Sean Nicholls

The Master Lock #175 is a 4-digit brass combination lock made by the Master Lock Company.

As a device with four digits, there are 10⁴ possible combinations (0000 to 9999). Ten thousand in total. This obviously makes brute-forcing a valid combination a non-trivial task, or rather a very tedious one.

Rather than spend tens to hundreds of hours brute forcing a combination lock, I opted to crack it open and look at its innards.

The outer casing is surprisingly thin and brittle. A slim screwdriver can be hammered into the gap between the casing and the guard which protects the dials and prevents you from seeing the inner workings. You can then pry the casing off - it's brittle enough to break under some pretty minimal strain.

The end cap which you can see is removed above can itself also be taken off rather easily by wedging the screwdriver between the outer housing and the cap itself and prying it out.

On close inspection you can see that the dials are under spring tension (shown below) which pushes the dials past a keyway in the guard (shown later), unlocking the device when the correct combination is entered. Seen below in the highlighted area.

The combination key entryway can be seen on the left-hand side of the image. Part of the shackle is just barely visible. These locks come with a special key that enables you to change the combination code. Master lock have a youtube video describing the process here.

I have yet to figure out how the key actually works since there appears to be no internal mechanism which is exposed to that keyway or anything which a key could interact with. Perhaps something was lost in the dismantling process.

In the image above, you can see the lock guard (highlighted area with a round circle in the centre - which is the spring keeping the guard under tension). This holds the shackle in place while dials are under spring tension and in the "locked" configuration.

When the dials themselves are in the correct position, under spring tension (not to be confused with the spring keeping the guard under tension) they are pushed through the keyway as though the dials themselves act like a key. When in the "unlocked" position, the guard seen above is pushed upwards - against a spring pressure which is acting in the opposing direction, and needless to say, resets the lock when the combination's dials are no longer in the "unlocked" position.

Bypassing

Looking carefully at the image above, you can see four to five prongs which run alongside the combination's dials. If one were to slide a thin piece of metal - and it would have to be quite thin to get past the cap that covers the dials - perhaps a ground down windscreen wiper blade, past the dial and into the central chamber you could lever the guard upwards - in effect creating the same "unlocked" state as if you had selected the correct combination.

Alternative to sliding the tool all the way into the lock's main chamber, one could get a thin hooked piece of metal and lever it from the front instead of going all the way in.

There are videos on youtube which demonstrate similar techniques here and here.

Decoding

With the front cover removed, you can see the internal mechanism of the Master Lock #175 dials. In the image above, the highlighted areas are the disks - the "key combinators".

These are effectively equivalent to the cut lines on a key, when they are all lined up correctly, the dials can be pushed (under spring tension, as discussed earlier) so that the guard that is keeping the lock secured releases and the shackle now rotates in free space.

There are two ways to decode the lock using these disks. The most obvious is of course to pry the brass guard that is preventing you from seeing them, but in similar locks with a higher build quality this is not a viable option. It's also kind of cheating, so lets consider the trickier way.

The second way, which does not damage the lock, is much more akin to picking pin tumbler locks where you would individually manipulate the pins until they catch on the sheer line. In the case of the combination lock, your goal is to determine whether the gaps in the disks are where you believe them to be - or rather, that they are uniform across all dials (then all you need to do is rotate all dials until the correct position is achieved).

A slim piece of metal, again perhaps a ground down piece of a windscreen wiper blade or something of similar thickness and strength, could be fashioned with a small hook at a 90 degree angle. The technique here is to rotate each dial while feeling for the gaps (negative space) or solid material (positive space) in the disks so as to determine which numbers correspond to the negative space.

Alignment of all the disks in the same angle/orientation would indicate that you have the correct combination. Although, you will still need to rotate all the dials at once, one at a time, in order to figure out the actual combination due to the positioning of the key guard inside the locks housing itself.

There is a video on Youtube which describes this process, here.

Update (02 Sept 2013)

Storm Lock Picks have a great video on youtube that shows a Master Lock 175 being bypassed using one of their picks, here.

Kelly Alwood on YouTube has another great video that shows how these locks operate, including a good view of the locking mechanism, here.

The word sequence to which ternary and binary belong

Flexbot

Tog Terminal

Search & Destroy: AR Drone 2.0

Dissection of a MasterLock 175