FAQ  •  Register  •  Login
UKLockpickers.co.uk Lockpicking supplies such as Lockpicks, tools, and more! COMMANDOLOCK.COM Military grade padlock systems lockpickshop.com A source for lockpicking supplies such as lockpicks, locksmith tools, and more!

Getting started with manipulation

Forum rules
A section for neophytes learning the hobby!

Learn the requisite skills watching videos of other experienced members in action.

Post TUTORIAL videos only!
<<

femurat

User avatar

Prolific Poster

Posts: 1451

Joined: Mon Mar 14, 2011 3:47 pm

Location: Italy

Post Tue Nov 29, 2011 10:37 am

Getting started with manipulation

A whole book isn't enough to cover all you need to know to learn manipulation. I'll try to explain how to start, based on my own experience.

You're going to work on your lock for many hours, so make a small investment and buy a good one.
A too worn, dirt, damaged or bad mounted lock will give you troubles and frustration. You may fail even if you're doing it right.
I suggest to buy a used combo lock from a fellow member of the forum, here or on LP101, or from a trusted ebay seller. A brand new lock would be perfect, but obviously it's much more expensive.
Getting a change key is highly recommended, otherwise your lock will be usable just once: it's not fun to look for a combo you already know.
I'm not a big fan of cutaways in general, and even in this case you won't need one. If you remove the back cover you can examine the inner parts interacts while you move the dial, that's enough. And you only need to undo 2 screws...

Usually you get a lock that has been removed from a safe, so you'll need to mount it on a stand. If you're lucky enough to have a real safe skip this part.
I use a wooden stand made from two assembled pieces of wood, one 15x15 cm and one 10x15 cm. The width of the wood depends on spindle length.
To mount the lock you can follow installation instructions from the manufacturer website, for example here.

You should build something like this.
2011-10-22 10.07.41_ok.jpg

2011-10-22 10.08.01_ok.jpg


Before starting your manipulation, make sure you've understood how to dial a combination and how a lock works. It's very important to know what's happening inside the lock while you move the dial. It's impossible to hack something you don't fully understand.
The theory behind manipulation is that the wheels are not perfect, so every time the gate of the biggest wheel is under the fence, the nose can enter a bit more in the cam, and the contact area will be smaller. Hence you can identify the biggest wheel gate position. Then you should find out which wheel was indicating. Now you have one of the combination numbers. Repeat the process until the lock is open. If you're interested in learning more, I suggest you to carefully read Safecracking for the computer scientist.

I guess you're a bit lazy, so I'll try to guide you trough your first manipulation experience.

First of all you should look for the 2 contact points. Usually every lock has them at the same numbers, but don't count on this. Turn the dial left and right and try to identify the 2 numbers where the fence start touching the cam. You don't need to be very precise, the closest whole number is enough.
I've made 2 red dots to help you identify these points. The first time it could be useful to look for the contact points with the back of the lock removed, so you can see and understand what's happening. After a few minutes you'll learn to recognize these points very well even with a mounted lock.
2011-10-22 10.11.23_ok2.jpg


Now you're ready to count the number of wheels in the lock. To do so turn the dial at least 4 times to a number far away from contact points area. Usually 50 is the perfect choice. Then change direction and count the number of wheels you'll pick up. You should feel a small click and some more resistance offered by the newly picked up wheel every time you pass at the number you have left them, 50 in this example. Once you have picked up all the wheels, passing at 50 would give no more feedback.

It's time to start checking contact points and log them on a graph. We are going to check differences in contact points every 2,5 numbers, while rotating all the wheels together, and mark the corresponding points on our first graph.
There are many different templates to draw your graph on, there are specialized software to assist you in this very simple task. Usually I just grab a few sheets of graph paper and draw my own. This is an example of the first graph I made to open a 3 wheels lock, similar to the one you see above. It was a Sargent & Greenleaf 6725 with 3 wheels.
2011-10-10 08.26.39_ok.jpg

First of all, you need to write the numbers on the top, from 0 to 100 in 10 increments is enough. Then you should write the numbers on the left. These are the left and right contact points, and a few adjacent numbers. In this example the contact points were at 6 for the Left contact point, and between 12 and 13 for the Right contact point.
The contact points reading requires good light, concentration, and precision. We are going to notice 1/10 number differences, so try to be very precise in your readings.

