### How to manipulate safes for beginners

Ok so, first I want to start off saying that I am a beginner in this field. I have traveled to several stores and cracked their safes (s&g 6700 series) with great amounts of success but that is the limit of my experiences. I am currently stuck on a LaGard 3330 so this little lesson is definitely for beginners who have not yet manipulated their first safe. I know there are a couple other lessons on this out there but I wanted to create my own because there will always be some missing piece of information for someone out there no matter how thorough the work (and my girlfriend is interested so this is partially dedicated to her <3 ). And I hope this will be able to address some of those questions and that this and all the different resources put together will be complete enough to get cracking! (Pun intended ). Before you begin, you MUST have a thorough understanding of how a safe works, how the wheels interact with each other and be able to visualize the wheel pack and know the state it is in at ALL times. I would suggest first to read www.crypto.com/papers/safelocks.pdf by Matt Blaze and get a copy of The National Locksmith Guide to Manipulation. Very good intro to how safes work. I would also say look up videos or get a cutaway safe lock to view how the wheel pick up.

Oh, and read the interview with Mark Bates at http://www.safeventures.com/news.php?id=16 and make sure you understand the different ways a lock can indicate a gate. And Oldfast has an AMAZING chronicle of his experiences with manipulation at http://keypicking.com/viewtopic.php?f=100&t=7432 He explains the terms used very nicely as well and I will be using those terms so it's best to get acquainted with those first. You should spend AT LEAST 3 hours reading over all these materials before you even touch a safe lol I'm not explaining how safes work in this because the 3 links I mentioned do a great job of that, especially Matt Blazes article. If it's needed I might post up something just on how they work as a precursor to this. So please, gain all the knowledge you can on how they operate and if you have any questions, feel free to ask!

IMPORTANT EDIT: I just created something to explain how safes work. I hope it has all the info needed to know before beginning manipulating. It can be found here: http://keypicking.com/viewtopic.php?f=100&t=8310&p=73720#p73720 . This would just replace reading the paper at crypto.com by Matt Blaze to know how safe locks work. I still recommend reading about gate indications though and Oldfast's safe chronicles.

Locks to practice on. In this I will be using the example of an s&g 6700 series. I recommend either the 6741 or 6730. The only difference is the 6741 has a dialing tolerance of +/- 1.25 and 6730 has +/- .5. This means with the 6741 if a number is 10, you can dial 8 3/4 or 11 1/4 and with the 6730 only 9.5 or 10.5.

Read the above articles first!

First graph

To begin your first graph, you need a graph sheet. It should look something like this:

Feel free to use this one or make your own based on it. Each of the two sections have 3 boxes to write the contact point in. Find the two contact point and write the closest whole number to the RIGHT contact point in the UPPER section. Do the same with the LEFT contact point in the LOWER section. Then fill in the blanks above and below each of the numbers by one number off. So with contact points of 96.5 and 6 your graph should look something like:

Now title your graph so if you need to come back later you will know what the graph is showing. For instance, put the graph # in this case Graph #1 and how you chose to start. AWL or AWR which is all wheel right or all wheels left. If that doesn't make sense to you, just keep reading and it will. For now, just put AWL because we will graph the first graph with left rotation.

The reason we start with left rotation is because 2 out of the 3 numbers are dialed with left rotation. Think about it: you dial LEFT RIGHT LEFT and then open with right. This give you 60% chance you'll get the rotation right with the first number you find. Plus, wheel 3 (dialed with left rotation) usually reads first. I don't know specifically why, but it does.

Graphing!

So pick up all the wheel by turning left 4 times and stopping on 0. Most likely this is between your two contact points within your contact area. You can measure your left contact point easily to turning RIGHT. This does not disturb the wheel since they are parked at LEFT 0. But to get to your right contact point, you have to turn right almost a whole revolution and go past the right contact point (be careful not to get too close to 0 or you will mess up the position of wheel 3) and then turn LEFT to lightly touch the right contact point. You want to record these two measurements on the graph. Lets say you found 96.5 and 6 and your contact points with AWL @ 0. So you find where 6 meets 0 and put a dot there. And the same with where 96.5 meets 0 and put a dot there. Each of the horizontal lines is 1/4 of an increment. You want to get precise enough to measure 1/8 of an increment which is in between each of the horizontal lines.

NOTE: YOU WANT TO BE VERY LIGHT WHEN YOU TOUCH EACH CONTACT POINT SO THE NOSE DOES NOT RIDE UP ON THE DRIVE CAM. IT IS ALSO IMPERATIVE THAT YOU READ ACCURATELY.

After you get these two dots on your graph, turn left to 0 again and turn to 2.5. Make sure you stop on EXACTLY 2.5 not 2 1/4 or 2 3/4. The repeat the process to read the contact points and graph them. You should have something like this now:

Repeat the process until you have:

Now that you have your first graph you want to look for indications of a gate. The right contact point shows a classic and unmistakable gate at 32.5-35. With most group 2 locks the right contact point (RCP) will indicate about 1/4 increment and the LCP will indicate about 1/8 to 1/4 increment. In this case the LCP is indicating 1/8 increment at 35-37.5. Now you want to amplify these areas. Graph again but only graph 31-39 so you should now have something like:

Oh, and it's a good idea to write the lock model on there too.

