Recently, I had the chance to visit Dollywood and experience their unique collection of roller coasters, including the Gerstlauer custom Eurofighter known as Mystery Mine. This is one ride at the park where I really had no idea what to expect, as I had heard pretty mixed things about it, but I was intrigued with the unique layout and great theming surrounding the ride going in, as well as being my first Gerstlauer I would experience. I'm going to go over the pros and cons in this video and discuss the many things that make this ride so unique and whether it's worth your time or not when you visit Dollywood. Mystery Mine opened in 2007 and was a huge investment for Dollywood at the time, who was just beginning to really build up and become the great destination theme park we know at Ask Today. Having just opened the stellar Thunderhead three years prior, the Gerstlauer Eurofighter would bring something totally unique to the United States for the time, featuring many crazy elements and quick transitions along a fairly short circuit that is basically half dark ride, half roller coaster. Mystery Mine reaches a max height of 85 feet, a top speed of 43 miles per hour, has a track length of 1,804 feet and two inversions. Now, before I get into what the ride offers, you may want to skip ahead a bit, as there are some surprises on this ride during the indoor portions that you may not want spoiled. As you depart the station in the two rows of four Gerstlauer Eurofighter cars, you will begin the ride by going down a small but quick drop, then go through a couple turns in complete darkness with some theming such as small lights and sound effects which are great. The first portion of the ride before the first lift hill makes up a significant part of the dark ride portion of this coaster. Once you get to the first lift hill, one of two vertical lift hills on this ride, you will see light pouring in from the top, which has an open roof, and you quickly ascend the lift through the roof followed by two very small dips bringing you outside for the first time. You then hit a quick block break and very abruptly dive down a small vertical drop into a sideways 90 degree banking turn to the left where you slow down a bit, then twist up to the right in a half helix and hit another block section followed by a descending helix to the left, then a small airtime hill providing a small pop of floater airtime, and then a quick turn to the right bringing you back into complete darkness. Here you will move forward a bit, then stop briefly as you can only see the bottom part of the second vertical lift hill, which is illuminated by flashing lights, and there is a very dark and ominous soundtrack playing, and then you begin the rise. This lift is the tallest point on the ride, and as you are looking straight up a screen on the ceiling plays a clip of objects falling towards you, when at the top you will stop for a few brief seconds, then see and feel some great flame effects before you are absolutely thrown down a large 95 degree drop. This drop again is just so snappy, and it will take you back outside for an awesome finale. You very quickly roll into an ascending heartline roll to the left, then you are hanging for a second upside down before you traverse the dive loop. Following the dive loop you hit the final breaks, ending the very long two minute ride on Mystery Mine. To just get the negative stuff about this ride out of the way, we need to first talk about these over the shoulder restraints. They are hard, and you will experience some headbanging. This is a common criticism I've heard with this ride, and it is not unfounded. Personally, this did not ruin the ride for me at all. I found it to be pretty bearable and not an overwhelming headbanging, but it is definitely there and it is noticeable. The worst section of the ride in regards to the headbanging is the first outdoor portion of the coaster after you send the first lift till. I remember the very fast paced finale with the two inversions being much better. The pacing of the ride is somewhat awkward, but that is definitely intentional, and I think it does work for the ride, seeing as basically half of the experience is a dark ride, but even the first outdoor section has the strange little small dips coming out of the building, which just take you to a drop break, and then you are abruptly flung down a vertical drop. Like, what the heck? I think that these out of nowhere bursts of speed are something that helped to make this ride so unique and fun, though. The biggest issue of all for me personally, though, was the capacity. This ride was just horrendous when it came to the throughput of people. These cars only hold eight people, and while the station was set up to load two cars at once, they were only loading one at a time during my visits. And the lines for this ride got so long. Due to this issue, I suggest getting right to this ride when the park opens so you don't have to wait in a huge line. As much as I enjoy this ride, it is not worth a really long wait. On my first ride, I waited about 55 minutes. The second time I rode it, however, was right at opening