on an assignment.

This is one of the better books on the basics of NDE and I recommend getting a copy for yourself or to to share. When you share the book, do keep in mind the book is written for red teams on an assignment and not for hobbyists. It is never a bad thing to give a small lecture on the locksport ethics and our view on locks as a puzzle with the book.

JimyLongs’s Lockpick Project

August 2nd, 2021

JimyLongs made a small batch of custom lockpicks and shared them with his friends to get feedback on the design and to make them better. I was fortunate enough to be included in the European distribution and testing of the picks.

The pick making process is pretty involved from selecting the right materials to endlessly simulating and tweaking the design. Jimy had the picks laser cut and it was not without issues. It turns out laser cutters can be too powerful and ruin the picks in the process. Furthermore Jimy build his own injection molding apparatus for the handles.

Let’s have a look at the picks. 🙂

The set contains three picks; short, medium, and long hook in 0.5mm. The picks are full tang tempered & polished 1095 carbon steel with characteristics similar to High Yield SS 301.

I like the picks very much. They give great feedback as they are very stiff. No chance I’ll snap the handles like I did once with a Southord Max (Sad image). Can’t wait to bring these picks to a meetup and gather more feedback for Jimy.

To wrap this one up let’s compare the profile of the long hook to other picks in my kit.

From left to right: Peterson H7, Sparrows SSDeV, JimyLongs long hook, Multipick PN04, Southord Max, Law Lock Tools Tipene Teardrop.

For me the thinnest profiles work best (LLT & SSDeV). Each of these picks have their uses.

That’s all for this post. See you in the next one.
Photos CCBY4.0 Jan-Willem Markus Toool Blackbag.

Manipulating the Stanton Concepts RKS

July 20th, 2021

By Tom Eklöf (obrotund on Discord), 2021 (CC BY-SA 4.0 license.)
Previous post on RKS: https://blackbag.toool.nl/?p=3416

This is a proof of concept for a manipulation method for the RKS. At least a passing familiarity with safe combination lock manipulation is assumed.

As far as I know this is the first public manipulation for the RKS – or at least it was when I did the actual manipulation some months before writing this post. Please do let me know if you know of others before me.

editors note: Pics or it didn’t happen, no hearsay allowed. 🙂

RKS operating principle

I’ll provide a quick rundown of how the RKS lock works, but I’d suggest reading Han Fey’s excellent writeup for more in-depth information. Note that there are some differences between what’s detailed in the doc versus the lock I have, but the general idea is the same.

The RKS cam lock innards resemble a hybrid of a fixed drive pin combination lock and a disk detainer lock. Like both disk detainers and combination locks, it has several disks with gates on them (ie. wheels in combination lock terms, but the RKS doc uses “disk” so I’ve stuck to the same terminology) – 5 in my version – and a drive disk which is equivalent to the cam. Like in combination locks, the gates can use the full 360° of the disk. Each disk including the drive disk has multiple false gates in addition to the true gate, but they’re equally spaced. Like in a disk detainer cam lock, the plug is prevented from rotating by a sidebar that fits into the gates on the disks. The combination is changed by changing the position of a drive pin on the edge of each disk, similarly to screw change combination locks although it seemed like only the “bottom” or dialer side pin is changeable – or possibly the ones I tried were just very tight, but I didn’t want to force them considering how tiny the screws are.

The drive disk is at the “far” or cam end of the lock, and it’s driven by a drive shaft that goes through the disk pack and is connected to a detachable dialer, either manual (which I have) or electronic. In effect this gives us a 5 wheel combination lock with each number in the combination between 0 – 63 which is opened like a fixed drive pin lock: you always track the previous number, so if the combination starts L30 R7 L28 … you need to pass L30 5 times (ie stop on the 6th), then dialing R7 you need to pass 30 4 times before stopping on R7, then going to L28 you need to pass 7 three times etc etc. After you’ve dialed the combination you apply counterclockwise tension to the edge of the dialer to rotate the plug itself (ie you don’t rotate the “dialing part” of the dial so the drive disk doesn’t move), which then forces the sidebar to slide down into the gates and allows the plug to rotate.

Note: I’ll use the same numbering scheme for the disks as with combination locks, so disk 1 (abbreviated to d1) is the one closest to the dialer and disk 5 (d5) the one furthest away from it, right next to the drive disk.

The cutaway lock, sidebar and disks visible. The drive disk is the one on the right, followed by d5, then d4 etc.

