Hacking Master Dial Combination Locks

I am by no means the first person to use this technique to hack the Master Dial Combination Lock.  That aside, hacking combo locks is fun.  Its kind of like solving a Rubik’s cube, except that I can’t solve a Rubik’s cube.  I can solve the top two planes, but I digress.

— UPDATE —

2 years later, a new improvement for finding the first number improves the following algorithm from 80 possibilities to a mere 8.  If you apply minimal force while pulling up the shackle, you should feel resistance at only one number while doing a full clockwise rotation of the dial.  The first number is this number plus 5.  An example of me demonstrating this is located at http://youtu.be/xf5DOOvSW5o

The remainder of the blog post still describes crucial information to understanding the hack.  Happy master lock unlocking!

— END UPDATE —

The rest of this page will explain step by step how to hack the Master Dial Combination Lock.

Step 1: Get a Master Dial Combination Lock.

You will need a Master Dial Combination Lock in front of you for the rest of this to make sense/work.  It is important that it is Master Lock brand, because to determine the combination  we will use modular arithmetic that relies on modular offsets that have proven to be consistent throughout the Master Lock product.  The fundamental theory will apply to most dial combination locks, such as the stopgaps and modular arithmetic, but the offsets may be different in different brands (I own many dial locks with different offsets).

A Master Dial Combination Lock

As a usual rule of thumb I like to buy a new lock and throw the combination sticker away without looking at it.  This guarantees that I will only be able to open the lock by picking it.  The first few times you do this, you will also probably want to have some paper and a pen handy.  Probably even a full sheet of paper.

Step 2: Determine the Stopgap Locations Using Manipulation.
There are three disks within the Master Lock, each corresponding to one number in the combination. In order to open the lock, the three disks must be aligned in the correct way.

The first step is to determine the stopgaps in your lock.  Pull up firmly on the lock,s shackle (The shackle is the “U”-shaped part that you pull on to open the lock).  Rotating the dial should be harder than it is without pulling on the shackle.  After a small rotation, or none at all, the dial should only be able to rotate about the width of one dial number.  For example, the dial should only rotate between the number 10 and 11.  If that were the case, you could record a stopgap being at the value 10.5.  Repeating this all around the lock should result in 10 numbers.

On my lock I got the numbers:

0, 3.5, 6.5, 10, 13.5, 16.5, 20, 23.5, 27, 30, 33.5, 36.5

So, just to recap, if the dial rotates between 23 and 24, I would record it as 23.5.  If it rotates between 19.5 and 20.5 I would record it as 20.  Out of the 12 numbers you record, 7 of them should end in .5 and 5 of them should be a whole number.  Of the whole numbers 4 should have the same ones digit, and 1 should have a unique value in the ones digit.  This is the third number in the combination.

In my lock the third number is 27.

Step 3: Find the Magic Number.

Now that you have the third number of the lock, divide it by four and find the remainder.  This is technically finding the third number modulo 4, but other tutorials refer to this as finding the magic number.  In my case 27 %4 = 3.  The magic number would then be said to be 3.  After having the magic number, enumerating all of the possible combinations of the master lock is easy.  The first number will be one of the magic number, the magic number +4, the magic number+8, and so on and so forth.

The possible 1st numbers for my lock are 3, 7, 11, 15, 19, 23, 27, 31, 35, 39.

The possible 2nd numbers for the lock fall evenly between the possible 1st numbers.

The possible 2nd numbers for my lock are 1, 5, 9, 13, 17, 21, 25, 29, 33, 37.

Step 4: Put it all together.

So in total there are a possible 64,00 combinations, 40 x 40 x 40.  By now we have reduced the total number of combinations to 100, 10 for the first number, 10 for the second number, and 1 last number.    100 possible combinations is a mere .15625 percent of the total number of combinations.

The total combinations for my lock would be every permutation of the 1st, 2nd, and 3rd numbers that we saw above.  In my case this leaves me with:

3-1-27
3-5-27
3-9-27
3-13-27
3-17-27
3-21-27
3-25-27
3-29-27
3-33-27
3-37-27
7-1-27
7-5-27
7-9-27
7-13-27
7-17-27
7-21-27
7-25-27
7-29-27
7-33-27 <– That’s my combo!
7-37-27
11-1-27
11-5-27
11-9-27
11-13-27
11-17-27
11-21-27
11-25-27
11-29-27
11-33-27
11-37-27
15-1-27
15-5-27
15-9-27
15-13-27
15-17-27
15-21-27
15-25-27
15-29-27
15-33-27
15-37-27
19-1-27
19-5-27
19-9-27
19-13-27
19-17-27
19-21-27
19-25-27
19-29-27
19-33-27
19-37-27
23-1-27
23-5-27
23-9-27
23-13-27
23-17-27
23-21-27
23-25-27
23-29-27
23-33-27
23-37-27
27-1-27
27-5-27
27-9-27
27-13-27
27-17-27
27-21-27
27-25-27
27-29-27
27-33-27
27-37-27
31-1-27
31-5-27
31-9-27
31-13-27
31-17-27
31-21-27
31-25-27
31-29-27
31-33-27
31-37-27
35-1-27
35-5-27
35-9-27
35-13-27
35-17-27
35-21-27
35-25-27
35-29-27
35-33-27
35-37-27
39-1-27
39-5-27
39-9-27
39-13-27
39-17-27
39-21-27
39-25-27
39-29-27
39-33-27
39-37-27

I got lucky, and my combination turned out to be 19th combination I tried.  Either way, even if its the 100th combination you try, that’s a lot less than 64,000.

Advertisements