and I managed to get in line before many others jumped in line and only waited for about 20 minutes, versus the at least 40 minute wait that quickly built up behind us. As for the positives, this ride is just really fun in my opinion. I got two rides on this, and I had an absolute blast both times. Part of the fun for me was the reactions of my mom, niece, and nephew who were all riding with me the first time. I knew about some of the elements, such as the vertical lifts, but I didn't share this with them, so it was pretty awesome seeing their reactions when we were sitting there right in front of that first vertical lift for a few seconds, especially my mom. It was priceless. There were effects that really surprised me, too, though, such as the flames and screen on the second lift, and that was awesome. I found the track itself to be very smooth, too. I was pleasantly surprised by how smooth it ran, especially since it navigates some really sharp sudden changes in speed and direction throughout the course, and the ride is also 13 years old as well. Mystery Mind had a couple moments of pretty good positive Gs, too. The big 95 degree drop is very intense, especially being taken with such quick acceleration. The two inversions immediately following are also fantastic and full of great intensity as you whip through the heartline roll and get suspended upside down for a couple seconds before diving down into the brakes. The finale on Mystery Mind is probably one of my favorite finales I've experienced on any coaster. It's almost like the ride just saves all of its intensity for the end, and it is just thrown at you, then just like that, the ride is done. It's very quick and effective, and certainly left an impression for me, which is a huge plus in my opinion when it comes to this ride. One final thing I really want to make sure I cover is the effort put into the theming. The whole building that the ride is built in and around just looks stunning as you are approaching it coming from Thunderhead and as you walk underneath it. Standing in the queue line, there are sculpted rocks everywhere, and as you go up the stairs and approach the station, there are these cool signs and pieces of mining equipment laying around, and it really makes you feel like you're taking an off-the-rails adventure into an abandoned mine. And of course, the theming elements featured on the ride during the indoor portions is just a very nice touch that keeps you immersed in the experience the whole way through. I don't think this ride would have left quite the impression on me like it has were it not for all of these small elements added to the experience. As a standalone coaster, the layout doesn't really have a lot to offer. This is one case where the theming truly makes the ride experience a blast. All in all, I ended up walking away from my rides on Mystery Mind being very pleased with what was offered, and I would have loved to gotten a couple more rides if the lines were shorter. I don't think it is one of Dollywood's most elite coasters, but it is an absolute blast, has incredible theming and dark ride elements, and those things really help to set this ride apart. My final score for Mystery Mind is going to be a 7 out of 10. It really is a fantastic supporting coaster that would be great for many parks. I believe Dollywood really knocked it out of the park in terms of the theming elements and turning this fairly small coaster into a very exciting experience. Have you ridden Mystery Mind? What are your thoughts on it? Be sure to let me know, and also like this video if you found my review to be helpful. And check out many other coaster reviews and a playlist on my channel. Subscribe for more roller coaster and amusement park content like this at least twice a week, and like my page CoasterDaddy on Facebook, and follow me at CoasterDaddyOfficial on Instagram. Thank you all so much for watching. This is CoasterDaddy. Bye.


Hello, everyone. Thank you very much for coming to this talk. We're going to attempt to crack this safe in the next 45 minutes. We could have made the safe cracker faster, but then how would we get a 45 minute time slot? So we're going to do the best we can.  As you can see, it's kind of a big setup, but we're going to go through the technical aspects of how we built it. I am Nathan. This is Joel and that's Rob. So a little background. If you may or may not know a company called Sparkfun Electronics. So about 15 years ago in 2002, I started Sparkfun Electronics in a little room. Hopefully you can see it. This was student housing. There was like 15 of us in this house.  