You find unknown base, step, offset info by watching the control channel to discover what channel number corresponds with what frequency (by watching to see what frequency is talking when the CC monitor software says they're using channel XXX), and figuring out what fits those numbers.
The tricky part is that a system might have multiple table entries, which will show up as channel numbers/frequencies that cannot be made to 'fit' a single simple bandplan. Then you get to guess where the different table areas start/end. It doesn't matter if your results are the 'official' ones (that is, perfectly correct), as long as they don't add a frequency. If your guesses WORK, for all the current frequencies, they're good enough.