Industry Advisory Board - The National Locksmith

More documents

Recommendations

Info

A Different Kind of Project Beware. Automotive locksmiths reading this article may be seen rolling around on the floor, laughing hysterically. Do not attempt to dissuade them. Those familiar with my background will know that I was recognized for my automotive lock books and courses as early as 1973, but that I had gravitated away from automotive work in 1985. It should come as no surprise, therefore, that in my work as a University Institutional Locksmith, I do very little automotive lock work, and have not kept up with much of the advances made in that field. Thus I felt woefully unprepared for a Mercury Cougar with both door key linkages disconnected and a dead remote. The driver door uses a passcode, but the owner, a staff worker I interact with regularly in my duties and rely on heavily to do my job, did not know the code. A quick travel through my memories of conversations 6 • The Institutional Locksmith & Security I had with commercial locksmiths over the years brought to mind the following information. The code is usually on a paper tag, which may be on the door hinge, in the trunk on the control box on the driver side, under the spare tire, or under the hood. If you disassemble the passcode control module the group of resistors can be decoded based on the value of the resistor. Therefore, the trunk was my first point of attack. I picked it quickly, using a small screwdriver to overcome the weakness of the tension wrench versus the strength of the return spring on the cylinder. I was disappointed to find no tag anywhere in the trunk, including on the module. Not knowing the resistor values offhand, I was reluctant to disassemble the passcode module. I used a J tool to bypass the hood linkage and open the hood, and once again, no tag. That left me with the option of disassembling the passcode module or “cracking” the code itself. The Mercury products use a five digit passcode with an additinal digit to then unlock the trunk. It contains no security shutdown (although if you tried the combinations too long, you might be able to run down the battery because the interior light comes on when a button is pressed) so continuous attempts are not a problem. There are also no penalties for an incorrect combination prior to the correct combination. A code of 35791 would open if you pressed 13559 and then began a new combination also starting with a one. Although it shows ten digits, there are only five buttons and it does not recognize the difference between a one and two, three and four, five and six, seven and eight, or 9 and zero. Many customers seem to think that pressing the left side of the button yields the left side digit and pressing the right side of the button yields the digit shown to the right, but this is not the case. The double numbers are simply for ease in remembering the code. 45678, for example, might be easier to remember than 45577 for some people, or vice versa. Therefore, we have five possibilities for a five digit long sequence. To get all the possibilities, I made a matrix similar to a Base Five master keying chart (single increment progression SPF) with 125 five digit numbers on each page of 25 pages, yielding a total of 3125 possible combinations, far fewer than it might otherwise seem.
Next, I applied more master keying logic to the situation. Just as a five pin key with more than three of the same depth of cut is undesirable, especially as the Top Master Key, I assumed a combination with more than three of the same digit was likely to be undedsirable. I put a single line through these, noting to myself that if I was wrong, I could always come back and try these combinations later. For a moment, the mathematician/cryptologist lying just below the surface of my skin contemplated trying to use higher mathematics to set up a de Bruijn sequence that would minimize the numbers necessary by mating all the possibilities and deducting those which could be created taking advantage of those combinations already created in passing by the fact that the combination string was not truly limited to five digit numbers, but also to incidental combinations created by the continuous key press sequences. For example, if we take the combinations: 15111 15113 15115 15117 15119 and try them, we could also strike off the list the following sequences: 51111 11115 11151 11511 51131 11315 13151 31511 51151 11515 15151 51171 11715 17151 71511 because they had already been tried. There are two drawbacks to this, however. The first and foremost is that in doing so, we make the order of each key press critical. One wrong key press and the entire sequence series is lost. The second is that it is a lot of unnecessary extra work, because if it hits the correct combination along the way, the lock will be activated and unlock the car, telling you to stop and note the combination. Thus, using full combinations rather than the seeming shortcut made possible by higher mathematics makes a lot more sense. With the combinations being crossed off that use four or five of the same combination digit, the number has been reduced by 85 combinations, leaving 3040 combinations to try. Because we are trying full combinations, we can begin wherever we choose and mark the ones used. I chose to start with combinations starting with a three. Halfway through the page and in the middle of a combination, the lock unlocked. It had hit the incidental combination which began with a seven. Once you know the five digit combination, finding the trunk add-on could not be easier. Simply type the five digit followed by a one. Then the same followed by a three, then a five, seven or nine until the trunk pops open. I am of little doubt that this may not have been the easiest and fastest way to get the combination, but for a master keying specialist, it was certainly a quick and effective technique, and a lot of fun. July - August 2011 • 7
Page 3: Staff Publisher Marc Goldberg Edito
Page 8: ILA PRESIDENTIAL PENNINGS “Get In
Page 11 and 12: specialist. Our goal is to get the
Page 13 and 14: Chromium Plated, and Satin Chromium
Page 15 and 16: strength and durability by recently
Page 17 and 18: Series and PIM400’s. “The WPR40
Page 19 and 20: CONTROL Regaining of an IC Core Sys
Page 21 and 22: 4. Using a dial caliper, I am measu
Page 23 and 24: • Will not clog or compromise per
Page 25 and 26: space between pieces. There will be
Page 27 and 28: 3. The “TAG” (Which can be a ke
Page 29 and 30: The E-790 offers contactless conven

Industry Advisory Board - The National Locksmith

Create successful ePaper yourself

Delete template?

Save as template?