And here we are today. Pretty advanced website. We have about 2,000 products that we sell. About 500 of those are open source hardware. So today, what Sparkfun does is we design little development boards and technology and then we build projects using that technology to demonstrate it and inspire other folks. So this is an example of a LiDAR with an Arduino shield and a couple of segment displays. And you can see if you have distance. No slides. I'm going to do an interpretive dance for all the slides. So I don't know if you can hear that noise, but I still have nightmares with that noise. We've been working on this a lot. But I'll wave my hands. So what the robot is doing, as you can see, if you can see, there's a dial on the front and there's a servo pulling on the handle. So while we set up here, we attached the robot using magnets. So the idea is that there's no glue, there's no drilling, there's nothing to make it so that you would, if we did it right, we got slides. I don't know if we're going to have this video feed up, but hopefully they'll work on that. In the meantime, I'm going to scream through this thing. So I'm Nathan, that's Joel, that's Rob. This is what SparkFun looked like 15 years ago, student housing, 15 people in this house. This is what our website looks like. Cool. This is, we build technology. This is a LiDAR with a couple of segment displays and you have distance out to about 40 feet, right? And so if you take multiple measurements per second, then you can turn that into speed. So this is a speed trap. You run at the wall and see how fast you can get that number up to. And in the lower right hand corner, you can see the hand print. We're lucky no one's cracked the drywall yet. This is another thing I built a speedbag detector so you hit the speedbag and vibrations from the platform using an accelerometer. You can count the number of speedbag hits. That helped me train for an amateur boxing match. I am undefeated one in zero amateur boxer. Beehive we hacked. So we took a bathroom scale, hacked it, attached it to Wi-Fi and you can see the weight of the beehive change over time. It's actually sawtooth because every morning five pounds of bees leave the hive and they come back during the day and then they leave again. Kind of interesting. Power wheels. My wife and I, this is my beautiful wife, like to hack things. So we hacked the power wheels up to about 48 volts.  It's an autonomous power wheels that does about 18 miles an hour. This is all to say I am a hardware geek. I don't know software. My wife had to explain this cartoon to me. I'm sorry. Then she asked me for a sandwich. Okay. You're all here today to figure out how to make these look like this. Now the story behind this thing is, I'm really into puzzles and my wife found a safe on Craigslist for $20. It was so cheap because the owner of that safe did not have the combination. They had lost it. You can hire a locksmith to open it up for you, but the owner was just like, forget it. I'm just going to kick it to Craigslist. My wife bought it, gave it to me for Christmas and I said, hey, we got to build a robot to open this thing up. And we're doing this, okay, we're doing good. All right.  The dumbest thing I've done in my life is demo Defcon. So we opened this safe in 41 minutes. Okay. Now this safe is really cool, but I'm going to give you a little animation about how safe combination locks work. A little background. There we go. Okay. There is three discs. The A disc, the B disc and the C disc. Lovely. All right. So the C disc is that blue one that's got the notches in it. The green disc is disc B, disc A. Now the first thing you need to know is that disc C is directly attached to the dial. So when you twist that dial, you're only turning disc C. Now after a while disc C has these dots on it. And those dots will interfere with the dots on disc B. And so that's how you turn disc B. Continuing to turn, you turn disc A.  Now if we go back, do, do, do. Now it's going to be important later on. Starting in the top left-hand corner, this thing runs on an Arduino. It's not a Raspberry Pi. It's not some heavy lifting single board computer. It's just an 8-bit microcontroller, which means we can make this thing portable. Next up we've got three magnets that help it stick to the safe. Power supply. That is just an AT power supply, common 12 volts, 5 volts. You find it really often with external hard drives. Really cheap. It provides us a couple amps on the 12 volt and 5 volt rails. Next is the erector set. That's from a company called Actobotics. That makes it really handy so that we can reconfigure the robot as we need it. For instance, if you have the dial in different place or the handle in different place, you can rejigger it real quickly to make those two things fit. The motor has 8400 ticks. What that means is it's a DC motor that spins really fast. But on the back end of it, it's got an encoder. And so it's a magnet that passes a Hall Effect Sensor. That motor turns at, I don't know, 10,000 RPM. On the front of that there's a gear head that gears it down to a single rotation. So 8400 turns of the magnet equal one rotation of the head. So we take a 100 digit dial and we split it into 8400 individual segments. Okay? So that's the motor. Next we have a servo with feedback. So that's the servo that pulls on the handle and tells us when the handle is pulled down. And let's see. Next step of building this thing is we had to 3D model the safe. From that, we were able to print a 3D print a coupler. So that coupler fits onto the dial really nicely and tightly. You can see the little flag sticking off of it. We use that in a photo gate. So there's