We could start by rotating the dial Right 4 complete turns, so we are sure we are moving all the wheels, and stop at 0.
Now we have all the wheels at 0, so we can rotate the dial back to check contact points: turn left until the dial is between 6 and 12, then try to move it back and forth to check where the fence touches the cam and exits the contact area. You'll find 2 numbers. I found 5,8 and 12,5, so I made 2 corresponding dots on my graph.

Then you should rotate Right until you reach the wheels you left at 0 and move them 2,5 numbers Right, to 97,5 in this case.
In theory you'll need to make 4 full turns to accomplish this. In practice, since we know where the wheels are, you can simply turn 1 time only, until you touch the wheels. You'll feel them being picked up by the dial, and move them 2,5 numbers Right. We have just saved a lot of time and turns.
Now rotate the dial Left to reach the contact area and carefully read contact points. I got 5,9 and 12,6. Mark your points on the graph.

Continue your readings every 2,5 numbers until you reach 0. You'll end up with your first graph.

Now that you have completed your readings, you should look for some narrow areas in the graph, these narrow areas represent the wheel gates. I clearly see one at 50 in my graph. If you have more than one narrow area, choose the smallest one, the one with steepest borders, just a few numbers wide, which can resemble a gate.

We just checked every 2,5 numbers to speed up the process, so now we should amplify our indications by reading contact points at every number around our newly found gate.
Prepare a small graph by writing at least 5 numbers before and after our gate. You can see the one I made on the bottom part of the page. Write down contact numbers also.
Turn all the wheels Right and stop 5 numbers before your gate. I stopped at 55: since we are reading Right, 55 is found before 50.
Read contact points and mark them on the graph. Then proceed with 54 and so on. When you have drawn the small graph, you should see a distinct narrow area. This is the gate, mark its centre, it's one of your combination numbers!

I got 51 in my example, so I knew 51 was one of my combination numbers, but which one? 51-x-x, x-51-x, or x-x-51?
You'll find out this by trial and error: dial some test combinations, check contact points with each one, and you'll identify which wheel that number belongs to.
Choose a high test number, by adding 10 to yours, and a low test number, by subtracting 10 to yours.
Dial the 3 possible combinations with your number on 2 wheels and the high test number on another wheel. Check contact points to see which wheel, if on a wrong number, changes the contact area the most. This is the wheel with the gate you've found.
To double check, do the same with the low test number.
To avoid confusion, I found useful to fill in a template from The National Locksmith Guide To Manipulation.

In my example I have 51, so my test numbers are 41 and 61.
I've dialled 41-51-51, 51-41-51 and 51-51-41. The results were uncertain: as you can see on the left part of the schema attached below, I got the same variations on second and third wheels.
Then I dialled 61-51-51, 51-61-51 and 51-51-61. I could clearly see that if the third wheel was far from 51, the contact area was increased a lot.
Hence I found out that my combination was x-x-51.

2011-10-22 10.05.29_ok.jpg


By now you should have found one of your combination numbers, so you should be very proud of yourself.

See you tomorrow for the next steps...

Cheers :)
You do not have the required permissions to view the files attached to this post.
<<

thehunter

Newbie

Posts: 5

Joined: Sun Apr 26, 2009 11:34 am

Location: Spain

Post Tue Nov 29, 2011 1:41 pm

Re: Getting started with manipulation

Thanks man.Very good and instructive howto to start.Only one question, any specific brand and model of lock to start with manipulation?.
<<

macgng

User avatar

Contributor / I Fought Tooth and Nail to Acquire BO...
Contributor / I Fought Tooth and Nail to Acquire BO...

