How to decode Lojack?

[ScannerSK]

I've attached the log files from todays events.

Hello PiccoIntegra,

I compared the results you posted in your zip file against my results from last night through this morning.

Matches were only found in the Function 2 and C lists.

For Function 2 there were 46 matches. You had 73 unique addresses and I had 169 unique addresses.

For Function C there were 3 matches. You had 40 unique addresses and I had 6 unique addresses (lower due to running the newer version SDRTrunk which eliminates FAIL CRCs). The matching IDs were EE00000, D5C0000 and 8586AA1. The first two are just common filler addresses so unimportant. We both received half a dozen or more 8586AA1 deactivate commands. So, we had one meaningful match in the Function C (deactivation) category.

Shawn

 

[ScannerSK]

what settings and such are you guys running in sdrtrunk to get this data?

Hi reconrider8,

On my end, I am simply running the audio output from a scanner into the audio input on my computer.

Settings:
Right click "Systems", add "New System",
Right click "New System", add "New Site",
Right click "New Site", add "New Channel"

Under "New Channel":
Source: Mixer/Sound Card
Decoder: NBFM / AFC checked / 3000 Hz
Aux: LJ1200 173.075 checked
Event Log: I only check the "Decoded Messages" (personal choice)
Record: nothing checked (personal choice)

Shawn

 

[reconrider8]

thinkj i like this idea better for my computer since sdr takes up so much memory i have it running on my desktop right. just let me know what you guys need as far as info and how to get the logs out

 

[ScannerSK]

I'm not entirely certain however it appears the same address may be used in both the activation and deactivation commands.

I was able to confirm today that the same address is indeed transmitted by the tower to both activate and deactivate specific LoJack transmitters.

This confirms what we are seeing in SDRTrunk where the same address is used to both activate units (Function 2) and also to deactivate units (Function C) at a later time.

Shawn

 

[ScannerSK]

just let me know what you guys need as far as info and how to get the logs out

I can think of two things that would be helpful both of which will likely take quite some time for someone to capture.

1.) To capture the full circle of events that occur in SDRTrunk: Activate Command (Function 2), Activation Confirmation from stolen vehicle, Tracking Pulses, Speed-Up and/or Rate Change Request and Deactivation Command (Function C).

2.) A high quality recording of the pulses transmitted "every second" by a stolen vehicle along with a known "reply code" (as may be overheard on the scanner when police first report it to dispatch). This will help to determine how the "reply code" is decoded and displayed on the screen.

In the mean time, I am just watching for anything different or unusual to appear in my logs and waiting for any stolen vehicles to drive down the nearby highway.

Shawn

 

[reconrider8]

yea im right down by I95 lol ill have to try it on my lappy and let it run a while

 

[PiccoIntegra]

yea im right down by I95 lol ill have to try it on my lappy and let it run a while

Are you near Raleigh or Fayetteville?

 

[PiccoIntegra]

I can think of two things that would be helpful both of which will likely take quite some time for someone to capture.

Hi Shawn

I've got a bunch more data from today if you want it. There is some small gaps between log files though. ~5 min gaps, Can't help that...

 

[reconrider8]

I'm actually in Roanoke rapids which is like 10miles south of the via line on i95

 

[PiccoIntegra]

I'm actually in Roanoke rapids which is like 10miles south of the via line on i95

You're 70+ miles from the neatest two towers, Durham and Raleigh. Might be out of range at your location...

 

[ScannerSK]

Here is a copy of the program (RecAllPRO version 1.2) I have used for over ten years to record sound automatically (sound activated). I use the older version as it has never expired. If anyone tries this program out and would like the settings I use just let me know. Currently, I am recording all the LoJack data bursts and then a few times a day I review the size of the files to look for any smaller sized files which could indicate a stolen vehicle pulse was received.

Update -- I just discovered Radioreference only allows 195 Kb uploads and the zip file for this program is over 400 Kb. If anyone would like a copy feel free to send me a private message through Radioreference with your e-mail address and I will forward a copy to you.

Shawn

 

[ScannerSK]

I've got a bunch more data from today if you want it. There is some small gaps between log files though. ~5 min gaps, Can't help that...

Hello PiccoIntegra,

For now, I don't require any additional data. I was just verifying whether some or all of the activation and deactivation requests were broadcast nationwide.

It appears many (upward of half or 50%) of the activation requests appear simultaneously across the country; these are likely the older activation requests. As for deactivation requests only 4-5% appear simultaneously across the country.

