How to decode Lojack?

[ScannerSK]

Function 2 (MSB) Comparisons

If anyone would like to verify we are receiving the same addresses in SDRTrunk across the county here are a few addresses which appeared on the 11th and 12th and have not been cleared as of this morning. These appear as Function 4 addresses in SDRTrunk.

Dec. 11th new addresses not yet cleared:
ADDRESS [3CE34C2]
ADDRESS [659699C]
ADDRESS [6E1914F]
ADDRESS [74DC987]
ADDRESS [77982D9]
ADDRESS [9631AE6]
ADDRESS [99B27AE]
ADDRESS [BDCD20E]
ADDRESS [C2A12DB]
ADDRESS [CC6D36B]
ADDRESS [DB975EF]
ADDRESS [F0A0A5F]

Dec. 12th new addresses not yet cleared:
ADDRESS [3D83120]
ADDRESS [65EAC89]
ADDRESS [84FC102]

I would be interested to know if anyone is seeing any of these same addresses?

73 Shawn

 

[DSheirer]

Shawn/Eric,
Sorry for the delay ... I posted a new build of sdrtrunk (sdrtrunk_20141214_1812_LJ1200_TEST.zip). I flipped all of the fields to use little endian format (MSB first) and I created an enum of the Function codes that you guys have recovered so far.

For Function 8 Site ID, I added SITE [NN-SS]. You can also create an alias list to attach to your decoder and include a Site ID alias to have the site name/label included in the parsed messages. I also left the ADDRESS [ xxx ] parsing in the site id messages for now, so that you guys can double check that I'm parsing the network and site values correctly.

If I've crossed wires or mixed up something in the process of flipping the bits around, please let me know and I'll correct it.

Denny

 

[ScannerSK]

Hi Denny,

Your hard work is appreciated! From what I can tell everything is being decoded properly (as we currently understand it). I'm starting a new spreadsheet this evening to keep track of the results here in Colorado.

Shawn

 

[ScannerSK]

Function 2 (activation) comparisons

With the updated release of SDRTrunk now in MSB format, the following is the list of Function 2 (activation) addresses that I would be curious to know if anyone else notices across the country:

Dec. 11th new addresses not yet deactivated:
ADDRESS [432C73C]
ADDRESS [39969A6]
ADDRESS [F289876]
ADDRESS [E193B2E]
ADDRESS [9B419EE]
ADDRESS [6758C69]
ADDRESS [75E4D99]
ADDRESS [704B3BD]
ADDRESS [DB48543]
ADDRESS [D6CB633]
ADDRESS [F7AE9DB]
ADDRESS [FA5050F]

Dec. 12th new addresses not yet deactivated:
ADDRESS [048C1BC]
ADDRESS [91357A6]
ADDRESS [4083F21]

My hopes are that we will be able to determine whether the activation requests are broadcast nationwide.

Shawn

 

[PiccoIntegra]

I can only run the app for about an hour before it kills the CPU. But I did run it for a while tonight and seen some of those addresses pop up here in Texas.

