Manipulation part IIAt this point I hope there are a number of things that you feel very comfortable with and should be
as natural as breathing for you. If not, I either haven't done my job... or you haven't done yours! lol
Moving through the wheelpack with very little thought, knowing exactly where you are at all times.
Rarely should you be clearing the dial or taking additional & unnecessary rotations.
Parking one wheel and isolating another is second nature now.
Converting a wheel or an entire combo is no problem.. .. ... .... ..... ...... ...... ........
OVERVIEW ........ ...... ...... ..... .... ... .. .
I always like to know what's going on before too many details are thrown at meWe'll use a series of movements coupled with shackle tension in order to extract all we can from the lock.
One, two, or possibly even all three gates may be revealed during this process. In addition to
locating the
gate(s), we also need to determine which wheel(s) they belong with... again using a series of movements.
Any remaining unknowns will then be found through exhaustive search. Also referred to as brute force BF
This is a systematic approach that simply means we'll try every possibility until arriving at the correct one.
Obviously, each gate we locate beforehand
drastically reduces the keyspace that needs to be searched.
MovementsThe two most useful movements are:
All Wheels Right and All Wheels LeftAs you well know, these two movements are very different & can produce different results.
99% of the time one and/or both these movements will yield more than enough to roll with.
The other approach I like to take sometimes is to search a wheel at a time.
Advantage to this is you don't have to wonder what wheel you have found.
The plan is to target w3 first. Then w2. And if all goes well, brute force w1.
Start by running w3 while parking wheels 1&2 in various positions.
1+2 park Rx .... 3 ALKeep it simple. Park quarterly around the dial: Noon, 3, 6, & 9 o'clock.
If unable to detect anything, a different direction may yield something.
1+2 park Lx .... 3 ARWith a known gate for w3 in hand... we now focus on w2.
Park w1 in various positions while running 2&3 together.
1 park Rx .... 2+3 ALAnd again, direction
can make a difference.
1 park Lx .... 2+3 ARIf a gate is detected during these rotations
other than the one we found for w3, then
we've undoubtedly found the gate for w2.
And we're off to brute forcing w1
TaggingSimply finding a gate certainly improves our situation, yes. However, if we are able to tag that gate
to its' rightful owner, well then we'll have taken a fair slice out of our possibility pie. Less to eat later.
Often times wheel 3 and/or 2 will 'read' first... leaving wheel 1 to exhaustive search.
Knowing this still does not allow us to skip steps, but
can help streamline our approach.
The fact is: when a gate is detected using an all wheels rotation, that gate may be on ANY
1 of 3 wheels. If we must search them all anyway, we might as well start with the most likely.
Attempt to tag the gate to w3 first. If you're unable to verify it, then focus on w2. And finally w1.
In this manner we're working from most likely to least likely. It just so happens this is also the
most logical order regarding efficiency. W3 is easiest to isolate. Followed by w2. Then w1.
The remainder of our discussion will be centered around this scenario...
Gate detected @ 10 using an AWL
Stop @ L7
TC .... L10. .. ... .... ..... ...... .......
Wheel 3 ....... ...... ..... .... ... .. .
Upon hitting the stop at LEFT 7, I immediately go RIGHT to see if I
catch the other side of the gate (
which should be around 12 or 13).
*This is also a good opportunity to take a quick sec to bring w3 around
the rest of the way. If the gate is on 1 or 2 it has likely allowed the pawl
to drop into the wheel pack enough to be able to find the gate for w3.*....nothingLEFT again. Stop at 60 (noon). Then RIGHT to the area in question (10).
I've just pushed wheels 1&2 a bit further and parked them @ LEFT 60...
then brought w3 RIGHT to 10. Oscillate within this area for the gate.
....nothingLEFT to 45. Then RIGHT to 10. Feel for the gate.
...still nothing?LEFT to 30. RIGHT to 10. Feel for the gate.
What I just performed is called 'backtracking'. It's what I call it anyway. lol
I'm simply pushing 1&2
ahead & bringing 3
back to the area in question.
