Safe cracking for everyone!

By:
Introduction
At this point at which I am writing this, I am definitely still a beginner. Ive manipulated my fair
share of group ! safe locks but I have not yet tried as many as I wanted to. Some, such as the "a#ard
$$$%, can give more trouble than the S&# '(%% series, which are simple and used as beginner locks
and sadly, also the most common type of mechanical safe locks. If you are a beginner or dont even
know anything whatsoever about this topic and you )ust want to learn this because its cool or to
impress a girl *+, then this book is definitely you. I know there are a couple other books,tutorials on this
out there but I wanted to create my own. -o matter how thorough the book, there will always be some
missing piece of information and I.m hoping this fills in the gaps for others out there /and my girlfriend
is also interested so this is dedicated to her 0$ +. And I hope this will be able to address some of those
1uestions and that this and all the different resources put together will be complete enough to get
cracking! /2un intended +. If you have any information not in this* feel free to contact me! I have an
account on keypicking.com under the username of 3aggers* )ust shoot me a message and Ill get back
to you!
#roup ! mechanical combination locks are locks that are supposed to resist manipulation for ! hours.
4hats the official rating. 5eah, right. #roup !6 are slightly more manipulation resistant and feature
things that make taking contact readings harder, false gates, etc. #roup 7 is, again, supposed to resist
manipulation for !% hours. Its way better than group ! and !6 but still not perfect. 4hey feature things
such as an e8tra step that needs to be done after you enter the combination to engage all the parts to
open it. And then there is the group 79. Same thing as group 7 but has several more features that make
it impervious to 8:ray and ultrasound attacks. 4hese locks can not be 8:rayed to see the combination
unlike the other groups. #roup 79 features things like wheels made out of delrin /low density plastic
that dont show up well on 8:ray+, spacers in between wheels with false gates, and other precautions
that confuse the 8:ray image.
Before you begin, you must have a thorough understanding of how a safe lock works, how the wheels
interact with each other, and be able to visuali;e the wheel pack and know the state it is in at all times. I
would suggest first to read www.crypto.com,papers,safelocks.pdf by 6att Bla;e. <ery good intro to
how safe locks work and safe cracking. 5ou wont understand everything at first, but thats ok. 4hats
)ust to get a basic idea of stuff. =hen I first started, I spent hours pouring over )ust that info* dont do
that. >se as much of a variety of sources as you can! I would also recommend you to spend the couple
e8tra bucks to get a cutaway safe lock to view how it works as you manipulate. 5ou dont need a
cutaway safe lock but you do need a safe lock! I recommend starting with an s&g '(?7. If it )ust says
s&g '(%% then its most likely a '(?7. A '($% is the same thing but re1uires more preciseness when
dialing in the combination and so is slightly harder for a beginner, but is still )ust as good. 3o -@4
start with a "a#ard $$$%! Its in the same group of locks, but has some features that I will cover later
which makes it harder to start with.
@h, and read the interview with 6ark Bates at http:,,www.safeventures.com,news.phpAidB7' and make
sure you understand the different ways a lock can indicate a which numbers are in the combination.
And this guy @ldfast has an A6ACI-# chronicle of his e8periences with manipulation at
http:,,keypicking.com,viewtopic.phpAfB7%%&tB(?$! De e8plains the terms used very nicely as well
and I will be using those terms so its best to get ac1uainted with those first.
Eh. 7: Dow safe locks work /or in other words, fail+
@k, I have really bad photoshop skills so youll )ust have to bear with me here. 4his is what the
back of a typical safe lock looks like with the back cover removed:
4his is a "a#ard $$$%. I highly recomment you have an s&g '(?7,'($%. It will for the most part, look
the same. Ilco, 9ench, 3iebold, 6osler, these work too as long as you have a group ! from them.
4he part outlined in blue is called the nose. It rides along the drive cam which is circled in
orange. 4here is a metal wire, at the end of the arrow, that you can see pushing the nose down onto the
drive cam. 4his means it is a spring loaded fence type of lock. 4he thing the spring is on is called the
lever or arm. Because the nose is being pushed down onto the drive cam when the gap is under the nose
that means itll drop into the gap ever so slightly. 4hats where the two little red dots come into play.
4hey are called the contact points. 4he nose hits those points every time it is coming out of the contact
area which is the space between the two contact points as indicated by the green line. 4he part in the
very middle of the drive can is called the spline key. Its outlined in black because its such an easy
color to see amid other dark colors..... nah, I )ust ran out of colors :2 4he shaft of the dial screws into
the drive cam /you can see the silver shaft behind the spline key). It has a little notch for the spline key
to fit into so that it will stay in place and not unscrew out.
