This war-dialing safe-cracker opens combination safes

Arduino and a stepper motor

Yep: https://www.youtube.com/watch?v=WnL8IEs-UqU

It took about 1.5 days for the home-made dialier in this video to find the combination. The software is optimized with a model of the lock’s internals. The dialer doesn’t need to repeatedly dial the three-number combination from the beginning. It just figures out the minimal amount of dial manipulation needed to get the three internal wheels aligned to the next combination, which most of the time is just bumping the third wheel one value higher.

Step 0. LLLL (reset lock)
Step 1. L (stop on 1st number)
(at this point, the first internal wheel is set to the 1st number)
Step 2. R (past 2nd number)
Step 3. R (past 2nd number again)
Step 4. R (stop at 2nd number)
(now the second internal wheel is set to the 2nd number)
Step 5. L (past 3rd number)
Step 6. L (stop at 3rd number)
(and the third internal wheel is set to the 3rd number–will the lock open?)
Step 7. R (if the dial stalls, the lock is open.)

Repeat Steps 6 and 7 with consecutively higher 3rd numbers until it’s time to move either the 2nd or 1st wheels, but then move the dial back only an amount sufficient to get the 2nd and/or 1st internal wheels aligned as needed. On this lock, dialing more distant 3rd numbers bumped the 2nd wheel, and that required resetting the 2nd wheel, too, slowing progress a bit.

The clockwise/counterclockwise dial oscillation that you see in the original video is the dialer trying a 3rd number and then trying to open the lock, checking if the dial stalls. Then dialing back to the 3rd number + 1 and trying to open the lock again.

The microswitch in this home-made mechanism helps detect when the dial stops turning and stepper motor just skips, meaning that the combination has been found.

11 Likes