Explanation of cracking a combo lock in 8 attempts or less!

[@ericbaier6176]

The indentation on the first dial that you use for the 1st number attack IS useful in the lock. When you pull up the shackle to open during a correct combination, it scrambles the wheel pack to keep the shackle locked the next time it's pushed closed. But great a video.

[@penfold7800]

Good spot. most people seem to miss that. On some locks of this type its when the shackle is pushed back down to lock it that the shackle retaining plate knocks the wheels to scramble them. I noticed when I first pulled one of these apart and I asked myself why that retaining plate was shaped that way and not just a spring clip. ...more worryingly in this video... If you look through to where the locking bolt is, on the front plate behind the dial, there seems to be some access holes. So you could easilly yank the dial off using a sharp flat-head screwdriver and then push the locking pall back through that hole with the same screwdriver. Those holes arent there on other versions of this type of lock so I have no idea why Masterlock included them here. Maybe it was a manufacturing shortcut. Masterlock keep doing these stupid things. They do a good job of making a lock physically strong, and then leave in or include a vulnerability. Back in the days of lock development, weak points or Drill Points were left in or included on purpose so that Locksmiths or Police could get past a lock if needed. That I believe was originally a legal requirement. But that was many years ago before portable drills with carbide diamond tipped drill bits and Portable grinders with cutting discs were readilly available (or invented). Theres absolutely no need for that kind of requirement nowadays. Its about time Masterlock beat the markets overpricing and made locks without added weak points.

[@kebers]

I did it! I am so proud of myself. I watched your video and re-watched many sections to make sure I followed your instructions exactly. I watched some other videos before yours. They were close, but not as exact as your method. I wasn’t able to figure out the second number till I watched your video. Thank you! I’m so happy. 😊

[@samykamkar]

Awesome job!! I’m proud of you too.

[@Nite0wl]

The 'metal bar' you point out around 3:11 is a return spring to force the latch to snap back to the closed position when the shackle is opened and closed. The 'Anti-Shim' modification Master made is the addition of deep serrations on the upper surface of the latch (the portion facing the opening of the hole that the toe of the shackle enters in the body.

[@samykamkar]

Nite 0wl Ohh, very cool! I'll note your comment in the annotations with attribution to you -- thanks Nite-diggity!

[@penfold7800]

I honestly didnt know that. I was glad to see that the two floating disks were metal and not plastic, so kudos to Masterlock for that, but WHY did they leave access holes behind the dial that arent present in other versions of this type of lock. Easy vulnerability to just lever off the dial and push the locking pall back.

[@billypilgrim3000]

Pedagogical genius! How brilliant and simple, actually to take apart the lock and show exactly how and why the "find the resistances" methods work. There are several videos showing how to do this but you'rs is the only one that goes inside the lock. True, there are shorter ways to calculate the math, as some have commented, you could streamline that, but this is really impressive. You're a great teacher.

[@samykamkar]

Thank you! Yeah, definitely could have simplified the math and effort!

[@erics8302]

Thanks......I got my lock open and had a lot of fun learning why it opened. When I can see how something works I can understand it but when I see a video or read something I have no idea. This was one of the best videos I have ever seen. Incredibly entertaining. Thanks again.

[@mishhmoshh92]

I got my lock open! I cant believe I was able to get it open. Your video and webpage is the only one that found my combo. Thanks for putting it all together. Keep up the good work!

[@samykamkar]

Great job! How did it feel to open it? :)

[@btpcmsag]

I took one apart long ago and found the combo that way, but I did not observe all the things your video shows. Thank you for a very easy to understand exposition of the works! I knew boys who could pick combo locks in the 1960's but they couldn't explain the reasons their method worked.

[@samykamkar]

+btpcmsag Thanks!

[@chanclaverde]

Used the tutorial and calculator 9 years ago to crack a lock I had forgotten the combo to. Found the same lock again and wanted to use it again but forgot the combo again 😂. Cracked it once more. I swear this dude's an alien from another galaxy!

[@judgeomega]

at 12:00 you try to measure distance. Would have been much simpler to just turn the dial until the gap is lined up. Then note the the difference of the reading on the dial.

[@samykamkar]

I'm a newb

[@groeszs]

Lol.... I think the joke "How many engineers does it take to change a light bulb" is apt here... :)

[@ObeyCamp]

judgeomega I was thinking the same thing. It seems so obvious when looking at the internals, right? Why complicate it with measurements and finding the circumference when you have a cutaway lock specifically for finding these vulnerabilities? The distance between the "indentation," or rather the protuberance, and the groove in the wheel is never going to change or even vary from lock to lock.

[@nicko3512]

While the exploit he found is pretty smart, I think he was trying to seem *extra* smart by doing the unnecessary calculation, but in reality it backfired

[@samykamkar]

+Vranvs don't worry, I'm not that smart

[@Robertlavigne1]

It is known that the second number is generally, approximately half a rotation from the first digit (from Carl Blacks book on combo locks). While this is not a set rule, I believe sorting the list of 8 options by distance from the first digit (farthest first) will enable you to open in fewer tries on average.