Are you still following alongA @kay good! -ow, the brass circle behind the drive cam is one of
the $ wheels in the lock. 4he purple part cutout in the wheel is called a gate. 4hese terms are very
important for later so make sure you remember all these. @h, and the part circled in teal is called the
bolt. It locks the handle of the safe the lock is on. 4he lock doesnt actually lock the safe, it locks the
handle which is turned to retract all the bolts along the door of the safe and allow it to be opened.
5our lock might have this little brass arm thingy at the bottom below the bolt. 3ont worry
about that yet, Ill get to it. =e will be learning more about what they all do later but for now, remember
these parts and what they look like! Seriously, remember all these terms and commit it to your mind.
Fnow them like you know apples are apples and bananas are bananas.
Im going to take it all apart now and show how all the different components fit together to
make this lock function! Study it carefully!
So I numbered them. G7 is a tension washer. Its slightly wavy so it acts like a spring and keeps
all the wheels /Gs !, H, & I+ lightly pressed against each other so nothing wobbles and it all fits snugly
together. G! is wheel number 7. 5ou can see the gate in the wheel. 4he position of the gate is what
determines the combination. =heel number 7 goes on first when being reassembled and will the be
wheel closest to the dial. =heel $ is the wheel E"@SJS4 to the drive cam! 4his will be e8plained
shortly. G$ is called a fly. Specifically, a movable fly. It fits directly on top of the first wheel as pictured
and the fly has a slot on wheel 7 it fits into. G? is a spacer. It spaces the wheels out from one another so
they dont rub on each other. GH is the second wheel. I have it laying upside down in the picture and for
a purpose. G' is pointing to a stub sticking out from the bottom of the second wheel called the drive
pin. It fits into a groove on the top of wheel 7 and when spun, hit the fly that is laying on top of wheel
one. 4his causes wheel one to turn with wheel two. =heel 7 has no drive pin since there is no wheel
under it that it needs to spin. G( does the same thing as G$ and goes on the top of wheel ! /the other
side of wheel two than whats shown in the picture+. GK is the same thing as G?. GI is the $rd wheel. It is
the same in appearance as wheel number ! including a drive pin /since it has to move wheel !+ e8cept
that it has a larger fly /G7%+. 4he reason its bigger will be e8plained later. G77 is another spacer but
thicker than Gs ? and K. G7! is a retainer. After all the other parts are on the shaft, it snaps on to lock
them into place. G7$ is the drive cam with an upside down view. It goes on after the retainer. =hat
holds it on is the spindle /the shaft of the dial+ which screws into it as e8plained earlier. G7? is the
spline key and it holds the spindle to the drive cam. G7H is a metal bar above and behind the nose and is
called the fence. =hen the nose is in the contact area on the drive cam, the fence lowers onto the
wheels. 9efer to the ne8t picture to kinda visuali;e how that works. If the drive cam isnt holding up the
nose, then the fence falls down onto the top of all the wheels. And I forgot to mark it but that plastic
ring between and to the right of the !nd and $rd wheel is to keep the dial running smoothly and so
theres no metal on metal interaction. It goes on the spindle.
So this is a pretty good picture on how the fence rests on the wheels:
=hen the nose is on the drive cam, the fence is higher. @ther wise, you would be able to feel the gates
as you turn the dial and they scrape underneath the fence. Deres a picture:
-otice how high the fence is nowA In this picture, the combination has been entered and all the gates
are aligned. But even if they werent, the fence still wouldnt be touching them because the nose is
resting on the drive cam. -ow, when we turn the dial to the contact area,drop in area in this ne8t
picture:
4he whole lever arm falls in! "ow enough that the metal protrusion at the top doesnt block it
from moving sideways. Feep turning and it retracts the bolt:
4he lever arm moves under the metal protrusion from the top of the lock body. -ow, 5ou see the little
metal spring below the boltA Its called a re:locker. It has a little arm going under the bolt and the bolt
has a cut in it for the arm. 4he arm goes up into the bolt so the bolt cant retract into the lock. 4he back
cover pushes the arm down so the bolt is free to move. 4his is because instead of manipulation, some
people drill the lock and punch off the back cover to see the combination. =ith the cover off, the bolt is
blocked by the re:locker. S&#s have a little brass arm that goes down into a hole in the bolt instead of
up from the bottom. 4he back cover pushes down one end of the arm and that raises the other end to
allow free movement of the bolt.
Basically the most important paragraph here!!!