The ones denoted with an asterisk are the matching addresses

20141214 212528,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [216C921] VRC [A0] LRC [EA] CRC [1E28]
20141214 212641,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [380D33F] VRC [74] LRC [88] CRC [F730]
20141214 212721,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [4C1E4D4] VRC [23] LRC [84] CRC [7120]
*20141214 212721,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [DB48543] VRC [9A] LRC [F8] CRC [14B3]
20141214 212721,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [38D82CE] VRC [4E] LRC [0F] CRC [4FA2]
*20141214 212721,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [39969A6] VRC [C6] LRC [E6] CRC [FE6D]
20141214 212745,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [BC0DAB6] VRC [9C] LRC [B6] CRC [5160]
20141214 212842,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [C1670D0] VRC [FC] LRC [98] CRC [5153]
20141214 212850,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [528B543] VRC [5C] LRC [EE] CRC [8396]
20141214 212850,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [AB571EB] VRC [66] LRC [C0] CRC [CB0E]
20141214 212850,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [33D9883] VRC [FA] LRC [C4] CRC [FA3B]
*20141214 212930,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [048C1BC] VRC [D8] LRC [E0] CRC [05F0]
20141214 212931,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [BABB7DC] VRC [2E] LRC [A5] CRC [7F31]
20141214 212954,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [FEC81FF] VRC [6A] LRC [A3] CRC [5D5A]
20141214 213204,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [197B4FA] VRC [22] LRC [84] CRC [A9D5]
20141214 213204,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [DDB8122] VRC [00] LRC [81] CRC [C612]
20141214 213412,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [D6E4EBF] VRC [2E] LRC [21] CRC [2FBC]
20141214 213517,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [CE85DD2] VRC [56] LRC [FC] CRC [CB7C]
20141214 213702,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [0AAB2B0] VRC [48] LRC [3F] CRC [1DAA]
20141214 214431,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [15C9906] VRC [00] LRC [12] CRC [8474]
20141214 214432,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [0AF507F] VRC [4E] LRC [DB] CRC [CEB5]
20141214 220358,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [55DAE6C] VRC [74] LRC [6A] CRC [19C9]
*20141214 220358,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [D6CB633] VRC [90] LRC [23] CRC [30D7]
*20141214 220358,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [E193B2E] VRC [36] LRC [27] CRC [0B0E]
20141214 220358,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [7A8A592] VRC [AC] LRC [10] CRC [A109]
20141214 220504,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [73AD240] VRC [0C] LRC [E7] CRC [FE96]
20141214 220504,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [CB91B8E] VRC [E4] LRC [D6] CRC [6BBD]
*20141214 220632,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [9B419EE] VRC [D2] LRC [D9] CRC [74C7]
20141214 220712,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [E8B7DA6] VRC [84] LRC [D6] CRC [0EA6]
*20141214 220816,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [4083F21] VRC [A0] LRC [83] CRC [3F8E]
*20141214 220816,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [FA5050F] VRC [C6] LRC [02] CRC [7CFE]
20141214 221128,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [6DB3FD2] VRC [44] LRC [E7] CRC [07F0]
20141214 221337,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [4C60FF2] VRC [0A] LRC [A3] CRC [09B5]
20141214 221337,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [0C7044A] VRC [78] LRC [B7] CRC [DDC3]
*20141214 221655,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [704B3BD] VRC [30] LRC [AF] CRC [1D9F]
20141214 222008,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [F714B82] VRC [44] LRC [03] CRC [54C0]
20141214 222008,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [44945A1] VRC [3C] LRC [ED] CRC [DFBB]
20141214 222538,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [B705C71] VRC [24] LRC [8B] CRC [46BB]
20141214 222643,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [42784B9] VRC [8E] LRC [6E] CRC [3262]
20141214 223004,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [0130CBE] VRC [66] LRC [E1] CRC [9EFE]
20141214 223437,PASSED,FUNCTION: 2-ACTIVATION ADDRESS [A719684] VRC [44] LRC [FF] CRC [4AFC]

Misc stuff:

20141214 213403,PASSED,FUNCTION: B-UNKNOWN ADDRESS [0745889] VRC [F8] LRC [3F] CRC [1BF0]
20141214 213517,PASSED,FUNCTION: D-UNKNOWN ADDRESS [5BF0B3A] VRC [D5] LRC [43] CRC [1774]
20141214 214031,PASSED,FUNCTION: D-UNKNOWN ADDRESS [7F4107F] VRC [B8] LRC [F7] CRC [80FF]
20141214 214652,PASSED,FUNCTION: 7-UNKNOWN ADDRESS [258DEC6] VRC [1F] LRC [86] CRC [07EF]
20141214 214806,PASSED,FUNCTION: E-UNKNOWN ADDRESS [1D3D1B4] VRC [83] LRC [FF] CRC [443E]
20141214 214808,PASSED,FUNCTION: 0-UNKNOWN ADDRESS [67C7F01] VRC [BE] LRC [38] CRC [A39D]
20141214 215537,PASSED,FUNCTION: 0-UNKNOWN ADDRESS [41C7F81] VRC [3E] LRC [2F] CRC [8BEB]
20141214 215640,PASSED,FUNCTION: 4-TEST ADDRESS [22E3F80] VRC [FC] LRC [B4] CRC [FF30]
20141214 215745,PASSED,FUNCTION: A-UNKNOWN ADDRESS [F993F2E] VRC [36] LRC [27] CRC [0B0E]
20141214 215754,PASSED,FUNCTION: B-UNKNOWN ADDRESS [0B89018] VRC [FF] LRC [8F] CRC [5C00]
20141214 220131,PASSED,FUNCTION: B-UNKNOWN ADDRESS [101BFC7] VRC [C7] LRC [50] CRC [9862]
20141214 221257,PASSED,FUNCTION: F-TRACK PULSE ADDRESS [EEE7FC1] VRC [9F] LRC [8C] CRC [C0ED]
20141214 222424,PASSED,FUNCTION: E-UNKNOWN ADDRESS [7D199FB] VRC [A4] LRC [7F] CRC [9F7F]

 

[reconrider8]

Lost? But I appreciate yalls hard work in trying to decode this. What are the known commands so far as far as a positive track/hit and do these go out system wide? I may grab SDR trunk and play with this some. Is there a link to the new trunk?

 

[ScannerSK]

I can only run the app for about an hour before it kills the CPU.

I wonder if you may need to update your Java version? If I remember correctly, I installed the JRE version of Java from the oracle website: Java Download

But I did run it for a while tonight and seen some of those addresses pop up here in Texas....

Thank you! You captured nine of the fifteen listed. After a few more hours you may have captured all fifteen. This confirms activate commands are issued across states and even nationwide. Possibly the initial activate commands are sent out from only the towers near where the vehicle was stolen and then distributed in an ever-broadening circle outward if no reply is received from the vehicle.

Misc stuff:

I would ignore most of the Misc. stuff unless the same address appears multiple times or there is some type of clear pattern worth investigating further. Also, it appears the FAIL CRC lines are inadvertently being added as PASSED in the Decoded Messages file with the current test version of SDRTrunk (see my updated post regarding this below).

Lost? But I appreciate yalls hard work in trying to decode this. What are the known commands so far as far as a positive track/hit and do these go out system wide? I may grab SDR trunk and play with this some. Is there a link to the new trunk?

LoJack is quite a system; it's amazing what all can be accomplished with a string of 1s and 0s. The mastermind behind the system invented it first as a means of giving law enforcement advanced warning of what they were potentially up against (to help protect law enforcement) and second as a means of recovering stolen vehicles.

My understanding is that once a vehicle is stolen the tower(s) near where the vehicle was stolen will first transmit the activation signal. If the stolen vehicle transponder does not reply after a given amount of time then the activation will be broadcast on a larger/broader scale (even nationwide at some point). Once the vehicle is activated the transponder will send out a confirmation of activation to the tower and will also start transmitting tracking pulses (once every fifteen seconds for many models). Once a police tracking unit decodes the "reply code", the reply code is run through the NCIC computers to obtain vehicle and activation details which in turn automatically notifies the LoJack system to send out a speed-up command to the vehicle (and also a land line dequeue message to the telephone connected towers which should have the effect of preventing further activation requests from being broadcast by any tower). At this point, the vehicle transponder enters tracking mode and begins to emit a tracking pulse approximately once per second for 30 minutes. If 30 minutes expires, it returns to the activated mode and only emits one tracking pulse per fifteen seconds (for many models) until police request another speed-up command be issued. The police request a recovery signal (deactivation command) to be sent once the vehicle has been recovered.