[@ahmedtwakkal841]

Thank you very much Samy!!! Your crack worked for me and I like the fact that you used math and computer programming to come up with the crack. I have been occasionally trying to open my Master lock for the last 6 months using the feel method described in many other videos and have had no success. I was able to open my lock using your method within 10 minutes. AWESOME!!! :^)

[@samykamkar]

+Ahmed Twakkal Sweet!!

[@tiger12506]

If you feel like your high school dropout is showing too much @14:39, then you can use a somewhat lesser known technique called various things in different fields where you always write the measurements for all quantities and the measurements should cancel out to get you what you want. For example, you wanted digits, so if you had written 8.64 mm * (1.5 mm / digit) you would have gotten mm^2/digit, which doesn't make sense, so you would instead write 8.64mm * (digit/1.5mm), the mm cancel and you get digits out. The other key to understanding how this work is you can multiply any number by 1/1, since any number * 1 is itself. Since 1.5mm = 1 digit, you are essentially multiplying by 1/1.

[@agxphoto]

This is the explanation I've been looking for. I applaud your approach, your observations, your demonstrations and constructions. Bravo!

[@samykamkar]

Thanks!

[@CandiceJoergan]

Thank you for telling me where the dial is on this lock. I never would have figured it out without you.

[@samykamkar]

I'm so happy to help.

[@AquaTeenHungerForce_4_Life]

This video should be shown to any kid who says, "I'll never need to know this type of math." Lol, sure. They might not "need" to know how to do this, but how many wouldn't "want" to know. :) Awesome video!!

[@samykamkar]

+mark johnson Thanks!

[@bulldozer8950]

Why do you think they make math boring? They can’t have the less behaved kids running around using what they learned in 8th grade math to get into the boiler room at school and shut off all the heating for the building.

[@ChrisDunn]

Samy, That "extra" bump on the first digit tumbler actually does serve a purpose. You stated in the video it was not needed. The shackle retainer clip is built the way it is with that little bent step to kick against that bump on the tumbler to spin it slightly once the shackle is opened. This provides the "relocking" of the lock so the shackle locks the next time is inserted. Without that feature the lock could be left in the unlocked position unless the dial was spun every time to scramble the tumblers. Excellent catch by the way on figuring out the resistance bump against the relocker. Long ago I had an offset table, that if you gave me an open lock, I could look in the shackle hole and see the tumbler notches and from there tell you the combination. Master locks are fun. :)

[@cigmorfil4101]

Chris Dunn not quite right - it's as the shackle is extracted that the third disc (1st number) is perterbed so that when closed (hence the spring on the latch) it is not unlocked. However it less than scrambles the discs - it moves the last disc slightly. If you open your lock and do not turn it (at least 3 complete revolutions) at some stage before leaving it, it is very easy to open - 1) note the unchanged 3rd number 2) turn dial gently to left until you feel (hear) the lug on the 3rd disc engage with the lug on the 2nd disc - note the 2nd digit of the combination. 3) keep turning to the left until you feel (hear) the lug on the 2nd disc engage with the lug on the 1st disc; add 5 to get the 1st number. 4) to unlock continue turning left until 1 less than number of engagement in step 3 (= 6 less than 3rd number) 5) turn right past that number to 2 less than 2nd number 6) turn left to final number. Alternatively: 1) note 3rd number 2) turn right until you feel the lugs between discs 3 and 2 engage - subtract 2 from number to get 2nd digit 3) keep turning right until you feel the lugs between discs 1 and 2 engage; move one number further on - you have the 1st number 4) to unlock continue as normal to turn left for 2nd and then right for 3rd digits.

[@jodywhelchel5134]

://kzbin.info/www/bejne/rWm0gqWeiJ6HhZo Sure what’s

[@OlPurpleBeard]

Samy- for as many presentations you've given, you don't seem super confident on the spot. You deserve to be, you're doing an excellent job.

[@nadacommie6235]

I like your videos, i have been a lock collector for a long time but haven't had the time to enjoy and explain the fascination i have for them. i wish i had a better education with math, your explanations make perfect sense to me but i seem to intuitively feel the logic and understand it but cant put it into words and document it the way you do. keep up the good work!

[@samykamkar]

+David Clark Thank you!

[@Texas-it9ci]

BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! BOO!!!!!!!!!! NOT WORK AT ALL AFTER A MILLION TRIES SO THIS VIDEO MUST BE HOAX!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[@andrewlisenby]

...and, subscribed. I started reading up on your exploits after I found your DEFCON lecture on PHP's LCG weakness and NAT pinning. Amazing! Looking forward to any new networking related exploits.

[@samykamkar]

+Andrew Lisenby Awesome!

[@edwardvarby4363]

I've a few locks I've done this on, but one is almost exact same lock, except I think the dial is 0.25 of a digit off. That really threw me off, & the combo label fell off. Had to go through it a few times, but it was so satisfying when I uncovered the lost secret! One thing i've played with is trying to speed up dialing by just bumping the 2nd number & redialing the 3rd, & eliminating combos where dialing the 3rd messes up the 2nd. That's one reason I liked this video. Great to see how it all works inside. Anyway, great job!

[@Raincountry]

Really liked your explanation and seeing the inner workings shed a lot of light. Reclaimed 2 old locks this weekend. Cheers!

