How to decode Lojack?

[ScannerSK]

Another vehicle LoJack is going off this morning in the Denver area. I'm hopeful someone will capture a recording of the Reply Code on 173.075 MHz.

It does not appear from the LoJack data that it has been deactivated yet. There are no apparent speed up or rate changes in the LoJack data. An unusual site ID began to be broadcast at 6:16 AM this morning and is still being broadcast. I have considered the idea of the unusual Site IDs being the speed up command however am uncertain whether this is only a local occurrence or whether this is occurring nationwide? The unusual site IDs are unusual only in that they are not the common Site IDs at this location.

An example of the unusual site ID which began at 6:16 AM this morning:

20150115	61613	PASSED	FUNCTION: 8-SITE ID SITE [4E-B1] 	ADDRESS [AC04EB1]	VRC [44] LRC [11] CRC [0EAA]

The vehicle was just recovered so I am awaiting the LoJack deactivate command.

Shawn

 

[ScannerSK]

The deactivate command was just received. It appears the first attempt to activate the stolen vehicle transponder was at 6:13 AM and a deactivate command was first sent at 9:41 AM.

20150115	61302	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [74C1BF2]	VRC [2E] LRC [E1] CRC [7310]
20150115	61406	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [74C1BF2]	VRC [2E] LRC [E1] CRC [7310]
20150115	61509	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [74C1BF2]	VRC [2E] LRC [E1] CRC [7310]
20150115	94100	PASSED	FUNCTION: C-DEACTIVATE 	ADDRESS [74C1BF2]	VRC [6C] LRC [1E] CRC [F884]

The unusual Site ID began to be broadcast at 6:16 AM and ceased at 8:53 AM. At 9:08 AM there was a single transmission of another unusual Site ID:

20150115	90804	PASSED	FUNCTION: 8-SITE ID SITE [72-01] 	ADDRESS [39C7201]	VRC [48] LRC [22] CRC [357B]

This event was far enough South of my location that the speed up and/or rate change commands may have been issued from towers not capable of being received at my location.

Shawn

 

[DSheirer]

Shawn,
Do you think that alternate signal format that you found a couple weeks ago is some form of local lojack tower to support these wrist type devices? I read that the wrist devices can be tracked up to 1 mile by land or 6-7 miles by helicopter. It might make sense that the agency using the devices might have their own local tower/transmitter to activate their own devices on 173.075 and the wrist devices chirp on the 200 mhz frequency in response.

 

[ScannerSK]

Shawn,
Do you think that alternate signal format that you found a couple weeks ago is some form of local lojack tower to support these wrist type devices? I read that the wrist devices can be tracked up to 1 mile by land or 6-7 miles by helicopter. It might make sense that the agency using the devices might have their own local tower/transmitter to activate their own devices on 173.075 and the wrist devices chirp on the 200 mhz frequency in response.

My initial instinct was the mystery signal could be related to LoJack's SafetyNet as the signal appeared to be strong near a number of hospitals and care facilities. The service availability website however does not appear to show any service in the area. So, I called SafetyNet this morning and the representative confirmed they do not offer SafetyNet anywhere in the state of Colorado. They provided me with the name, number and website address of another company called Project Lifesaver which appears to be similar. I have not had a chance to look into this system yet.

My other guess was that it was related to LoJack timing signals. I contacted the company that sends out timing signals on a tower possibly from where the mystery LoJack signals are originating from and was advised they do not use LoJack for any timing signal purposes or to transmit timing signals.

For now, it remains a mystery.

Shawn
73s

 

[ScannerSK]

My initial instinct was the mystery signal could be related to LoJack's SafetyNet as the signal appeared to be strong near a number of hospitals and care facilities. The service availability website however does not appear to show any service in the area. So, I called SafetyNet this morning and the representative confirmed they do not offer SafetyNet anywhere in the state of Colorado. They provided me with the name, number and website address of another company called Project Lifesaver which appears to be similar. I have not had a chance to look into this system yet.