@k, now its time for you to learn how the wheels move. 4he dial is directly connected to the
drive cam so amount that the dial moves, the same movement is done by the drive cam. If you spin the
dial at least one whole rotation to the right, it will take one full left rotation of the drive cam /and dial+
to start the $rd wheel moving left. Feep going and it will take another full rotation left to move the
second wheel and again for the 7st. 4he reason the first wheel to get picked up is called the $rd is
because its the $rd G in the combination. 4hink about it* spinning the dial ? times left sets the first
wheel and 7st G in the combo. -ow, you reverse direction ! whole rotations to the right to pick up the
!nd wheel and then keep going until you get to the second number in the combination. 9everse
direction again to the left one rotation to pick up the $rd wheel and then stop at the $rd number. 5ou
cant set the $rd wheel first because then, how are you going to set the 7st and !nd wheel without
messing up the $rdA Eombinations are usually dialed by spinning the dial left ? times to 7st G, right $
times to !nd G, left ! times to $rd G, then you spin the dial to the right to the drop in area and retract the
bolt. =hen I say left ? times to the 7
st G
, thats saying pass the 7st G $ times and stop on the fourth. =hen
I say right $ times, pass the !nd G ! times and stop on the $rd. Because of how they work, it takes !
rotation /two passes of the second number+ to pick up the second wheel. 4o 2IEF it up, not set it on
where its supposed to be. 4hen you have to move the dial to the !nd number for the third time and
leave it there. 4hats why you stop the $rd time.
Basically the most important paragraph here!!!
Dow combination changing works
In the ne8t photo you can see there are small serrations in the wheel. 4he brass bit from the
wheel locks into those. 5ou can see a circular:ish shape hole by this. =hen the combo is change, all
these holes line up and a special metal rod called a change key slips into there. @n the back of the lock
casing there is a hole in the bottom left for this. 4he change key is turned and the brass arm going into
the serrations is lifted off and then a new combo is dialed. 4he brass /which includes the gate of the
wheel+ is in a different relative spot to the silver center of the wheel /which has the drive pin and fly+
and the combo is now different. -ot all wheels will look like this but if they use a change key, they will
work on the same principle, the change key moves the arm off the wheel, and then back on to the new
combo.
Eh. !: J8ploiting these failure points
5ou made it through learning how these locks work! @r maybe you didnt..... )ust go back and
re:read, youll get it soon enough. -o one gets it on their first go anyways! 5oure probably wondering
what failure points did I go overA =ell, learning how something works is the same thing as learning all
the ways that it can be defeated. 5ou )ust have to recogni;e what it is and thats why youre still
reading! "ocks to practice on: In this I will be using the e8ample of an s&g '(?7. I recommend either
the '(?7 or '($%. 4he only difference is the '(?7 has a dialing tolerance of L,: 7.!H and '($% has L,: .
H. 4his means with the '(?7 if a number in the combination is 7%, you can dial K.(H or 77.!H and with
the '($% only I.H or 7%.H and the lock will still open.
=hy and how its possible
4hese locks seem pretty secure rightA 4he only thing you can use to move or do anything with
is the dial. Its not like a key lock where you can stick some lockpicks in and pop it open, what you see
is what you get! Safe cracking works through the measurement of where the contact points are located.
@n my lock, its I' for the left contact point and ' for the right. 5ou can feel these points on your lock.
4hey will always be in the same general area. 4hey will move, but only to a ma8imum of an increment
and a half or so.
-ow, remember how when the contact area is under the nose the fence rests on the wheel packA 4his is
the key. "ook at the drop in area on the drive cam* its sloped. 4he further down the nose is, the less
wiggle room there is for it until its all the way in there and fits snugly. 4he contact point on the sloped
side is the right contact point and the other side is the left one. Imagine it as if you are staring at the
front of the lock /not the back+ and you can see through it to the contact points. "eft and right. 5ou
have to turn the dial left to touch the right contact point. If you turn it right, the nose drops down but
you cant feel e8actly where the contact point is. So you feel the right contact point only by hitting it
from the left side of it. @pposite for the left contact point. And when I say hit, I mean to )ust lightly feel
it. If you put too much force, the nose will ride up on it and go past.
-ow you know how to find the contact points! -e8t thing to do is to know what this information can
do for you. =hen the nose is deeper in the drop in area, theres less side to side play. 4his means the
contact points will be closer together. But how does the nose go deeper in without all the gates being
lined upAA "ook at this ne8t picture very closely* youve seen it before:
If you look at where the fence is on the wheels, you can )ust barely make out that its only touching
@-J wheel. 4he second one. 4he third one is slightly below and the first one is even more so lower
than the $rd. -ow, imagine if the gate on wheel two was there under the fence. 4he fence would drop
ever so slightly onto the ne8t largest wheel, the $rd one and the nose would drop further into the drop
in area. 4hat means theres less wiggle room. 4he contact points will be closer together by about a
1uarter of an increment. 4hats not a lot, but thats what we measure when we do manipulation. =e pick
up all the wheels, generally with a left rotation, and put them at %. 4hen we spin the dial with right
rotation to the contact area and measure the contact points while making sure not to pass % or else the
wheel positions will be disturbed. =e then turn left until we reach % again put all the wheels at !.H and
measure the contact points again. =ash, rinse, and repeat at H, (.H, 7%, and so on until you get to I(.H.