a photo gate attached to the Arduino that looks for that flag and sees when it breaks the beam. When it breaks the beam, it knows that it is, well, it knows the flag is there. And then it asks the human, hey, what number am I at? The human types in 62 and says, ah, okay, I know where 62 is. It can immediately go to zero. So it's a way that we kind of calibrate and home the dial. This is what the handle puller looks like. So we have a spring that pulls the handle back up. We have a servo with this cool nautilus gear. That allows us to maintain constant torque while we're pulling on the handle. And then we have some very fancy string that you can get from anywhere that attach the handle to the servo head. And again, we've got analog feedback on that servo. The way that you do that is you take any off the shelf servo, you open it up and there's a potentiometer in there. You solder to the center point of that potentiometer and you can see, you get an analog voltage that is in relation to where the head is. So now we can say, okay, the head is at 45 degrees or it's at 90 degrees. And from that we can tell when the handle is open. This is what the electronics look like. Top left corner, motor driver. It's a 15 amp motor driver because this motor pulls a couple of amps so it's overrated but that's good because we don't want it to get hot. Underneath we've got an Arduino, right? It's just a red board. That's the board that Sparkphone makes. We've got a buzzer, piezo buzzer, so that it can beep and let us know whenever the safe is open. We initially designed a current sensor into the board thinking that we would look at how much current this motor was using to tell when it started to stall. We found out that it's actually a lot faster to see the encoder stop. So when we tell the motor to do something, if we ever see the encoder ever stop turning, it's about 100 milliseconds before we see the current increase. So we don't actually use the current sensor, we just look at the encoder. Next is that 12 volt external hard drive power supply. Next we have the motor control and feedback. So motors are pretty simple, right? You give it DC power in one direction and the motor starts turning. In this case it's got a couple more pins because it's giving us feedback to that, it gives us access to that encoder. So we can read the encoder, we can power the motor, we can switch directions on the motor and so that we can turn the dial in different directions. Next up we've got a display, and I'm just going to check it out real quick. So currently we're testing 18 1693. So that's a display, seven segment display with a bunch of segments. The interface to that display is three wire. So it's serial, just going to the display. Next is that home photo gate. So it's a really simple photo interrupter, you power it and whenever it breaks the beam you can see that pin go low. So we tell the head to turn until we see that beam broken and we know that the flag is there. Next up we have a go button. So we wanted to make this thing as autonomous as possible. You'll see a red button on the robot. So we adhere it, we can hit the red button and it starts doing its thing. Next up is the servo and feedback. Again that's where we attach the servo to find out where the handle is at. Now we had to connect all these things together. So this is a pretty simple schematic, right? There's not a lot going on. It's just a whole series of connectors and making sure that the servo and the buttons and everything are connected to the right spot on the Arduino. We could have done this with wires. We could have just inserted things, but it's not going to make it reliable. So this is the schematic you can see in the bottom center is that gear logo. I don't know how many people are familiar with open source hardware. This is, yeah, yeah, awesome. The open source hardware association. This, you can take, this design, you can modify it, you can copy it, you can sell it, you can do whatever the heck you want with it and that's the same for all SparkFun products. We believe that everything should be open source and if you can learn from me, then I can help you and we can build upon each other's work. So this is all open source. This is the schematic and then we turn it into a printed circuit board. So this is a really simple printed circuit board. It's two-sided, but the traces are huge and it's all through whole soldering and it's really pretty straightforward. So that's the PCB. Now let's talk a little bit about the keys and how we will hopefully get this thing open quickly. There is about a million combinations on a given safe and the reason that is is you've got a dial zero to 99, so it's 100 times 100 times 100, that's a million. If a human walks up to a safe, think about it, you've got to clear the dial, right? And then you've got a dial in the first one and you've got a dial in the second one and the third one and you've got to pull the handle. It takes about 10 seconds for a human to do that. So worst case, if we were to brute force this, it would take 115 days of nonstop trying every 10 seconds. So the first exploit we came about was the dial