My other guess was that it was related to LoJack timing signals. I contacted the company that sends out timing signals on a tower possibly from where the mystery LoJack signals are originating from and was advised they do not use LoJack for any timing signal purposes or to transmit timing signals.

For now, it remains a mystery.

Shawn
73s

A little hunting around turned up with the following three articles below which indicate that both Project Lifesaver and also Colorado LifeTrak are available in this area. Possibly one or both of these systems explain the mystery signal.

http://news.developingmindssoftware.com/?p=32
Colorado Lifetrak
RadioReference - New Tracking System

A quote of interest from the above RadioReference forum states the following: "SafetyNet is a LoJack product and LoJack provides equipment to Project Lifesaver, and in turn ( I believe) Colorado Life Trak."

So, it appears both Project Lifesaver and Colorado LifeTrak utilize LoJack made equipment. This takes us back to the possibility of the 170 MHz band (173.075 to be specific) as the possible frequency used to activate these medical devices. https://www.google.com/patents/US8350695?dq

While driving around another city (Loveland, CO) I am fairly certain I heard another one of these mystery transmissions off in the distance (very weak signal while atop a tall hill). Possibly they are located in the various cities that provide coverage to these systems?

Shawn
73s

 

[ScannerSK]

A new LoJack tower was put online today at my location. One of the existing towers [FA-81] was experiencing difficulties (lots of tower testing taking place recently). This morning the signal from tower [FA-81] appeared noticeably weaker than normal. By the end of the day a new tower [FA-80] (or at least a second repeater located at the same tower) was up and running. Currently, I am receiving all three repeaters. Tower [FA-80] may be a temporary tower/repeater until [FA-81] is fixed.

Shawn

 

[ScannerSK]

Used LoJack Vehicle Location Unit (VLU) purchased as an inexpensive LoJack Receiver

So, I purchased a used LoJack Vehicle Location Unit (VLU) some time ago for $10.00 on e-Bay plus a little for shipping. It has a Registration Number or Unit Label Number of 09912CE. I was considering placing it inside my vehicle however the seller never would advise if the original vehicle was still being driven or not. If yes, I would not want the thing to go off if the original VIN is ever reported as stolen. (That could cause the police some confusion to say the least.) If no, I could place it in my vehicle and have the police manually activate it if my vehicle were ever stolen.

For now, I just have it running inside the house during daytime hours to experiment with. I must be one of the only people in the country to have a LoJack VLU running inside their house.

If anything, used LoJack VLUs work great as high-quality LoJack receivers. However, there are some caveats. First, the receiver portion of LoJack VLUs (following synchronization) only turns on briefly to catch the start of each tower broadcast. Second, it will still be activated and begin to transmit police tracking signals (reply codes) if the original VIN is ever stolen. Third, there is no squelch control so constant static is received between transmissions.

With regards to the above caveats, I have determined in the model I purchased how to keep the receiver portion of the circuit active. And, by removing the power amplifier, this would prevent transmission of any vehicle tracking signals/reply codes. Squelch does not really come into play unless the audio signal is being recorded or monitored audibly so that is not a problem.

If you are looking for a good quality LoJack only receiver and have some "advanced" electronics know how a used LoJack VLU might be just the purchase for you!

Shawn
73s

 

[ScannerSK]

I recall about ten years ago monitoring the LoJack frequency and receiving not only towers but also constant transmissions from what appeared to be vehicle locating units. Does anyone else recall this? I wonder if LoJack use to have vehicles constantly sending out test transmissions in order to maintain tabs on what state different vehicles were located in should they require activation however due to privacy concerns later discontinued this practice? I wish I had kept some of those old recordings to see what has changed between then and now.

Shawn

 

[ScannerSK]

The deactivate command was just received. It appears the first attempt to activate the stolen vehicle transponder was at 6:13 AM and a deactivate command was first sent at 9:41 AM.

