How to decode Lojack?

Status
Not open for further replies.

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
Last I knew, SafetyNet is still 200 Mhz as most of the LE around here have the 200 Mhz Beams

I'll second the above. After digging a little further, it does appear SafetyNet is still in the 216 MHz range.

The mystery signal is not that strong of a signal however it carries for a distance of at least 10 miles on hill tops. Notice in the attached sound example how the two systems can interrupt each other. In this case the standard LoJack transmission won the battle.

If the mystery signals are somehow related to clock timing for the LoJack towers possibly a change in the signal would occur around midnight UTC time (5 PM MST) when the towers reset themselves daily.

I guess this mystery LoJack signal near Denver will remain a mystery for now.

Shawn
 
Last edited:

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
I noticed today an address that went from activation to deactivate back to activation and then back to deactivate all within 2 hours time.

Possibly there was some LoJack training taking place today in Colorado.

Shawn
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
I ran across information regarding a LoJack chase on 12/16/2014 near Denver. The plate listed to an out of state vehicle. At least one school was placed on lock down. The vehicle chase turned into a foot pursuit and ended with one suspect at gunpoint who required medical assistance when all was said and done.

Comment 1
Comment 2
Comment 3
Comment 4
Comment 5

I was recording LoJack data during this date.

The first comment made at 10:17 AM stated the LoJack activity had been in progress for an hour. The final comment appears to indicate the pursuit ended around 10:59 AM.

There are three possible candidates. Below are listed the first activation, last activation and first deactivation for each likely address which may correspond to the LoJack chase the morning of Dec. 16th.
Code:
20141216	83808	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [075223D]	VRC [6C] LRC [C3] CRC [AE27]
20141216	123345	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [075223D]	VRC [6C] LRC [C3] CRC [AE27]
20141216	124537	PASSED	FUNCTION: C-DEACTIVATE 	ADDRESS [075223D]	VRC [2E] LRC [3C] CRC [25B3]

20141216	91521	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [2070847]	VRC [B2] LRC [7F] CRC [9C89]
20141216	110721	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [2070847]	VRC [B2] LRC [7F] CRC [9C89]
20141216	112217	PASSED	FUNCTION: C-DEACTIVATE 	ADDRESS [2070847]	VRC [F0] LRC [80] CRC [171D]

20141216	83241	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [4F3D552]	VRC [9A] LRC [E0] CRC [2898]
20141216	83553	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [4F3D552]	VRC [9A] LRC [E0] CRC [2898]
20141216	121857	PASSED	FUNCTION: C-DEACTIVATE 	ADDRESS [4F3D552]	VRC [D8] LRC [1F] CRC [A30C]

I would conclude the middle address [2070847] was the vehicle the police were in pursuit of that morning. Notice how the first activation command was sent at 9:15 AM. At 10:17 AM a comment was made that LoJack activity had been in progress for 60 minutes which would place the start time at about 9:15 AM. Also, the pursuit ended around 11:00 AM. The closest deactivate command to this time is the middle address at 11:22 AM. The middle address would appear to perfectly fit the bill.

There were no "unknown", "speed-up" or "set rate" Functions during this time period.

The only thing unusual during this time period was an unusual site ID. However, there were a lot of unusual site IDs appearing around this date so I do not believe it to be related. The activations and deactivations for the stolen vehicle [2070847] all occurred in the 2nd time slot. The below unusual site IDs [8E18C30] were falling into the 5th - 9th time slots (primarily the 9th).
Code:
20141216	85713	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	85817	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [1C] LRC [05] CRC [13C3]
20141216	85825	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	91417	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	91521	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	91625	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	92705	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	92713	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [1C] LRC [05] CRC [13C3]
20141216	92809	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	92817	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	92921	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	93017	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	94617	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	94625	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [1C] LRC [05] CRC [13C3]
20141216	94825	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	100537	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	100633	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [1C] LRC [05] CRC [13C3]
20141216	100745	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	100841	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	100945	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	102553	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	102649	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	102753	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]
20141216	102801	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [1C] LRC [05] CRC [13C3]
20141216	102857	PASSED	FUNCTION: 8-SITE ID SITE [8C-30] 	ADDRESS [8E18C30]	VRC [14] LRC [05] CRC [13C3]

This leads me to wonder if the speed-up/rate set command was never issued or if it was issued only from a tower I am not capable of receiving at my location? I would assume the second answer to be correct. I see many activations which turn into deactivations with few speed-up or rate set commands to correspond to them. This leads me to conclude that the speed-up and/or set rate commands are likely broadcast out of only the closest tower to the stolen vehicle while the activation and deactivate commands are broadcast more widely out of many towers including some not nearest to the vehicle.

