How to decode Lojack?

[ScannerSK]

LoJack Activation Errors?

I spent some time this evening listening to corresponding archived scanner feed audio for function 8 speed up requests noticed in the LoJack tower data over the past several months. I came across one LoJack hit in which police dispatch were advised the vehicle was not stolen and that LoJack was sending out a deactivation request.

I wonder how many LoJack units are activated in error by noise or improper decodes? I recall seeing another post on this subject somewhere where someone advised they were constantly chasing down LoJacks that were going off in error.

Shawn

 

[ScannerSK]

Oddball Site IDs

I have noticed two types of oddball site IDs that do not seem to fit into any category.

The first one is site ID 72-01. Site ID 72-01 frames are transmitted among the other frames by the normal towers. 72-01 site ID frames are sent with a different address each time. I have noticed 72-01 frames in my data and also in the data of a member in Florida so these must be occurring nationwide. We even had matches in the addresses. Whether this is a quirk in the system and these are being transmitted in error or whether they serve some purpose is unknown.

The second and third oddball site IDs are BA-40 and BA-81. These appear to be local in nature however something similar may be occurring nationwide. Notice these two oddball site IDs (BA-40 and BA-81) are similar to two of my normal local tower site IDs: FA-40 and FA-81 (B and F are four characters apart from each other which may prove true for other locations as well). The BA-40 and BA-81 frames always appear as the very first of the eleven frames in each tower data burst which is unusual and they always appear with the same identical address each time. Possibly this is the actual address of the tower? I just noticed both of these site IDs (BA-40 and BA-81) always have an address which begins with EBD.

FUNCTION: 8-SITE ID SITE [BA-40] ADDRESS [EBDBA40]
FUNCTION: 8-SITE ID SITE [BA-81] ADDRESS [EBDBA81]

I have never received a BA-80 site ID similar to my final normal tower site ID FA-80. Possibly this indicates that FA-80 is a called site and FA-40 and FA-81 are non-called (relay) sites?

Shawn
73s

 

[ScannerSK]

LoJack Alarm Batch File

Denny is currently working on updating SDRTrunk as time allows to include enhanced features which should allow commands to be carried out (such as playing a sound file) when speed up requests are received in the tower data or when reply codes are received from nearby stolen vehicles. While he is working on the updates to SDRTrunk, I have been experimenting this week with a batch file that does something similar.

How it works:
-The batch file combines all log files stored in the SDRTrunk event_logs folder into a single file on the desktop titled LoJack.log to improve efficiency.
-The batch file then searches LoJack.log for any speed up requests and if found plays the sound file. If none are found then it moves on to the next line.
-The batch file then counts all reply codes found in LoJack.log. If the count is greater than or equal to two (to help prevent false alarms) then it plays the sound file.
-If no speed up requests are found and if there are less than two reply codes then the process is repeated approximately 64 seconds later to capture and search through the new tower data that has been added to the current decoded_messages file (which updates every few minutes depending upon the number of frames being received every 64 seconds from the towers).

If anyone is interested in giving this a try I have attached my work in progress batch file. You will have to change every place the word "Shawn" occurs with your computer username.

Also, you will have to update the alarm line in the batch file which currently reads as follows:
start C:\Progra~2\WI54FB~1\wmplayer.exe C:\Windows\Media\LoJack~1.wav
The above line simply opens Windows Media Player on my computer and plays a sound file I stored in the Media folder.

A person could change the batch file to play a different sound for speed up requests than for reply codes or process any number of other commands with this file.

Personally, I use this batch file to notify me when police are tracking a LoJack signal within range of the local towers and also as notification when a stolen vehicle may be in my immediate area (which would be confirmed by seeing multiple occurrences of the identical reply code).

Shawn
73s

 

[ScannerSK]

LoJack Alarm Batch File

Updated batch file

 

[DSheirer]

I posted a new build (sdrtrunk_20150214_1656.zip) that contains a new Alias Actions feature. You can now assign an action to any alias so that when the alias becomes active, all alias actions will be executed. Actions include: beep, play audio file, execute script.

