MULTACC PCR keybox decoding

Intro

Here are some techniques for opening key compartments on MULTACC PCR lockboxes, which I've had success with on 7 of 10 lockboxes tried. Your mileage may vary! If you haven't familiarized yourself with the operation and internals of these keyboxes, please check out Will Phoneman's overview (video) and Gordon's teardown and key data specs.

The general process is to (1.) decode false gates to identify code wheel types for each of the five code wheels, (2.) use a flat bitted "key" and determine the appropriate combination using a lookup table of key bittings for a given code wheel type, and (3.) gently but firmly attempt an open.

Tooling

You'll need tools to both turn and push in the keyway, as well as something appx. 0.078" (2mm) wide to act like a key. I additionally used a long thin tool to move sliders up and down because they were sticking. The "key" I used was a bicycle spoke of 0.075" diameter cut down to 1 13/16" length, which happens to be within tolerances to act as a 66666 key. It's possible to get away with hex wrenches as turning and pushing tools, using the short end to turn the keyway then a long stiff end to push, but the spring is very strong and it hurt my hands. Instead I used vice grips coupled with a filed-down Schlage deadbolt actuator. There are some caveats, see them below.

See the cutout in the actuator? That's important! The pushing force is applied on a ridge on the side of the keyway, and without making that cutout, pressure would be put fully on the nub on the slider, possibly breaking it (which I've done :( ).

You also want enough clearance on the cutout to accommodate the slider nub with the "key" inserted.

Opening

Now onto opening! There are five different code wheel types.

1. Use false gates to identify code wheel types

1. With box vertical and sliders in full down position, turn and push the core in, holding it tightly.
2. Feel for the binding wheel. My boxes bound right-to-left.
3. Determine all false gates for that wheel and write them down.
4. Leave wheel in a false gate and move on to next binding wheel.
5. (If binding seems ambiguous, make sure you're turned the right amount, and try out different false gates on other wheels to go deeper.)
6. Translate mapped false gates into wheel types.

So for the box pictured above, my data looked like

___ ___ ___ ___ ___
 6  1/3 5/7 4/6  4 

Next we use the lookup table. Since the sliders are in their downmost position, we're looking for matches in the "bottom" category.

False gate mapping for code wheels

"Top" refers to false gates encountered when a slider is put at maximum lift, and "bottom" when a slider is at minimum lift.

	Top	Bottom
B	1	4, 6
E	2	5, 7
F	1, 3	6
G	5, 7	4
H	4	1, 3

Which gives us wheel types of

_F_ _H_ _E_ _B_ _G_
 6  1/3 5/7 4/6  4 

2. Determine combination for flat bitted "key"

Ideally we'd have one of SgrA*'s 3D-printed keys (video) to use, but it's possible to improvise; I made do with the bicycle spoke. I had a core out to test the spoke's height against the code wheels, which told me it worked as a 66666 key, but it should be possible to get a more exact height by matching against Gordon's key data specifications. Honestly, try whatever you have around, you never know. I found a segment of a drink stirrer that acts as a 22222 key.

Now we use our key bitting and the known code wheel types to arrive at the numbers we need for the combination. This is easiest using the combination lookup tool on the main page.

Key bitting for chosen number on code wheel

If the box is held upright, maximum lift is 1, minimum lift is 7, using GWeins2001's terminology on Keypicking.

	1	2	3	4	5	6	7
B	5	6	7	3	1	4	2
E	4	6	7	1	2	5	3
F	5	3	6	7	1	2	4
G	3	5	1	2	4	7	6
H	2	1	4	6	7	3	5

So our found wheel types FHEBG yield

                     | Discovered wheels |
                     |                   |
                     | F | H | E | B | G |
---------------------+---+---+---+---+---+
Key bitting    66666 | 3 | 4 | 2 | 2 | 7 |
               22222 | 6 | 1 | 5 | 7 | 4 |
---------------------+---+---+---+---+---+

3. Load key and open

1. Turn the lockbox upside down, moving all sliders to the full up position.
2. Turn the lockbox horizontal, loading in the key to the appropriate depth. Watch that it doesn't slip too far into the keyway.
3. Turn the lockbox vertically, moving all sliders to the down position and properly flush against the key substitute.
4. Dial code, if not already.
5. Use turning tools to turn and push.
6. Open! Possibly. Be firm, but if not cooperating, DON'T FORCE IT.

Here's a video I made of this whole process:

4. Dealing with failure

30% of my lockboxes have resisted opening this way. Note that there are two different kinds of sliders, with different diameters and nub lengths, which sit differently and were designed to prevent this exact kind of attack. Genuine keys had track-in-track construction to properly align the sliders regardless of the type of nub. You can see the difference between the leftmost and rightmost slider nubs here.

If you can't succeed with an improvised tool, I'd recommend trying to 3D print a key to see if your luck improves. In any case, thank you for reading!