Field & Stream gun safe (by Stack-on) direct entry

[madsamurai]

So we had this gun safe sitting in the warehouse at work for the past few months because the combination that came with it was wrong, and the combo we got from Stack-on based on the serial number was still wrong, so nobody could open it, and therefore we obviously couldn't sell it... It normally retails for $399, so when I talked my manager into parting with it (letting me take it out of the way) for $50, we were both happy, and I had a new practice lock and a potentially usable safe once I managed to open it. Truthfully, I would never pay the asking retail price for one of these anyway, cuz they're pretty much junk, imho, but for what I paid I feel like I got a decent deal in the end even if just for the lock and the experience.

I learned a lot with this one -- mostly about the stupidity of assumptions, as I started with a few of them (and proved them all wrong):
1) Cheap Chinese direct-entry lock, should be cake even if it is my first time (and certainly couldn't be harder than the S&G 6741, right?)...
2) The other stack-on locks I've seen had plastic wheels with false gates only on wheel 3
3) If graphs show some good looking numbers, you can save time by trying combinations of those numbers instead of keeping on the path

In hindsight, I think 1 was true, but the other two negated that anyway. There will be a lot of 'in hindsight...' references throughout this post, so please forgive me in advance for being annoying with that word.

So I got myself a dial indicator with a magnetic base and proceeded to rig up to measure handle movement. That actually worked quite nicely, for the most part, tho I had a lot of trouble getting consistent readings... I was never really quite sure if the magnet was slipping, if there was something slipping in the dial or flex in the locking mechanism, or if I had just gone too long without a break, but whenever I measured a spot and then went back and re-measured, I'd be off by a bit. So I measured a lot of things two or three times. Ultimately, even tho there was some variation the peaks and valleys still ended up in the same place, and it all worked out anyway, but that's why in my graphs you'll see some extra dots and dots crossed out here and there.

Here's my rig... magnetic base on the dial indicator overlaps the door on purpose, to keep the door from wobbling. Used a small woodworking clamp to hang a counter-weight for even pressure (I knew I'd find a good use for a Master padlock), and also provided an easy lever to ease that pressure. My dial indicator measures in .001" increments, so when you see whole numbers on my graphs they're actually thousandths of an inch.

Started out graphing AWR, since this is a R-L-R combination I figured that would be more appropriate.

You're actually looking at three different steps on this graph, so ignore the numbers and lines and imagine I just have the dots at this point. Hindsight regret #1, I wasted a good amount of time graphing non-gate areas here, and could have skipped that and just marked where it fell into (false) gates and checked for which one went deepest.
Anyhow, from the dots, I decided to roll with R54 since it had the highest (barely) points.

So next, I graphed 1&2 AL/3@R54

So, keeping in mind assumption #2, I thought I had two pretty obvious gates at L3 and L15, and what I imagined to be injection-mold seam gunk in the 45-70 range, but didn't throw out L48 and L61 yet. Since I didn't have a whole lot of confidence in w3, I ran these peaks against each of the gates on w3 (the numbers under my gate marks on graph 1 there) and you can see I got the most movement on all four peaks against R7. At this point I also thought it would be good to check the edges of the false/gates on w3 and find the true centers, hoping one of the gates measured wide or different. R7 was the only gate that was centered on a whole number, so I felt like that backed up R7 as the true gate.

So now, since I was set on R7 instead of R54, I re-graphed 1&2 AL/3@R7

I couldn't see L3 from graph 2, but L15, L48.5 and L61 were still there... and a new gate-like peak at L25 appeared. So now I've got 3 good looking peaks and two weird looking peaks on wheels I was sure didn't have false gates. Here I wasted a bunch of time trying combinations of these 5 numbers and R7 (assumption #3) with no joy. This, of course, didn't make any sense to me at all, and it was getting late so I called it a night and came back to it the next day.