So once you amplify, you have to find the gate center. To do this, take the middle of each indication 32-35 (33.5) and 33-37.5 (35.25) and average them together. (33.5+35.25)/2 = 34.375 but we'll go for 34.5. So we know 34.5 is a number in the combination we just don't know which one yet. To find out, we have to to High/Low testing. This means putting two of the wheels on the right number and putting the other wheel 10 numbers below and 10 numbers above. For example:

Low testing:

R24.5 L34.5 L34.5 (This is right 4 times to 24.5 and left 3 times (this picks up 2 wheels) to 34.5)

L34.5 R24.5 L34.5 (This is putting only 2nd wheel on 24.5)

L34.5 L34.5 R24.5 (This is left 4 times to 34.5 and right 2 times (this picks up only 1 wheel) to 24.5)

Each of these times you want to measure both contact points and write them down. Then find the space in between them. That's the size of the contact area. Now, this is where a thorough understanding of how safes work come into play. Since you know 34.5 is one of the correct numbers, the nose will drop lower when this number is on the right wheel (smaller contact area) and higher (wider contact area) when the right wheel is NOT on 34.5. So by putting just one number off, when the wheel with the combination of 34.5 has 24.5 on it, the contact area will be WIDER. So let's say these 3 test show this:

LCP 97 RCP 6 Contact area 9

LCP 97 RCP 6 1/4 Contact area 9 1/4

LCP 96 3/4 RCP 6 1/4 Contact area 9 2/4

The most likely wheel to have 34.5 as a the combination is wheel 3. But we need to do High testing as well so we do:

High test:

R25.5 L34.5 L34.5 (This is right 4 times to 25.5 and left 3 times (this picks up 2 wheels) to 34.5)

L34.5 R25.5 L34.5 (This is putting only 2nd wheel on 25.5)

L34.5 L34.5 R25.5 (This is left 4 times to 34.5 and right 2 times (this picks up only 1 wheel) to 25.5)

and say we get:

LCP 97 RCP 6 Contact area 9

LCP 97 RCP 6 Contact area 9

LCP 96 7/8 RCP 6 1/8 Contact area 9 1/4

Now both test show wheel 3 to indicate. So we know so far the combination is ?-?-34.5. This is why an understanding of how wheel pick up is needed. You need to know how to put each wheel at a specific number and know which wheel is at what number. IT IS CRUCIAL!!!

VERY IMPORTANT NOTE

Notice how we found 34.5 with AWL rotation. In all the high low tests everytime we put a wheel on 34.5 is is with LEFT rotation. This is important. Parking with right rotation will put the wheel slightly off.

Graph #2

So start graph number two like you did number one with all the titles and all. But since you have wheel 3 going left you will have the other two wheels going right. It would be titled with

LOCK TYPE Graph #2 1&2 AR / 3 @ L34.5. This means you are graphing wheels 1&2 with right rotation and wheel 3 is at 34.5 with left rotation. To graph this you pick up all wheels with right rotation and stop at 0. Then you turn left and pick up wheel 3 from 0 and stop at 34.5. Then you graph your contact points. Next turn right and pick up the wheel from 34.5 and the other 2 wheels at 0 and turn to 97.5. Turn left, pick up wheel 3, stop at 34.5 and read contact points. So the first two readings should look like:

Remember: 100 and 0 are the same number.

Repeat. Until you have:

Remember, when you pass 34.5 on the second graph, you will disturb the wheel which is parked there so you have to pick up all wheels again with right rotation to 32.5, go one whole rotation and pick up wheel 3 to put it on 34.5 and continue as normal.

Now, if you were a good boy/girl then you would have read the links I provided at the beginning including the one about Mark Bates and gate signatures. In this scenario we get the gate signature that has a dramatic drop and never goes back up again like a normal gate a reading or two later. It stays flat for a while. Now you might think both contact points indicate a wide gate but it's WAAY to wide to be a classic gate signature. No, this is a drop that does not rise. Amplify now and you should get:

Since gates are usually about 3 increments wide I would choose 67.5 as the gate center not 68. Now do high low test again and find which wheel is indicating. Since we already know 34.5 is the 3rd wheel we only need to do high low tests for 2 wheels not all 3. Let's say wheel two indicates so now you know the combo is ?-67.5-34.5.

Now, just dial in 0-67.5-34.5, 2.5-67.5-34.5, 5-67.5-34.5 and so on until it opens. You can graph this until it opens just in case the lock does not open you have something extra to refer to but usually it's not needed to graph on the final run.

Now, if you read Oldfast's chronicles you know he goes by every 2 increments when graphing and on the final run. This is because it is possible to miss a number every 2.5 increments. Personally I graph with 2.5 and I go every 2 increments on the last numbers. With experience you'll be able to get your own way of doing it.