[@samykamkar]

Nice job!

[@talhatariqyuluqatdis]

We need MORE VIDEOS from you. Come onn, it isnt as hard as the work youre doing. Get it going!

[@kaitachi08]

Kudos for the excellent explanation throughout the video!! You really did a great job there with how you worked out this method of cracking open these types of Master locks, and thoroughly pointing out most details and how observations led to clever ideas. Keep up the great work!!

[@WalterShore]

In your video, you say that you don't know what that "indentation" on the third disk is for. The indentation that you feel the resistance on to find the third digit. I believe that is to bump the combination off of the correct setting when the lock pops open. The plate on the bottom of the shackle when it pops open turns the third wheel so if you just push the shackle back closed it is no longer in the correct alignment to re-open. Nice video. Thanks for your efforts.

[@WalterShore]

So I count my disks with 1 being the one close to the dial, and 3 being the one at the back of the lock.

[@lancelot1953]

Nice explanation Samy, thank you for showing the community the inner works and the logic behind Master-type lock. Amazing looking at the cheap way the third wheel is made to save money! Ciao, L

[@tgy119]

Thank you for this video. I watched a bunch on KZbin and this was the only one able to crack my gym lock. Haven't been to the gym due to covid lockdown so I forgot my combination.

[@lorinwells1466]

This method works really well! I had to try several different #s for the second combination because I couldn't tell if the first number was 10, 11, or 13. Finally clicked open!!

[@stratman1234]

Thanks for the video. I bought a new Master lock today and noticed that the feel of the knob turning was more like a scaping feel. I guess that's what happens when you buy a new lock for $3.23. I was having a difficult time getting the first number. I suppose that might be due to sloppy tolerances on Master's part. After I entered the first number, the rest of the numbers all fell into place and I successfully opened the lock. Great video.

[@samykamkar]

Nice!

[@jg-bordfronco2925]

For the first time in my life, i finally understand why Math is so important =) Great video Samy!

[@andrewford80]

I wish I had paid more attention at school

[@jacka602]

Samy! You have been my hero ever since I heard about your MySpace virus. Please make a guide or tutorial teaching us the basics of coding and what softwares to use etc. :)

[@jacka602]

Jack Atherton Also a hack on how to improve internet speed, would be *AMAZING*.

[@samykamkar]

Jack Atherton Thanks Jack! Okay, I will add these to the list of videos! I have a few upcoming that I need to get out first...stay tuned

[@jimlocke9320]

I have a number of earlier vintage locks and I believe that the "collar" does not contact the "protrusion" when the lock is closed. Master Lock may have made some dimension changes which introduced the vulnerability. In any case, it would be difficult to tell the difference between that resistance and the resistance of the "lever" contacting the notched third wheel. With an open lock, you can leave the shackle outside the latching hole and turn the dial left multiple times with the shackle at held loosely at different heights. The "latch" will stay clear of the third wheel during this test, so the only resistance is that noted by Samy. At certain heights, the "collar" will contact the "protrusion" and actually lift the shackle. Using this method, you can determine the minimum height where the "protrusion" contacts the "lever". Then close the lock and see if the shackle will lift high enough before the "latch" is pushed against the third wheel. Note that this method will always allow someone to use Samy's method to find the combination for a lock that has been left around open, so never leave an open Master Lock unattended. A thief can determine the first number this way, then come back later and use Samy's method to open your locked padlock when no one is watching.

[@samykamkar]

+Jim Locke Interesting! I was able to feel the protrusion in all Master combo locks I've tested, including several brand new ones and several older ones, with one being at least 10 years old (the newer ones were easier to feel for the protrusion, however the old ones had it), however I doubt I have any as old as some of yours!

[@nish3258]

Hi there, I realize 2 years have gone by. I found this video as part of a master lock search. I too have experienced the inability to feel the relock tab hitting the bump on the 1st number wheel. In fact, with the shackle unlocked and spinning the dial as suggested, I found the following. I found that the shackle needs to come out about 1/16" beyond the interference point between the lever fence and the 3rd wheel false gates. I tried 6 old locks that are 20 plus years old. I could feel the relock rub on just 1 of the locks. I too wonder if the vunerability (the relocker hit on the 1st number wheel as the shackle is pulled up) is only detectable on newer master locks?

[@meerabakshi2676]

Though I am not yet been able to open up my master lock, I enjoyed the math you applied, my son at 4-5 years of age, was also very inquistive about how something works from inside, and your opening up the lock to look from inside reminded me of those days! :-D Very confusing to feel the frist number clicking...it will take time but I will keep trying! Thanks.

[@PhillHermans]

I tried this method on a lock with unknown combo and was unsuccessful. I also tried it on one with a known combo and the method also didn't work. It seemed to me that the 1st and 2nd positions were locked on both, and I can't consistently find a "resistant location". However, I notice using your calculator that the First digit is always Resistant location + 5, regardless of the 1st and 2nd positions. Using my known combo I can calculate the Resistant Location to try and get a feel for it. To me it actually seems like the smoothest part of the rotation, the other spots I can feel the bumps of the locked positions. These locks are over a decade old, so I don't think they are a new design. But I do feel a bit of "play" with the knob itself, I can apply pressure up or down and I think it will contact differently with the shackle. Not sure what's going on, but you actually cut the thing open so I am confident this mechanism is solvable! Thanks for the video!

