How to decode Lojack?

[ScannerSK]

I'm looking into why the test message fails the CRC (possibly this is intentional to prevent rebroadcast by other towers) and why the stolen vehicle tracking pulses on the YouTube example require correction on the Function Code part of the data most of the time.

It appears the Function 4 test message was designed to intentionally fail the CRC. I assume this is to prevent test messages from being rebroadcast by other towers. The CRC for the test message begins with a couple "1" bits and then trails off into fourteen "0" bits. A correct CRC would appear to be F92D if I did the math correctly rather than C000. It appears this message is broadcast by the towers to troubleshoot tower related issues. Reception of a Function 4 test message (with the three tones) is therefore likely an indication of tower related problems.

As for the stolen vehicle tracking pulses on the YouTube example, I find it rather unusual that every decode has to be corrected and none pass automatically. It appears what is being corrected in most instances is the forth bit in the function code (from a 0 to a 1). The function code that is being transmitted by the stolen vehicle unit is 1110 however for the CRC to match it must be corrected to 1111. I looked at the waveform of a strong pulse and the Function Code decodes out to 1110 (the "0" bit clearly being 1.5 cycles at 1623 Hz). The frequency is a little on the low side (1623 Hz instead of 1800 Hz) however there is a clear transition from 1200 Hz to 1623 Hz and a transition from the one cycle "1" bit to the one-and-one-half cycle "0" bit. I'm not sure what to make of this currently however thought it was worthy of mention.

One additional note of interest with regards to the vehicle tracking pulses, a total of one hundred extra "0" bits are broadcast at the end of each tracking pulse. I assume this is to assist the tracking unit to more accurately determine the signal strength and direction to the stolen vehicle.

Shawn

 

[ScannerSK]

Mystery LoJack System #2?

Hello,

Sometimes it pays to monitor the LoJack frequency while driving through a large city or down an interstate. You never know; you might just begin to receive stolen vehicle pulses (please record them and share if you do as I am collecting examples) or even something more mysterious!

While driving through a Denver suburb today (Thornton), I began to receive what I first thought were stolen vehicle tracking pulses. It turns out it is something altogether different, a mystery! (For those in the Denver area, one of the strongest locations of the pulses is near 7859 Washington Street, Denver, CO.) The signal can be received in at least a five to ten mile radius.

This signal is broadcasting out on the same frequency as LoJack (173.075 MHz) with the same 1200 baud rate and the same format of 1 cycle at 1200 Hz for a "1" bit and 1.5 cycles at 1800 Hz for a "0" bit. However, that is where the similarity appears to end.

Whatever this signal is it only broadcasts once every 15 minutes (4 times per hour). The format of the broadcast is as follows:
First, a transmission of approximately 2,366 "1" bits.
Next, a "01" bit pattern repeated 50 times.
Next, three separate but identical messages which each consists of 80 bits.
Last, a transmission of 524 "1" bits.

I decoded one message which occurred at 2:09 PM and another message which occurred at 2:54 PM and they were identical messages. I recorded a dozen examples however only took the time to manually decode two of them as I have no tool to automate the decoding of these signals. The current version of SDRTrunk is not capable of decoding this mystery LoJack signal as it does not begin with the standard short preamble (01010101) and flag (00001111).

For those interested, the decoded 240-bit message (apparently three 80-bit messages) is as follows:

00101010110101010101000010001100000000010000100011000000000100001000110000000001
00101010110101010101000010001100000000010000100011000000000100001000110000000001
00101010110101010101000010001100000000010000100011000000000100001000110000000001

Possibly a separate version of SDRTrunk that is capable of displaying all the bits in a burst without any exceptions would be helpful with investigating this mystery LoJack signal and also with viewing other LoJack signals such as the Function 4 test signals (which fail the CRC and are not displayed in the current version of SDRTrunk).

I have attached one of the better sound captures of this mystery LoJack signal.

Nothing is assigned in the FCC records to the LoJack frequency in the vicinity of the mystery transmissions. These mystery transmissions were noticed to trample over the standard LoJack transmissions on several occasions.

Does anyone have any ideas on what this is? Could it be a second LoJack system with a different format used in large cities to find something other than lost vehicles?