4hats ?% positions around the dial. =e go !.H increments because these locks dont open on )ust that
one combination, there is some error so !.H increments is sufficient. So basically since one wheel is
bigger than the rest, we are graphing )ust the biggest wheel, not all of them. 4his flaw is unavoidable.
4he imperfections of machines make this happen. 4he third wheel usually is the wheel that the fence
rests on. 4his is not )ust because of wheel si;e, but because the spring pushing the lever down is only
pushing on the lever, on the side closest to the thirds wheel. It unbalances it and the side of the fence
where the nose is, is pushed down further than the back of it. @-4@ 4DJ #9A2DI-#!
Deres a graph paper you can use, copy it, print out as many as you want, do whatever :+
#raph 7
So the first thing to do is to label your graph. =rite #raph G7 A=" and then your lock model at
the top. A=" means all wheels left. 4hats how were going to be starting. 4his is important so that you
can come back and know where you left off. Safe cracking doesnt have to be all at once, you can stop
any time and come back later. In the !nd to the top bo8es on the left side of the paper you put the right
contact point. 5ou want the closest whole number. "ets say you have a contact point of ' M or H N,
then put '. If it.s ' O you can put ' or (, doesn.t matter. 4hen in the bo8 above it, put (. 4he bo8 below,
H. 3o the same with the left contact point and the bottom $ bo8es. It should look like this:
-ow, pick up all the wheels with left rotation /spin left at least $ or ? times.5ou can feel the wheels
being picked up+ and park all wheels on %. 4hat means stop on %, or put all the wheels there. 2arking is
the same thing as leaving a wheel on that number. =hen you dial a combination to open a safe lock,
you are parking the 7st wheel on the 7st G and the !
nd
wheel on the !
nd
G.
4he way you graph the number where the contact point is, is simple. 4he way the graph is divided, the
hori;ontal lines stand for M of an increment. 5ou want to be able to consistantly read the dial and see if
its on ' M, ' $,K, ' O, ' H,K, etc. #oing by Kths is the best. An eighth is in between each hori;ontal
line. So if the right contact point reads ' M for all wheels on %, you would go down from % /on top of
the paper+ to one line above the '. 2ut a dot there. Same procedure for the left contact point.
9emember when I said that the contact points have to be felt from the inside outA If % is in between the
two contact points for you, turn right to feel the left contact point /this is for all wheels left. Because if
you have all wheels right, turning right even more would mess them up+. "ightly move the dial until
you encounter resistance. 5ou should be moving the dial with enough force to move it, but light enough
that the contact point stops the dial and your hand keeps moving on the surface of the dial but doesnt
move the dial itself. It takes practice. Being able to take accurate contact readings is FJ5 4@
J<J954I-#! #raph the number it stopped on. 4o read the right contact point, spin right rotation to
the other side of % /because going the short way and spinning left will mess up the wheels on %+ and go
slightly past the right contact point. "ightly turn left and read the right point. 4hen graph it.
If % is to the left of both contact points, )ust spin right and read both contact points that way, making
sure not to pass % and mess up the wheel positions. If % is to the right of both contact points, spin left
and do the same thing.
After youve graphed the two contact points for %, spin the dial left and pick up all the wheels again at
%. 4urn to !.H and repeat the same procedure. It should look something like this:
4his has two points on ' and two points on I'.H. 5ou want to repeat this process all the way around at
every !.H increments. If you have a contact point on H M or somewhere close to a number youre
testing, you have to be careful not to disturb it when you take contact reading. "ets say you have H M
and 7? N and your contact points. A=" to H, right rotation )ust BA9J"5 pass H M, try not to go
completely to H. Its not too bad if you do though, )ust dont go past it! Spinning right, the wheels will
pick up not 1uite where you left them with left rotation. 4he wheels will pick up a bit under H so you
have some e8tra room to move between where the wheels are and the contact point. -ow, lightly feel
the right contact point. 5ou can spin the dial back and re:feel as many times as you want, )ust be careful
not to disturb the wheels at H. 5ou can feel where the wheels are and where they pick up so you can get
a sense of how far you can go before you disturb them. -ow, when you test 7H, put all wheels left
rotation to 7H and turn the dial a couple increments right, past 7? N. =hen taking the contact point
reading here, )ust make sure to do so lightly and not have the nose ride up on the drive cam. 4urn too
far and the wheels at 7H will be messed up. So graph the whole wheel pack and youll get something
like:
4his!
4his graph is how you find the gates. So you.d understand how it.s kind of important. 4aking the
correct contact point readings means an accurate graph! So make sure when you take contact point
readings, it always consistant! It.s best to use a light touch and make sure that the point you take is
right where the nose touches the drive cam. But if you use the SA6J JPAE4 amount of force each
time /even if the nose does ride up on the drive cam a little+ then you should still be fine. -ot everyone
will have the e8act same points because everyone feels with differing amounts of force, but relatively,
the graphs should show the same thing.
