Mosler Group 1R - Manipulated!

[droshi]

Not sure how interesting this particular lock is to manipulation, but I have found a method that is not only possible, but doesn't take all that much longer than a regular Group 2 manipulation. I'm probably more at a 2 hour range, but should be able to work it down to an hour if I practice more.

Here is my lock, I did mill out the top to get a good look on the inside while everything was together. This was really necessary, as the wheels are attached to the back plate, so with the back off it's not as easy to look at how things work like it would be on a S&G. You may notice the last pic I have an audio listening device, this may be helpful for some to listen taking readings, but I've found touch is more than enough.

https://imgur.com/a/caRK4

The basic idea that makes it work is a couple of factors:

1. First, the fence has a nice little bump over W3. This means that you will always feel wheel 3 first. It's a binary thing, you either don't feel anything inside the contact area, or you feel something, in which case you have found the gate on W3.
2. The main manipulation works by first going into your contact area, then just before the spring mechanism flies out (around 9.75 on my lock), you can work the ball-bearing spring loaded clicky thing (bottom on pic 2) up onto a shelf on the cam
3. If you do Step 2 correctly, you can back my lock to the 5-7 area and attempt to take a reading, often you'll hear a click and spring pressure will be gone from the main accelerator spring
4. Also, if correct, when you move outside about 5-7, it will slip off that shelf and click (basically much earlier than it would if you were going normally which would click around 10)
5. If you did not do Step 2 correctly, the spring will begin charging again and only click around the normal 10 (9.75 for me)

There you have it! You only need to take RCP, or at least from what I can tell that's about all you can take, but it's all that's needed.

I'll be doing a video series on this lock most likely at some point, but I figured a quick write up was in order. I now have several blind manipulations under my belt, such that I'm reasonably sure this works very well on my lock. I bet it would work on most locks, though I could conceive that some locks just may not allow you to balance on that ball bearing (just before the accelerator spring clicks over). Maybe if they are very new, or if someone clever happened to grease up that area. OR it just might make manipulation harder, but not impossible.

[Riyame]

My, those locks look awfully familiar

Congrats again on cracking them.

[MartinHewitt]

Thanks droshi. Of course every safe lock manipulation is interesting!I can't verify this method as I don't have such a lock. I have never seen one sold here in Europe. When I'm back in the office I have to look up in the books this lock. It is the famous lock which is used in every Hollywood safe, isn't it? All locks in movies to be opened by burglars make clicking sounds.

[Oldfast]

Very exciting stuff!

No doubt you put some serious time & effort into attacking these.
I really appreciate you sharing what you've learned about them!

I have a couple projects going at the moment - but at some point
I'll definitely have to explore what you've presented here. I'll let
you know how it goes. Or, maybe have some questions for you.

Also, what of the faceted wheels?
You made no mention of them.
Have they given you much grief?

Thanks for posting Droshi.

[Cheesehead]

Great stuff! I have a few questions:
1. Is the deviation in readings more or less than your average group 2 lock? I'm wondering if manufacturers would have gotten sloppy being confident in their design.
2. Can someone briefly describe the special spring mechanism? I can't seem to figure it out from the picture. Does the notch in the cam wheel get covered over when engaged?

-Tyler

[droshi]

Thanks everyone, will definitely make more videos.

Very exciting stuff!

No doubt you put some serious time & effort into attacking these.
I really appreciate you sharing what you've learned about them!

I have a couple projects going at the moment - but at some point
I'll definitely have to explore what you've presented here. I'll let
you know how it goes. Or, maybe have some questions for you.

Also, what of the faceted wheels?
You made no mention of them.
Have they given you much grief?

Thanks for posting Droshi.

Hi Oldfast,

Glad to hear. The faceted wheels don't matter too much in terms of getting W3, it's pretty easy to tell when you start reading that. On the other two wheels, it goes like a normal manipulation. If your wheels are staggered (flutes overlap) then you will get pretty even readings, and going by each number seems to be necessary, or finding a low spot on one wheel then spinning the other around is sometimes needed. If they line up, you'll get pretty varied readings, indicating that they are in line and you are going up and down on them. A true gate reads like you expect, even more than your standard low/high...overall I don't find them too bad on this lock to deal with.

Great stuff! I have a few questions:
1. Is the deviation in readings more or less than your average group 2 lock? I'm wondering if manufacturers would have gotten sloppy being confident in their design.
2. Can someone briefly describe the special spring mechanism? I can't seem to figure it out from the picture. Does the notch in the cam wheel get covered over when engaged?

-Tyler

I mentioned some above, and while it does require some group 2M skills, it's nothing too out of the ordinary otherwise once you get the trick done.

Spring mechanism I've tried to explain here when I first got the lock:
https://www.youtube.com/watch?v=qOWfoUjrWDI

Basically it attempts to hide the typical contact area you would read on a group 2 lock by using an accelerator spring and a 2-piece cam. The cam also has a ball bearing pressing into a milled feature, which is what you exploit to do the actual manipulation.

I've probably got some things wrong on that initial video, but as mentioned I'll try to take more videos in series to explain the lock as it pertains now more to the manipulation method. Overall though, it's one of those things where if you have a lock, it's a lot easier to play with it and follow along than if you are just thinking about it academically. For me personally, dis-assembly is the first and main key to understanding weaknesses in a design.

[MartinHewitt]

The contact you feel is with the brass cam or with the silvery part?

[droshi]

The contact you feel is with the brass cam or with the silvery part?

Contact is on the brass cam, you won't feel anything until you feel W3 (due to the extra bump in the fence it keeps the fence off of W1/2 initially always), after that you will take readings on W1/2 as "normal" to find a gate.

[Cheesehead]

The contact you feel is with the brass cam or with the silvery part?

Contact is on the brass cam, you won't feel anything until you feel W3 (due to the extra bump in the fence it keeps the fence off of W1/2 initially always), after that you will take readings on W1/2 as "normal" to find a gate.

I know this is an old post, but i thought I'd clear some things up/make it easier for people who want to learn this. I experimented with two locks, and this process really is effective and reliable.

1. Contact point is actually not on the brass part of the cam wheel, but on the wheel behind. This is because the silver part, when balanced as described, is taller than the brass bit. This can give you inconsistent readings if you're not consistent in how you balance the cam, because it is not directly connected to the spindle

2. When balancing the wheels, the cam sometimes needs a little encouragement to fall into place. Stop at 9.75 (approximately) as described, the rotate back to 6-7 and jiggle the dial in that area until the cam falls into place and releases spring pressure as described.

3. Because the cam is not directly connected to the spindle, it can have some play when reading the contact point even while balanced on the ball bearing, which means inconsistent readings. to counter this, after getting onto the balance point, I try to jiggle the dial between 4.5-5.5 to get the cam to settle into a consistent position. This maybe different on individual locks, and how well they're lubricated.

4. With one of my locks it is sometimes possible to feel the contact point at almost exactly 7, when not on the W3 gate. This is just an observation, not relevant to actually manipulating.

Hope this helps people trying to work on these locks!

-Cheesehead (Kaesekopf)