Day 2
I figured the next proper step was to hi/low test the five peaks I found in graph 2 and 3, however I could see the standard +/- 10 routine wasn't going to work because 3 of my potential numbers were right about 10 digits apart. So I picked a low point on the graph away from anything interesting, and tested each peak against L90. Still thinking L48.5 and L61 were junk readings, I was almost sold on L3 for w1 and L15 for w2, but they didn't open anything, so I tried L48.5 just to be thorough (was feeling a little lost at this point), and WHAM, it dropped almost .2"! I thought I had it, then it still didn't open and I thought "how can it move that much and not open?" I went ahead and checked L61, and it moved almost as much as L48! All of my movements before had been at best .005", so I knew I was on to something... but I was confused as hell... I couldn't see why anything could move that much with one wheel at 90, the lowest of all points on my graph, and how could L48 and L61 both be on the same wheel? Smoke break...

L3 and L15 still looked pretty enough I was convinced they had to be something, so I ran them on w1 against L48 and L61 on w2 and w3@R7. w1@L3 gave me .180" movement on both, so I thought maybe it was time to recheck the w3 gates, which is what you see boxed-in on the bottom left of graph 3. Everything measured nearly exactly the same except R42, which moved considerably further, so finally I had my w3 number @R42. L61 looked really good for w2, as did L48.5, so I wasted a bunch of time trying combinations against those again (back to assumption #3) to no avail, and went out for a nice long dinner break.

The only thing I could think to do next was to graph w1 and w2 separately, because, frankly, I was even more confused than before. In hindsight (told ya) I should have just done this instead of trying combinations and getting tired and frustrated, but I digress...

So I start my 4th graph 1AR/2@L48.5/3@R42 (why did I pick 48.5 instead of R61? I dunno...)

Enlightenment... False gates all around w1 (the little down-arrows on the graph were around .200" below my zero). Seriously, assumption #2 kicked my ass. Now I'm guessing w2 has the same, and nothing left to do but graph it, too... but I'm dead tired and decided to give in for the night and start again in the morning.

Day 3
Coffee in hand and a clear head, I set out to graph wheel 2 in case I was wrong about one of the other number choices. R25 looked really good on Graph 4, so Graph 5: 1@R25/2AL/3@R42. Turns out trying wheel 2 in a RLR combination is pretty quick work, you can stick w1 and just bounce back and forth between w2 increments and w3, so all of about 3 minutes later...

I hit L72 and the damn thing moves all the way... Open at last! I laughed, then I called it dirty names like some kind of tough guy, then I just stared at it for like 10 minutes... It was the most beautiful cheap-ass open safe I've ever seen.

The After-Party
So, here's what she looks like under the pretty dress:

The handle moves that small silver plate, which pushes the top end of a long piece of U-shaped sheet metal (I'm not gonna call it angle-iron, cuz it's sheet metal) that pushes the bolts out the edge of the door. There's quite a bit of flex in that, and the "grease" they used on those bolts was surprisingly sticky. Really not impressed with that design at all... in fact, there's a tiny bend in that bar right around the middle bolt already. I'm gonna have to make some kind of reinforcement bracket for that. The pink/black tetris puzzle is drywall pieces glued edge-to-edge to fill the front door area for "fire protection." I guess they just use whatever scraps they have laying around...

Here's a closer view of the wheel stack, which you can clearly see is NOT made of plastic, and has false gates on all wheels. Assumption #2 couldn't have been more wrong.


Some additional notes, in case you get to mess with one of these:
• There is about 1 increment of play between the spindle and the drive wheel
• Looks like the combination is set with a pin that's been squished a bit like a rivet, so changing the combo might be tricky... haven't taken it apart that far yet to say for sure.
• w3 is roughly 3.035" dia., w2&1 are visibly smaller at 2.950" dia.
• not sure it matters, but false gates are the same (relative to true gate) on w2 and w1. False gates on w3 are spaced differently so only 3 of 7 are in the same place as 1&2.
• If you get one with a springy handle, it's probably the lower bolt stuck part way putting inward pressure on that crappy bar, which acts like a spring and will initially seem like the dial is locked. A little counter-clockwise pressure on the handle will release the dial and a bit of rattling might help that bolt move the rest of the way to the closed position. We have another of these at work that has this issue (which I'll be trying to open in a few days), and after studying mine I'm fairly certain that's the case. When closing the bolts, that lower one will make a delayed thump as it lags behind the others.