New user's manual wiki page: https://code.google.com/p/sdrtrunk/wiki/AliasAction

I also updated the alias user's manual page with an example of creating a lojack tower id alias that will match against any tower id, except the ones specified (see alias identifier wildcards): https://code.google.com/p/sdrtrunk/wiki/Alias

Denny

 

[ScannerSK]

I posted a new build (sdrtrunk_20150214_1656.zip) that contains a new Alias Actions feature. You can now assign an action to any alias so that when the alias becomes active, all alias actions will be executed. Actions include: beep, play audio file, execute script.

New user's manual wiki page: https://code.google.com/p/sdrtrunk/wiki/AliasAction

I also updated the alias user's manual page with an example of creating a lojack tower id alias that will match against any tower id, except the ones specified (see alias identifier wildcards): https://code.google.com/p/sdrtrunk/wiki/Alias

Denny

Thank you Denny!

I worked on creating an alias however appear to not have been successful. What drop down option would we select to add an Alias ID? LJ1200 173.075 does not appear in the drop down list. I believe this is where I am stuck.

Shawn

 

[DSheirer]

Thank you Denny!

I worked on creating an alias however appear to not have been successful. What drop down option would we select to add an Alias ID? LJ1200 173.075 does not appear in the drop down list. I believe this is where I am stuck.

Shawn

An Alias can be associated with as many identifiers as you want to define. For LoJack, you're looking to associate the site (tower) identifiers with an alias. Your site identifier can either match a specific tower, or it can match by not being in a list of site identifiers that you don't want to match against. The idea is to specify a list of the tower identifiers that you know exist, so that you can be alerted any time a new site identifier appears ... ie. the speed up function messages.

137 easy steps for setting up the new alias action feature for decoding lojack and being alerted to new tower ids (speed up messages):

Create an Alias List, Alias Group and LoJack Alias
1) Right Click on Alias Lists and create a new Alias List: 'LoJack List'
2) Right Click on LoJack Alias List and create an Alias Group: 'LoJack Group'
3) Right Click on LoJack Group and create an Alias: "LoJack Alias"

Add a Site Identifier to the LoJack Alias
4) Right Click on LoJack Alias and add new Site Identifier
5) Enter the Site Identifier value that you want to match: FA-40
Or, enter the Colorado sites that you DON'T want to match: (?!FA-40|FA-80|FA-81).*
6) Click Save in the site identifier configuration window.

Add an Alias Action to the LoJack Alias
7) Right Click on the LoJack Alias and add an alias action (beep, clip or script)
8) Configure the alias action (interval, period, file)
9) Click Save in the alias action configuration window.

Attach the Alias List to your decoding Channel configuration
10) In your decoding channel configuration window, select the LoJack Alias List from the drop-down box.
11) Save the channel configuration.
...
137) Start decoding

Denny

 

[ScannerSK]

Thank you, with the above instructions I was able to get sound alerts set up and running in SDRTrunk.

Does SDRTrunk currently support Track Pulse/Reply Codes as identifiers? The chance of a stolen vehicle with LoJack activated passing through my area is very slim however it might be nice to receive a notification for these as well just in case one did happen to pass by.

Shawn

 

[ScannerSK]

Speed-Up Coverage Area

I wonder what the typical coverage area in miles is for a speed up request? This may be dependent in part upon the type of terrain. In areas where mountain top repeaters can be utilized I imagine the coverage area would be greater than in areas where there are no mountain top repeaters.

Most speed up requests are broadcast from all three of my local towers however at times I am unable to locate which police department is tracking a specific stolen vehicle.

Possibly at some point data could be compared by members within 100-500 miles of each other to see how far outward speed up requests are broadcast.

Shawn

 

[ScannerSK]

LoJack Discovery - Change in format of Site IDs and Speed Ups

Denny brought to my attention on Friday that it appeared the previous three bits to the last bit in the address are always set to zero for reply codes, speed ups and site ids. I just got around to really processing this information this evening.

I discovered the reason for this is that all three (reply codes, tower site ids and speed up requests) are using the exact same identical bit format used to determine reply codes!

Take for example a stolen vehicle from January. The Function-8 speed up address was 43BEA91. The Function-F reply code being transmitted by the stolen vehicle was 5LCNL. These are both the same identical 28 address bits! So, in essence, the tower speeds up the stolen vehicle transponder by transmitting the same reply code that is being broadcast by the stolen vehicle!

