FAQ  •  Register  •  Login
UKLockpickers.co.uk Lockpicking supplies such as Lockpicks, tools, and more! COMMANDOLOCK.COM Military grade padlock systems lockpickshop.com A source for lockpicking supplies such as lockpicks, locksmith tools, and more!

Popped my safe-cracking cherry with a Diplomat MC-350

<<

Hippo_vibrations

User avatar

Newbie

Posts: 8

Joined: Thu Jan 10, 2019 11:58 pm

Location: Finland

Post Sat Jan 12, 2019 1:31 pm

Popped my safe-cracking cherry with a Diplomat MC-350

Hello all!

I got to crack my first safe this week and wanted to share my adventure :D (Even though, as some people on another forum pointed out, the MC-350 could better be called a fire-safe or a fire-resistant locking chest than a anti-burglar safe, but it had a dial-combination for opening it and the sides were quarter-inch steel so I'm calling it a safe and promote myself to an amateur safe-cracker.)

The background is kinda classical, a friend's relative had bought an old safe and didn't put the combination in a safe place. I promised to try and crack the box since I had some familiarity with lockpicking and with the mechanics of safe locks. (Together with spending a whole hour once in a locksporting event learning how to crack S&G -type dial-safes under the tutelage of datagram. Good stuff!)

Here's a front view of the box, a Diplomat MC-350. The text in top-left is just a sticker telling that the safe has passed some security standards (of fire-resistance) of the Swedish government. The keyhole is for a pin-tumbler lock, which I didn't try to pick yet since we had the key, but it seemed quite standard. The dial is for a four-number combination.
Image

There were some markings on the dial around the last number of the combination. My wild guess is that some previous handler was trying to figure out the combination by improvising the techniques you would use for e.g. a S&G 6730 -lock, i.e. trying to find changes on how far the dial turns near the last number. TBH I have no idea.
[Image

Wiggling around with the key and dial it quicly became apparent that the box is a "direct entry safe" (a term I recently learned from Gordon) i.e. turning a key operates a fence pushing against the wheels inside the lock. As seems to be common in these types of locks, the wheel directly connected to the dial (which I call Wheel 1) was a bit larger than the other weels (which I call Wheels 2-4). This stops you from dragging the fence along the other disks by putting pressure on the key and turning the wheel, so the latter wheels are harder to analyze, but it also often gives the position of the gate in Wheel 1. (Why is there a stethoscope in this picture, you ask? The most important reason is that I was gently fucking around with my friend who was watching what I'm doing, the other is that I like the sounds the mechanism makes.)
Image

Since in this safe the fence and bolts are controlled by a key instead of a lever (as in e.g. SG6730), the feedback on how deep the fence is dropping does not come from left and right contact points of the lever's nose, but on how far the key is turning. The variation in turning is not many degrees, so it's hard to measure just by looking at the key. A nice way to "amplify" the amount the key turns is by attaching a laser to the key, shining the laser to a wall and measuring how much the beam moves. (This I again learned at LA hacklabs, either from Datagram or some other wizard of lockpicking. The details are hazy since it's a long time ago and since I was taught to always crack safes with beer.) To this end I build a little gizmo from few clamps.
Image

Now after attaching a scale to the wall we are ready to go. (This is a prototype scale I had before I found my ruler, the idea is the same, though.) A noteworthy point is that due to how the locking mechanism translates rotation of the key to the fence moving towards the wheels, the relationship between the degrees of turning and millimiters of fence movement is not linear. The same holds true with the movement of the laser on the wall and the degrees of turning of the key. Thus the measurements made should be considered relative to each other instead of some absolute scale. Not visible in this picture is a rubber band I added to apply pressure to the key, since the amount the key turned varied a bit too much for my liking depending on how strong of a torque I applied to the key.
Image

Even though I was pretty sure I knew the location of the gate on Wheel 1, I made a full set of measurements on it as well. (Also for configuration purposes.) I had noticed that the width of the gate was actually around 3.5 numbers of the dial, so it sufficed to measure every second number. In the attached picture the number of the dial is running on the left, and the second column shows the amount the key was turning. I always started the measurements by rotating the dial four times clockwise and stopping at zero to keep the wheels I was not studying in a consistent position. (I turned out to be very lucky, since in this position wheel 4 was not covering the gates of Wheels 2&3, and Wheel 3 was not covering the gate of wheel 2.) From the measurements of the first disk I was able to guess that Wheel 1 is an off-cented circle, with a false or a true gate around 63-67. Between the numbers 13-28 the fence was hitting some other wheel. (You could read this from the flat measurements or, since it was the outermost wheel, from the lack of friction in the dial from applying torque to the key.) There are also notes in the end that the width of the fly of Wheel 1 is stopping me from immediately measuring numbers 93-99 without changing the position of the other weels.
Image