20150115	61302	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [74C1BF2]	VRC [2E] LRC [E1] CRC [7310]
20150115	61406	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [74C1BF2]	VRC [2E] LRC [E1] CRC [7310]
20150115	61509	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [74C1BF2]	VRC [2E] LRC [E1] CRC [7310]
20150115	94100	PASSED	FUNCTION: C-DEACTIVATE 	ADDRESS [74C1BF2]	VRC [6C] LRC [1E] CRC [F884]

The unusual Site ID began to be broadcast at 6:16 AM and ceased at 8:53 AM. At 9:08 AM there was a single transmission of another unusual Site ID:

20150115	90804	PASSED	FUNCTION: 8-SITE ID SITE [72-01] 	ADDRESS [39C7201]	VRC [48] LRC [22] CRC [357B]

This event was far enough South of my location that the speed up and/or rate change commands may have been issued from towers not capable of being received at my location.

Shawn

Reviewing audio recordings from the morning of this LoJack hit reveals it had a reply code of AD17U. The vehicle was entered as stolen at 6:08 AM. The first request from the tower for activation was at 6:13 AM. The final activation request was sent just two minutes later at 6:15 AM due to successful activation. This confirms the tower is receiving confirmation of successful activation. The vehicle was recovered unoccupied and running at 9:00 AM. Mention was made they were going to impound the vehicle and get the LoJack turned off. The first deactivation request was sent by the tower at 9:41 AM.

The only information missing appears to be the speed up/rate change commands. My assumption is those commands were broadcast only from the tower that received confirmation of successful activation which was too far from my location to be received. The only other possibility is that the unusual site ID was actually the speed up/rate change command. Currently, my assumption is the first scenario is correct that I was just too far from the towers to receive the speed up or rate change commands.

Shawn
73s

 

[ScannerSK]

Set Rate, Speed Up and Unusual Site ID notes

Reviewing data for the past 30 days reveals the following:

I had two verifiable set rate commands on two separate dates (1/6/15 and 1/10/15). The set rate commands were broadcast in both instances for a duration of 45-50 minutes and then ceased.

I had four verifiable speed up commands on four separate dates (12/17/14, 12/19/14, 12/24/14 and 1/4/15). The speed up commands were broadcast in all four instances for only 1-3 minutes and then ceased.

I am still researching the unusual site IDs which appear now and then. Some of the unusual site IDs appear to begin being broadcast following a successful activation (when specific activation commands for an address suddenly cease being broadcast) and to end either around the time the vehicle is recovered or at least before the deactivate commands are broadcast.

Shawn

 

[ScannerSK]

LoJack SafetyNet

For those interested in LoJack's SafetyNet I ran across the following regarding the wearable devices:

FCC OET Grantee Code YXV

In the test report it is stated that the type of modulation is "on off keying (OOK)" and the frequency range specified is once again 216.0125 - 216.9875 MHz.

There are several pictures of the actual devices with a frequency on each device.

In the "Client Instruction Page" a "VHF transmitter tester" is pictured which verifies the device is transmitting after changing the battery. At first I thought the tester was transmitting a signal to the wearable device however upon further inspection it appears the tester is only detecting the presence of RF energy in the frequency range of 216-217 MHz.

Shawn
73s

 

[ScannerSK]

Reply Codes, Mystery System, Speed-Up/Set Rate and Misc. Notes

Reply Codes
While in Denver Monday evening, I began to receive a faint LoJack tracking signal off in the distance while driving in the area where the mystery system is fairly strong. I drove around a bit and rather quickly came across the general area where the tracking signals were originating from. I recorded a sample of the tracking signal and analyzed it later when I arrived at home. It had the same exact format as the YouTube example previously discussed (Function F in SDRTrunk). On Tuesday morning while listening to Denver police on the scanner, I overheard the police mention receiving a LoJack hit in the same general area where I had previously picked up the tracking signals. They aired the reply code they were seeing in the area which matched what SDRTrunk showed as the reply code. This appears to confirm the decoding I had assumed was being used is correct and working properly in SDRTrunk. So apparently, Function E is still unknown while Function F is the true tracking pulses. This could be updated in SDRTrunk.

