japaneseport.blogg.se - Change code on digital sentry safe

#CHANGE CODE ON DIGITAL SENTRY SAFE PATCH#
#CHANGE CODE ON DIGITAL SENTRY SAFE FULL#
#CHANGE CODE ON DIGITAL SENTRY SAFE SOFTWARE#

Some safes are equipped with a mechanical safe lock where you need to turn a dial to enter your code.

Changing the Combination on a Mechanical Safe Lock However, depending on whether you have a mechanical or electronic lock will determine the route you’ll need to take to get the job done. It is possible to change the combination on your safe lock.

The combination is difficult to remember or is no longer meaningful to you.

You have fired an employee, or one has quit that has the combination to your safe.

You’re getting divorced and no longer want your spouse to have access to your firearms.

You’re concerned that someone, like one of your children, has discovered your combination.

This could be because of one or more reasons like: Now we have all the information needed to automate this process with a short Arduino function.There might be a time when you want to change the combination on your safe lock. We can see that checksum corresponds to command byte added to each code byte.

finaly, the last byte changes depending on the code, it seems to be a custom checksum.

then 5 digits of the pressed code are sent.

after that, fixed value 0x71 is sent, it seems to be a command byte (0x71 = try an unlock).

after wake up, signal always sends 0x0 byte.

signal always begins by a wake up shape with 2.7 ms low state, then 0.25ms high (not part of UART protocol).

So we try to set this frequency in our decoder.Īfter some tries with different codes, here is some observations about different signal parts: UART frequency must match 9600 subdivision, 4762 is very close to 4800 wich match 9600/2, a common speed for UART. (1000 ms / 2.1 ms) * 10 = number of bits that can be transmitted in a second ~= 4762 UART uses basically 1 start bit, 8 data bits & 1 stop bit = 10 bits The whole key took 2.1 ms to be transmitted, and the shortest peak took approximatly 0.2 ms. To find out the frequency, I start by measuring time between each shape that we suppose to be a pressed key.

#CHANGE CODE ON DIGITAL SENTRY SAFE SOFTWARE#

Good news, the open source pulseview software contains a lot of decoders including UART. So I guess it can be the most used asynchronous bus protocol: UART Only one microcontroller on each of them.Īccording to the datasheet, main communication protocols used with this microcontroller are SPI and I☬.īut not this time, cause both of them need a clock signal, and there is no movement on any of the other wires.

So let's take a look at the chips on boards. This safe is not open hardware or software, so we don't know how it works.

#CHANGE CODE ON DIGITAL SENTRY SAFE FULL#

To decode the full signal, we have to find the protocol used. We can see on the captured signal 5 repetitions of the same shape in a row, so we can assume that matches our "1" key pressed 5 times.

Black is always low, yellow & red are always high (so colors are respected). Result : only green wire has changing signal. This kind of electronic safe needs a 5 digits code, so for the first cature I will just press the "1" key 5 times. We can inspect circuit tracks to find the wire mapping, but as my new logic analyser can cature 8 channels, let's just plug each wire in. As the color of wires are not always respected, let's assume that we don't trust them.

1x inside with memory & solenoid (who mechanically unlock the bolts)īetween these two boards, there are 4 wires (black, yellow, green & red).

1x outside with batteries, keypad, leds & buzzer.

Start by disassembling the door to take a look inside. I just bought a logic analyser, what can I do with it?

#CHANGE CODE ON DIGITAL SENTRY SAFE PATCH#

I created an alternative PCB and firmware to patch this issue, available here Story The company was notified but never responded. A vulnerability allows opening electronic safes from the Sentry Safe and Master Lock company without any pin code.