View of the “keyway”

Manual dialer. The dial itself is rotated with the knob, and torquing the body / edge (the black part) of the dialer counterclockwise is used to actually open the lock

Manual dialer, underside. The black screw visible on the right side of the body of the dialer makes it click to increments when dialing

Measurements

  • number range 0 – 63, meaning 5.625° per increment
  • 5 disks and a drive disk
  • 4 gates per disk (including drive), 3 of which false at 16 increments or 90° apart
  • 8 drive pin holes per disk, at both edges of each gate
  • gates are ~5 (28°) increments wide, including the drive disk. Measured by looking at the cutaway from the top and moving the edge of the sidebar from one side of a gate to another
  • gate binding (or, rather, lack thereof) can be felt for ~6 increments
  • drive pin width is ~2 increments, 11.25°
  • sidebar ~2.2mm

Top and under side of disks with default “0” pinning. Each disk’s three false gates are a bit poorly visible in this picture, but all gates are 90° from each other.

Figuring out a manipulation method

To even get started I had to slightly modify the dialer; normally it clicks in place to number increments, but that would stop me from getting useful feedback. I removed the screw that does this, meaning I got a free-spinning dial. Unfortunately that made accurate dialing very hard since the dial moves if you so much as look at it wrong.

My initial thought was to approach the RKS like a DD lock; I first turned all disks left or counterclockwise (“ADL”, i.e. same as AWL or all wheels left for regular combination locks) to L0, then started to apply tension while turning the dial to the right, feeling for gates on d5 passing under the sidebar. However, this method has some fairly obvious problems. First of all, you get feedback from the gates (false or otherwise) of every disk that’s rotating, including the drive disk. Even on d5 you’ve got the drive disk gates and d5’s own gates in play, and it only gets worse the further down the disk pack you go. I did feel the gates (true & false) on d5, and while I thought I could distinguish false ones from the true but that seems to have just been confirmation bias.

Like with safe combination locks, some disks are also “shadowed” by others due to manufacturing tolerances, meaning that a very slightly bigger disk (or one that sits slightly higher on the drive shaft) will block feedback from smaller disks. This means that simply turning all disks in one direction won’t necessarily give you the gate positions on all disks.

So, obviously this wasn’t a viable manipulation method, at least by itself.

“Well, it’s sort of like a safe lock?”

Maybe I should have approached it more like a safe lock?

My reasoning was that when there’s a gate under the sidebar, applying tension with the drive disk gate (think “cam gate”) also under the sidebar should allow the sidebar to descend slightly lower than otherwise, meaning I should be able to measure the width of the area where the sidebar doesn’t bind near the drive disk gate when I apply torque to the dialer’s edges to make the sidebar drop down – this is the RKS’s equivalent of the contact area and contact points you deal with on safe combination locks.

Unsurprisingly this method turned out to be the proverbial ticket, but to actually get good results I had to refine it. I had problems with consistent torque when tensioning, poor choice of initial disk positions when starting graphs, slop / play in the dial, and the sheer amount of dialing that would have to be done unless I cut down on the number of measurements I had to do.

Tensioning

Getting consistent readings was hard since I was tensioning using my fingers – the torque I was applying was variable, which meant that the sidebar lowered different amounts every time I took measurements. So to even get started I needed to come up with a way to provide consistent torque when tensioning, and I experimented with a few different methods. Since this is a proof of concept I eventually gave up and ended up cheating a bit and tensioning by hanging some weight from the cam itself, but something similar-ish should be doable on the dialer side albeit with more work.

Tensioner attachment on the cam.

Tensioner weight (and yes that’s a Manifoil lead shield)

Initial disk positions

I started my first graphs with ADL. However I soon realized why this is a bad idea.

When going ADL, the drive pin of the previous disk ends up in the gate, meaning that it blocks the sidebar from descending and therefore gives you much narrower and shallower gate signatures.

Going ADR leaves the gates open.

Dialing

Dialing with a modified free-spinning manual dialer is extremely fiddly and liable to drive you insane, and since there’s 5 disks the amount of dialing that would have to be done with a “naïve” approach would be ridiculous.

However, the fact that gates are always 90° apart can be exploited to radically cut down on the amount of dialing. This means that when you find one position where the drive disk doesn’t bind, you know that the other gates are n * 16 increments (1 <= n <= 3) apart from it. Since gates can be felt over about 6 increments, you can then map out the edges of one gate and therefore figure out the edges of all gates.