The same holds true for Site IDs. Site IDs use the same bit format used to determine reply codes.

My local towers suddenly change to the following:

NEW SITE ID   OLD SITE ID
--YN1         FA-01 (Received only when I am in Denver)
--YN2         FA-80
--YN3         FA-81
--YN4         FA-40

So, YN represents the sector of towers where I am located of which I have received towers 1, 2, 3 and 4. It appears all Site IDs may have the letter Y as the middle character.

So, what this means is that all the Function-8 addresses need to be changed to the same format that is being used to display reply codes.

Sorry to make more work for you Denny. I hope this is an easy change in SDRTrunk.

Shawn

 

[ScannerSK]

Reply codes middle character

I went through all 39 stolen vehicle reply codes I have received since the middle of December. So far every available character for the middle character has been used with the exception of the following: D, E, M, P, Q, R, S, T, U, V, W, X, Y. (Y is likely only used for Site IDs as it is the last available character.) I assume the letters D, E and M are in use however that I have just not received an example on my end.

It appears reply codes are being assigned first from 0-9 and then from A-Y (B, I, O, Z are not used). It also appears they may currently be on the letter P in their assignment of reply codes.

Shawn

 

[ScannerSK]

I can receive ten transmitters in Eastern MA, RI, and NH.

030F or 01CE depending on the beam position
829E
029E
049E or 80CE depending on the beam position
019E
809E
849E
839E

I assume xx9E is MA, xxCE is NH (beam is towards the north), and xx0F is RI (beam is towards the south).

The next 4 bits are either 3, 7, B, or F. The lower two bits of the nibble are always set.

I noticed I will eventually receive most of the possible values for the lower 8 bits if I log for a long while.

73 Eric

Eric had a good example of site IDs in the above post. Using the Reply Code Format (R/C Format) the towers would be as follows:

[u]R/C Format[/u]      [u]Notes[/u]       [u]LSB[/u]     [u]MSB[/u]   
 --YH6      Rhode Island    030F   F0-C0

 --YD1      New Hampshire   80CE   73-01
 --YD2      New Hampshire   01CE   73-80

 --Y91      Massachusetts   809E   79-01
 --Y92      Massachusetts   019E   79-80
 --Y94      Massachusetts   029E   79-40
 --Y95      Massachusetts   829E   79-41
 --Y97      Massachusetts   839E   79-C1
 --Y98      Massachusetts   049E   79-20
 --Y99      Massachusetts   849E   79-21

So, in this example it appears Eric is able to receive tower 6 from the Rhode Island sector towers, towers 1 and 2 from the New Hampshire sector towers and towers 1, 2, 4, 5, 7, 8 and 9 from the Massachusetts sector towers.

The patent that refers to how towers are roughly set up is as follows Patent 7664462.

Shawn

 

[ScannerSK]

Speed-Up Coverage Area

This evening I noticed a speed-up/tracking request being issued by all three of my local towers. It turns out the LoJack hit was being tracked by police nearly 100 miles away. So, it appears identical speed-up/tracking requests (at least in the state of Colorado where we have mountain top repeaters) are broadcast out of every repeater in the state of Colorado.

Shawn

 

[ScannerSK]

Time lapse from a LoJack hit until tower speed-up transmitted

I have noticed that typically the time lapse between when an officer reports receiving a LoJack hit until the speed-up is issued by the tower is typically five minutes.

Shawn

 

[ScannerSK]

Police in pursuit of LoJack hits Radio Reference thread - Are you interested?

Does anyone have an interest in a Radio Reference thread in which links to scanner audio archives of police in pursuit of LoJack hits are shared? Premium membership is required to listen to feed archives.

The latest activity from here in Colorado was yesterday on the following feed:
Aurora, CO LoJack Hit 2/22/2015

The LoJack activity begins at about 12:20 on the right audio channel.

Shawn

 

[Dafe1er]

Does anyone have an interest in a Radio Reference thread in which links to scanner audio archives of police in pursuit of LoJack hits are shared? Premium membership is required to listen to feed archives.

The latest activity from here in Colorado was yesterday on the following feed:
Aurora, CO LoJack Hit 2/22/2015

The LoJack activity begins at about 12:20 on the right audio channel.