@k, so now its time to see if youve done your homework! At the very beginning, in the introduction
/gasp! 4hat stuff is usefulAAA =ho reads thatA!A!+ I gave you a site that describes how a gate will
indicate its position on the graph. =hen the fence is resting on the wheel pack and the gate of the
largest wheel is under it, it will be lower rightA 5up. And then when its moved off, it will be higher
rightA 5up again! -ow think hard and youll remember the right side of the drop in area is sloped. 4his
will give a greater change in contact point that the other side. 4he left contact point reading will be less
dramatic but will help confirm a gate on that number.
So it dips down for a couple numbers and then back up /with the right contact point. =ith the left, itll
go up and then back down. 4hink about it, when the two contact points get closer, the left one increases
in number+. =here in this graph do you see a dip in the contact point and a corroboratory rise in the left
contact pointA Si! It drops at around $H for the 9E2 /right contact point+ and up at $(.H for the "E2. It
can sometimes be in the same spot but it can also be a little off like it is here.
-ow you want to do something called amplification. 9emember how we went every !.H incrementsA
#o every 7 increment from $7:$I and graph that in a different color.
5oull get something like this:
4his is to find the center of the gate. #oing every !.H increments isnt precise but it lets us find the gate.
-ow we need to know the e8act number its on. So for the 9E2s its $!:$H. Qind the middle of that. Its
$$.H. -ow do the same for the "E2s. Its $H.!H. 4hen find the middle of these two numbers* its
$?.$(H. Eongratulations!!! 4hats one of the numbers! 5ou dont really have to dial in $?.$(H, you can
dial $?.H or $? M. -ever go off by more than M increment! -ow to find out which number in the
combination it is :2 Is this seeming like a long process yetA It should, but with practice you can get
your time to H:7%min for an s&g '(%% series.
Digh low testing
4he way you can determine which wheel the number belongs to is something called high low testing.
9ecall that the nose drops lower when the gate is under the fence. 4he contact area will be narrower.
-ow, when the wrong number is entered, the contact area will be wider. So we want to put the number
we found on two of the wheels and throw the other wheel off. And do this with each wheel. So that in
two of the tests, the gate will be under the fence and in the other it wont. So in one of those tests, we
should have a contact area that I significantly wider since the gate will not be under the fence for one of
the tests. =e start with the first wheel being thrown off by 7% increments under. 4his is a low test. It
doesnt have to be 7%, it should be at least 7% though. 4his is )ust so it has more isolation.
Qor e8ample: =e find $?.$(H /well make it easy and say $?.H+
"ow testing:
9!?.H "$?.H "$?.H /4his is right ? times to !?.H and left $ times /this picks up wheels 7&!+ to $?.H+
"$?.H 9!?.H "$?.H /4his is putting only !nd wheel on !?.H+
"$?.H "$?.H 9!?.H /4his is left ? times to $?.H and right ! times /this picks up only 7 wheel+ to !?.H+
Jach of these times you want to measure both contact points and write them down. 4hen find the space
in between them. 4hats the si;e of the contact area. -ow, this is where a thorough understanding of
how safes work come into play. So lets say these $ test show this:
"E2 I( 9E2 ' Eontact area I
"E2 I( 9E2 ' 7,? Eontact area I 7,K
"E2 I' $,? 9E2 ' 7,? Eontact area I !,?
4he most likely wheel to have $?.H as a the combination is wheel $. But we need to do Digh testing as
well /its not re1uired if the indications from low testing is good enough. It )ust helps support it+:
Digh test:
9??.H "$?.H "$?.H /4his is right ? times to ??.H and left $ times /this picks up ! wheels+ to $?.H+
"$?.H 9??.H "$?.H /4his is putting only !nd wheel on ??.H+
"$?.H "$?.H 9??.H /4his is left ? times to $?.H and right ! times /this picks up only 7 wheel+ to ??.H+
and say we get:
"E2 I( 9E2 ' Eontact area I
"E2 I( 9E2 ' Eontact area I
"E2 I' (,K 9E2 ' 7,K Eontact area I 7,?
-ow both test show wheel $ to indicate. So we know so far the combination is A:A:$?.H. 4his is why an
understanding of how wheel pick up is needed. 5ou need to know how to put each wheel at a specific
number and know which wheel is at what number. I4 IS E9>EIA"!!!
<J95 I62@94A-4 -@4J
-otice how we found $?.H with A=" rotation. In all the high low tests every time we put a wheel on
$?.H is is with "JQ4 rotation. 4his is important. 2arking with right rotation will put the wheel slightly
off. 4he width of the fly and drive pin on each wheel makes it so that when you approach each wheel
from the opposite direction, it will pick up in a slightly different spot than how you left it.
