UART uses basically 1 start bit, 8 data bits & 1 stop bit = 10 bits

The whole key took 2.1 ms to be transmitted, and the shortest peak took approximatly 0.2 ms. To find out the frequency, I start by measuring time between each shape that we suppose to be a pressed key. Good news, the open source pulseview software contains a lot of decoders including UART. So I guess it can be the most used asynchronous bus protocol: UART

Only one microcontroller on each of them.Īccording to the datasheet, main communication protocols used with this microcontroller are SPI and I☬.īut not this time, cause both of them need a clock signal, and there is no movement on any of the other wires. So let's take a look at the chips on boards. This safe is not open hardware or software, so we don't know how it works. To decode the full signal, we have to find the protocol used. We can see on the captured signal 5 repetitions of the same shape in a row, so we can assume that matches our '1' key pressed 5 times. Black is always low, yellow & red are always high (so colors are respected). Result : only green wire has changing signal. This kind of electronic safe needs a 5 digits code, so for the first cature I will just press the '1' key 5 times. We can inspect circuit tracks to find the wire mapping, but as my new logic analyser can cature 8 channels, let's just plug each wire in. As the color of wires are not always respected, let's assume that we don't trust them.

1x inside with memory & solenoid (who mechanically unlock the bolts)īetween these two boards, there are 4 wires (black, yellow, green & red).1x outside with batteries, keypad, leds & buzzer.Start by disassembling the door to take a look inside. I just bought a logic analyser, what can I do with it? I created an alternative PCB and firmware to patch this issue, available here Story The company was notified but never responded. A vulnerability allows opening electronic safes from the Sentry Safe and Master Lock company without any pin code.

Sentry safe open bolts prevent closing