Shawn
73s
 
Last edited:

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
January is the peak month for stolen vehicles

I just heard on the news that January is the peak month for stolen vehicles mostly due to vehicles left running unattended. Also, more vehicles are stolen on Tuesday than any other day of the week while the fewest are stolen on a Sunday on average. This means Tuesdays in January are the hottest days of the year in terms of vehicle thefts. Possibly this would be a good day of the week to monitor for stolen vehicles on 173.075 and record any stolen vehicle pulses received so we can understand how to properly decode the reply codes. Stolen vehicle pulses stand out from the normal tower transmissions as they occur more frequently (once every ten to fifteen seconds or once every second). In the future it may be possible for us to assist local law enforcement by being able to provide the time and location a specific reply code was received.

Shawn
73s
 
Last edited:

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
Ok, here is something unusual. I captured an unusual "Site ID" that turned into a "Function E". The "Site ID" fell six times into the fifth message slot and apparently one time into the third message slot. The "Function E" fell twelve times into the fifth message slot, eight times into the forth message slot, three times into the third message slot and three times into the second message slot. I only noted the message slots for the bursts which appeared to be complete with all messages intact.

The address first began to be broadcast by tower FA-40 (possibly the called tower) as a "Site ID" and then began to also be transmitted as a "Site ID" by tower FA-81 (possibly a non-called {relay} tower). The "Site ID" then turned into a "Function E" which has only been noticed to be transmitted by tower FA-81.

Code:
20141230	203033	PASSED	FUNCTION: 8-SITE ID SITE [29-A0] 	ADDRESS [C4A29A0]	VRC [72] LRC [AA] CRC [03E6]
20141230	203137	PASSED	FUNCTION: 8-SITE ID SITE [29-A0] 	ADDRESS [C4A29A0]	VRC [72] LRC [AA] CRC [03E6]
20141230	203145	PASSED	FUNCTION: 8-SITE ID SITE [29-A0] 	ADDRESS [C4A29A0]	VRC [72] LRC [AA] CRC [03E6]
20141231	22755	PASSED	FUNCTION: 8-SITE ID SITE [29-A0] 	ADDRESS [C4A29A0]	VRC [72] LRC [AA] CRC [03E6]
20141231	23011	PASSED	FUNCTION: 8-SITE ID SITE [29-A0] 	ADDRESS [C4A29A0]	VRC [72] LRC [AE] CRC [03E6]
20141231	23107	PASSED	FUNCTION: 8-SITE ID SITE [29-A0] 	ADDRESS [C4A29A0]	VRC [72] LRC [AA] CRC [03E6]
20141231	23115	PASSED	FUNCTION: 8-SITE ID SITE [29-A0] 	ADDRESS [C4A29A0]	VRC [73] LRC [AA] CRC [03E6]
20141231	23315	PASSED	FUNCTION: 8-SITE ID SITE [29-A0] 	ADDRESS [C4A29A0]	VRC [72] LRC [AA] CRC [03E6]
20141231	72644	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	72748	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	72852	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	73059	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	73308	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	73828	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	74244	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	74348	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	74556	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	74907	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	75012	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	75532	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	75740	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	75947	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	80508	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	80612	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	80716	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	81132	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	81340	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	81756	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	81900	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	82003	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	82420	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	82731	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	82836	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	83044	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	83252	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	83356	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	83500	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	83812	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	84331	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	84539	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	84644	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	85203	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]
20141231	85307	PASSED	FUNCTION: E-UNKNOWN 	ADDRESS [C4A29A0]	VRC [F6] LRC [19] CRC [AE98]

The "Function E" addresses are still being transmitted as I am typing from tower FA-81.

Any ideas??

Shawn
 
Last edited:

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
VRC

I worked for a while today on figuring out how the VRC is determined with a purpose in mind. VRC is usually very straightforward however for the life of me I cannot figure this one out.

The first seven bits of the VRC are almost always even parity and the last bit of the VRC appears to always be a "0" bit. Also, the forth bit of the VRC is usually a "0" bit as well however not always.

Shawn
 
Last edited:

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
Function E

If anyone receives numerous Function E messages which have the same address, I would be interested in looking at your SDRTrunk "Decoded Messages" file.

Shawn
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
VRC and LRC

Determining the VRC and LRC is fairly straightforward after all.