Eompensating for this will be covered later.
#raph G!
So start graph number two like you did number one with all the titles and all. But since you
have wheel $ going left you will have the other two wheels going right. It would be titled with
"@EF 452J #raph G! 7&! A9 , $ R "$?.H. 4his means you are graphing wheels 7&! with right
rotation and wheel $ is parked at $?.H with left rotation when you take contact readings. A9 means
around right.
4o graph this you pick up all wheels with right rotation and stop at %. 4hen you turn left and
pick up wheel $ from % and stop at $?.H. 4hen you graph your contact points. -e8t turn right and pick
up the wheel from $?.H and the other ! wheels at % and turn to I(.H. 4he 7st and second wheel will pick
up at the same time so no need to to an e8tra rotation. 5oull get better at is as you go. 4hen repeat the
whole process, turning left to pick up wheel $, park it at $?.H and read contact points. Sust be careful
when you pass by $?.H and you try to read $!.H. 5oure going to mess up the wheels so youll have to
reset the first wheel. 5ou can )ust start at $!.H instead of % to avoid this problem. 4hat is what I
recommend. So the whole thing should look like:
-ow: 4heres not an indication like there was in the last graph. 4here could be, but heres theres not
because Im illustrating a principle to you. 4hings dont always work as perfectly as they did in the first
graph I showed you. Since you are graphing the wheels with 9I#D4 rotation, you read the graph from
right to left. 4he first graph was A=" so you read it left to right. #ate signatures can vary and can also
be directional, as in only read as a gate from one direction. A down and up signature is the most
common type youll get. 4he ne8t one is where it drops and doesnt rise back up within a reading or
two. It can rise back up, but not immediately after. 4hats the case in this graph. =e see after (%, it
drops and takes a while to come back up. 4hat is a gate signature. 4he whole thing is way to wide to be
a gate so the gate is going to be right under (%. Amplify your findings and you should have this:
Since gates are usually about $ increments wide I would choose '(.H as the gate center not 'K. -ow do
high low test again and find which wheel is indicating. Since we already know $?.H is the $rd wheel we
only need to do high low tests for ! wheels not all $.
2ay attention to the rotation direction. Its different than the first high:low tests we did because this
number was found with right rotation. So every time we go to '(.H, it needs to be right rotation.
"ow test:
"H(.H 9'(.H 9'(.H 9E2: I'.H "E2: ' Eontact area: I O
9'(.H "H(.H 9'(.H 9E2: I'.H "E2: ' M Eontact area: I N
"H(.H 9'(.H 9'(.H 9E2: I' N "E2: ' M Eontact area: I N
9'(.H "H(.H 9'(.H 9E2: I' O "E2: ' O Eontact area: 7% M
"ets say wheel two indicates like in the e8ample, so now you know the combo is A:'(.H:$?.H. -ow,
)ust dial in %:'(.H:$?.H, !.H:'(.H:$?.H, H:'(.H:$?.H and so on until it opens. 5ou can graph this until it
opens )ust in case the lock does not open you have something e8tra to refer to but usually its not
needed to graph on the final run. If you read @ldfasts chronicles you know he goes by every !
increments. 4his is because it is possible to miss a number every !.H increments if its a lucky s&g
'($%. 2ersonally I graph with !.H because I know my '($%, even though it has L,: .H dialing tolerance,
its not that precise and will work with !.H. =ith e8perience, youll be able to get your own way of
doing it.
"ets say in your first graph, the !nd wheel indicated first and not the $rd. 5ou would graph the
second graph by going all wheels "JQ4 to %, right $ times to $?.H /actually, not $?.H but that will be
e8plained later in 9otational Eonversion+, left twice to %. 9epeat with I(.H instead of %. Basically,
youre dialing in a combination each time because the first wheel has to be set, the second wheel has to
be set in a different place than the 7st, and then the $rd wheel has to be set different than the !nd. If the
$rd wheel reads first, the first two wheels are parked in the same place together so theres no e8tra
dialing for the second wheel.
If the 7st wheel reads first, the its easy! 4he !nd and $rd wheel can be graphed without
disturbing the $rd wheel at all! If you start at $!.H, you wont pass $?.H and mess up the first wheel
there. 4his doesnt happen often though. 4he third wheel is the wheel that indicates most of the time.
And there you go!!! 5ou should have )ust manipulated your first safe lock! =ell, itll take
practice so you probably didnt but if you did then youre a natural :+
6ore TadvancedU techni1ues /-othing too cra;y+
Eh. $: Alternatives
4here are different ways to graph and different ways to tell which wheel is indicating rather than using
the hi:low method.