At this point I decided to go with the hope that this is an old cheap safe with no fancy false gates at the wheels, assume that 65 is the real gate of Wheel 1 and start studying the second wheel. The procedure was simple, I again put the lowest two wheels (3&4) at the same position as earlier, dialed the second wheel through all the even numbers while taking measurements with the last disk at the gate, 65. I've blacked out the points where I was measuring so that it's less obvious what the second number actually is; the combination will probably be changed soon but nevertheless out of principle I will keep the combination out of public forums. :) For the same reason I covered the key shape with my pinky in the earlier picture. (I also know that some of you could deduce the combination from these censored notes as well, but those of you who can could also crack the safe in half the time I did.) Anyway, I got good measurements from the second wheel. There were two intervals both with width of roughly 10 numbers on the dial where the fence was probably hitting wheel 3 or 4, two places where the measurement was obstructed a bit by the way the fly works, and very luckily a clear 'drop' with the same width as the possible gate on wheel 1. Thus I could make and educated guess where the gate of the second Wheel was at.
Image

The measurements on the third wheel would have taken more time (keep wheel 4 at the standard position and go through all the positions with wheel 3 while taking measurements with wheels 1&2 at their gates), but I got very lucky, and found the gate within the first 10% of measurements! There was again a strong increase of turning amount in an interval the same width as the previous gates. I made an educated guess that this was the gate location and started to go through the possibilities of the last gate one by one. Again I was lucky and hit upon it very early, giving me an opened safe in less than three hours of work. :hbg: (spread over the span of three days)
Image

I was able to confirm that most of my measurements and ideas about the shape of the lock and disks had been correct, as the lock system was easily accessible behind a plastic cover.
Image


Anyway, many of you have opened much harder safes with more clever techniques, but this was the first safe I honestly cracked with no previous information on the structure of the lock or on the combination, and there's always a special feeling when you do something delicate and demanding for the first time :cool: Also, since my friend is awesome, my reward for cracking the safe was a beer named after me! (I've censored my name, again because I am silly, it's not very hard to figure out my name but I prefer that it's not immediately googleable, or that googling my name or email brings up adventures in safe-cracking :D )
Image
Last edited by Hippo_vibrations on Sat Jan 12, 2019 2:29 pm, edited 3 times in total.
<<

Riyame

Keeper of the Bests / Supreme Overlord of Small Format Interchangeable Picking Nightmares

Posts: 2164

Joined: Sun Jul 24, 2011 11:16 am

Location: Canada

Post Sat Jan 12, 2019 1:35 pm

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Whoah, please edit your post, those images are HUGE. I edited them into links instead of images for the time being.

If you go to your images page, click on the image you want, it will pop up a window. At the bottom you can select an option called "Huge Thumbnail"

Then copy the link from the Linked BBCode and paste it where you want the image. This will shrink your image a lot and allow people to click on it to see the full sized version.

Image
PhoneMan: I always knew I'd say something stupid and it would be someone's sig
macgng: i am an equal opportunity pervert
macgng: aww fuck thats goin in someone sig :-(

If life gives you melons, you might be dyslexic.
<<

L4R3L2

Active Member

Posts: 257

Joined: Sun Sep 30, 2018 9:48 pm

Location: Sutter County, CA

Post Sat Jan 12, 2019 1:53 pm

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Well, shoot! Where to begin?
Welcome.
Congratulations!
Good job!

What you are calling wheel 1 (the drive wheel) is actually wheel 4, as it represents the 4th combination number.
Very nice write-up with clear explanations. Thanks for sharing.
<<

Werewolf

Familiar Face

Posts: 234

Joined: Sat Jun 11, 2011 4:00 am

Location: Belgium

Post Sat Jan 12, 2019 2:19 pm

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Nice job!
These things are a lot of fun to play with. I've done about 5-6 of these. These were very popular here in the 80's and 90's. You can find this type with many different make and model names, but they are all basically the same.
The way i do it is slightly different than yours.
"Who are you and how did you get in here ?"
"I'm the locksmith , and i'm a locksmith"
<<

Hippo_vibrations

User avatar

Newbie

Posts: 8

Joined: Thu Jan 10, 2019 11:58 pm

Location: Finland

Post Sat Jan 12, 2019 2:30 pm

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Riyame wrote:Whoah, please edit your post, those images are HUGE. I edited them into links instead of images for the time being.

