Monitoring LoJack / Generic FSK Decoder?

[fog]

I live in the boonies, and just threw the Lojack frequency (173.075) in my radio. I'm hearing activity there; it turns out that cars will throw out their ID every now and then ordinarily, and jump up to an ID every second (I think) when stolen. So no stolen cars, but I'm curious what I'm hearing, especially whether it's one car in the neighborhood or many cars.

Is there anything out there that will display the LoJack signal? I'm not sure what's there, but the units in police cruisers seem to show a 5-digit alphanumeric code, which I assume is a unique identifier for the car.

KB9UKD's digital sounds page (http://www.kb9ukd.com/digital/) describes the data burst:

1200bd, Binary 0 = 1.5 cycles @ 1800Hz, Binary 1 = 1 cycle @ 1200Hz

Of course that's the 'raw' data; I don't know if it'll come out to ASCII or anything else sensible. But I'm wondering if there's anything out there that does generic FSK decoding? At 1200bps, it seems that it ought to be easy enough to decode over a headphone jack, not requiring a discriminator tap. But what would I use to do so?

 

[slicerwizard]

I'm hearing activity there; it turns out that cars will throw out their ID every now and then ordinarily, and jump up to an ID every second (I think) when stolen.

I don't think so. More like infrequent transmissions when the asset is reported stolen and frequent transmissions when law enforcement reports detection of the signal.

So no stolen cars,

I dunno - I wouldn't be so sure. Too bad you can't report the LoJack ID to your local PD.

 

[fog]

More like infrequent transmissions when the asset is reported stolen and frequent transmissions when law enforcement reports detection of the signal.

I was going from http://www.freqofnature.com/index.php?m=Common&p=LoJack -- oddly, it seems that not many other people I've found have ever tried to monitor LoJack, or at least, have ever posted about it anywhere, so it's hard to find people corroborating (or refuting) this part.

Too bad you can't report the LoJack ID to your local PD.

And there's the gist of my question -- any advice on how to try to start decoding the data? I have no idea if it's in a proprietary format or not; I'm wondering if it'll 'decode' to ASCII or something similar. As it stands right now, though, all I have is really annoying sound, and no way to even begin analyzing it.

 

[fog]

I did a little more poking around; Wikipedia says "Vehicles with the system installed send a 200 ms chirp every ten seconds on this frequency. When being tracked after reported stolen, the devices send out a 200 ms signal once a second," though it actually cites the Freq of Nature site, so it doesn't necessarily corroborate anything.

The lack of any real data only makes me more curious!

 

[WayneH]

I get periodic traffic on the freq on a daily basis so I would say there's more than infrequent traffic on it.

 

[ecps92]

Most Likely hearing the Local Towers Polling themselves,
vs actually hearing:

a.) Activation Signal
b.) DeActivation Signal
c.) Track Signal [Speed up]

I get periodic traffic on the freq on a daily basis so I would say there's more than infrequent traffic on it.

 

[fog]

It turns out that, when LoJack says that the police "operate" LoJack, they weren't kidding:

http://fjallfoss.fcc.gov/General_Me...ortstring=,+lic_name,+file_num&limit_select=4
^ a list of all the licensees on 173.075. They're pretty much all state PDs.

As ecps92 suggested, I've got a local tower maybe 10 miles away, 300W ERP.

Now I'm even more curious about decoding this data!

 

[ind224]

TV show

There is a TV show were they go after LoJacked cars. Not sure if it is Tru TV or not.
Pretty sure it was LAPD or NYPD but it was just a stolen car division. They *may* have it affliated with a moving map so they can actually watch it move in real time.

I'm going to do more research. Very cool to me,too. Patented, so anyone being able to crack it and release a "decoder" for fun would probably not be able to get legitimate licensing.

 

[RolnCode3]

There is a TV show were they go after LoJacked cars. Not sure if it is Tru TV or not.
Pretty sure it was LAPD or NYPD but it was just a stolen car division. They *may* have it affliated with a moving map so they can actually watch it move in real time.

I'm going to do more research. Very cool to me,too. Patented, so anyone being able to crack it and release a "decoder" for fun would probably not be able to get legitimate licensing.

It's Newark, NJ. It's a task force, and the name of the show is "Jacked".

 

[Tman305]

Here is what you need to decode lojack sigs

The LoJack III vehicle transponder employs a phase continuous Fast Frequency Shift keyed subcarrier at a 1200bps data rate.

The subcarrier data modulation method complies to the following specifications:

Subcarrier modulation: Phase continuous FSK
Bit rate: 1200 bits per second
Modulation rate: 1200 baud
Binary “0”: One and one half cycles of an 1800 Hz sine wave
Binary “1”: One cycle of a 1200 Hz sine wave

I assume that knowing this you could conceivably sniff out the activation/deactivation codes sent to the vehicle tracking units. Now the question is: Are activation codes universal and simply accompanied by the VTU number on each transmission? or is each VTU assigned it's own activation number ?

If the activation numbers are universal, this could be a HUGE problem for lojack since any malintentioned person/hacker could send out a blast and activate numerous VTUs maliciously and create shear havock!

Have Fun scanning...

 

[scottyhetzel]

When a vehicle owner makes a police report...the agency activates the LoJack tower sending out the vehicle last 6 digits of the vin. Once the. Vehicle antenna picks up the tower broadcast , the vehicle chirps it's vin number. The vin displays on the LoJack equipped police cars and helicopter and at border check points.

 

[ecps92]

Lo/Jack uses the Complete 17 Character VIN (1981/1982 and newer) or the (Commercial/Construction) Complete PIN and for Boats the HIN

Using the last 6 (sequential only)could activate more than the target vehicle, same for the using the last 8 (Year, Plant and Sequential)

Once Activated the Vehicle sends out a UNIQUE 5 character Alpha/Numeric Code that is then run thru the STATE Law Enforcement System, that Code will inquire the Lo/Jack DB and IF STOLEN, return the NCIC stolen response info.

When a vehicle owner makes a police report...the agency activates the LoJack tower sending out the vehicle last 6 digits of the vin. Once the. Vehicle antenna picks up the tower broadcast , the vehicle chirps it's vin number. The vin displays on the LoJack equipped police cars and helicopter and at border check points.

 

[ScannerSK]

For those interested a LoJack decoder program for Windows has been compiled. Ongoing work on the LoJack decoder project is at the following RadioReference forum:

http://forums.radioreference.com/general-scanning-discussion/235059-how-decode-lojack-2.html

Shawn
KB0LSW