Currently, it would appear Function 3 or Function 6 is used for the speed-up command and Function F for the tracking pulses from the stolen vehicle however it's still a little bit early to tell for certain. At some point we will capture the full sequence of events and map out the process a little more clearly.

I'm not certain how the LoJack system knows what towers to issue the speed-up request from. The vehicle could potentially drive across the country in the activated state before the police receive the reply code and a speed-up request is transmitted. Possibly only the towers which cover the area of the office requesting a speed-up are activated? The patents may address this however I do not recall any specifics.

The link to the new SDRTrunk is as follows: SDRTrunk Website

Shawn

 

[ScannerSK]

Small glitch in new test version of SDRTrunk (sdrtrunk_20141214_1812_LJ1200_TEST)?

Hi Denny,

In SDRTrunk under the "Messages" tab I see the following while the program is running:

10:16:18	LJ-1200	FAIL CRC	FUNCTION: 5-UNKNOWN ADDRESS [8BEAFEF] VRC [0D] LRC [AC] CRC [7DEF]	01010101000011110000110110101100010110001011111010101111111011110111110111101111
10:10:58	LJ-1200	FAIL CRC	FUNCTION: F-TRACK PULSE ADDRESS [FFF3FFB] VRC [9F] LRC [8D] CRC [E3E0]	01010101000011111001111110001101111111111111111100111111111110111110001111100000
10:03:21	LJ-1200	FAIL CRC	FUNCTION: 5-UNKNOWN ADDRESS [8BEAFD3] VRC [0D] LRC [AC] CRC [FE3F]	01010101000011110000110110101100010110001011111010101111110100111111111000111111
09:56:23	LJ-1200	FAIL CRC	FUNCTION: F-TRACK PULSE ADDRESS [1C71E67] VRC [E6] LRC [87] CRC [637E]	01010101000011111110011010000111111100011100011100011110011001110110001101111110
09:52:49	LJ-1200	FAIL CRC	FUNCTION: 0-UNKNOWN ADDRESS [2786EEA] VRC [BB] LRC [F5] CRC [1E84]	01010101000011111011101111110101000000100111100001101110111010100001111010000100
09:51:45	LJ-1200	FAIL CRC	FUNCTION: 0-UNKNOWN ADDRESS [2786EAA] VRC [BB] LRC [F5] CRC [1ECD]	01010101000011111011101111110101000000100111100001101110101010100001111011001101
09:51:19	LJ-1200	FAIL CRC	FUNCTION: B-UNKNOWN ADDRESS [C79D87F] VRC [FF] LRC [3E] CRC [DF86]	01010101000011111111111100111110101111000111100111011000011111111101111110000110
09:48:49	LJ-1200	FAIL CRC	FUNCTION: 0-UNKNOWN ADDRESS [16707C7] VRC [82] LRC [2C] CRC [91FF]	01010101000011111000001000101100000000010110011100000111110001111001000111111111
09:48:26	LJ-1200	FAIL CRC	FUNCTION: 5-UNKNOWN ADDRESS [8BEAE7F] VRC [0D] LRC [AC] CRC [3F3F]	01010101000011110000110110101100010110001011111010101110011111110011111100111111

In the "Decoded Messages" file I find the following related lines:

20141215	101618	PASSED	FUNCTION: 5-UNKNOWN 	ADDRESS [8BEAFEF] VRC [0D] LRC [AC] CRC [7DEF]
20141215	101058	PASSED	FUNCTION: F-TRACK PULSE 	ADDRESS [FFF3FFB] VRC [9F] LRC [8D] CRC [E3E0]
20141215	100321	PASSED	FUNCTION: 5-UNKNOWN 	ADDRESS [8BEAFD3] VRC [0D] LRC [AC] CRC [FE3F]
20141215	95623	PASSED	FUNCTION: F-TRACK PULSE 	ADDRESS [1C71E67] VRC [E6] LRC [87] CRC [637E]
20141215	95249	PASSED	FUNCTION: 0-UNKNOWN 	ADDRESS [2786EEA] VRC [BB] LRC [F5] CRC [1E84]
20141215	95145	PASSED	FUNCTION: 0-UNKNOWN 	ADDRESS [2786EAA] VRC [BB] LRC [F5] CRC [1ECD]
20141215	95119	PASSED	FUNCTION: B-UNKNOWN 	ADDRESS [C79D87F] VRC [FF] LRC [3E] CRC [DF86]
20141215	94849	PASSED	FUNCTION: 0-UNKNOWN 	ADDRESS [16707C7] VRC [82] LRC [2C] CRC [91FF]
20141215	94826	PASSED	FUNCTION: 5-UNKNOWN 	ADDRESS [8BEAE7F] VRC [0D] LRC [AC] CRC [3F3F]

It appears the FAIL CRC lines are being added to the Decoded Messages file as PASSED when they were actually a FAIL CRC. This would likely explain the large number of Function 5 codes I began to receive with the new test version of SDRTrunk.

Shawn

 

[ScannerSK]

One of the LoJack towers at my location [FA-40] appears to have gone down as only one [FA-81] is currently on the air. It sounds as if a radio technician is keying up the tower attempting to work on it or get it running again.

The tower came back up for a short time after being down for 50 minutes and then went off the air again. After one hour of the tower being down, the LoJack signal with the three tones following the burst was received again on two occasions. After the second occasion, the tower that was off the air began to function again. So, it appears this Function 4 signal is used as some type of tower test or tower resynchronization signal.

12:54:06	LJ-1200	FAIL CRC	FUNCTION: 4-TEST ADDRESS [040C800] VRC [40] LRC [40] CRC [C000]	01010101000011110100000001000000010000000100000011001000000000001100000000000000
12:56:15	LJ-1200	FAIL CRC	FUNCTION: 4-TEST ADDRESS [040C800] VRC [40] LRC [40] CRC [C000]	01010101000011110100000001000000010000000100000011001000000000001100000000000000

As I'm typing it appears the tower went down again. I noticed the middle tone (1200 Hz tone) during both test broadcasts came across screechy and distorted sounding. I assume a problem receiving/transmitting the 1200 Hz tone explains why the tower is experiencing difficulties.

Shawn

 

[EricCottrell]

Hello,

Here are the addresses I saw while logging from the 11th to the 13th. I noted if other stations reported seeing the address. I noticed FEC81FF in PiccoIntegra's list with the same VRC and LRC while I have FEC81FE.