Posts: 991

Joined: Sat Jan 22, 2011 9:38 pm

Location: MD, USA

Post Tue Nov 29, 2011 2:06 pm

Re: Getting started with manipulation

Very nice intro... Why u gotta leave us hangin!!!!!
Nibbler: The poop-eradication is but one aspect of your importance.
<<

the picker

User avatar

Familiar Face

Posts: 233

Joined: Sun Mar 06, 2011 12:58 pm

Location: usa iowa

Post Tue Nov 29, 2011 6:31 pm

Re: Getting started with manipulation

nice right-up looking forward to the rest of it.
<<

femurat

User avatar

Prolific Poster

Posts: 1451

Joined: Mon Mar 14, 2011 3:47 pm

Location: Italy

Post Wed Nov 30, 2011 3:04 am

Re: Getting started with manipulation

Thanks to all for the compliments :mrgreen:
Personally I have no suggestions about brands or models. I've heard S&G 6700 or 6730 are good choices.
Sorry to let you hanging, but till you complete the first step, you don't need any other info :twisted:
<<

femurat

User avatar

Prolific Poster

Posts: 1451

Joined: Mon Mar 14, 2011 3:47 pm

Location: Italy

Post Wed Nov 30, 2011 4:43 am

Re: Getting started with manipulation

We have found our first number, the most difficult part. Now we just need the others two and we have done our job.
We are going to repeat the first test to look for another gate, but instead of moving all the wheels together, we'll use the known number on its wheel and test the others.
The process is almost the same. The only difference is that we need to dial a two numbers combo instead of moving all the wheels together (in the previous example we dialled a one number combo).

In my case I had 51 on wheel number 3, so I've checked wheels 1 and 2 Around Left, and kept wheel 3 at Right 51.
In order to efficiently accomplish this task, I started with 4 full turns Left and stopped at 50. Then turned Right one turn plus one number, to put wheel three at 51. Then went left to check contact points.
Next step was to turn left, pick up wheel three at 51 and continue to turn, picking up wheels 1 and 2 at 50 and move them 2,5 numbers forward, to 47,5. Then made one turn Right to pick up wheel three and moved it to 51. Then checked contact points.
If you don't want to think about how to efficiently move the wheels, you're welcome to make many more turns and waste much more time.
This is not a big deal during your first experience, but it will become a huge waste of time every time you try to manipulate a lock.

SG6725_2.jpg


As you can see in graph number two, I got more than one narrow area. I decided to amplify all the possible gates and made an accurate reading of the narrow areas (graphs on the bottom of the page).
I spent a lot of time in this process, but since I had no evidence of the gate position, I had to do so. No guessing allowed while you manipulate.
By analysing the graphs, I choose 11 as gate centre. Look at its shape: it's steep and resembles a gate. The area around 35 is wider and has high and low points. The area around 60 is too wide and smooth to indicate a gate.

Then I had to check which wheel, between one and two, had the gate at 11. As I did before, I tried a high and a low test numbers to see which wheel, if moved from its gate, would have made the contact points wider. My high test combos were 21-11-51 and 11-21-51. My low test combos 1-11-51 and 11-1-51. I found out the gate at 11 was on wheel one. So my combo was 11-x-51.

Once you have two out of three numbers, it's quicker to brute force the last number rather than reading the contact points to draw a graph. So just dial all the combos, with 2,5 step increments, to open the lock. My lock opened when wheel 2 was at 32,5. The emotion you feel when the fence enters the gate it's like picking a hundred of locks! :cool:
To get the actual combo I tried 11-32-51 and it didn't work. Then I tried 11-33-51, it was the working combo :mrgreen:

Remember, the most important things are: patience, precision, practice.

Good luck ;)
You do not have the required permissions to view the files attached to this post.
<<

abroxis

Contributor
Contributor

Posts: 349

Joined: Sun Apr 27, 2008 10:12 am

Post Wed Nov 30, 2011 6:12 am

Re: Getting started with manipulation

WoW
Thank you Femurat I found that really interesting.

For those that are interested in safes you might want to check out this site with some safe opening related software.

http://analoghacking.com/
<<

femurat

User avatar

Prolific Poster

Posts: 1451

Joined: Mon Mar 14, 2011 3:47 pm

Location: Italy

Post Wed Nov 30, 2011 6:46 am

Re: Getting started with manipulation

Thanks abroxis for pointing that site out. I've used his software and it works great. I wouldn't suggest to use it for a first time experience. It's better to concentrate on the reading rather than on the graph. Even the vernier is useful but not necessary for a newbie. Then if you decide to be serious about manipulation, an amplified contact microphone, a webcam with magnifying lens and the proper software are more than welcome.

Cheers :)
<<

abroxis

Contributor
Contributor

Posts: 349

Joined: Sun Apr 27, 2008 10:12 am

Post Wed Nov 30, 2011 8:02 am

Re: Getting started with manipulation

Here's a very simple wooden lock that someone did .