Example from this morning:
Code:
06:49:14	LJ-1200	PASS	FUNCTION: 2-ACTIVATION ADDRESS [CB91B8E] VRC [E4] LRC [D6] CRC [6BBD]	
01010101000011111110010011010110001011001011100100011011100011100110101110111101

The last 48-bits (Function, Address and CRC) are as follows:
001011001011100100011011100011100110101110111101

Line these 48-bits up into rows of eight bits.
The LRC is even parity (top outlined row) and the VRC is even parity (right outlined row) with a zero added at the end to make the VRC eight bits in length.

So, if the Function and Address are known the CRC can be determined. If the Function, Address and CRC are known then the VRC and LRC can be determined.

Shawn
73s
 
Last edited:

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
CRC Polynomial

I manually decoded the stolen vehicle tracking pulses on the YouTube video and the function bits decode out to "1110" (Function E). The VRC and LRC calculations confirm Function E is correct rather than Function F.

However, the puzzle is that for the CRC calculation to come out correctly the function code must be a Function F using the current polynomial.

Could the CRC polynomial be off slightly?

Shawn
 
Last edited:

DSheirer

Member
Premium Subscriber
Joined
Feb 15, 2010
Messages
614
Location
Fulton, NY
Shawn, I added the reply code parsing for Function E and Function F and relabeled both of those functions as track pulse functions. Testing against the youtube video shows the same reply code as what you posted.

I'll post a new build shortly.

Denny
 

DSheirer

Member
Premium Subscriber
Joined
Feb 15, 2010
Messages
614
Location
Fulton, NY
Shawn, new build posted (sdrtrunk_20150106_2024_lj1200_and_tait_test.zip) with the reply code parsing that you posted.

enjoy,
Denny
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
Shawn, new build posted (sdrtrunk_20150106_2024_lj1200_and_tait_test.zip) with the reply code parsing that you posted.

enjoy,
Denny

Denny,

Oh, wow! It is wonderful and working great! I ran multiple examples of known reply codes I have on hand through it and it worked flawlessly each time. Thank you!

It's amazing what you are able to do with the SDRTrunk program.

One last thing that comes to mind is whether it would be possible to have an option for the program to play a sound file stored at say C:\LoJack.wav for example when a passing or corrected tracking pulse is received? Possibly just a batch file command to "Start C:\LoJack.wav" or something down this line would be sufficient?

Thank you again Denny. I have hoped for something down this line for the past ten to fifteen years.

Shawn
73s
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
Stolen Vehicle Pulses - Function F in SDRTrunk

Shawn, new build posted (sdrtrunk_20150106_2024_lj1200_and_tait_test.zip) with the reply code parsing that you posted.

enjoy,
Denny

Denny,

I spent some time thinking about whether stolen vehicle pulses are Function E or Function F today. After reviewing how Eric determined the polynomial using single bit shifts, the polynomial would have to be spot on so that cannot be the issue.

I received 92 valid Function E messages from a local tower on 12/31/2014. All of these examples had a valid VRC, LRC and CRC all based off a Function E bit pattern (1110). These transmissions originating from a mountain top tower were certainly not setting off every LoJack receiver up and down the Colorado front range over the course of several hours.

Rather, it appears the LoJack system was designed in such a way to specifically prevent the possibility of a tower from ever broadcasting any type of stolen vehicle pulse. The way this was accomplished was to base the VRC and LRC calculations for a stolen vehicle pulse off a Function E bit pattern (1110) and to base the CRC for a stolen vehicle pulse off a Function F bit pattern (1111). By doing this, the towers are effectively prevented from ever broadcasting any type of stolen vehicle pulse.

In light of the above, Function F would be the only valid Function code in SDRTrunk for stolen vehicle pulses/reply codes. Even though Function E is transmitted by the stolen vehicle transponder the CRC calculations are based off a Function F bit pattern which SDRTrunk uses to correct the Function E code to a Function F code.

Shawn
73s
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
Mystery Signal

The mystery LoJack signal near Denver appears to fall into one of the specific 8 time slots. I have noticed on multiple visits that the mystery signal appears to always follow shortly after the two strongest tower transmissions by about one or two message slots (have not timed). I'll have to research this further.

I almost thought this mystery signal could be related to the Function C [D5C0000] addresses however those are broadcast every 16 minutes while the mystery signal is broadcast every 15 minutes.

The bits transmitted by the mystery signal were the same identical pattern today as on previous trips.