If you're still reading this, you're a wonderfully patient person... I feel like there's at least a dozen things I could have done (or not done) to save time and frustration thru this all, and really hope you'll tell me all about them. Thanks for following along!

[escher7]

Very helpful post for a novice reader.

[femurat]

Congrats for the opening! I like your simple and effective setup, and your detailed graphs.

Here's a cheap approach to safes with false gates on all the wheels: it's very easy to spot one of them on each wheel.
Let's start with wheel #3 that is usually bigger and look for a gate on it.
When you find it, stop looking. Doesn't matter if it's a true or a false gate.
Look for a gate on the other two wheels, and stop looking once you have found them.
So now you have found a gate for each wheel.

Park two wheels on these gates and quickly map the other one to find all of its gates.
Once you have all the gates on all the wheels, well, it's just a matter of dialing all the possibile combos to find the true ones...

This is the quickest way I can think of to open a safe like that. If some more experienced manipulator have a different method, I'll be happy to stand corrected.

Cheers

[MartinHewitt]

Another method is to go for the deepest gate. So in these maps chose the deepest gate. If the lock doesn't open do another map and look for a deeper gate. So if you have a gate on W2 and W3 and a map of W1 with W2/W3 set to the gate of your choice you chose the deepest from W1 and do a remap of e.g. W3 with W1/W2 set to the gate of your choice, because the deepest gate in W1 might enable to find a deeper gate in W3. And a deeper gate in W3 might enable to find a deeper gate in W2 and so on until you have all three true gates.

So my theory as I don't have any locks with false gates.

[Jaakko Fagerlund]

Congrats for the opening! I like your simple and effective setup, and your detailed graphs.

Here's a cheap approach to safes with false gates on all the wheels: it's very easy to spot one of them on each wheel.
Let's start with wheel #3 that is usually bigger and look for a gate on it.
When you find it, stop looking. Doesn't matter if it's a true or a false gate.
Look for a gate on the other two wheels, and stop looking once you have found them.
So now you have found a gate for each wheel.

Park two wheels on these gates and quickly map the other one to find all of its gates.
Once you have all the gates on all the wheels, well, it's just a matter of dialing all the possibile combos to find the true ones...

This is the quickest way I can think of to open a safe like that. If some more experienced manipulator have a different method, I'll be happy to stand corrected.

Cheers

I think you left out aone important point: once you find a gate for each wheel, go and check what gate gives free wiggling on the dial on W3, the false gates usually all just feel solid or scratchy. This way you eliminae one wheel complete, thus having a 100 combo puzzle at first (assuming 10 gates per wheel and 3 wheels).

Other than that, most locks of this type have equal divisions between the potential gates, so it is easy to check the numbers.

And on some locks of this type, like the Diplomat, you can find the gate on wheel 3 and instantly know where the other gates on other wheels are with just one calculation. Then it is just a matter of elimination.

[madsamurai]

Thanks for the feedback, guys.

Both those ideas make sense... I think the thing that threw me most was my assumption that there weren't going to be false gates on w1 and w2. Seems like graphing 1&2AL in graph 2 didn't really help me much... in fact I'd say it confused me more than anything because it doesn't seem to indicate false gates on those two wheels (at least not the way I'd expect) and ultimately NONE of the peaks on that graph represented actual combination numbers.