Also, as I went along it turned out that I was getting indications in order starting from d5; my assumption is that this was due to the fact that I was tensioning the lock from the rear which meant that the sidebar would be at a very slight angle so that it’s lower on the d5 end and higher on the d1 end. After some playing around I noted the same phenomenon but reversed if I tensioned using the dialer (like it would “really” be done), so d1 would read first, then d2 and so on. This meant that once you successfully find the position of a disk’s gate you can figure out how many increments from that position the next disk’s gate will be at a minimum, and start your next graph from that position so you wouldn’t waste time graphing a spot where it’s impossible to have a gate. You can do this by using the fact that there’s a fixed amount of drive pin positions; when going right the minimum distance is - (pin distance + pin width * 2) , and left is pin distance - pin width, both modulo 64 (proof is left as an exercise to the reader).

Graphs

Graphs for this method end up looking slightly different from safe combination locks since a lot of the time you’re not actually getting any binding on the drive disk due to shadowing, so for some indices you can’t get any contact point readings.

I generally kept the cutaway “window” covered, but since this was a proof of concept I occasionally peeked to verify theories or make sure I dialed a number right.

I’ll showcase the graphs for the first 3 disks here since they’re the most interesting.

ADL

As I said, I started off with ADL before realizing it’s a bad idea. This is what the first graph where I used the tensioning tool but with ADL looked like (left contact on the bottom):

So I found the gates, but I couldn’t tell the true gate apart from the false ones.

First ADR, disk 5

Switching to ADR gave this graph. Note that only 3 gates are visible; one of them was shadowed entirely by a disk further down the pack.

The gate with midpoint R49 gave the deepest reading with the sharpest edges. My theory was that since the false gates are so shallow, that’d be the true gate on some disk. I used my Mk I Eyeball on the cutaway window and noted that it was the gate for d5, so now I could be fairly confident that I should be able to tell the true gate apart from the false ones.

To actually verify this, I started by moving d5 a bit to the left and checked for sidebar binding. After I got worse binding for that, I did the same for d4 and got good binding, then d3 and still got good binding (ie. I essentially did a lo test but with only 3 disks). This satisfied me that I’d probably found the number for d5: R49 / L46

Disk 4

I started the next graph assuming that I’d probably be getting indications from d4, so I dialed d5 to L46 and then the rest to R38 which should be close to the first possible index for the true gate on d4.

Note that gate edges are about 2 increments – ie. drive pin width – off from the gates on d5: there’s a gate edge at R20 here but it’s R18 on d5, there’s a gate edge at R36 here but R34 on d5 etc. This means that this graph is most likely for d4.

The gate with midpoint R2 has the sharpest profile, so I assume that’s the true gate. I do a lo test with just d4 and get worse results, so I figure that my assumption about this being d4 was right.

Disk 4 rotational conversion

I initially tried doing rotational conversion with my estimation of the drive pin width plus some simple math, but I kept having problems with it so I end up doing it with graphs. This is what the graph looked like for d4 R2, determining the gate midpoint is at L59:

Lucky disk 3

After finding the gate for d4, I dialed d5 @ R49, d4 @ L59, and the rest ADR to R60 which would be the first possible index for the gate on d3:

After measuring a few points around R60 I realized I probably hit the true gate right off the bat since the gate signature was so sharp and deep. I took readings from the midpoints of all the other gates and noted that they weren’t as deep as the one at R60, and after a quick lo test I declared d3 to be R60.

Disks 2 and 1 held no surprises and graphed as the first 3 had.

Et voilà, that’s how you manipulate an RKS.

About Impressioning Handles; DIY

July 10th, 2021

In the summer of 2020 Jan-Willem decided to photograph his impressioning handles. Not only are pictures easier to share than the handles themselves, most of them are not worth keeping as they don’t work as well as advertised. This will hopefully be a short series of blogs on impressioning handles. This is the first one about DIY handles and handle experiments by Jan-Willem. Hopefully this post will inspire you to pick up impressioning or to motivate you to build your own impressioning handles; really you can do a lot better then most of the handles in this post.

What makes an impressioning handle an impressioning handle? It has a few requirements:

  • To hold a key for impressioning.
  • Facilitating the motion of impressioning; rotational torque while moving the handle up and down.
  • optional: Comfortable to hold. (This will come in at another blog on improvised handles.)
  • Preferably to reduce strain on the arm by applying rotational torque with one hand and the up and down movement with the other.

