Reversing the X6 Key Cutting Machine

So this lovely little machine, made in China, without any real documentation, is pack full of Key Profiles for all sorts of cars….
Cars…
Nothing else.
Except I want to cut keys for almost everything BUT cars.  Cabinets mainly.

What do we do?

Well, we contact the manufacturer to ask them to support the blanks I need.
https://www.aliexpress.com/store/2287083

This company unfortunately had no interest in doing so, but at this stage I am still in talks with them, and we will see.

So, to begin with, I pull the machine apart and find out the basics of its workings.
It seems to be based on a pair of Atmel micro-controllers, and an SD card for storage.
Ignoring everything PCB I jump straight to the SD card hoping to find something useful, and I do.

There seems to be 2 types of files.
Possibly Binary? Possibly Mnemonics, I don’t know, but this is an example.
Located SILCA/ACURA/GM15.D88

Screen Shot 2018-05-18 at 10.53.49 pm.png

But much more excitingly, there is this second type, ASCII!.
Here is an example file located X6/15-GOLFScreen Shot 2018-05-18 at 11.00.32 pm.png

Well, it would be plain ASCII if it weren’t for that Null terminator on the end, anyway, now comes to making sense of this file.

This is the key in question, or at least, very close to it.

Screen Shot 2018-05-18 at 11.01.29 pm.png

so from this, we should be able to figure out some meanings.

Let’s break it down

The First 8 doesn’t immediately make any sense, moving on.

!SB5,1,1,650,300,0,0,100

The next 9 can immediately be matched.
The first is how many cuts are needed, followed by the distance to each cut.

From SD
8,2430,2140,1850,1560,1270,980,690,400
From Key Profile
8,2400,2100,1800,1500,1200,900,600,300

Now there is no guarentee I have the same key, so this could be to do with the machines positioning, or it could be a different key, time will tell.

Next we have a block of 8 again, and I assume these are an offset for something, possibly cut depth.

100,100,100,100,100,100,100,100

Now we have something which makes sense again, this is how far on the Y axis the cut needs to be, and again, the first number is the amount to follow

From SD
4,280,220,160,100
From Key Profile
4,380,320,260,20

This time they match up perfectly, except for 100.
This could be tool size?  Again, time will tell.

And now we have another lot of unknown points.

0,0,0,0,0,0,0,0,0,0,250,1,2,3,4,0

What else can we do, but look for another key!

Again, this is a best guess.  X6/Toyota-DM
Knowing where the cuts go in the file, we can find a key which is for a toyota, with that many cuts, and this is what we find.

Screen Shot 2018-05-18 at 11.29.50 pm.png

So going through the file again.

!SB2,1,3,780,300,0,0,100

This time we found another one!  The 780 is the width of the key!
This is not the case with the Laser Cut key…

4,1600,1250,900,550,1500,1150,800,450
So, 4 Positions (on both sides)
From SD
1600, 1250, 900, 550  -  1500, 1150, 800, 450
From Profile
1600, 1250, 900, 550  -  1480, 1130, 780, 430

This time this is a bit more interesting, we have the cut distance for both sides, this time though, we have slight differences only in 1 direction.  Still not sure why.

100,100,100,100
100,100,100,100

Still not sure what that is for, but it is the same as the laser cut key, so obviously not depth.  Maybe it is motor speed, 100% ?  Keep guessing.

From SD
4,300,235,170,105
From Profile
4,300,235,170,105

Another perfect match!

,0,0,0,0,0,0,0,0,0,20,0,1,2,3,4,0;

And unfortunately still, no sense with any of this.

Let’s try a THIRD key, to try to match more up!

Chevrolet N200

Screen Shot 2018-05-18 at 11.46.38 pm.png

Again, the type of key I want, and with 9 positions on both sides…. let’s look!

!SB0,0,2,819,229,0,0,280,

Key width where we expect, but the rest is still meaningless ….

From SD
8,240,450,660,869,1080,1290,1500,1710,
From Profile
9,250,460,670,880,1090,1300,1510,1720,1930

Unusual, an extra position, otherwise a perfect match, apart from the 0.1mm offset.

100,100,100,100,100,100,100,100,

Again, 8 100’s…..  why?

From SD
4,819,760,700,640,
From Profile
4,820,760,700,640

This is what we expect again

0,0,0,0,0,0,0,0,0,0,1,2,3,4,0;

And finished with more “no idea” stuff…
Now I have the issue of not know what key matches what, so let’s just try to understand the file!

I have picked the smallest file, for the smallest number of cuts, hopefully something pretty close to what we will use!

!SB5,0,0,670,250,0,0,100,

670 key length

6,250,550,850,1150,1450,1750,

Our 6 positions, for the cuts.

100,100,100,100,100,100,

Only 6 this time, and only 6 cuts, still no idea what it means, but at least we know how many times 100 needs to be repeated!

3,300,225,150,

Theres our 3 depths!

0,0,0,0,0,0,0,0,250,1,2,3,0;

We got another one!  This is just a count of the number of depths!
Also, the 0’s, possibly, theres 3 depths. (3 x 2) + 2.  Possible?

We really need to keep going……

This one is a VIZI … no idea, let’s look!

!SB0,0,2,770,229,0,0,280,

Key width, still no idea on the rest.

7,260,509,720,1150,1500,1860,2100,

7 Positions, like we expect

100,100,100,150,150,100,150,

This is a first, we expected 7 100’s, but 3 of them are 150.  Still no idea what it means.

4,760,700,640,580,

The 4 depths like we expect

0,0,0,0,0,0,0,0,0,0,1,2,3,4,0

1,2,3,4 like we expect.
(4 x 2) + 2 Zeros like we expect.

So a summary as to where we are at.

!SB# – What does this mean, what is the number
#,# – Unknown numbers
### – Key Width
###,#,#,### – Unknown

n – Number of Positions
#*n – Distance from origin for each position
#*n – 100 ?  Does it matter?

n – Number of Depths
#*n – Depths
#*n – always 0?
#*n – always 0?

#,# – Always 0,0 ?

1,2,3,4,5,6, – If there were 6 depths, 1,2 if there were 2

# – Always 0

Then terminated by ; and a Null (00h)

Getting closer, hopefully the supplier sheds some light on this!

 

5 thoughts on “Reversing the X6 Key Cutting Machine

  1. Wow! Man, I am recovering from having two tumors and a parasitic infection in my brain and am relearning a lot of things I lost… Following your logic here was such an awesome exercise for me, you have no idea. Thank you for taking your time to make this and to publish it. It makes me so happy to be able to understand something again!!

    I want to get my ‘smithy license, open a hackerspace or security firm and do all the hacking things I dreamt of before I got sick and didn’t know why I couldn’t logic through problems like I used to… Working out these problems without jumping to an end answer is going to be such an awesome experience!! Thank you so much!

Leave a Reply

Your email address will not be published. Required fields are marked *