So if I had one specific question here I'd like to get answered: how would I determine if there are additional/false gates on w1 and w2 if I didn't know they were there? W3 is easy because it bumps against the handle as it turns, so it was obvious, and since it can be turned alone it's easy and quick to map out the limits of all of the gates. I feel like if I had skipped the 1&2AL graph and gone straight to just graphing w2AL or w1AR individually I could have done this a lot faster. Then I'd have 8 possible numbers for each wheel and could just keep picking the deepest ones like Martin suggested (or at worst, try all 512 combinations until one worked -- not exactly ideal, tho). KNOWING there are false gates on all wheels, this seems the fastest concept, however if those two wheels didn't have false gates, the 1&2AL graph would be the faster way to go, I think. So how to choose if you don't know what you're dealing with?

@Jaakko (you posted while I was writing this) I didn't notice any difference in feel in the gates on w3 as far as being free-wiggling or sticky (at least in the beginning when I was graphing that wheel), but that's something I'll keep in mind and test out on the next one... I wasn't looking for that, so it might have been there and I just didn't think to note it. The gates on these wheels are not evenly spaced... that was something I did check for, hoping the false gates would all be evenly spaced and the true gate would stand out as different, either in spacing or in gate width (which is why I liked w3@R7 for a bit... it was the only one centered on a whole number, while all the others were centered at 1/4 increments), but it didn't really pan out in this case. Good to know about the Diplomat and that some locks are predictable if you know the lock you're working with. In my case, I couldn't find ANY information about what kind of lock might be in this thing... Stack-On didn't seem to consider it a worthy point to include in any of their product descriptions, and they're not user-changeable combinations so there was nothing in the product manuals (and they wouldn't let me take apart one of the ones at work to look).

[Oldfast]

.....Used a small woodworking clamp to hang a counter-weight for even pressure (I knew I'd find a good use for a Master padlock).....

HaaaAAAA! Ha Ha!

So, I'm really excited this is the lock you worked on! I've been wanting to have a
discussion on it for a while. I myself have encountered only ONE of these, and it
was probably 2 years ago. So we're on the same page.... we're tied at 1&1, lol.

And here you thought I was being sarcastic asking for pics from the opening of
some cheap-ass safe, LOL. But look! There's tons to be learned about this one.

My first and only experience is laughably similar to yours. The assumption of only w3
having false gates... lol... yep, that kicked me in the ass too. Or how 'bout that huge
drop?! Did your heart skip a beat too?! Ha! We now know that all we did was line
up all the wheels with gates - most if not all of which were probably false gates.

So the one I opened was a Stack-On Elite. There's a few minor differences in the
boltwork... but the wheelpack, as you can see is nearly identical to what you have.

Unfortunately I didn't take good notes on it... but I remember thinking a
lot afterwards on exactly how the whole process could be stream-lined.

In hindsight (yep, I said it.... aaagain lol) I think you'll agree there's no need to graph.
And, although I too used a setup for consistent handle pull... I think you'll also agree
there's no need for that either. The fluctuations we're looking for are so drastic that
manual turning of the handle is sufficient. Your dial indicator (or my laser) are both
going to light up those gates like a fuckin' Christmas tree. Eliminating these two
things immediately shaves tons of time off the opening already.

I agree with Femurat & Jaakko. I really think it's the best approach for these;
Locating the gates for all three wheels, then using them to dial for the dollar.
I'd like to expand upon this. How one might actually execute it. But take it all
with a grain of salt, or maybe just as some brain-teasers to start running with.

1. Find and choose a gate (any gate) on w3. Use it for a parking place.
2. Get a gate for both 1&2 aligned with the tail piece. Big drop will occur.
3. Manually explore w3. Identify true gate or at least narrow down possibles.
4. Park 1&3. Run w2. Locate all 8 gates on it and find true center of each.
5. Park 2&3. Run w1. Locate all 8 gates on it and find true center of each.
6. With all 8 gates for all 3 wheels in hand - brute force to open

Find and choose a gate (any gate) on w3. Use it for a parking place.