ADR	006EBE4	FUN	2	
ADR	0298B98	FUN	2	
ADR	048C1BC	FUN	2	ScannerSK PiccoIntegra
ADR	058B030	FUN	C	
ADR	060124F	FUN	2	
ADR	0972AA9	FUN	C	
ADR	0AAB2B0	FUN	2	PiccoIntegra
ADR	0AEB26E	FUN	3	
ADR	0AF507F	FUN	2	PiccoIntegra
ADR	0DBF61D	FUN	C	
ADR	0DC79CD	FUN	2	
ADR	0E49330	FUN	C	
ADR	0F2DE26	FUN	2	
ADR	11DC6DB	FUN	3	
ADR	11F57BA	FUN	2	
ADR	12A0071	FUN	C	
ADR	1314670	FUN	6	
ADR	143B716	FUN	C	
ADR	144C879	FUN	2	
ADR	186DF17	FUN	C	
ADR	197B4FA	FUN	2	PiccoIntegra
ADR	19E38B0	FUN	6	
ADR	1C1431C	FUN	2	
ADR	1EF9192	FUN	C	
ADR	1EFA192	FUN	2	
ADR	1FB96FC	FUN	2	
ADR	1FEF44C	FUN	C	
ADR	213F18F	FUN	2	
ADR	24144B0	FUN	6	
ADR	25561F6	FUN	2	
ADR	280C7C6	FUN	2	
ADR	28B0AE5	FUN	C	
ADR	2ADF06B	FUN	2	
ADR	33D9883	FUN	2	PiccoIntegra
ADR	3587B52	FUN	C	
ADR	364127F	FUN	2	
ADR	3943305	FUN	C	
ADR	395DBEA	FUN	2	
ADR	39969A6	FUN	2	ScannerSK PiccoIntegra
ADR	39EE230	FUN	6	
ADR	3B8BF92	FUN	2	
ADR	432C73C	FUN	2	ScannerSK
ADR	44EB9BD	FUN	C	
ADR	456415F	FUN	2	
ADR	458B8B1	FUN	C	
ADR	467ACCF	FUN	2	
ADR	4A5ADB0	FUN	6	
ADR	4A643CF	FUN	2	
ADR	4C60FF2	FUN	2	PiccoIntegra
ADR	4CE2D65	FUN	C	
ADR	4E4ADF1	FUN	2	
ADR	4FD19E1	FUN	C	
ADR	51C4957	FUN	2	
ADR	55191AB	FUN	C	
ADR	55315EF	FUN	2	
ADR	5612A1F	FUN	C	
ADR	5AB8131	FUN	2	
ADR	68691D9	FUN	C	
ADR	6AC46BB	FUN	2	
ADR	6C87962	FUN	C	
ADR	6D3EC19	FUN	2	
ADR	6DB3FD2	FUN	2	PiccoIntegra
ADR	6DB7EBE	FUN	C	
ADR	6EE9157	FUN	2	
ADR	708F970	FUN	6	
ADR	7218832	FUN	2	
ADR	73AD240	FUN	2	PiccoIntegra
ADR	772F3E0	FUN	C	
ADR	7888860	FUN	2	
ADR	7A8A592	FUN	2	PiccoIntegra
ADR	8200000	FUN	C	
ADR	8295154	FUN	2	
ADR	879F5B3	FUN	C	
ADR	87B6156	FUN	2	
ADR	8F35FE2	FUN	C	
ADR	91F3D12	FUN	2	
ADR	958321E	FUN	C	
ADR	963B90D	FUN	2	
ADR	A0DCFA4	FUN	C	
ADR	A3E4E83	FUN	2	
ADR	A413FA0	FUN	C	
ADR	A45799E	FUN	2	
ADR	A4F5A92	FUN	C	
ADR	A5486BD	FUN	2	
ADR	AAFC4D2	FUN	C	
ADR	AB571EB	FUN	2	PiccoIntegra
ADR	AEB6CFB	FUN	C	
ADR	AF0F779	FUN	2	
ADR	B848CE0	FUN	D	
ADR	B897C73	FUN	2	
ADR	BC0DAB6	FUN	2	PiccoIntegra
ADR	C19EEF7	FUN	C	
ADR	C288806	FUN	2	
ADR	C6D8A71	FUN	C	
ADR	C73E48E	FUN	2	
ADR	D4DF513	FUN	C	
ADR	D6CB633	FUN	2	ScannerSK PiccoIntegra
ADR	D6E4EBF	FUN	2	PiccoIntegra
ADR	D848583	FUN	C	
ADR	D91E679	FUN	2	
ADR	DA52F10	FUN	C	
ADR	DA6C664	FUN	2	
ADR	DAB1C8C	FUN	C	
ADR	DADF58D	FUN	2	
ADR	DC24670	FUN	6	
ADR	DCA5A54	FUN	2	
ADR	DDB8122	FUN	2	PiccoIntegra
ADR	E20C000	FUN	C	
ADR	E287B5E	FUN	2	
ADR	E8B7DA6	FUN	2	PiccoIntegra
ADR	ED03000	FUN	C	
ADR	ED51006	FUN	2	
ADR	ED51006	FUN	C	
ADR	ED806E8	FUN	2	
ADR	EF69B10	FUN	C	
ADR	F13C422	FUN	2	
ADR	F97B585	FUN	C	
ADR	F9CC85E	FUN	2	
ADR	FA71692	FUN	C	
ADR	FA8B11B	FUN	2	
ADR	FEC81FE	FUN	2	PiccoIntegra
ADR	FF5FD5E	FUN	C