[@samykamkar]

Getting the feel for the resistant location is tough (it's about how much you lift the shackle and is a very specific amount), however once you do find it, it's like riding a bike and you can always find it very easily the next time and across different locks. If it's rotating smoothly at that location (minus about 5.5), then lift the shackle slightly higher -- if it gets locked instead of just resistance, then release shackle a little, and keep repeating those two steps. Good luck!

[@PhillHermans]

​@@samykamkar Thanks for the response. I ended up cracking it via the old method: locating the 3rd number of the combo via the 12 "sticky points", and then working through the table of 100 combos. I picked ones that "felt" right (I vaguely recall there being only even numbers, this was my lock 20+ years ago) so that didn't take me but 30 tries Now that I know the combo, I started hacking your calculator to get it to spit out what I want. The values that I should have entered with your method are: 4, 7, 7 I was already pretty confident in the first 2 locked positions (4, 7) after following your instructions. But I was no where close to ever thinking that 7 was the resistant location. Not only because 7 was already one of the inputs, but the lock really likes to stick around the 0 position, so I think that was really throwing me off. Needless to say the thrill when it finally opens is worth the effort. I watched many videos of this variety and I was suspicious that I was being trolled until I watched yours! Your video (and response :-) gave me the confidence to keep trying! Thanks for sharing your knowledge!

[@GIJew]

Another fine example of what happens when companies cut corners to save a little bit of money.

[@isaacchen6630]

Xbox disc reader...

[@djscurge]

Yeah you'd think, but there was likely several meetings to discuss if the cost/value ratio of that corner. They asked the question "Would the amount of money we would save in manufacturing be greater than the potential impact to sales if the vulnerability were made public?" The answer was obviously "Yes"... Master Lock probably even hired an actuary (That's what you can do with a math degree kids. $100K/year avg. google it.) or two to figure that ratio out. The depiction in Fight Club of the car manufacturers assessing whether to do a recall or not isn't too far from the truth of nearly all industry, on all levels (not just the safety critical industries). I too had no idea how convoluted the whole corporate mechanism becomes, all in the pursuit of one thing: profit margin.

[@Rulerofwax24]

Thanks for this video, it really helped. Though, the calculator wasn't working out for me, so I ended up following this video by hand. The error came from the resistance location. On my lock it was pretty much 4.5-5.5, so 5. Based on the math from this video, 5 + 5.76 = 10.76, round to 11 [my real first digit]. However, your calculator says the first digit is 10, which throws off all the rest of the calculations. Putting in 5.5 gives an accurate combo set, but putting in the more real-world accurate 5 messes it up. In any case, I'm glad I had this video to follow along with. This lock has been sitting on my desk (well, around it really) for 4 years.

[@variablestar90]

Dear Samy, I tried to apply this method ito two different locks and it didn't work out. I turned out that the problem was with the third numer. It is not always the same modulo 4 as the first number. After watching how this locks work, I tried just to find the number with the widest gap or the smoothest gap of all locked numbers and then it worked out :) Thirst and second numbers were consistent with your method, so if you modify your calculator it would apply to wider range of such locks. Tested on two locks from different producer. Love your videos! Cheers

[@justinwatson1510]

You are genuinely brilliant and I appreciate you sharing your knowledge this way. Thank you.

[@TusharThakur]

You are father of genius. Hats off

[@bradstronger4438]

The indentation on the back of the rear dial is not "useless." The interaction of the shackle collar and that bump scrambles the dials when you open the lock. It's the reason you can't just close and open the lock again. Also the metal "bar" at the top is a spring, it's not an anti-shim device. Try assembling the lock without it and see how it feels mushy when you pull on the shackle.

[@btpcmsag]

+Brad Stronger -- I was going to tell a friend that little button on the back of the 1st number dial is only there to save Master some money. Now I'm glad I read your comment. Whoever settled on this design probably thought that leaving the button there (making the first 2 dials the same) could serve as the method of scrambling the combo automatically, and it's convenient that can be done using two identical dials. They perhaps never thought about the picking vulnerability.

[@samykamkar]

+Tobia C. Interesting!

[@cigmorfil4101]

The one i have doesn't have a single bump when trying to find the first digit - it has 3 roughly evenly spaced across 8 digits, none of which is 5 from the correct first digit. It does however have the same 2nd and 3rd discs that his lock has (which are both the same - I hope there are other discs which can be put there): subtract 14 from the first digit and I (and he) get our second digit. It also has a key override in case combo lost. The combo can be converted into a left-handed version by subtracting 6 from the first number, add 2 to the second and leave the third alone.

[@rfn944]

Really nice video. You're a genius. One little correction. While there are indentations, what you are pointing to are protrusions. Sorry, it's my OCD at work.

[@RolandOuellette]

The outer shell steel is pretty bendy. You can undo the crimp with a pair of diagonal cutters in a minute. Very little noise & no flying metal shards.