If you go to your images page, click on the image you want, it will pop up a window. At the bottom you can select an option called "Huge Thumbnail"

Then copy the link from the Linked BBCode and paste it where you want the image. This will shrink your image a lot and allow people to click on it to see the full sized version.



Oh damn, thanks for your help! I fixed them now to a more reasonable size. Also, nice cat!
<<

Hippo_vibrations

User avatar

Newbie

Posts: 8

Joined: Thu Jan 10, 2019 11:58 pm

Location: Finland

Post Sat Jan 12, 2019 2:34 pm

Re: Popped my safe-cracking cherry with a Diplomat MC-350

L4R3L2 wrote:Well, shoot! Where to begin?
Welcome.
Congratulations!
Good job!

What you are calling wheel 1 (the drive wheel) is actually wheel 4, as it represents the 4th combination number.
Very nice write-up with clear explanations. Thanks for sharing.


Thanks you.
Thank you!
Thank you!

Also cheers for the terminology improvements, I'll start using the proper numbering henceforth :)


Werewolf wrote:Nice job!
These things are a lot of fun to play with. I've done about 5-6 of these. These were very popular here in the 80's and 90's. You can find this type with many different make and model names, but they are all basically the same.
The way i do it is slightly different than yours.


Cheers! It was indeed really fun :D I have an old safe of myself with not quite identical but essentially the same lock system. Keeps the amateur burglars out for a while at least.

Are you open to share your method? I'm always interested in seeing other solutions once I've figured out one myself.
<<

L4R3L2

Active Member

Posts: 257

Joined: Sun Sep 30, 2018 9:48 pm

Location: Sutter County, CA

Post Sat Jan 12, 2019 3:08 pm

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Since the drive cam is quite a bit larger than the other wheels, and it has no false gates, it seems you could have put torsion on the key and just spun the wheel around until you felt the drop. Is that the case here?

It looks like you have 13 combinations possibilities available. Simply move the bolt in the drive wheel to another position to change the combination. Just don't close the door until you're sure what the new combo is.
<<

Hippo_vibrations

User avatar

Newbie

Posts: 8

Joined: Thu Jan 10, 2019 11:58 pm

Location: Finland

Post Sun Jan 13, 2019 2:01 am

Re: Popped my safe-cracking cherry with a Diplomat MC-350

L4R3L2 wrote:Since the drive cam is quite a bit larger than the other wheels, and it has no false gates, it seems you could have put torsion on the key and just spun the wheel around until you felt the drop. Is that the case here?


Pretty much yeah, besides the one area between 13-28 you could easily feel the friction on the drive cam, and the drop of the gate was really obvious.

L4R3L2 wrote:It looks like you have 13 combinations possibilities available. Simply move the bolt in the drive wheel to another position to change the combination. Just don't close the door until you're sure what the new combo is.


I haven't yet opened the wheelstack, but I'm hoping/guessing that the position of the fly can be altered in any of the four wheels, giving 13^4 different combinations (much less than 100^4 you might market the safe for or the 50^4 you deduce from the width of the gates.) I'll update if I get the chance to take apart the stack! :)
<<

Werewolf

Familiar Face

Posts: 234

Joined: Sat Jun 11, 2011 4:00 am

Location: Belgium

Post Sun Jan 13, 2019 11:28 am

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Hippo_vibrations wrote:I haven't yet opened the wheelstack, but I'm hoping/guessing that the position of the fly can be altered in any of the four wheels, giving 13^4 different combinations (much less than 100^4 you might market the safe for or the 50^4 you deduce from the width of the gates.) I'll update if I get the chance to take apart the stack! :)


No , the driven wheel is the only one that is adjustable. All the others just have a fixed peg, or in cheaper versions a raised lip.
You can switch the middle wheels around, or turn them around to change the combo.
"Who are you and how did you get in here ?"
"I'm the locksmith , and i'm a locksmith"
<<

cracksman

Newbie

Posts: 3

Joined: Mon Nov 27, 2017 6:25 pm

Post Sun Jan 13, 2019 7:54 pm

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Congrats...a straight Tailpiece is a great place to start...atb...Dave
<<

Hippo_vibrations

User avatar

Newbie

Posts: 8

Joined: Thu Jan 10, 2019 11:58 pm

Location: Finland

Post Mon Jan 14, 2019 9:42 am

Re: Popped my safe-cracking cherry with a Diplomat MC-350

L4R3L2 wrote:Since the drive cam is quite a bit larger than the other wheels, and it has no false gates, it seems you could have put torsion on the key and just spun the wheel around until you felt the drop. Is that the case here?