Don't spend any more time on this than needed. You'll come back to explore w3 in a moment.
But not until AFTER Step 2. Then the wheels will be positioned to optimize feedback for w3.

Get a gate for both 1&2 aligned with the tail piece. Big drop will occur.

Most of these steps are pretty straight forward. But this step I think needs the most discussion.
The goal here obviously is to get all wheels positioned at a gate (true or false, doesn't matter).
A huge drop will undeniably signal when this occurs. At that point we'll have optimized the
wheelpack's layout and we'll use the setup we've found to carry out the remaining steps.

So the question is: what's the quickest way to position wheels 1&2 on gates? And I'd love
to hear some more thoughts on this! But here's what I'm thinking my approach would be:

For the sake of discussion, let's say we run wheels in incs of 2.5. Maybe we can get away
with more, I dunno. But for now it's 2.5. Also, I'm not including w3 here - but remember you
chose a gate for it in Step1. You'll constantly be parking it at that # while working wheels 1&2.

Park w1 then run w2 around every 2.5 incs. There is NO NEED to run w2 all the way around.
1/3 of the way around (maybe even only 1/4 of the way around) will suffice. If the huge drop
does not occur.... push w1 2.5 incs further and run w2 around a portion of the way again.
Continue this (pushing w1 & running w2). I really don't think this'll take very long.
Maybe 6-8 'pushes' of wheel 1 before we find what we're looking for.

Manually explore w3. Identify true gate or at least narrow down possibles.

NOW is the time to feel out w3. The tailpiece has sunk deeper into the wheel pack,
giving you the best shot you'll have to identify true from false. This can be a bit of a
crap-shoot depending on tolerances. Best case scenario, find the true gate. And at
the very least, identifying & eliminating false gates will shave time off your endgame.

As Jaakko mentioned... you might be able to feel the drag/scraping of the tailpiece
as it bottoms out on a shallow false gate. Or the lack of this feeling for a true gate.
I don't think variations in gate widths will help us decipher much with this one tho.

4. Park 1&3. Run w2. Locate all 8 gates on it and find true center of each.
5. Park 2&3. Run w1. Locate all 8 gates on it and find true center of each.

Not much talk needed here. Basically isolating wheels. You'll end up with 2 lists of 8 numbers.

With all 8 gates for all 3 wheels in hand - brute force to open

There's nowhere near as many possibles as you're thinking. Nor will it take you as long as you're imagining.
Just keep in mind the dead-zones created by the large pickup differences & be aware of wheel movement.
No unnecessary rotations and you'll plow through the possibilities at a pretty good rate.

Great thread, great discussion, and congrats on this opening! Damn that must've felt good

[madsamurai]

My first and only experience is laughably similar to yours. The assumption of only w3
having false gates... lol... yep, that kicked me in the ass too. Or how 'bout that huge
drop?! Did your heart skip a beat too?! Ha! We now know that all we did was line
up all the wheels with gates - most if not all of which were probably false gates.

lol... you have no idea how much better that makes me feel! And yeah, when that first big drop happened after so many little thousandth-inch differences, I thought sure it had just opened for me, but not so much. That was a pretty crazy bunch of emotions back-to-back, and a few choice words...

So the one I opened was a Stack-On Elite. There's a few minor differences in the
boltwork... but the wheelpack, as you can see is nearly identical to what you have.

Looks like yours has top & bottom bolts, but otherwise same. I believe this one would be the FS Series if it still had the Stack-On name on it, which only has side locking bolts.

That methodology sounds pretty solid to me.

There might actually be some usefulness in the spacing between the gates, tho... because they're spaced irregularly we might be able to figure the true gate if we know where all of the gates are and the pattern of the spaces between. I would be curious to know if Stack-on randomizes their wheels or if they only press two, one bigger one for w3 and a smaller one for 1 & 2... it wouldn't surprise me if they used the same wheels for all of these safes, as cheaply as the rest of it is made. If that's the case, the spacing pattern could give it away. I'll have to check that when I try the other one at work next week.