[@DarcyWhyte]

For the first digit, why not move the dial to point of resistance (as you did), and then in the next step move the dial to the first digit in while eyeballing the disk. Now you know the difference between the point of resistance and the first digit (in dial numbers).

[@DellAnderson]

Just wanted to say, you saved one of my newer forgotten-combo locks from the rubbish bin. However, my confidence was short-lived as I was tried it on a second Master lock (purchased c. 2010) on which I wasted half a day trying to open it! Fortunately, remembered where the combo was written down and sure enough, the last two digits were among those listed on your website, but the first number was completely off. So perhaps Master made some earlier versions with a major different 'resistance' point to gap distance. Even now, knowing how it works, I'm not sure how to explain the discrepancy because I even had someone else try to find the resistance point and came up with the same numbers I did. So apparently the 5-6 digit difference between the protrusion resistance ('indentation' in your video) and the lever gap is not always uniform in all locks. This lock is definitely a Master, but feels slightly better made than the cheaper version that I easily opened, but maybe that is just my imagination after struggling with it for several hours (nothing compared to what you put into making this video without which I never would have opened the first lock however, so thank you!)

[@davemarm]

Great video! One question: Why did you do the calculations with diameter, circumference, etc in order to get the # of digits offset from the resistance digit (for the 1st number of the combination)? It seems like you could have just manually turned the dial to read off the value on the front and determined visually that the difference is 5.5 digits between resistance and where the notch lines up. That would remove some of the rounding and measuring errors inherent in the caliper.

[@WilliamWHaywood]

Love your tutorials. Those round bumps on the wheels are protuberances, not indentations. Reminds me of some of the technology inside a safe door. Wonder why they do not make them harder to open?

[@palewriter1856]

Perhaps the term you were looking for was OUTdentation? Ha ha ha (thanks for calling this one for me... leaving me wound up to say something that had already been said... so I HAD to make up something else... or just waste my breath....)

[@samykamkar]

Haha, thank you both!

[@palewriter1856]

I know this video didn't offer or imply anything resembling a warranty, but I came looking precisely because of these two locks I happened to have lying around the garage for lots of years now - totally useless to me because I can't even remember their sources, much less their combo's! Sadly, NONE of the tricks I find on YT are any help: one doesn't EVEN have the usual snags when tugging and twisting; the other has them entirely symetrically - lacking the necessary oddball. Pretty frusterpating! (Obviously, given the low cost of buying a new one, this ain't earth-shattering, but surely maddening that I can't seem to break either one!) Totally aside, and as useless for you as it was for me: one time when I was a kid I had one of unknown combo - took it to bed one night, after all was REAL QUIET, and held it to my ear as I turned. Actually opened it by ear, but in the dark I still had NO IDEA what the combo was! Oh well....

[@DaveGamesVT]

Interesting video. Hopefully this will lead to them improving their design.

[@guyflynn8216]

5:30 wait a second the little sticky out bits that catch each other are at set distances from the notch cut into the disc that lets the lock open meaning that if you figured out the point when the two discs meet (it would be quite easy if you were feeling for it) you can count a certain amount of numbers over and find out the numbers and what order they are in!

[@adriansue8955]

Assumption: The attack is based on the assumption, that the 'vulnerability dimple' on the rear wheel is at a fixed location relative to the gap. How do you know this is always true? Seems that the dimple exists because the 1st and 2nd digit wheels are machined from the same stock... but if 2nd digit wheels vary its location to allow different number settings, then the 1st digit wheel potentially will as well; which would invalidate the assumption. Perhaps you could cut open a large sampling of locks to verify consistency of the 'vulnerability dimple' ?

[@tedalper1464]

the 8.64 mm is the length of the CHORD, not the arclength. admittedly, for a small turn, the distinction is pretty slight.

[@fryloc359]

You can also pop the dial off and use a thin wire like a paperclip to line up the discs and pop it open that way. However, due to the springs holding the discs, you can't just press it back on.

[@DaveJacoby]

I always wondered how combo locks work. Thanks.

[@flyrcm]

Cracked one lock after watching your video ! 👍👏

[@nikushim6665]

From what i remember that spring loaded latch was also a major vulnerability, unless they fixed it. Master lock wise you used to be able to just tap the shackle with a blunt object wile lightly pulling on it to retract the locking paw.

[@H0RRAX]

I realy like what you are doing and your way of thinking. Keep up the good work!

[@orgigami]

Storage lockers everywhere just shuddered.

[@Joelych]

My lock is before 1998, I couldn’t unlock it using your method. I opened it with a thin metal not the combination. When I looked down, the opening is at 36/37, 6/7, 1/2. The resistance is at 24. Perhaps there is another formula for old lock? I am trying get the combination back and use it again.

[@mariustancredi2192]

Does that last knob has anything to do with auto-locking mechanism? By auto-locking I mean the mechanism that prevent the lock from opening again when you closed the lock but didn't turn the dial. Master Lock should make different plates to the knob isn't predictable.

[@TDG2654]

If the plates are all the same, wouldn't you be able to determine the other numbers of the code if you knew one? Because the distance between the numbers is then always the same?