73 Eric

 

[DSheirer]

It appears the FAIL CRC lines are being added to the Decoded Messages file as PASSED when they were actually a FAIL CRC. This would likely explain the large number of Function 5 codes I began to receive with the new test version of SDRTrunk.

I just posted a new LJ1200 test build (20141215_1857) to fix the issue.

I was over-riding the message isValid() method to always return true so that the 'Messages' window and the event loggers would not throw away any messages, until you guys could confirm that the CRC was working as intended.

The event logger tests the message for valid and logs it as PASSED. Thus, it was logging every message as passed.

The new version will only show CRC Pass and CRC Corrected messages and throw away any CRC Fail messages. In the event logs everything will show as PASSED.

Denny

 

[ScannerSK]

I noticed FEC81FF in PiccoIntegra's list with the same VRC and LRC while I have FEC81FE.

73 Eric

Hi Eric,

I show FEC81FE on my end as well noted 24 times between Dec. 10 and Dec. 14. I'm guessing that the FEC81FF was actually a FAIL CRC. The FAIL CRC are currently getting passed into the decoded messages file as PASSED.

I compared all my Function 2 addresses (213 total) between Dec. 10-14 against your Function 2 addresses (68 total) and show 30 as matching so about half of your addresses. We have repeaters atop 10,000+ feet high mountain tops which likely explains the larger number of addresses.

I'll work on a comparison of the Function 3, 6 and C as well.

73 Shawn

 

[ScannerSK]

Hi Eric,
I compared all my Function 2 addresses (213 total) between Dec. 10-14 against your Function 2 addresses (68 total) and show 30 as matching so about half of your addresses. We have repeaters atop 10,000+ feet high mountain tops which likely explains the larger number of addresses.

I'll work on a comparison of the Function 3, 6 and C as well.
73 Shawn

Part two:

Neither of the two Function 3 addresses on your list matched any on my list of 30 addresses.

None of the seven Function 6 addresses on your list matched any of the 21 addresses on my spreadsheet.

I compared all my Function C addresses (47 total) with your Function C addresses (44 total) and show only 2 as matching.

The Function D address on your list did not match any of my Function D addresses.

So, quite a few activations match however very few deactivations match and no Function 3, 6, C or D matched.

73 Shawn

 

[ScannerSK]

The new version will only show CRC Pass and CRC Corrected messages and throw away any CRC Fail messages. In the event logs everything will show as PASSED.
Denny

Hi Denny,

I think we are fairly safe not viewing the FAIL CRC items. The only valid FAIL CRCs currently are the Function 4 tests which so far have always consisted of the same identical message. The best of both worlds might allow the viewing of all items on the screen while the program is running (including FAIL CRC) however only save the PASS and CORRECTED items to the Decoded Messages file. Your latest update helps tremendously by removing the FAIL CRC items from the Decoded Messages file.

Thank you for the update Denny!

 

[ScannerSK]

Function 8 messages seem to be ID messages
xxCnnss Station ID
xxDnnss Station ID
xxEnnss Station ID
xxFnnss Station ID
where:
xx maybe a pseudo-random number to spread out the values of VRC and LRC?
nn is network and ss is site. Maybe ss = x0 are landline connected base stations?