Alternative to hi:low
Since wheel $ indicates most of the time, you can )ust park wheels 7&! in the Tforbidden ;oneU /the
contact area. Its called that because youre not supposed to set the $rd number to a number inside it+
and then )ust move wheel $ through the area you think theres a gate in. If the contact points indicate a
gate, then you know its wheel $ because nothing else is moving! If nothing indicates, you can do the
same for wheels 7&! separately. 4his saves time only when wheel $ is indicating though.
Alternative if !
nd
wheel reads 7
st

If the second wheel reads first, basically what you are doing is entering a new combination every time
you test a number for the !
nd
graph. %:$?.H:%, !.H:$?.H:%, etc. 4he first wheel has to be moved so you
end up taking so much time! An easier way is to )ust put the 7
st
and !
nd
wheel on the gate for the !
nd

wheel and )ust move wheel $ around. In the first place, wheel $ usually reads first, if not, the wheel $ is
most likely going to read !
nd
. 4his is way faster and has a high chance of you finding the second gate so
I highly recommend you do this. 4his is what I do when the !
nd
wheel reads first in a lock.
Alternative to A="
4he first obvious answer would be A=9, all wheels right. 5up, you can do that too if the lock isnt
indicating any gates with A=". Its )ust that ! numbers in the combo are set with left rotation and the
$rd wheel usually indicates first* and the $rd wheel is set with left rotation. =hen you set a wheel at
lets say, H%, with left rotation, it will be in a different spot that if you set it at H% with right rotation. Ill
e8plain how to compensate for this later. 5ou can also graph )ust one wheel such as the $rd wheel so
that you dont have to do hi:low or isolate wheels to find which wheel is indicating because its the only
wheel moving. But again, this is only faster if the $rd wheel indicates first.
6ake it all go faster
If you want to get fast at manipulation, you have to take some shortcuts. 3ont graph. It takes =A5 to
much time! And only take right contact points, the right ones are enough of an indication by themselves
because of the slope of the drive cam. Sust go A=" and look for a suitable drop, amplify, hi,low test
/)ust one+, then move on to the ne8t wheel. Feep going like this. @r if youre ok with some risk, )ust run
the $
rd
wheel around until you find a gate and then amplify. 4hat way, you dont have to do hi,low
testing* you know its on wheel $! 9epeat for wheel !. 5ou can get H:7%min manipulations this way!
9otational Eonversion
-ow if you graph with A=9 and the 7
st
or $
rd
wheel indicates or you graph A=" and the second wheel
indicates first, then you need to make sure you dial to the right number. If the combo is $%:I%:'%, its
going to be dialed ":9:" traditionally. If you dial it in 9:":9, and then left to drop in area and right to
retract bolt, it wont even drop in. 4he gates will be )ust barely off from underneath the fence. 4hats
because with each wheel, the width of the fly and drive pins add up and push each wheel off more. 4he
$rd wheel will be the least affected because theres only the drive pin of the drive cam. 4he $rd wheel
has the drive cam, fly on the !nd and $rd wheel, and the drive pins on those wheels as well.
4o fi8 this, first pick up all wheels and take them to any number. I like H% because its far from
the contact points and I wont confuse the wheels picking up from the contact points. 5ou can go right
or left. In this e8ample I picked up all wheels right. -ow start turning left and right before you get to
H%, slow down and feel for where the $rd wheel will pick up. It might be H% or it might be a bit off. Act
like youre feeling for a contact point, be light and gentle. "ets say it picked up at H%.H. So the first
wheel is .H off. -ow go around again and feel for the second wheel being picked up. "ets say thats
H7.H. So the !nd wheel is 7.H off. -ow do the same for the $rd and lets say It picks up at H!.H. So the
$rd wheel is !.H off. I like to write them down like this: .H:7.H:!.H )ust so I know which wheel is off by
what amount. So for the combination of $%:I%:'% ":9:" converting to 9:":9, we start by dialing $%
with right rotation. But we go 2AS4 by .H to !I.H. 4his puts the gate centered under the fence. Qor I%,
we go left to I% and 2AS4 by 7.H to I7.H. Same thing with the $rd wheel. #o right rotation 2AS4 '% by
!.H to H(.H. 4hen left until you feel the nose drop in to the drive cam and the turn right to retract the
bolt!
#reat )ob! 5ou can now successfully manipulate a safe lock! If you
still havent got it, read on! 4heres a troubleshooting page :+ And
keep at it, this takes time and you will get out what you put into it!
Additional info: 4he reason I had said not to start with a "a#ard $$$% is because it has more oval
shaped wheels. I dont know if its intentional or )ust how theyre made, but the ovals all block the gates
on the other wheels so you wont get any good or consistent indications from them. 4heres more on
how to get past this in the ne8t chapter *+
Eh. ?: 4roubleshooting
So the main purpose I wrote all this was to help people with no knowledge of safe cracking. =hen I
started out I had many problems I had that I wasnt sure about and this section is to address those issues
for others that might have those problems. If the lock doesnt open:
: Digh:"ow tests: 6ake sure you are getting the high,low tests right. 2ut the right wheels on the right
numbers and in the correct rotation. 9emember: =heel 7 is the first number in the combination so it is
the wheel thats closest to the dial and gets picked up last. =heel $ is the last number and gets picked
up first. 3ont forget that or to use correct rotation.