[@StevenHongMN]

You stated that the second number cannot be close to the 3rd number by 1 position away in either direction. Would it stand to reason that the first number could not be close to the second number for the same reason? I would think that you could eliminate one of the numbers based on closeness to the 1st number.

[@ivegas1000]

I'd be damn. After watching quite a few KZbin videos on my MasterLock 1813M that I forgot combo for a long time and was not able to use. Was getting quite disappointed with all of them because they were cumbersome and confusing. Then picked this video by Sammy because he had 300,000+ views and I said "why not?" Follow exactly his instructions and on second tries got my combo back!!! Bravo, Sammy and thanks much for your help. Now I am subscribing, who knows what other hacks he can give me.

[@pfsmith007]

Damn Samy, you're smart. I really enjoyed watching you work. Thanks for posting the video.

[@samykamkar]

Thanks!

[@1danleung]

I have to say that only certain Master Locks will follow this mathematical model, maybe locks form the same batch. I have a Master Lock with resistance point at 15 and the 1st digit is 22, offset by 7, not 5.5, maybe the disc size is different. And my 3rd digit is 25, MOD(22,4) is not equal to MOD(25,4) as in your case. And my 2nd digit is 3 which will not work with the formula MOD(3,4)+2 equals to MOD(22,4) or MOD(25,4) as you said. But the basic design and mechanic of the lock is still the same.

[@frankyboy4409]

The metal splate is just a spring. The Anti-shim is the two groves on the latch (because that catches the shim and prevents it from pushing the latch away)

[@dougholtz]

I just got back from Sydney, AU. Had tried picking an old master combo for some time before going. Saw a Master combo near Mrs MacQuarie's "chair" overlooking the harbor. Wished I had success on the lock here before encountering one ever so far away from the US. Still can't open this old thing here.

[@ianbot]

Wow I swear it actually worked I was so excited when the lock popped open I did not believe it would work at first but it really does i subbed

[@NicholasAarons]

Another Fantastic Video Dude. Keep up the great work. Nick.

[@lilblkspider]

I managed to remove a lock using your method am amazed at how this worked.

[@NelsonClark]

This works perfect on the regular Master dial lock, but with the smaller master dial locks, the third digit is not good (I needed to add 4 to the last digit to get it to work). Is this because of smaller wheels inside, I have no idea because I did not cut it open to compare.

[@kevincozens6837]

It would take only a small modification to the shackle collar by the manufacturer to avoid that rubbing that gives away the first number. The number of possible combinations would go up by a factor of 40. It would still be a manageable number for the Combo Breaker but take a little longer to crack the combination.

[@olivialambert4124]

With measuring the distance then the circumference etc I can't see the advantages of that way vs simply looking at the number you felt resistance at then placing the dial in the open location and comparing the two numbers. Anyway, interesting view and it certainly shows why making the cheapest possible lock has some serious flaws. Additionally I am surprised even the cheap locks are quite so basic on the inside, I really thought they would be made so much better. It really doesn't seem hardened to a simple hammer strike downwards making it utterly worthless.

[@martinherald6492]

+Olivia Lambert I agree, I don't know why this and other comments like this one are unanswered. However... his over engineered method of measuring everything is a formula that will work in more complex situations.

[@thomapple]

+Olivia Lambert Totally agree, I was wondering the same thing.

[@ZBostOneR]

+Olivia Lambert cuz it gonna give you 5.5 but if you get the resistance on a whole number (like 8, not 8.5) 5.5 doesn't give you a exact number (8+5.5=13.5 so u don't know if 1st digit is 13 or 14) with the other way u know the exact digit diference (5.76) and u know that u need to round to 6 if u have a whole number and 5.5 if u get a X.5 number...

[@skylerguerette8791]

You're hot and smart. Not bad. It funny to think that 90% of the population has no clue what this guy is taking about.

[@olivialambert4124]

skyler guerette Well then 90% of the population needs to stop and think. This video isn't exactly hard to understand. Quantum physics sure, but measuring a few indents on a disk really isn't.

[@rleng168]

This is amazing! I would be extremely interested on how you determined a modular relationship between the digits. Was this information you got off of 1 lock? Any relationship with the difference between the circumference of the larger and smaller wheel? or did you brute force it with a data bases of known locks combinations? or is this information you have about how Master does their randomization during the manufacture process? So I guess my questions are: Why % ? Why %4 ? Why %4=2 ? Thanks Samy, stay awesome. -r

[@saizai]

id=10t The mod trick has been known for a long time. Simple reason: the indents that couple the lock wheels together are a fixed distance away from the grooves that allow the lever in. That distance happens to be 18°, i.e. 2 digits on the dial.

[@thomastempelmann]

Sai Does that mean that they could modify their production process to place them at other distances, thereby breaking this long-known rule, or do the technical (mechanical) requirements enforce this rule, so that they cannot be modified by the manufacturer?

[@saizai]

Thomas Tempelmann I'm not 100% sure, but I believe that they could indeed mostly randomize the distances - at least enough to make it better than %4. It'd be more expensive to produce, though.

[@LouisEmery]

15:33 If you already have the lock opened up you can determine the number offset empirically: just turn the knob till the notch position is seen to match up with the lever stop. I read some of the comments, which now I realize pointed out the same.

