I would assume that microphone (e.g. piezo contact mic) or high frequency acceleration sensor attached to the dial should be able to feel the vibrations which are probably more accurate than soundwaves through to safe door. If you can detect the sound of lever spring going over the edge accurately enough, you can just count the number of samples until the fence hits the wheel pack. As the lever is always moving by the same spring force, it should move at identical speed every time and the time needed until hitting the wheel pack should be enough to graph the pack. For example, even if you use basic 44.1 kHz sampling in the sound card, you can still detect 1/21k second time differences even in worst case. The idea of also checking the sound / ringing is pretty neat. Combining both could result in knowledge how far the gate is from the wheel (assuming the wheel makes a bit different sound depending on the hit point vs distance to the gate). Recording the ringing of plastic wheel through the door may be really really hard, though.

@grainorice8293

2 жыл бұрын

That was a thought that I had. I had a hard time finding a reliable signal when using electronic methods.

@MikkoRantalainen

2 жыл бұрын

​@@grainorice8293 You might need to misuse LP player needle (with the amplifier meant to bring needle signal to line level). That should be accurate enough to detect any movement. If you can find an old LP player from flea market, that could be pretty cheap way to get the required parts.

@grainorice8293

2 жыл бұрын

@@MikkoRantalainen I might have to give that a try. Thanks!

Just curious as to where you placed the microphone? Is there any feel through the dial when you push in the dial? If not maybe place the microphone there or possibly use something more sensitive like a piezo contact mic you can buy them cheap enough on eBay

@grainorice8293

3 жыл бұрын

Yep! There is a tactile feedback.

Adding a frequency resonator to the mix with an oscilloscope will do the trick.

@grainorice8293

3 жыл бұрын

Still a lot of noise to filter out.

@blake_lively_matters6553

7 ай бұрын

Yes, and that is why those in the know (about your little tricks) set at least one number of the combination at a half number, since the R-1 is accurate to one number. The burglar would be going out of his mind trying to figure out why his reads weren't working.

Interesting concept -- I have an 8550, know the lock, and am somewhat experienced in manipulation. I am wondering how the experts manipulate this lock? Perhaps with some DSP (Digital Signal Processing) one could test your concept, but not for me at the moment. I might suggest using a professional AMP and Pickup for recovering the signal, such as one from Lockmasters, combined with a storage scope. Do you have any scope traces?

@grainorice8293

4 жыл бұрын

From what I understand there is a way to manipulate the lock through "feel", but it seems to be a trade secret. The idea presented here is plausible, but it would be difficult to achieve in a lock that is secured to a thick safe/ vault door.

@blake_lively_matters6553

7 ай бұрын

@@grainorice8293 - The term 'manipulation-proof' means that access cannot be gained non-destructively.

If you were gonna test this, it has to be real world tested. A TL rated safe that is locked by someone with the known combination, and you would have to see if you can hear a difference through a thick door.

@grainorice8293

10 ай бұрын

I agree, this was not a fair installation of the lock.

@therocketman321

10 ай бұрын

@@grainorice8293 for demonstration purposes, it's fine. I'm just saying if you wanted to test out your sound amplifier theory, you would have to see if you can even differentiate sounds through a thick door. I can tell you from work experience, if a bank overwinds their time locks, depending on the thickness of the main vault door, you may hear a very low ticking. But when the door is open the ticking is very loud lol.

Just came across this video while doing rando research of the older styled S&G 6720. That spring loaded fence actuator lever seems like definitely an added feat that’d step up security measures quite a bit ‘but’, with the inclusion of that mechanism, doesn’t that more or less defeat the point of including them non-metallic wheels, if fence is no longer riding pressure along their faces continuously? Just a thought that over time, that new mechanism allowing the fence’s engaging face to “snap down” against them plastic wheel faces of INCORRECT combo, would eventually leave mares or divots along them plastic faces that could then be heard as dial is turned, at least during the rotational span of that arms’ resetting lobe? Edit: just read that other comment left 9 months ago. Granted such wear patterns would likely take a number of years & obvi, of many releases of that lever allowing the fence to potentially cause such wheel face wear, my original thought of them even being plastic still, seems pointless, since fence is NOT in contact with the wheels, until released.

@grainorice8293

2 жыл бұрын

The reason for the nylon wheels is so that the lock can not be examined with an x-ray. Metallic wheels would show up on the x-ray. Cold war solution if I remember correctly.

@seanbatiz6620

2 жыл бұрын

@@grainorice8293 Thanks! That does seem most plausible for that material used… wasn’t even thinking of x-rays

@blake_lively_matters6553

7 ай бұрын

@@seanbatiz6620 - That's why Harry Miller got the big bucks.

Instead of trying to filter the noise, do you think you can use wide-band amplifier and then look at a waterfall frequency diagram might do the trick?

@grainorice8293

3 жыл бұрын

That is something I did not think about, but yea that might work!

@froggypicker

3 жыл бұрын

@@grainorice8293 i do not have a similar combination lock in hand, but shoot me an email (see my channel about) and we can talk a bit more offline. If be interested to see what can be done.

ITL, safe cracking is the only way to fly

@grainorice8293

3 ай бұрын

Good to know, thanks.

Hmmmm metal striking plastic... Over time that's gonna wear down the plastic from normal use and/or someone spamming the button

@grainorice8293

3 жыл бұрын

It would take a long time. These locks are made for long-time service.

The people who are looking at audio as a possible way to achieve a manipulation defeat of S&G's 8500 series locks are on the right track (sort of) but the answer/solution is not as high tech as all might think. If you're interested in learning more, reply here. As far as detecting anything of use just by turning the dial and moving the wheels, no. All you'll get is wheel pickups and wheel count. The lock part known as the "Z" spring works to hold the fence out of contact with the wheels after the fence is actuated by pushing the dial inward at 0. The wheel material is called "Celcon," a Delrin-like low mass material used to impart radiographic resistance.

@grainorice8293

Жыл бұрын

I've always been curious about an audio method but the direct manipulation is where my heart is for this lock.

@jimlocke9320

3 ай бұрын

The proposed method would detect differences in the sound made when the fence drops against the wheel pack when some gates are aligned and no gates are aligned. In the padlocks, the wheels have different diameters, so the largest diameter wheel holds the fence back unless its gate is aligned. I suspect that the same strategy is deployed in the safe lock. Since the fence is not left in contact with the wheels, we can rule out strategies which would vibrate the fence against the wheels. However, we can note that the notched wheels have acoustic properties. If we expose the wheels to ultrasound, we should be able to set up standing wave patterns at various frequencies. The standing wave patterns would be the same for all orientations but we may be able to detect the orientation. If we can detect the precise orientations of all 3 wheels this way but not know which wheel is which, we have narrowed it down to 6 combinations to try. Errors in knowing the orientation can be accommodated by trying more combinations. We could refine the method by turning the dial several turns clockwise, then one turn counterclockwise, making note of the number stopped on, and start turning the dial clockwise. At some point within one turn, the notches on two wheels will line up. The standing wave patterns in one wheel should, at least partially, reinforce or cancel the patterns in the other aligned wheel. We have a state which we can probably detect. If we succeed, we can proceed to try to align all 3 notches. Knowing the relations, we have narrowed it down to 100 combinations to try. With refinement of the strategy, we may be able to detect the wheel positions to some level of precision and narrow down the number of combinations to try to fewer than 100. Right now, this method is competing with a robotic dialer, which does a brute force dialing of all the combinations, opening the safe within a day or 2. This method should be faster and may be less expensive to implement.