I did notify the police of the general area Monday evening. Hearing the police mention receiving it Tuesday morning, not too far from the same area, I re-checked the area I had heard it in and sure enough it was still going off so I contacted the police again. I never heard the police check the area on the scanner so am uncertain if they ever did. Sometime Tuesday evening Denver police were talking again about seeing the same LoJack hit and taking it out of the system due to a paperwork error. I notified a LoJack representative regarding the area I heard the tracking pulses in much of the time and have not heard back. It would be nice to hear the end of the story. I wonder what the likelihood is that an installer could mix up which LoJack units are installed in which vehicles? I have not heard of this before however I suppose it could happen.

Mystery System
I captured another 14 examples of the mystery system. All were the same bits as previous examples with the exception of two which I believe were due to noise/weak signal. While driving in South Denver I also received the mystery system fairly strong. Due to the distance involved this must be a second example of the same system. Unfortunately, I was unable to record an example for comparison. Possibly if I get down that way again, I'll have a chance to record a sample. My guess is that it would have the same pattern of bits.

Speed-Up/Set Rate
Several times, I noticed a change in the rate of the tracking signals being broadcast from the transponder going off in Denver between 15 second pulses to 1 second pulses. However, there were no corresponding speed-up or set rate commands in the tower data from my location. Another member in a Denver suburb was also recording tower data during this time as well and again there is nothing in his data in the way of speed-up or set rate commands near the time when they appeared to have taken place. So, the functions we have labeled as speed-up and set rate in SDRTrunk may not actually have anything at all to do with speed-up or set rate changes. Possibly these functions are only used for certain LoJack models? Or, possibly they could even be for another purpose altogether maybe even the activation of the medical tracking devices? I still believe there is some evidence in the tower data that the unusual site IDs may play a role in the speed-up of stolen vehicle tracking pulses. On days when there is not much activity, it is possible to see a specific address activated and later deactivated and also see unusual site IDs around the same time frame. I have manually decoded one of the unusual site ID frames and verified it is correct and not an artifact of SDRTrunk or my setup. The same unusual site IDs appear in the data from the member located in the Denver suburb as well.

An Idea
I had an idea. As tracking pulses end with a steady 1800 Hz tone of approximately 800 ms duration, would it be possible for a tone decoder to pick out the short burst of 1800 Hz tone and activate a notification of some type?

I think we are about at the end of discovering anything new with the standard LoJack system. Possibly SDRTrunk will one day have the capability to alert us of a reply code going off maybe by playing a .wav file or something down that line. It's not that important but would make for a nice feature.

Shawn
73s

 

[KE7IZL]

LoJack transmits GPS coordinates as well. How do you think the company knows where the car is? There's a GPS receiver attached to the LoJack transmitter. So you can get any car's GPS coordinates, I think, if that car has LoJack, just by decoding the LoJack signal (though this may be encrypted, in which case decrypting it would be illegal).

 

[ScannerSK]

LoJack transmits GPS coordinates as well. How do you think the company knows where the car is? There's a GPS receiver attached to the LoJack transmitter. So you can get any car's GPS coordinates, I think, if that car has LoJack, just by decoding the LoJack signal (though this may be encrypted, in which case decrypting it would be illegal).

Greetings,

The LoJack system was actually designed prior to the existence of GPS. It is based around use of the 422 Hz doppler shift carried on the tracking pulses to locate the vehicle as outlined in patent 4908629. Police cars equipped with LoJack typically have four antennas mounted in a square pattern atop the vehicle to properly decode the doppler shift technology used by the LoJack system.