[@DracoSilverscar]

Wouldn't it be possible to narrow it to 6 numbers? Since the pins are always in the same locations wouldn't the same thing apply for the first tumbler in relation to the second as the third?

[@MrHatoi]

My school has these exact same locks in the locker room. Can't wait to try this!

[@MrHatoi]

As a joke, of course. I'm not actually going to steal anything.

[@RocTaylor5]

MrHatoi Morgan freeman voice: "and on that day.. he stole everything"

[@michaelchaney175]

Note the collar that holds the shackle in place also acts as a "scrambler" to make sure the lock can't be opened again after pushing it shut. That might be the reason that they use a disk with an extra bump on the first ring.

[@samykamkar]

***** Oh, very interesting!

[@jakemcmillian]

What determines the combination from one lock to another? I thought it would be determined by the way the dials are stamped, but the first and second number dials look identical. It also doesn't seem to be determined by how the dials as assembled. Could you possibly change the combination on your cut open lock? It looks like Master could fix theses vulnerabilities by adding a second line to manufacture 1st digit discs (without tabs on the back) and retool the grooves to match the width of the channel.

[@mendymerkur2982]

Very Nicely explained

[@timewave02012]

I wish I had known the first number trick 15 years ago. I also vaguely recall the third number giving me trouble with some locks. Maybe it was slight dial misalignment? Eventually I figured something out and would always get it right, but I might not have been able to describe how I knew then, and I definitely can't now.

[@chase_like_the_bank]

Shouldn't your 8.64 number be closer to 8.95? Because you measure the distance linearly, and then compare it to the circumference. To convert the linear 8.64 to the arc length, do 19.34*sin^-1 (8.64/19.34)=8.95 Idk this shouldn't actually effect anything but I'm curious if you overlooked the fact that you can't compare linear distance to arc distance, or am I just being dumb? Great video either way

[@sideflip7]

chasenallimcam he could actually simpli have turned the thing till the pin end up where he merured for other edge and substract both numbers values

[@jasonstahl1327]

Alex Arsenault Desjardins Exactly, he resorted to convoluted math when he could have just observed the dial and got a more accurate number. The technique is awesome though

[@bhayes409]

chasenallimcam Can't you just use the dial and the internals to get the number? Turn the dial to see where it lines up with the release and compare it to the digit where there's resistance.

[@deday6525]

he rounded up to 9 anyway.

[@obliviontrooper]

You don't need to do the circumference math - just rotate the dial from the front, and note the reading when it's lined up, find difference to 8.5.

[@FlowersForYou629]

too bad Masterlock will see this video and change the design. Thanks for the video. You actually know what your doing in your videos.

[@rickpaulos]

Masterlock did change the design when they started making these locks in China. Those are even easier to pick like this demo lock.

[@ArgusBrown]

Instead of calculating the distance along the circumference per digit could you have just spun the dial until the gap is in the correct position and just read the number off the dial. (or am I missing something?) Interesting video. Now I wish I hadn't thrown that old master lock away.

[@rosemarymcfarland6005]

Nice theoretical attack but I feel this would be better applied to safes. Master locks are too easy to manipulate open (not shimming). (1) Feel the click and add five (2) go left until it wont turn (3) go right pulling shackle. This is a good attack for someone who has no tactile sense or experience however.

[@ObeyCamp]

That thin strip of metal that you said might be stopping a shim is interesting. On the latching mechanism that holds the short, locking end of shackle inside of the lock's body when it's locked closed, you'll see a groove where the latching mechanism meets the shackle. That's the main shim-preventing feature. If you were to insert the shim into your cutaway lock you'd see the shim get trapped by that small groove on the shackle latch before it can travel far enough into the mechanism to separate the latching mechanism from the indent in the shackle. With a little manipulation you would still be able to shim the lock if not for that thin strip of metal. From what I'm seeing in the video, it appears to me that the thin strip of metal helps the shim-prevention technology work even better. Again, inserting a shim into the cutaway lock would illustrate it better than my words can, but upon pushing a shim into the shackle hole, the shim would first hit the thin strip of metal and that strip would rotate the body of the latching mechanism to the right (from our rear perspective) pushing the latching mechanism farther into the shackle. At that point any simple shim is guaranteed to be trapped by the groove that's cut into the shackle latching mechanism, preventing the shim from continuing on to separate the latch from the shackle.

[@ObeyCamp]

As I continue watching I'm noticing that you may even be able to shim the lock despite these protections, but you'd need a strong shim that will retain its original shape without folding or breaking, but with a little bit of flexibility to it. Try this with your cutaway lock. It looks like if you apply an upward force to the shackle before you insert the shim, you may just be able to negotiate the shim between the shackle and the groove cut into the latching mechanism meant to trap a shim. It may require several attempts and some blind luck, but I think it might be at least possible...

[@samykamkar]

Interesting! I've tried using strong shims on these with no luck (not an aluminum soda can but rather stronger, dedicated shims), but perhaps with a thinner yet strong shim it can be done. I will try playing around with it further.

[@rubixman7x7]

Wouldn't the little bulging things also mean that the second number can't be within the 2 closest numbers from the first number?