Shawn
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
LoJack Stolen Vehicle Reply Codes (Hits/Tracking Pulses) (LoJack Receiver)

For those who may be using the SDRTrunk program specifically to decode LoJack "Reply Codes" (the stolen vehicle codes seen by police on a LoJack receiver/police tracking unit display), it should be noted that there will continue to be occasional false decodes in the SDRTrunk program.

If the following two events are true then you are most likely receiving actual Reply Codes from a stolen vehicle:

1.) It is a "Function F" tracking pulse (which appears as "CORRECTED" in the message tab on the "live" screen)
2.) The identical address is received more than once (typically evenly spaced apart in time)

3.) And the certain give away to verify you are receiving live tracking pulses from an actual stolen vehicle in your vicinity is when you see a Function F tracking pulse every few seconds with the same address!

Those living in large cities have the greatest chance of receiving signals from stolen vehicles which typically have a range of 3-5 miles. Using a rooftop mounted antenna may extend your reception area.

Viewing the LoJack coverage area reveals that 30 states are included in the coverage area. A whopping 20 states have basically no LoJack coverage at all. And, only 3 states in the entire country offer statewide coverage. Throughout the majority of the United States there are large areas where there is little if any monitoring taking place for stolen vehicle pulses on the LoJack frequency! How many stolen vehicles are hidden or being driven around in these areas of the country? Thieves may intentionally be driving stolen vehicles into areas not covered by LoJack to prevent being detected.

Once a LoJack transponder/transmitter in a stolen vehicle is activated (begins transmitting stolen vehicle pulses) the LoJack transponder will continue to transmit stolen vehicle pulses indefinitely whenever power is available to the LoJack unit. It is possible there could be literally hundreds of stolen vehicles all over the country actively transmitting stolen vehicle pulses which are outside the range of any LoJack receivers. Some of the newer units will slow down to one tracking pulse transmitted every minute or even one tracking pulse transmitted every three minutes after a certain length of time has expired. Older units will continue to transmit stolen vehicle pulses several times per minute. In either case an activated stolen vehicle transponder, also called a vehicle locating unit or VLU, will continue to transmit for years on end until the vehicle is recovered and the LoJack transmitter deactivated.

What does this mean? On your next road trip (vacation) keep the LoJack frequency plugged into the scanner. You will certainly travel through areas of the country where there are no LoJack receivers and you might just be the one and only person that would ever receive the signal from a specific stolen vehicle. By providing the details (time, approximate location and reply code) to law enforcement you may just help someone get back their vehicle or other piece of stolen equipment (generator, backhoe, light pole, skid steer, boat, tractor, trailer, etc.)

Stolen vehicles are often occupied by armed and dangerous criminals. Therefore, it is strongly recommended to never attempt to track the actual location of a stolen vehicle. If a criminal was to see or detect someone tracking the vehicle they stole the story may not have a good ending especially if a gun is involved if you get my point.

It would be interesting to hear from anyone that actually picks up stolen vehicle pulses using the SDRTrunk program and even more interesting if reporting it to the authorities leads to the recovery of a stolen vehicle or to an arrest.

Shawn
73s
 
Last edited:

DSheirer

Member
Premium Subscriber
Joined
Feb 15, 2010
Messages
614
Location
Fulton, NY
LoJack SafetyNet

Has anyone heard or recorded the new LoJack SafetyNet wrist-worn transponder beacons yet?

On this page ...

https://www.safetynetbylojack.com/Public_Safety/Features_and_Benefits

It says that each bracelet operates on a specific frequency within the band (216.0125-216.9875 MHz) allocated by the FCC for law enforcement tracking

I wonder if they're using the same message protocol as the LoJack system.

Denny
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,462
Location
Weld County, Colorado
Has anyone heard or recorded the new LoJack SafetyNet wrist-worn transponder beacons yet?

On this page ...

https://www.safetynetbylojack.com/Public_Safety/Features_and_Benefits

It says that each bracelet operates on a specific frequency within the band (216.0125-216.9875 MHz) allocated by the FCC for law enforcement tracking

I wonder if they're using the same message protocol as the LoJack system.

Denny

I recently ran across the following patent regarding LoJack's SafetyNet. It mentions both 216 MHz and 170 MHz (presumably 173.075 MHz). It would almost appear as if the wrist band may be activated by a LoJack transmission on 173.075 MHz while the wrist band transmitter operates on one of 60 frequencies between 216-217 MHz.

https://www.google.com/patents/US8350695?dq

Shawn
 
Last edited:
Status
Not open for further replies.
Top