: 3ial accurately: 3ial within 7,K of an increment of where you are trying to park a wheel. Its best if
you get JPAE4"5 on that number. If your contact point feels really faint, heres a techni1ue 3atagram
taught me. #et close to the contact point and then turn the dial by lightly running your thumb along the
dial with )ust enough friction to turn the dial. =hen it hits the contact point, it should stop e8actly on it.
6ake sure you 3@ -@4 increase the force otherwise the nose will ride up on the drive cam and youll
get a false reading. 4his takes practice. 4ry having the back of the lock open as you do this and look at
it,have someone else look for you,or record it so you know )ust how much force to put on the dial with
your thumb. If you have too light of force, youll randomly stop and think the contact point is there.
: 9ead correctly: 6ake sure you are consistent with your readings. 4his is a big thing. If the increments
on the dial are really wide and its hard to pinpoint e8actly where the dial is, tape a needle to the inde8
mark you dial to and a piece of tape tapered to a point on each contact point. 4his helps greatly with
readings since you need to be consistent down to the 7,K increment. =hat you see to be $,K could be
what I see to be !,? or vice versa. 4hat doesnt matter as long as you are consistent with all your
readings. Another problem is you have to make sure that you are viewing the dial from the same angle!
"ooking at it from different angles can give you varied readings. 5ou can also tape paper on. 4his little
setup was done in $% sec and it works well enough to tell that in the picture its on K $,K not K 7,! or
K7,?.
:Qeel consistantly: "ike I said before: It.s best to use a light touch and make sure that the point you take
is right where the nose touches the drive cam. As long you use the SA6J JPAE4 amount of force
each time though /even if the nose does ride up on the drive cam a little+ then you should still be fine.
-ot everyone will have the e8act same points on their graphs because everyone feels with differing
amounts of force, but relatively, the graphs should show the same thing. #raph the first graph with the
same combination several times without looking at previous graphs until you get the same graph every
time! 4hat way, you.ll improve on your touch. It.ll take time but it.s worth it!
Sub:Ehapter ?.H: "a#ard $$$%
I dont have too much information on this so itll only be a sub:chapter. As e8plained, the
"a#ard has a masking effect or wheel shadowing, whatever you want to call it. 4his means the graphs
will look like it has multiple hills,a giant hill or mountain in it. 4his information comes from a
conversation on a site called keypicking.com. #reat site to learn about lockpicking, safe cracking, etc!
Qor graphs with one big ma)or hill in it:
Qirst thing, make a first graph and find the lowest point on the graph. Im assuming you did A=" or
A=9. 4his means that low point, is a low point for A"" wheels. -o wheel has a high point there or
else it would not be low. 3o something similar to a high:low test now. 2ut two wheels on that low point
and one at the highest point. 3o it for each wheel and find contact area. 4he widest contact area will
belong to the wheel that has the big hill. -ow put that wheel on the lowest area and graph the other two
wheels. Feep doing this to find the highs and lows of each wheel and try to TunmaskU the other wheels.
Qor graphs with multiple, distinct, hills:
3o the same thing as previous but for each hill. 4ag each hill to a wheel so you know which wheels to
park in which spot to reveal the gates on the other wheels. 2ut wheels 7&! on their lowest point and
isolate wheel $ and graph )ust that wheel. If that doesnt work, try with )ust wheel 7 or )ust wheel !. I
prefer to try wheel $, then !, then 7. 7 is last because it takes longest to graph that one when isolating it.
Another way!
4ake readings every 7% increments and then amplify the lowest point. 3o a high:low type test and have
two wheels on the highest point and one at a time put a wheel on the lowest point. Qind the contact area
that is the slimmest, thatll give you whichever wheel has that as a low point. "ets say wheel $ had that
point. #raph a second graph with the same method and have wheel $ on that low spot. Qind another
low spot and the wheel it belongs to. Basically, youre acting like that low point is a number in the
combination temporarily. 3o a third graph with the other two wheels on their low spots. If it doesnt
open, put the final wheel on its low spot. 5ou should now have low spots for all the wheels. 2ut wheels
7&! on their low points and graph )ust wheel $. 4hey should allow wheel $ to be graphed. 3o this for
wheels 7&! if wheel $ doesnt show up. After you find a gate for a wheel, put that wheel on its gate,
and pick another wheel to isolate and graph.
Acknowledgements: 4hanks to everyone at keypicking.com! Jspecially @ldfast
for large portions of information as well as getting me started in this hobby! And
to my girlfriend for the motivation to write this :+