Theres a video of it working so you can get a good idea how these locks work.

He sells plans for $7.00 for those who want to make their own or just want better images of it .

Some of his terminology is not what standard safemen use but the concept
is pretty clear.

http://woodgears.ca/combolock/
<<

datagram

Familiar Face

Posts: 95

Joined: Fri May 28, 2010 11:25 am

Location: Los Angeles

Post Wed Nov 30, 2011 11:30 am

Re: Getting started with manipulation

All of the standard S&G models are good for practice:

S&G 6730/6741 - Three wheel practice locks
S&G 6731 - Four wheel practice lock
S&G 664x - Three wheel practice locks with better gate tolerance
S&G 6630 - Manipulation resistant (false gates) three wheel, but NOT a Group 1, it's a "2M"

LaGard 3330 is another common practice lock, but their other models can be very challenging (they use floating fence & cam mechanisms). The S&G 29xx/84xx/85xx are all Group 1 and manipulation resistant...not good for beginners.

dg
<<

s1deshowmick

User avatar

Contributor
Contributor

Posts: 634

Joined: Fri Aug 08, 2008 5:31 am

Location: Western Australia

Post Thu Dec 01, 2011 9:16 am

Re: Getting started with manipulation

That was an excellent post!!! Thanks for the effort mate..
If you can't be good, Be good at it.

http://au.youtube.com/S1DESHOWMICK
<<

macgng

User avatar

Contributor / I Fought Tooth and Nail to Acquire BO...
Contributor / I Fought Tooth and Nail to Acquire BO...

Posts: 991

Joined: Sat Jan 22, 2011 9:38 pm

Location: MD, USA

Post Thu Dec 01, 2011 10:05 am

Re: Getting started with manipulation

Ooooh I wanna get one so I can try this!!
Nibbler: The poop-eradication is but one aspect of your importance.
<<

steveslock

Familiar Face

Posts: 51

Joined: Mon May 24, 2010 3:45 pm

Location: Manhattan Beach, CA

Post Thu Dec 01, 2011 4:19 pm

Re: Getting started with manipulation

Most of this was fairly guarded in my industry up until 5-6 years ago and the internet has opened it up by publishing documents. If you are a legitimate locksmith/safe tech I would suggest taking a course on manipulation (LSI, MBA, Clark, etc). All the reading in the world is nothing compared to real life experience and having a solid instructor walk you through each step while you are trying is vital in my opinion. They also teach you short cuts, so you can manipulate open a lock in under 30 minutes if your lucky!
<<

Oldfast

User avatar

OldddffAASSTT the Spin Master Extraordinaire and American Lock Slayer
OldddffAASSTT the Spin Master Extraordinaire and American Lock Slayer

Posts: 4412

Joined: Thu Mar 31, 2011 9:16 am

Location: Michigan

Post Sat Dec 03, 2011 7:03 pm

Re: Getting started with manipulation

Femurat! What a great write-up man!! Thanks so much for your time and effort. What I like the most
is that you chose to add to an area of the forum that could certainly afford to be expanded. Great stuff!
" Enjoy the journey AS MUCH as the destination."
<<

WhiteGraphite

User avatar

Familiar Face

Posts: 20

Joined: Wed Nov 03, 2010 4:11 pm

Location: Ireland

Post Sun Dec 04, 2011 12:10 pm

Re: Getting started with manipulation

datagram wrote:All of the standard S&G models are good for practice:

S&G 6730/6741 - Three wheel practice locks
S&G 6731 - Four wheel practice lock
S&G 664x - Three wheel practice locks with better gate tolerance
S&G 6630 - Manipulation resistant (false gates) three wheel, but NOT a Group 1, it's a "2M"

LaGard 3330 is another common practice lock, but their other models can be very challenging (they use floating fence & cam mechanisms). The S&G 29xx/84xx/85xx are all Group 1 and manipulation resistant...not good for beginners.

dg


Would a Group 2 S&G be ok to start on? I know I haven't said what model, I'm more interested in the "Group" bit.
Next

Return to Tutorials

Who is online

Users browsing this forum: No registered users

Don't forget to visit our sponsors for all of your lockpicking needs!
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Grop
"CA Black" theme designed by stsoftware