Some of the LoJack commercials actually tout the fact that LoJack works where GPS cannot. Here is one such commercial: LoJack Commercial

There are many stolen vehicles being driven around the country which have LoJack installed that have not been recovered because no one knows where the vehicle is located. Some say this is outdated technology but it works. No other company can come anywhere close to the results that LoJack has achieved in stolen vehicle recoveries and with assisting police officers with safety by given them advanced warning of what they are up against before confronting the criminals. I was just reading where in 2013 alone LoJack assisted with the recovery of more than $121 million in stolen vehicles equipped with LoJack. Article Here. And, on the LoJack website it states, "The LoJack Stolen Vehicle Recovery System has been installed in over 9 million cars and light trucks worldwide and has helped law enforcement to recover over 300,000 vehicles to date globally."

Some of the newer LoJack models, typically those which offer the early warning system, appear to allow external devices to be connected to the LoJack transponder via RF/Wifi. The early warning system will notify the owner immediately if someone drives the vehicle without a special key fob inside the vehicle. Some type of GPS technology may be used in the external device as I recall reading that the vehicle is only allowed to move so many feet without the key fob inside the vehicle before the owner is notified. However, the backbone of the LoJack system itself is doppler shift based.

The standard LoJack system is not encrypted. A stolen vehicle only transmits a five-character code useful only to the police to obtain additional information regarding the vehicle and details surrounding the theft. There is no private or location based information transmitted so no real requirement for encryption. There are other competitors that do transmit GPS coordinates of stolen vehicles however their success rate is not that great.

Anyway, it is a good system. If I could afford it I would purchase one and have it installed in my truck. On rare occasions I have seen where they have given one away free in a contest.

Shawn
73s

 

[KE7IZL]

Greetings,

The LoJack system was actually designed prior to the existence of GPS. It is based around use of the 422 Hz doppler shift carried on the tracking pulses to locate the vehicle as outlined in patent 4908629. Police cars equipped with LoJack typically have four antennas mounted in a square pattern atop the vehicle to properly decode the doppler shift technology used by the LoJack system.

Some of the LoJack commercials actually tout the fact that LoJack works where GPS cannot. Here is one such commercial: LoJack Commercial

There are many stolen vehicles being driven around the country which have LoJack installed that have not been recovered because no one knows where the vehicle is located. Some say this is outdated technology but it works. No other company can come anywhere close to the results that LoJack has achieved in stolen vehicle recoveries and with assisting police officers with safety by given them advanced warning of what they are up against before confronting the criminals. I was just reading where in 2013 alone LoJack assisted with the recovery of more than $121 million in stolen vehicles equipped with LoJack. Article Here. And, on the LoJack website it states, "The LoJack Stolen Vehicle Recovery System has been installed in over 9 million cars and light trucks worldwide and has helped law enforcement to recover over 300,000 vehicles to date globally."

Some of the newer LoJack models, typically those which offer the early warning system, appear to allow external devices to be connected to the LoJack transponder via RF/Wifi. The early warning system will notify the owner immediately if someone drives the vehicle without a special key fob inside the vehicle. Some type of GPS technology may be used in the external device as I recall reading that the vehicle is only allowed to move so many feet without the key fob inside the vehicle before the owner is notified. However, the backbone of the LoJack system itself is doppler shift based.

The standard LoJack system is not encrypted. A stolen vehicle only transmits a five-character code useful only to the police to obtain additional information regarding the vehicle and details surrounding the theft. There is no private or location based information transmitted so no real requirement for encryption. There are other competitors that do transmit GPS coordinates of stolen vehicles however their success rate is not that great.

Anyway, it is a good system. If I could afford it I would purchase one and have it installed in my truck. On rare occasions I have seen where they have given one away free in a contest.

Shawn
73s

Maybe I'm getting LoJack confused with OnStar. I know that one of these (maybe it's OnStar) has the ability to send all kinds of telemetry data about your car (including I assume your car's GPS coordinates), and even allow voice communication with an OnStar employee when you press the special button called the "OnStar button". On the TV ads this voice communication feature is shown to be useful if you are ever in an accident. The device can basically be thought of as like an airplane's "black box", but for a car instead of a plane.

