Push-Button Lock Hacking
by Clawz
This article is about messing around with the Benton brand of T2 push-button locks.
First, a quick overview.
The locks come in two main models, the DL2700 and the DL2750 - the latter has a knob, the first comes with a handle. Handles are far more common due to handicap accessibility being required in some buildings.
These are the locks with a telephone like pad over the handle/knob, with the pound sign replaced by an AL figure. They are run off a set of five "AA" batteries. These batteries are mounted on the opposite side of the door. They are protected by... one Phillips head screw. More on this later.
Codes for these doors can range from three to five digits, and assuming 10-digit combinations - this is almost three million different combos. Also, these locks are virtually unpickable. They do have a key override, but those are usually on someone's keychain.
Now for the fun part.
The only true way to hack these is to reset them and basically, take root on them! Here's how.
One screw. Remove it. Remove a battery, and hit a few buttons to eliminate any existing power. Boom. No more memory registers. Now put the battery back in and close the door back up. The system has now been reset successfully.
A word about the codes for these doors.
You select a master code first. This is used not to open the door (although it does) - but to program instead. The default Master Code after a reset is: 12345
Use this and the door will open, but it also waits for programming as well.
First, reset the Master Code. For example, I am going to use: 8888 (I like 4-digit PINs) so I hit AL 1 AL 8888 AL 8888 and then I get six beeps. Success!
Wait until the system locks back up (audible sound from engine spinning the lock) and try it. 8888 should open her right up.
Now, let's program a code for use (remember, 8888 is the master). Now, since I chose a 4-digit master, any other codes will have to be 4-digits. Don't ask me why. These locks can hold up to 15 unique user codes (three banks of five users), plus the Master Code and a Management Code. The 15th user code can be replaced with a "one-time entry" code as well - great for service maintenance, etc.
Extended functions of these locks include full unlock and relock (open during business hours, lock again after hours), disabling banks of users, and re-enabling of banks of users. Also, the time the lock stays unlocked after a good code has been entered can be changed to anywhere from 5-20 seconds.
These locks are a ton of fun, but they require you to be inside the room to reset the master password using the above method. It goes without saying that if you reset the Master Code - or any code, whoever is in charge will find out pretty damn quick.
The default Master Code (12345) cannot be used for programming - it must first be reprogrammed.
| Code | Program | Remarks |
|---|---|---|
| New Master | AL 1 AL | Mandatory. Enter 3- to 5-digit code, then AL, enter same code again and listen for 6 beeps. Allows all functions. |
| Management | AL 2 AL | Enter same number of digits as Master Code. Allows all functions except Master Code, Management Code, and Passage. |
| User 1 | AL 1 1 AL | Bank 1, User 1 |
| User 2 | AL 1 2 AL | Bank 1, User 2 |
| User 3 | AL 1 3 AL | Bank 1, User 3 |
| User 4 | AL 1 4 AL | Bank 1, User 4 |
| User 5 | AL 1 5 AL | Bank 1, User 5 |
| User 6 | AL 2 1 AL | Bank 2, User 1 |
| User 7 | AL 2 2 AL | Bank 2, User 2 |
| User 8 | AL 2 3 AL | Bank 2, User 3 |
| User 9 | AL 2 4 AL | Bank 2, User 4 |
| User 10 | AL 2 5 AL | Bank 2, User 5 |
| User 11 | AL 3 1 AL | Bank 3, User 1 |
| User 12 | AL 3 2 AL | Bank 3, User 2 |
| User 13 | AL 3 3 AL | Bank 3, User 3 |
| User 14 | AL 3 4 AL | Bank 3, User 4 |
| User 15 | AL 3 5 AL | Bank 3, User 5 |
| Service | AL 3 AL | One-time entry, replaces User 15 |
| Service | AL 4 1 AL | Re-enable Bank 1 |
| Service | AL 4 2 AL | Re-enable Bank 2 |
| Service | AL 4 3 AL | Re-enable Bank 3 |
| Service | AL 4 4 AL | Re-enable Banks 1-3 |
| Service | AL 4 5 AL | Unlock time. Enter "1" for 5 seconds, "2" for 10 seconds, "3" for 15 seconds, "4" for 20 seconds. |
| Service | AL 4 AL | Enable Passage - use Master Code only. |
| Service | AL 5 AL | Disable Passage - use Master Code only. |
| Service | AL 5 1 AL | Disable Bank 1 |
| Service | AL 5 2 AL | Disable Bank 2 |
| Service | AL 5 3 AL | Disable Bank 3 |
| Service | AL 5 5 AL | Disables Banks 1-3. Total user lockout. |
All users must be the same number of digits as the Master Code.
To disable, enter Master Code or Management Code, then program address (with no entry code), allow to relock.