[@terryrankhorn8189]

I tried to mimic the technique and had an interesting outcome. I am absolutely certain that my "resistance point" is between 6 and 6.5, yet my first number is 29. According to this model, the resistance point should have been between 23.5 and 24. My lock serial number was 922XXX. I tried this with another lock, serial number 211XXX and it worked flawlessly. I wonder if this is just an anomaly that only works on a few serial number ranges. Regardless, the technique for finding the third number worked on both locks, so I wonder if it is just an issue of finding the first number on later locks.

[@YashKumar-it5fr]

We don't have these locks in india but it is amazing to see this

[@erics8302]

At about 5:40 you talk about indentations but I think a better word would be protrusions. A really informative video. I love your videos. Thank you.

[@samykamkar]

Good call! Thanks!

[@johnking5811]

I have a question. When you said 2nd number is the module of 4 plus 2. Is it always 2 or is it the remainder that you add to the module of 4?

[@bridekiller17]

This is really fascinating. I am curious about the code. Do you publish your source anywhere?

[@bridekiller17]

+bridekiller17 Nevermind. I see you did it with JS, and a simple inspect element worked.

[@Freeak6]

At 6:18, when you close the lock, isn't the combination wheels supposed to scramble ? If I remember correctly, when you open a master lock and close it, if you try to pull the shackle right after, it doesn't open anymore, even if you didn't move the dial. I think there is a scrambling mechanism when locking. My guess was that maybe the shackle caller wasn't really in place, otherwise, it would push the indentation of the last wheel. Anyway, nice video :D

[@wiredrat1]

Why that "modulus 4" limitation? It's some mechanical constraint? Although the indentation vulnerability is pretty awesome, I think the major flaw comes from that. In a constraint free lock, having combinations of 3 numbers chosen from 40, it has 64000 (40^3) differents combinations. However, with the "modulus 4" constraint it only has 10 combinations for 3rd disc and 8 for disc 2, giving a total of 3200 possibles combinations.

[@Basssssseeeeeeee]

Yeah, this is my main question too! Whats the reason for this modulo 4 correlation? Is this due to some manufacturing decision? Could it have been avoided?

[@TrackedHiker]

+Basse Baba it's because the 3rd combo disc has those little bumps on it-they are a "disguise" so you can't tell when the disc's slot is passing under the spring. They happen to be 4 numbers apart, but they didn't have to make them evenly distributed.

[@abcjme]

It also relates to why you get the 12 locking numbers (8 you track and 4 you ignore): 12 x 3 = 36, +4 for the gap (the +-2 buffer between the 2nd and 3rd numbers), and there you have your 40 digit combo lock.

[@darkdancerman]

Please upload videos on hacking more things. You are very good at it, and informative.

[@micker1407]

Is there a simplified written formula somewhere that's has the normal math needed and you just input your locking positions and resistance numbers? I'm looking to find an easy way to do this without the use of the calculator and I didn't didn't completely understand how you did it in the video.

[@samykamkar]

+Micker I have basic Javascript code that does it here: samy.pl/master/master.html

[@obliviontrooper]

In fact, the info leakage should be enough to directly crack the combination - once you have the point of resistance, you have the location of the opening on the first disc. If you rotate the first disc enough, it will pull the second and third into tow. Now you know the location of all the openings (assuming you've kept track of how far you rotated the first disc) because the openings are at a fixed angle to the indentations. Then, it's just a question of rotate and leave your discs in the correct spots.

[@Gryphon018]

Brilliant analysis! I very much enjoyed this video!

[@samykamkar]

+Austen S Thanks!

[@miro-hristov]

Why go trough the trouble of finding circumference and all that? You could just turn the dial and find out how many numbers it takes to move it by the desired distance... Edit: Also, the last indentation does provide value to the lock. It's so that when open the shackle it spins the last drum to a random number. That way if you lock it back immediately it won't remain on the unlock position.

[@samykamkar]

I could have simplified that portion! Ah, so the bump is required...which makes it harder for them to remove the vuln unfortunately.

[@nexus1g]

I think the anti-shimmy tech is the ridges in the latch. It would prevent anything rigid enough to push the latch back from getting in between the shackle and the latch by catching it.

[@x9x9x9x9x9]

Hey sammy a few years back I made... I mean some I know made the arduino that could open hotel doors with Onity locks. -I- They just dragged and dropped Cody Brocious's code to the arduino to do this. I was curious how that actually worked I tried reading the paper on it but it was a little over my head at the time. A video would be awesome on this since now the problem has been fixed but its still a cool mystery.

[@Ki-Lessons]

Your videos are wonderful. (I do want to note, what you call and 'indentation' perhaps would be more descriptive if called a 'nipple'. It is the difference between an innie and an outtie.)

[@samykamkar]

+Reichart Von Wolfsheild Thanks, and good point!

[@G_Cs]

@Reichart Von Wolfsheild: Oh thank you! I was looking to see if anyone else pointed out this word glitch. Now that Sammy knows, I will not have to cringe for his future videos. Every time he said indentation, I got distracted from the content. And to you Sammy, great video; you did get there after all.