 

[ecps92]

Probably, someone forgot to CLEAR the vehicle from NCIC which was the paper error.

Since the Installer also will generally TEST the device to ensure it turns on (Activates) and turns off (DeActivates) the chance of the wrong Vehicle is unlikely. The chances of a department entering the wrong vehicle are higher and I've tracked more than one, where the Dept fat-fingered a VIN in the entry and activated the wrong car Try Looking for the Red Car when the activated one is Blue

Reply Codes

Sometime Tuesday evening Denver police were talking again about seeing the same LoJack hit and taking it out of the system due to a paperwork error. I notified a LoJack representative regarding the area I heard the tracking pulses in much of the time and have not heard back. It would be nice to hear the end of the story. I wonder what the likelihood is that an installer could mix up which LoJack units are installed in which vehicles? I have not heard of this before however I suppose it could happen.


Shawn
73s

 

[DSheirer]

Reply CodesSo apparently, Function E is still unknown while Function F is the true tracking pulses. This could be updated in SDRTrunk.

I'll get this updated in the next release.

I think we are about at the end of discovering anything new with the standard LoJack system. Possibly SDRTrunk will one day have the capability to alert us of a reply code going off maybe by playing a .wav file or something down that line. It's not that important but would make for a nice feature.

I've been thinking about how to implement something like this. I'm leaning towards extending the Alias code to let you define a command line program and alerting periodicity (once, every xx minutes, every time active, etc). When the alias is active it will execute the command line program (play a wave file, send a text message, start an external decoder, etc.). Subsequent alerts will be according to the periodicity.

Denny

 

[ScannerSK]

I'll get this updated in the next release.

I've been thinking about how to implement something like this. I'm leaning towards extending the Alias code to let you define a command line program and alerting periodicity (once, every xx minutes, every time active, etc). When the alias is active it will execute the command line program (play a wave file, send a text message, start an external decoder, etc.). Subsequent alerts will be according to the periodicity.

Denny

That sounds really good Denny. I'm not sure if it's any easier but another possibility would be if SDRTrunk were to call/run a pre-named batch file if a box is checked. The pre-named batch file could be programmed to process any number of actions.

There was another LoJack hit this morning near Denver that ended with a suspect at gunpoint. It made for interesting listening.

Shawn
73s

 

[ScannerSK]

LoJack and GPS

Maybe I'm getting LoJack confused with OnStar.

While we're on the discussion of GPS, LoJack appears to have announced this morning the availability of their new LoJack® Fleet Management Lite powered by TomTom. It appears they are getting more into the GPS market with some of their newer inventions.

Shawn

 

[ScannerSK]

LM567 to detect LoJack stolen vehicle tracking pulses

An Idea
I had an idea. As tracking pulses end with a steady 1800 Hz tone of approximately 800 ms duration, would it be possible for a tone decoder to pick out the short burst of 1800 Hz tone and activate a notification of some type?

I tried out an LM567 tone decoder circuit and it works! The best setting for the frequency appears to be at about 1792 Hz rather than right at 1800 Hz. If the sensitivity (volume into the circuit) is set too high it will trip on both tower bursts and stolen vehicle tracking pulses however if the sensitivity is adjusted just below where it trips on tower bursts then the circuit is only activated when stolen vehicle tracking pulses are received. This circuit could additionally be tied into an LM555 timer that trips a tape recorder or piezoelectric buzzer or other device for a set duration of time whenever a stolen vehicle tracking pulse is received.

Of course this circuit is only necessary in areas where tower data is received every 64 seconds. Throughout most of the United States LoJack does not have tower coverage so a person has only to enter the LoJack frequency (173.075 MHz) into their scanner and wait to receive stolen vehicle tracking pulses.

Shawn
73s