1+2 park @ L60 .... 3 R101+2 park @ L45 .... 3 R101+2 park @ L30 .... 3 R10I parked 1&2 in several positions. With each new position, w3 is brought
back to 10 in order to feel for the gate. You'll notice I spread out my test
positions around the dial quarterly (noon, 9 o'clock, and 6 o'clock). I do
this in hopes of revealing the gate just as the initial all wheels left did.
At this point I'm fairly certain this gate does not belong to wheel 3.
. .. ... .... ..... ...... .......
Wheel 2 ....... ...... ..... .... ... .. .
Same idea is applied here when attempting to tag this gate (10) to w2.
But this time we're only parking w1 in various positions while running wheels
2&3 together through the area of 10. If the gate is present we can then tag it to w2.
The parking places I choose will be a bit different than when I was running w3 though.
I usually like to use the gate itself for my first parking place.
Lets run through this first one turn-by-turn.
1 park @ R10 .... 2+3 AL thru area of 10TWO turns RIGHT. Stop @ 10.
Turn LEFT ONCE (w3 picks up w2 @ 17).
Apply ST and continue LEFT thru the area of 10.
The other movements I'll just list.
1 park @ R20 .... 2+3 AL thru area of 101 park @ R30 .... 2+3 AL thru area of 101 park @ R40 .... 2+3 AL thru area of 101 park @ R50 .... 2+3 AL thru area of 10Normally just 2-3 parking positions
will suffice - but you get the idea.
Oh shit! POP QUIZ
Why didn't I park @ 60?
. .. ... .... ..... ...... .......
Wheel 1 ....... ...... ..... .... ... .. .
Not much to say here. At this point you've been unable to verify wheels 3 or 2 as the owner.
By default, or process of elimination, we can now tag the gate to w1 with some certainty.
Wheel 1 reading first is
somewhat rare. But it's always a welcomed surprise.
I consider w1 the '
rotisserie' of the wheel pack... you can "
set it and forget it".
Whether searching the other wheels for a gate, or brute forcing, it's much easier
and more efficient now with w1 out of the equation. You still need to be careful
not to disturb w1 though! Keep in mind the large pickup difference of 14 incs.
This limits your movements to roughly 3/4 of the dial. Which, by the way....
....brings us back to our pop quiz. The goal was to bring
only wheels 2&3
through the area of 10. Parking w1 @ 60 allows it to be picked back up
before reaching 10. You'll be bringing all 3 wheels through the area!
It's an easy mistake. And it's a quick way to mis-tag a gate to w2.
Whole Numbers ...in regards to taggingWe touched on this briefly towards the end of the 'Tolerance' section. But lets explore it more.
Whole numbers - I'm referring to the numbers that are
actually wrote on the face of the lock.
The 3-digit combinations for these locks will be comprised
only of these whole numbers.
Increments between whole numbers are not utilized and can therefore be disregarded.
However, I do not want to present this rule as absolute. I've found there are exceptions.
There's quite a wide variety of makes & models from Slaymaker - some of which do not
conform to this rule. You'll see one such lock in my 'Examples'. And others can also be
found at vintagecombinationlocks dot com. The lack of precise machining also plays a
factor. It's rare, but I have found a gates' TC to be slightly offset from a whole number.Nevertheless, we can still rely on this to an extent & take advantage of it when possible.
The most glaring advantage, as we already discussed, is a significant drop in key space.
But this knowledge can also, at times, help in tagging a gate to a wheel. Mainly wheel 2.
First, realize this rule only applies when wheels are rotated in their traditional direction!
So long as we stick with traditional directions, the TC of each wheels' gate will
always land directly on a whole number. Or damn close to it anyway.
Next, recall rotational differences. W1... 14 incs. W2... 7 incs.
Lets break this down slowly,
focusing only on w2Traditionally dialed with LEFT rotation. Its' pickup difference: 7 incs.
So AWR leaves w2 being turned opposite its' designed direction.