key set. And I don't know if you've noticed, but we are only testing 93 over and over and over again. Why is that? That's because oh, let me take one step back. So 100 times 100, we can actually reduce that a little bit. They design the safes so that if the digit is say 56, humans are really bad at doing fine stuff. So it's hard to get 56 just right. So they design the safes so that 57 and 55 are there. So it's a three-digit window, so we're not actually trying 100, we just have to hit that middle digit. So we're doing 33 times 33 times 33. It's still four days. It's mind-nimmingly slow. So this is what the inside of the safe looks like. There are three dials and the two white ones in the black one. If you see that black one, it's got a bunch of indents on it. And that's what we call those little indentations. And those are there. Yeah. 11 small indents and then there's one large indent and that's the solution slot. So we know that one of those 12 indents has to be the solution slot. So we don't need to try all 33 digits on the last disk. We only need to try 12 on disk C. That's the black disk. So now we've reduced the solution set 33 times 33 times 12, still at one and a half days. The real kicker came when I took the safe and found out that the solution indent on this older model safe is slightly different in size. Okay, so that small indent is about 10,000 of an inch smaller than the other 11 shallow indents. So from the outside of the safe, if we have a sensitive enough motor, we can measure those indents and find the skinniest indent. So if we can do that, then we can take disk C down to one. We have the solution number within about 20 seconds. So if disk C has the skinny indent, we take 33 times 33 times 1, we're now down to about 3 hour test time. So the first thing I want to show you, well, no, I've got to show you all sorts of stuff, but this is the model safe that we had back in Boulder that we got off Craigslist. And that's the one we cracked open, worked well. The problem is that we wanted to do this demo at DEF CON. This safe is about 10 years old, you can no longer get this model safe. Awesome. So we looked around and said, well, what is the model of safe we can buy at... What's that? We're good. Okay. What's the model safe that we can buy here in Vegas? We bought this safe at Home Depot. This is the model you can get at home. How did you about this picture? What is it? There's keys. Where the hell did those come from? Those weren't on the original model safe. So when we found, we saw the model safe in Vegas, we're like, okay, cool, let's get the same model in Boulder. I buy this same model in Boulder where we're from and I take it up to Rob's office and I'm like, hey, we got the safe and I'm like, hey, we're not standing about demos, but we can't just show up with a robot that doesn't work. How are we going to open this lock? Well, anybody who knows tubular locks, right? This is the first time in my life where I used a big pen to open a lock. It works really well. It's incredible. So sure enough, if you find this safe and you need to get it open, build it with you. That's all you need. So inside this safe, again, we have this we've never opened this safe. We bought it yesterday. God, I hope we get it open. But this is what the inside of our safe, same model in Boulder looks like. Same 12 indents, all plastic. Now the interesting thing about this disc C is that the solution slot is actually 50,000 of an inch larger indents. That may not sound like a lot, but that's 54 ticks on the encoder. That's a huge gaping, it's such a sore thumb it sticks out at you. So this is what it looks like how we measure the indents. So the robot will spin the discs to an indent, and then it'll apply pressure on the handle and rock the wheel back and forth. Now remember, the encoder is at 17 and then it went to 312. And then we do the subtraction and we say, okay, that indent is this many ticks wide. And we do that for each indent. And I think, yep, we'll eventually do the solution slot, measures that. Got it? Okay. That's how you measure the indents. Now we're not trying anything yet, but we are establishing what those indent widths are. So this is what the terminal looks like. Nothing may jump out at you except for that. The width of that indent is like a sore thumb. It's much bigger than any of the other indents. So our software says, okay, cool, the largest indent number is 6. That is the number I'm going to try for all the other combinations. So in this case, we think the indent is 93. We're really, really hoping the solution indent is 93. We're pretty sure. So, we know we have the solution to disc C. It's 33 times 33. It still takes about three hours. So how are we going to do this in under 45 minutes? There's some other things that we can do. How can we get the test time down from 10 seconds to something shorter? This is something we created called set testing. So we've got the test time done on that. But let me demonstrate what set testing is because it's a little complicated. Well, it's not complicated. It's hard to describe. So this, I'm going to play this animation again, but disc C