This post is solely about the handles not about impressioning itself. Missed out on this marvelous way of defeating locks? Maybe you can find videos on YouTube. I believe Jos Weyers has a few videos on the subject. 🙂

Disclaimer: I’m not a machinist and most of these handles are mostly build with simple tools and from scrap metal.

DIY Impressioning handle 1

After lockCon Jan-Willem was inspired to build his own Impressioning handle. This is the first iteration. Build from scrap laying around in the workshop. The handle works very well and the form factor is great. Mostly as you can’t torque and move the handle up & down with the same hand teaching good impressioning habits from the start.

DIY Impressioning handle 2

This is the second impressioning handle. It’s from 25mm or about 1/2″ aluminum round stock with a slot for the key and a few screws to keep the key in place. The long screw was kept in place to help with rotational torque. The blue covering is for racing bike handlebars and is, apart from looks, completely useless. The covering gives the illusion of grip. People unfamiliar with impressioning tent to think impressioning must require a lot of torque and thus break more keys when starting out.

This model was quite successful and about 20 of them where made. Jan-Willem still uses them, without the handle. Toool has a bunch as well for impressioning workshops, two of these are still traveling the UK, and the rest are sold to friends starting out with impressioning.

DIY Impressioning handle 3

Impressioning handles three and thereafter are made to save as much cost as possible. They can be made with simple tools out of inexpensive material but still work reasonably well.

The first two are made from partially flattened copper pipes. The ends are bend up to keep the key in place. While the design works it has a few obvious drawbacks like replacing the blank is an hassle on both of them.

DIY Impressioning handle 4

This design works a lot better than handle 3. But it’ll not work for all keys as the hole in the blank is used for mounting. It was also an experiment using bicycle handles for grip. It works almost as well as it looks.

DIY Impressioning handle 5

This concept is the cheapest of them all. It’s a PVC tube with a wooden dowel/insert clamping the key with friction. It works well but changing the blanks can be a hassle. The rings of dust around it are where it used to have the race bike handle covering. That has been removed and hence the ugly stripes.

DIY Impressioning handle 6

The last design I want to show is a failure. This is made from POM (Brandless Delrin) rod and is similar to handle two of this article. The POM is not stiff enough for gripping the key tightly.

In a future blog post we will hopefully discuss more impressioning handles. A few ideas for future blogs: Why you might or might not want to pickup professionally designed impressioning handles for hobby use, Things that can hold a key but where never designed to, and more DIY handles from other people in the community.

Feel free to steal ideas or use the photos. The ideas are free the photos are CCBY4.0 Jan-Willem Markus, Toool Blackbag. If you create your own impressioning handle design, please share it with us and we will add it to the DIY impressioning handles in a future blog.


New tool: EVVA Dual Gut Key

June 24th, 2021

The EVVA Dual is a lock with twelve spring loaded sliders and two sidebars. One on each side. It is an exceptionally hard lock to pick. Reinder Stegen, a gifted picker, found gutting of the Dual error prone and devised a tool to help with gutting the lock instead.

EVVA Dual with the correct key inserted.

For a normal pin tumbler lock you can gut the lock once the plug rotates freely. This can, for example, be achieved by picking, back shimming, or using the key. The EVVA Dual can’t be gutted in the same way as a regular pin tumbler lock as the sliders protrude the cylinder both in the resting position as with the correct key. While the housing has grooves cut for the sliders to slide and rotate this also means that gutting the lock is much harder to accomplish.

EVVA Dual Gut Key moved the sliders down

You will find more detailed pictures on the EVVA Dual on a recent upload to the Lock Wiki. http://lockwiki.com/index.php/EVVA_DUAL This wiki has been quietly expanding with lots of detailed pictures over the past year. Certainly worth a look at the Abloy Easy and the Chubb Mark IV Manifoil that are recently added.

Let’s get back to the EVVA Dual as that’s what this post was all about. The solution to gutting the EVVA Dual is this Gut Key (Set-up key for gutting) designed and 3D printed by Reinder. It solves the problem by moving the sliders down to the fictitious ‘shear line’ making gutting the Dual a breeze.

EVVA Dual Gut Key by Reinder Stegen

Reinder Stegen was kind enough to allow inclusion of the pictures and STL under CCBY4.0.

Alternative download for the Gut Key: https://www.thingiverse.com/thing:4892450