And an AWL is naturally rotating w2 in its' traditional direction.
Rotational conversion example: L8 equates to approx. R6.3
Based on this information, lets run an example to illustrate.
AWR produces a Drop n Stop: 6 - 7.1 . . . . TC is approx. R6.3Note that TC lands directly BETWEEN two whole numbers (6&7) rather than ON a whole #.
W2 sticks out like a soar thumb! It is the only wheel being rotated opposite its' traditional
direction - which is why it didn't land on a whole #. We can be fairly certain this is w2.
Unfortunately, this concept of whole numbers is not applicable to the other couple wheels.
Wheel 3 (drive cam) is not sensitive to direction. And w1's pickup difference being nearly
15 incs pretty much places it on a whole # regardless of which direction it's dialed from.
We can derive from this a couple of semi-reliable conclusions though:
If a gate is detected with an AWR rotation and its' true center......
.... lands directly ON a whole # - we've likely found w1 or w3
.... lands BETWEEN two whole #'s - then it's very likely w2
Exhaustive SearchExhaustive search, (aka. brute force BF): systematic approach whereby
every possible configuration is tested until arriving at the correct one.
So here's a topic that we could easily babble on about for awhile. lol
aaaand our discussion would inevitably lead to bustin' a load of contaminated, filthy formulas whereby
the unknown
x factor defiles the untainted
y variable.... all of which is then skull raped to the power of
z.
A mathematical approach would be a waste of our time. And there's not THAT many possibilities anyway.
Besides, all of the groundwork has been laid at this point. You already know how to do this.
An intimate knowledge of wheel movement, pickup differences & the dead zones they create,
rotational conversion, and the concept of whole numbers all come into play as we run a wheel.
The nature of these locks & the tolerances within will very much dictate how we go about brute
forcing a wheel. I'd encourage you to take a quick moment to re-read the last half of this
sectionBy far the most likely scenario you'll be left with:
Brute Forcing w1Rx - L35 - R451
AR .... 2@ L
35 .... 3@ R
45So you're running w1 around right testing each whole number (40, 45, 50, 55, 60, 5, 10, etc.)
With each test # remember to dial wheels 2&3 to their known gates before trying the shackle.
Take note of where I strategically began my search for w1 depending on where w2's gate is.
Or you may be left with w2 as the unknown:
Brute Forcing w2R15 - Lx - R451@ R
15 .... 2
AL .... 3@ R
45W1, the rotisserie of the wheel pack. Set it & forget it. But don't disturb it from here on!
We're then ready run w2 around left testing each whole number (10, 5, 60, 55, etc.)
With each test # don't forget to dial w3 to its' known gate before trying the shackle.
L10-R45 pull shackle. L5-R45 pull shackle. L60-R45 pull shackle. It's pretty quick.
Regardless of what wheel we're brute forcing, it all plays out fast. Even if you were to screw it up by
testing numbers that are not possibilities, you're still looking at less than 60 seconds to run a wheel.
However, we can speed up the process by keeping in mind a couple of things we've learned:
*
Minimize unnecessary rotations by being conscious of where you left each wheel -
mainly the wheel you're testing. There's no need to clear the dial after each test #.
*
Minimize test #'s. Be mindful of the large pickup differences & the dead zones they create.
Bringing a wheel into these areas will knock the previously positioned wheel off its' gate.
So any #'s within these zones cannot be part of the combination - no need to test 'em.
The 'Tolerance' section illustrated the effects of this on w2. Only 7 possibilities left.
One last thing. The concept of
Whole Numbers in regards to Brute ForcingIn our examples above the test #'s were simple - possibilities included ONLY whole numbers.
However, if we break suite from traditional directions, test numbers will NOT land on whole #'s
Brute forcing w1 in the non-traditional direction (left):Test #'s will land
beyond each whole # by 1 inc.
around left 19, 14, 9, 4, 59, 54, 49, 44, 39, etc.
Brute forcing w2 in the non-traditional direction (right):Test #'s will land
half way between each whole #.