Troubleshooting

So the main purpose I wrote all this was to help people with no knowledge of safe cracking. When I started out I had many problems I had that I wasn't sure about and this section is to address those issues for others that might have those problems.

If the lock doesn't open:

- Make sure you are getting the high/low tests right. The right wheels on the right numbers and in the correct rotation. REMEMBER: WHEEL 1 IS THE FIRST NUMBER IN THE COMBINATION SO IT IS THE WHEEL THAT'S CLOSEST TO THE DIAL AND GET'S PICKED UP LAST. WHEEL 3 IS THE LAST NUMBER AND GETS PICKED UP FIRST. Don't forget that.

- Dial accurately. Dial within 1/8 of an increment of what you are trying to park a wheel on. It's best if you get EXACTLY on that number. If your contact point is really faint, here's a technique Datagram (amazing guy) taught me. Get close to the contact point and then turn the dial by lightly running your thumb along the dial with just enough friction to turn the dial. When it hits the contact point, it should stop exactly on it. Make sure you DO NOT increase the force otherwise the nose will ride up on the drive cam and you'll get a false reading. This takes practice. Try having the back of the lock open as you do this and look at it/have someone else look for you/or record it so you know just how much force to put on the dial with your thumb.

- Read correctly. Make sure you are CONSISTANT with your readings. This is a big thing. If the increments on the dial are really wide and it's hard to pinpoint exactly where the dial is, tape a needle to the index mark you dial to and a piece of tape tapered to a point on each contact point. This helps greatly with readings since you need to be consistent down to the 1/8 increment.

You can also tape paper or whatever helps. This little setup was done in 30 sec and it works well enough to tell that in the picture it's on 8 3/8 not 8 1/2 or 81/4.

- If all else fails try parking wheels 1 & 2 in the contact area with right rotation and just run wheel 3 around left. Make sure when you pass by the place wheels 1 & 2 are at, you don't mess them up. Re-park them and carry wheel 3 to the next number. This is because wheel 3 usually reads first. So you don't have to do high/low tests since wheel 3 is the only one moving it is the only one that the gate can belong too if you find one.

- You can also try starting with AWR if AWL doesn't work. Locks read differently depending on the rotation.

- The wheels on the lock might be parked at different spots than you think. If you found a number on a wheel while that wheel was going RIGHT and you dial that number in LEFT then that could be a problem. If wheel 1 or 3 reads first on AWR, do a rotational conversion otherwise you will be off. I can't explain this nearly as well as Oldfast like he does in the comments below. I want to thank him for the explanation; it makes this article more whole! I'm adding it here just in case some people don't read the comments:

By Oldfast:

The standard rotations for opening a 3-wheel lock is with a LRL rotation. We know that the gates

can also be aligned, and the lock opened, by using a RLR rotation. We also know that by doing so,

the combination (according to the dial) will be different from the original combo. But why is this?

You've already illustrated nicely how movement is transferred throughout the lock -

fixed drivepins coupled with the movable flys allow each component to pick up the next.

It's the WIDTH of these pins & flys that actually creates this difference when dialing from the opposite direction.

If we don't account for this & make adjustments accordingly, the gate will stop just shy of being under the fence.

First, be aware that these differences will vary with EACH WHEEL. If you really think it through --

Wheel 3 (closest to the drive cam) will have the smallest difference. When moving w3, we're dealing with only

one drivepin (on the cam) and one fly (on w3). So a fairly small difference occurs... often times less than 1 inc.

On the other hand, wheel 1 (furthest from the drive cam) will have the largest difference. Since all the wheels

are being moved in order to position it.... multiple pins & flys are involved. It may be 2 1/2 incs, or even more.

To determine each wheels' exact pickup difference, first park all wheels coming from one direction. Then,

switch directions and make three rotations. With each of these three rotations, a wheel will be picked up.

Wheel 3 will pick up first, then w2, then w1. You'll find the pickup point for each wheel to be slightly off

from where you originally parked all three. Precisely note this difference for each wheel as they pick up.

One last note, then we'll run through an example. I would suggest parking all wheels at either 50 or 60.

This places them far from the contact area so you don't mistake a contact point for a wheel picking up.

So for example, lets say we have a combination of: L10 R20 L30

We want to convert this so we can open it with a RLR rotation.

First, figure out the pickup differences for each wheel:

-Park all wheels @ R50. Now switch direction turning left.

-As you approach 50, feel wheel 3 pick up @ 50 1/2.

-Now continue around left again and feel wheel 2 pick up @ 51.

-And one last time around left to pick up wheel 1... feel it pick up @ 52.

This quick procedure reveals the pickup differences for each wheel.

Wheel 1 .....2 incs

Wheel 2 .....1 inc

Wheel 3 .....1/2 an inc

But how do we actually utilize this? You could say, subtract, add, subtract...

but that's far more complicated than it has to be! Instead, think of it this way:

Simply dial BEYOND/PASSED the original combo # by the appropriate amount.

So our original combination of ..... L10 R20 L30

dialed the other way will be ........ R8 L21 R29.5

I know this got a bit wordy... lol... but hope it helps you (and others) understand this quicker than I did.