It looks like you have 13 combinations possibilities available. Simply move the bolt in the drive wheel to another position to change the combination. Just don't close the door until you're sure what the new combo is.


Werewolf wrote:
Hippo_vibrations wrote:I haven't yet opened the wheelstack, but I'm hoping/guessing that the position of the fly can be altered in any of the four wheels, giving 13^4 different combinations (much less than 100^4 you might market the safe for or the 50^4 you deduce from the width of the gates.) I'll update if I get the chance to take apart the stack! :)


No , the driven wheel is the only one that is adjustable. All the others just have a fixed peg, or in cheaper versions a raised lip.
You can switch the middle wheels around, or turn them around to change the combo.


I stand corrected, L4R3L2 and Werewolf! I went to look at the wheels again and you are indeed correct, just fixed pegs. I guess the first three wheels can then be put in any order (3*2*1 = 6 possibilities) each with either of two orientations (2*2*2 = 8 possibilities) which, together with the 13 positions of the fly on the outermost wheel give a whopping 6*8*13 = 624 different combinations that can be achieved without new disks :S Admittedly 624 is more than just one combination, but it does compromise the security quite a bit since anyone left alone with the safe open can take a picture in 10 seconds and write down later on all the 624 combinations.

cracksman wrote:Congrats...a straight Tailpiece is a great place to start...atb...Dave


Thanks! Is tailpiece same as the fence here?
<<

MartinHewitt

User avatar

Prolific Poster

Posts: 1823

Joined: Sat Nov 26, 2016 12:19 pm

Location: Germany

Post Mon Jan 14, 2019 10:45 am

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Be assured that a fire is not good at trying 624 possible combinations to get the safe open.

PS: Yes, a "straight tail piece" means the fence in this type of lock.
In case you wonder ... Martin Hewitt is a fictional detective in stories by Arthur Morrison:
Martin Hewitt, Investigator Chronicles of Martin Hewitt
<<

Hippo_vibrations

User avatar

Newbie

Posts: 8

Joined: Thu Jan 10, 2019 11:58 pm

Location: Finland

Post Tue Jan 15, 2019 2:40 am

Re: Popped my safe-cracking cherry with a Diplomat MC-350

MartinHewitt wrote:Be assured that a fire is not good at trying 624 possible combinations to get the safe open.

PS: Yes, a "straight tail piece" means the fence in this type of lock.


Fair enough :D I guess I really need internalize the fact that this fire-box is not designed to keep people out.
<<

Werewolf

Familiar Face

Posts: 234

Joined: Sat Jun 11, 2011 4:00 am

Location: Belgium

Post Tue Jan 15, 2019 5:35 am

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Hippo_vibrations wrote:Are you open to share your method? I'm always interested in seeing other solutions once I've figured out one myself.


Not on an open board that is indexed by Google.
PM sent
"Who are you and how did you get in here ?"
"I'm the locksmith , and i'm a locksmith"
<<

Jaakko Fagerlund

Active Member

Posts: 383

Joined: Mon Jan 06, 2014 9:55 am

Location: Finland

Post Wed Jan 16, 2019 9:28 am

Re: Popped my safe-cracking cherry with a Diplomat MC-350

Congrats Hippo_vibratios and if your location is correct, terveppä terve ;) You can send me a PM if you like a chat.

Those Diplomat safes are quite typical to find in residential houses here, plus all the knock-off variants of it. The Diplomat is nice in that you can get the key made for it just from the number on the lock itself and the combination mechanism can be examined for a minute to give you a list of all the possible numbers for each wheel, thus making the opening quite easy.

Werewolf, mind sending me the same PM, I'm always curious to see if there is some new ideas :)
Next

Return to Safes, Strongboxes & Combination Locks

Who is online

Users browsing this forum: No registered users

Don't forget to visit our sponsors for all of your lockpicking needs!
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Grop
"CA Black" theme designed by stsoftware