Hello,

I started noticing a new Station ID [28-F0] today. It is being broadcast from both my local towers. This new Station ID appears sporadically in one of the middle slots among the existing FA-40 and FA-81 tower messages. The reason I mention this is that it does not follow the format of having a C, D, E or F as the third character. The following is one example of this new Station ID in the 4th message slot:

20:11:28	LJ-1200	PASS	FUNCTION: 8-SITE ID SITE [FA-81] ADDRESS [DBDFA81] VRC [84] LRC [20] CRC [9DF6]	01010101000011111000010000100000100011011011110111111010100000011001110111110110
20:11:28	LJ-1200	CORRECTED	FUNCTION: 8-SITE ID SITE [FA-81] ADDRESS [1FDFA81] VRC [A0] LRC [D3] CRC [5C88]	01010101000011111010000011010011100000011111110111111010100000010101110010001000
20:11:28	LJ-1200	PASS	FUNCTION: 8-SITE ID SITE [FA-81] ADDRESS [BCEFA81] VRC [22] LRC [55] CRC [244F]	01010101000011110010001001010101100010111100111011111010100000010010010001001111
20:11:28	LJ-1200	PASS	FUNCTION: 8-SITE ID SITE [28-F0] ADDRESS [70328F0] VRC [00] LRC [AC] CRC [6696]	01010101000011110000000010101100100001110000001100101000111100000110011010010110
20:11:28	LJ-1200	PASS	FUNCTION: 8-SITE ID SITE [FA-81] ADDRESS [8ADFA81] VRC [A6] LRC [46] CRC [8A92]	01010101000011111010011001000110100010001010110111111010100000011000101010010010
20:11:28	LJ-1200	PASS	FUNCTION: 2-ACTIVATION ADDRESS [092C575] VRC [E8] LRC [E3] CRC [BE5F]	01010101000011111110100011100011001000001001001011000101011101011011111001011111
20:11:28	LJ-1200	PASS	FUNCTION: C-DEACTIVATE ADDRESS [EE00000] VRC [66] LRC [F3] CRC [DF02]	01010101000011110110011011110011110011101110000000000000000000001101111100000010

Possibly this is related to the tower problems from earlier in the day?

73 Shawn

 

[PiccoIntegra]

I updated my java to the latest today, and got about nine hours worth of data. So thanks for that suggestion. One thing I'd like to see changed is flushing the log files. The log files are always cut short. Not a huge issue...

I've attached the log files from todays events. I'm seeing weird site ids too..

 

[ScannerSK]

I updated my java to the latest today, and got about nine hours worth of data. So thanks for that suggestion....

I've attached the log files from todays events. I'm seeing weird site ids too..

Hello,

You're welcome; I am glad updating Java worked for you. Also, there is another update to SDRTrunk (sdrtrunk_20141215_1857_LJ1200_Test.zip) which will prevent most of the UNKNOWN ADDRESS lines you are currently seeing (most if not all of which are actually failing the CRC verification check). The updated version will make a very noticeable difference.

SDRTrunk Website

I should have enough data by tomorrow morning to compare against your list.

Shawn

 

[PiccoIntegra]

I was using last nights test release when 1857 was posted. heh

 

[reconrider8]

what settings and such are you guys running in sdrtrunk to get this data?

 

[PiccoIntegra]

what settings and such are you guys running in sdrtrunk to get this data?

The attached tuner, assuming you're using an RTL device, will be detected automatically. Set the frequency to 173.1 MHz. You do not want to center tune to the LoJack frequency of 173.075. Also set the 'Correction PPM' for said dongle. I use a sample rate of 0.960 Mhz. I also use a gain of 444, which is 44.4.

Right click on 'Systems' to add a new system, then add a new site to that system, then add a channel to the new site.

In the Channel configuration, make sure the channel is enabled. Under the Source tab, select tuner as your source, and set the frequency to 173.075 MHz. Under the Decoder tab, select NBFM. In the Aux tab, check the 'LJ1200 173.075'. For the Event Log, I select all three options. These log files are where the data is logged.

You may need to adjust the tuner frequency after creating and enabling the LoJack channel. Just keep the channel out of imaging and other RF anomalies.