[Oldfast]

The patterns (if they're indeed consistent) leaking information....
Hmmm. That's a very interesting thought and a worthwhile pursuit.
Love to have a nice large test group of these right about now, eh?

[Jaakko Fagerlund]

And remember with that lock, once you have the 8 possible positions for wheel 1 and 8 positions for wheel 2, you only have 64 combos to run - because you already know the wheel 3 number (read Oldfasts good explanation of the steps above). And statistics will tell you that it opens after trying 32 combos. Reality tells you it is the last one, so start from that

[madsamurai]

Did a bit of fiddling around, and I can confirm Jaakko is right... the false gates on w3 are not as deep as the false gates on 1 & 2, so if you have 1 & 2 on gates you can definitely feel grinding on w3's false gates and free wiggle on the true gate.

Another thing I found interesting and potentially useful (kinda working this out as I write here): the pin that sets the combination for each wheel is also the pin that drives the w2 & w1. So even tho there are 23 combination holes available, all of the pins have to be on either the outside holes or the inside holes so they'll make contact. There are 12 outside holes and 11 inside holes. w3 only has 4 potential mounting angles based on the way it attaches to the spindle, so can only be one of four numbers. All of the holes are exactly the same on all three wheels relative to their true gate, which means 3 & 2 can't be in the same hole, and 2 & 1 can't be in the same hole, otherwise they'd have to be on top of each other to align the true gates.

So using the outside holes, there are 12 pin options for w3, leaving 11 for w2, which also leaves 11 for w1, so you would think you'd get 4x(12x11)x(11x11)=63,888 possible combinations...
However, the holes are evenly spaced. So a pin @ hole 1 on w3 and hole 2 on w2 would result in the same positioning as hole 2 on w3 and hole 3 on w2, etc. So rather than count potential pin positions, we have to count potential pin offsets, which is a much smaller number... actually only 11 each for w2 and w1 (it really doesn't matter where the pin on w3 is located). So there are in actuality only 4x11x11=484 total possible physical combinations (only 400 if the inside holes are used) that can be programmed into these.

So, I'm thinking once determine the true gate for w3 using your first 3 steps and Jaakko's grindy/free-wiggle technique, we should pretty easily be able to calculate the possible 11 numbers for w2 and w1 based on that relationship (could make it really quick with a simple spreadsheet). If we just measure those 11 spots on each wheel to see if they match a gate, I bet we'd be left with only 2-3 possibilities for each wheel, leaving us to brute force maybe 9 combinations if we're totally unlucky...

[MartinHewitt]

Are all locks of this type the same and the only difference is where the pins sit in the hole? Or are there different locks with different relative position of gate and holes?

[madsamurai]

Are all locks of this type the same and the only difference is where the pins sit in the hole? Or are there different locks with different relative position of gate and holes?

From the looks of it, and looking at Oldfast's picture, I'm pretty confident that the holes are consistent relative to the true gate on each wheel as they seem to be 'centered' directly around it and are exactly the same on all three wheels in my lock, even tho w3 is different from 1&2 in outer diameter and position of false gates.

[madsamurai]

Guts... just for Oldfast

Not much to it, really. Gonna try to see if I can remove the pins and recombinate... maybe thread the holes and use some small allen screws or some such. Also gave me a chance to get all the nasty-sticky china-grease off it and re-lube with some good stuff. Seriously, the grease in this thing is awful.

[MartinHewitt]

Are all locks of this type the same and the only difference is where the pins sit in the hole? Or are there different locks with different relative position of gate and holes?

From the looks of it, and looking at Oldfast's picture, I'm pretty confident that the holes are consistent relative to the true gate on each wheel as they seem to be 'centered' directly around it and are exactly the same on all three wheels in my lock, even tho w3 is different from 1&2 in outer diameter and position of false gates.

Yup, looks like.