Shawn

I have been following this thread for a while now and think this would be a great idea. Especially after listening to how they worked it. Great grab. IMO.

 

[ScannerSK]

LoJack Police Pursuits - Scanner Audio Thread

I started a thread titled, "LoJack Police Pursuits - Scanner Audio" for those interested in this aspect of the hobby. The thread is located under the "General Scanning Discussion" category.

LoJack Police Pursuits - Scanner Audio

Shawn

 

[ScannerSK]

I ran across online documentation today which verifies that LoJack uses LSB first format. Currently, we have SDRTrunk set up to display using MSB format which is backwards.

I have forwarded the information to Denny in the hopes SDRTrunk can be updated to use LSB first format and also a fix implemented to the site IDs and speed ups (MSB Function 8 addresses) so they are displayed using the "reply code" format.

The above two changes should be the last major updates to SDRTrunk with regards to LoJack.

I hope these are not too time consuming to implement. I'm looking forward to the updates.

Shawn

 

[DSheirer]

I posted a new test build (20150225_2042_LJ1200_test.zip) with the following changes:

1) Address, CRC, Function, LRC, and VRC are now displayed in Big-Endian (LSB first) format.
2) The reply code and address are now shown for all messages. The reply code is labeled as either reply code or site id, depending on the message type
3) Function 1 (former function 8 site id) is now correctly identified as site or transponder.

The function codes are now:

F1_SITE_ID( "1Y-SITE ID" ),
F1_TRANSPONDER_REPLY( "1-REPLY CODE" ),
F2_TEST( "2-TEST" ),
F3_DEACTIVATE( "3-DEACTIVATE" ),
F4_ACTIVATE( "4-ACTIVATE" ),
FF_TRACK_PULSE( "F-TRACK PULSE" ),
UNKNOWN( "UNKNOWN" );

I also updated the aliasing. Use the SiteID identifier to specify site IDs and reply codes. Use the ESN identifier to specify any address value. Be sure to use a full 5 characters/wildcards for site id/reply code and use a full 7 characters for addresses.

Denny

 

[ScannerSK]

I posted a new test build (20150225_2042_LJ1200_test.zip) with the following changes:

1) Address, CRC, Function, LRC, and VRC are now displayed in Big-Endian (LSB first) format.
2) The reply code and address are now shown for all messages. The reply code is labeled as either reply code or site id, depending on the message type
3) Function 1 (former function 8 site id) is now correctly identified as site or transponder.

The function codes are now:

F1_SITE_ID( "1Y-SITE ID" ),
F1_TRANSPONDER_REPLY( "1-REPLY CODE" ),
F2_TEST( "2-TEST" ),
F3_DEACTIVATE( "3-DEACTIVATE" ),
F4_ACTIVATE( "4-ACTIVATE" ),
FF_TRACK_PULSE( "F-TRACK PULSE" ),
UNKNOWN( "UNKNOWN" );

I also updated the aliasing. Use the SiteID identifier to specify site IDs and reply codes. Use the ESN identifier to specify any address value. Be sure to use a full 5 characters/wildcards for site id/reply code and use a full 7 characters for addresses.

Denny

Wonderful job Denny! I am trying out the updated version of SDRTrunk currently and it appears to be working great.

I find it noteworthy that under MSB 1st format the function codes appear to be randomly spaced (2, 4, 8, C) however under LSB 1st format the function codes line up nicely all in a row (1, 2, 3, 4). This in and of itself appears to confirm LSB 1st format is the correct format.

It appears tower related function codes are being assigned beginning with the lowest values (functions 1, 2, 3, 4) while vehicle transponder related functions codes are being assigned working back from the highest values (function F).

As Denny mentioned, under LSB 1st format the function codes are different.

Function 1 = Site ID (when the 5-character address contains a letter 'Y' in the middle)
Function 1 = Speed-Up/Tracking Request (when the 5-character address contains a number or letter other than a 'Y' in the middle)
Function 2 = Tower test transmissions
Function 3 = Deactivations
Function 4 = Activations
Function F = Tracking pulses transmitted from stolen vehicle transponders

I noticed reply code addresses were added as a reference to the other function codes as well which is a nice feature just in case additional function codes (other than functions 1 and F) also use the reply code formatting as well.

Great work Denny!

Shawn