is the blue disc. Disc B is the green disc. Now we have those interference points, right? To test as quickly as possible, I shouldn't reset all the discs. I'm a robot. I shouldn't have to reset B. I tested C and now I'm going to turn C until it interferes with B. B will move three digits and then C returns to where it needs to be and we test again. So we do this. We turn B, we bring it back. We turn B, we bring it back. And I want to show you the next video of that in practice. Set testing measurement. Okay. So this is it the robot. Oh, set testing. Measurement. There we go. So we test. We move the disc, we test. We move the disc, we test and you can see that slot opens up a little bit and keeps going and we go right through it. Now realize that this is just a quick little video but we're testing a large number of combinations in the ten seconds it takes to watch this video. If we can get to the set time test time per combination down to about four seconds, how are we going to get it down to 45 minutes? We can't. It's all luck, right? It's to the demo gods at DEF CON to try to get this thing open in 45 minutes. It's not an exploit, it's just luck. So you may ask yourself, okay, how can we improve upon this technology? How do I protect myself? Well like combination locks, get one with a keypad, right? The one in the middle is a keypad. My robot does not work on keypads. However, before you buy the model of safe in the middle, I suggest you search for it on the internet because that safe can be opened faster than we can open this one. You take a high power magnet, you take it on the outside and there's a solenoid that when you type in the key pad, that solenoid pulls the magnet from the outside and you can open the safe in a couple seconds. Do your research. Well, Nathan, I could just spend more money on a safe. Yes, you could. There's lots of very good secure safes out there for, you know, $1,000. You can get a safe that doesn't have plastic internals, right? This safe is the most common model at Home Depot, Lowe's, all the other places, so this is the one we wanted to exploit the most. However, if you spend a whole bunch of money, you can get a jeweler safe, you can also get the SG6730. The interesting thing about this is that the only people that buy this are locksmiths because they're the only ones that can actually dial in the single digit combination. Remember, our safe has that plus or minus one digit, so if you dial in 56 and it's supposed to be 55, it's still going to work, and there's always somebody around with a thermal lance, right?  So a few things about future research. We found out that there's two aspects, two motors on our robot. One is the motor that spins the dial. The other one is that pulls on the handle. We have a very sensitive motor that turns the dial. We can also get a very sensitive servo that pulls on the dial and gives us feedback about how far down that handle has been pulled. If we based on the depth at which the handle is going, we ought to be able to glean some information about the disks inside the safe. I don't know if we can or not, but we can get depth feedback from the servo. Something to look into. Another one, this is called impulse response. We ought to be able to slam the arm into the disks and listen to what it sounds like. If there's three pieces of plastic there, we should hear one sound. Humans probably won't be able to detect this, but a computer could look and do the analysis and say, ah, there's three pieces of plastic there. Or in this case, you can barely see that there's one slot lined up, so whenever we slam into it, there's only two pieces of plastic, we can make this happen, then I won't have to stand next to a safe that isn't open, we should be able to open it up a lot faster. Next, we have a 3D printed coupler that works with this dial. So if you want to hack into a safe, you have to get measurements of that safe, measurements of that dial, or on a safe similar to it. In this case, there are really interesting grabbers. This is from iRobot, and it's basically a balloon filled full of coffee grounds.  So you can grip all sorts of different objects in different shapes, a few shown here. We may be able to create a coupler that you shove onto the disk, you evacuate the air, and then you have a very tight grip on whatever dial, any size or shape dial you've got. Another thing, the next safe that we would like to work on is the keypad safe. So these are the ones you often find in the hotel room, or the one I suggested before, there are combination to the safe. Lastly, we ought to be able to see the tactile feedback of buttons. So using a load cell on a pen, we ought to be able to press the button and see where the tactile force fails, and from that, you can see which buttons have been worn out. In theory, this is future research. Not sure if we can, but we've done a lot with load cells, and this is a common testing method for tactile feedback of buttons. It might work. Yeah, and then once you have the number of buttons figured out, it's just n factorial. This is all really boring compared to that, so yeah. We got it open. That's all I got.