I would take this as an indication that deactivation requests are typically sent from towers nearest the vehicle location.

Shawn

 

[reconrider8]

PiccoIntegra i still get strong bursts up this way

 

[PiccoIntegra]

For now, I don't require any additional data. I was just verifying whether some or all of the activation and deactivation requests were broadcast nationwide.

Okie, no problem, I'm not going to gather any more data then. It's too much trouble keeping the app running. If you need more, just holler.

My local agency used to test/train LoJack all the time. But haven't heard a peep in a couple of years now. :/

 

[ScannerSK]

There was a dramatic scene involving LoJack in El Cajon California four days ago. There are a dozen videos regarding it on YouTube at the following link:
https://www.youtube.com/results?filters=week&search_query=lojack&lclk=week
The above link will show the story for the next few days after which it will become greater than a week old.

Shawn

 

[ecps92]

The 'box' is an RX device only. So the Towers really have No idea on which one is nearest to the vehicle, other than knowing the State who made the inquiry 'by Code' to NCIC

Hello PiccoIntegra,

For now, I don't require any additional data. I was just verifying whether some or all of the activation and deactivation requests were broadcast nationwide.

It appears many (upward of half or 50%) of the activation requests appear simultaneously across the country; these are likely the older activation requests. As for deactivation requests only 4-5% appear simultaneously across the country.

I would take this as an indication that deactivation requests are typically sent from towers nearest the vehicle location.

Shawn

 

[ScannerSK]

The 'box' is an RX device only. So the Towers really have No idea on which one is nearest to the vehicle, other than knowing the State who made the inquiry 'by Code' to NCIC

Hello,

By 'box' are you referring to the device hidden inside the stolen vehicle that transmits the tracking pulses upon activation? My LoJack unit (an IDIVLU-05) has a 2-watt RD02MUS1 power amplifier inside it however the FCC document shows it is limited to 1-watt.

With reference to how the towers appear to know where the vehicle is located here is a statement from one of the patents: "A typical locating unit is configured to transmit an activation acknowledgement message in response to the activation message." And later in the article, "In the vehicle locating unit, an activation message received is processed and an acknowledgement message is transmitted in response." Patent 20070066219

So, upon successful activation the vehicle locating unit (inside the stolen vehicle) transmits a notification to the towers that it was successfully activated. The tower then relays the successful activation details to the central computers which in turn submit a dequeue message to the tower to cease broadcasting activation signals. Once activated, the vehicle locating unit remains activated (transmits tracking pulses) whenever power is present until it successfully receives a deactivation command. The towers likely also pick up the 1-watt tracking pulses transmitted by the stolen vehicle, in addition to the acknowledgement message, to keep tabs on where the vehicle is located.

Shawn

 

[ecps92]

That must be the "Early Warning System" as the "Original" Lo/Jack is RX Only from the Towers and the TX is to the Tracking Devices (Cruisers and Helos)

Hello,

By 'box' are you referring to the device hidden inside the stolen vehicle that transmits the tracking pulses upon activation? My LoJack unit (an IDIVLU-05) has a 2-watt RD02MUS1 power amplifier inside it however the FCC document shows it is limited to 1-watt.

With reference to how the towers might know where the vehicle is located here is a statement from one of the patents: "A typical locating unit is configured to transmit an activation acknowledgement message in response to the activation message." Patent 20070066219

So, it appears upon successful activation the vehicle locating unit (inside the stolen vehicle) transmits a notification to the towers that it was successfully activated. The tower then relays the successful activation details to the central computers which then send a dequeue message to the tower to cease broadcasting activation signals. Once activated, the vehicle locating unit remains activated (transmits tracking pulses) whenever power is present until it successfully receives a deactivation command. The towers likely also pick up the tracking pulses, in addition to the acknowledgement message, transmitted by the stolen vehicle.

Shawn

 

[ScannerSK]

That must be the "Early Warning System" as the "Original" Lo/Jack is RX Only from the Towers and the TX is to the Tracking Devices (Cruisers and Helos)

Hello,

No mention of the early warning system is mentioned in the patent which states it relates primarily to the, "applicant's successful and popular vehicle recovery system sold under the trademark LoJack®..."

It appears the original LoJack may have been updated to include the ability of vehicle transponders to send an activation acknowledgement message to the tower. I also recall reading that the towers have the capability to receive the tracking pulses from stolen vehicles however I cannot locate the statement to verify its accuracy or authenticity.

Shawn

 

[reconrider8]

do i need to save my log in anyway on sdrtrunk or is it automatic