Shawn
73s

 

[ScannerSK]

Hello,

I found one patent (US 7518502 B2) that may or may not be related to this mystery signal. This patent at least mentions "LoJack" and the frequency of "173.075". It also appears this system could be sending an 80-bit message. Also, a fifteen minute polling time is mentioned.

This patent relates to tracking surgical assets.

I plotted out all the locations where this mystery signal was either weak or strong on a map. The four locations that had a fairly strong signal were all noticed within approximately 1-2 miles of a specific hospital (Vista View Care Center) which I did not realize at the time. The four different locations with a decent/strong signal were 1 mile to the NNE, 1 1/2 miles to the ESE, 1 mile to the South and 1 1/2 miles to the SW of this hospital. (Further to the North, South and West the signal appeared to vanish. To the East was a river I did not pass over).

My guess at the moment is that this mystery signal may be coming from the hospital. Once all the snow melts I'll take another short trip to check this theory out.

I thought only LoJack was on this frequency. I wonder if it is possible for other companies to operate on this frequency as well?

It may also be possible this signal could be related to another LoJack patent (US8169328) that is used to track people such as those with "Alzheimer's disease or an autistic child"? Possibly the hospital (also a care center) utilizes such a system to keep track of certain aforementioned patients... This patent (used to track people) mentions the following: "It is a further object of this invention to provide such a proximity monitoring and locating system which includes, as the locating component, several aspects of the applicant's successful and proven LoJack® system." And again, "Preferably, the locating unit includes several aspects of the applicant's successful and proven LoJack® system." It may be possible that the same frequency of 173.075 is used in this separate system.

Another patent down this same line:
US8350695

Shawn
73s

 

[DSheirer]

I posted a new build ( sdrtrunk_20141226_0838_lj1200_transponder_test.zip) that will decode these new messages. It will show in the messages tab as "TRANSPONDER TEST".

I'm passing all of these new messages as valid, so you may see noise (errant) messages appear until the CRC is figured out. Since it's a 64-bit message, it's probably 48 message bits and 15 or 16 CRC/parity bits.

I've wanted to add a generic 1200 FSK decoder that lets you specify the sync pattern and the message length, but I'll put that in the to-do hopper for now, since I'm in the middle of writing another decoder.

Denny

 

[ScannerSK]

I posted a new build ( sdrtrunk_20141226_0838_lj1200_transponder_test.zip) that will decode these new messages. It will show in the messages tab as "TRANSPONDER TEST".

I'm passing all of these new messages as valid, so you may see noise (errant) messages appear until the CRC is figured out. Since it's a 64-bit message, it's probably 48 message bits and 15 or 16 CRC/parity bits.

I've wanted to add a generic 1200 FSK decoder that lets you specify the sync pattern and the message length, but I'll put that in the to-do hopper for now, since I'm in the middle of writing another decoder.

Denny

Thank you Denny!

For those interested, this version of SDRTrunk will only work with the Mystery LoJack system. It will not work with the standard LoJack system.

I ran all the recordings of this broadcast I had noted through the Mystery LoJack SDRTrunk decoder and show the following results (at least one message appears to be significantly different):

09:04:13	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:04:13	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:04:13	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:04:00	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:04:00	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:04:00	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010001111111001111111111111111111111111110000100001000110000000001
09:03:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:35	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:35	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:35	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:26	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:26	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:11	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:10	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000010
09:03:10	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010111000010001100000000010000100011000000000100001000110000000001
09:03:01	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:03:01	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000010
09:03:00	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:02:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:02:47	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:02:47	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
09:01:40	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001

Shawn
73s

 

[JSTARS03]

Logs

SDRTrunk has been working flawlessly, if anyone wants the logs from Florida for further analysis let me know.

Thanks
JSTARS03

 

[EricCottrell]

SDRTrunk has been working flawlessly, if anyone wants the logs from Florida for further analysis let me know.

Thanks
JSTARS03

Hello,

What are the station ids that you are receiving?

73 Eric

 

[DSheirer]

Shawn,

Is the test build not decoding the normal lojack bursts? It's supposed to decode both. I'll run a test against some of the previous recordings to see what's going on and post a new build when I get it fixed.

 

[DSheirer]

New test build (sdrtrunk_20141227_2052_lj1200_transponder_test.zip) that decodes both the tower transmissions and the transponder transmissions.

Denny

 

[ScannerSK]

While in Denver I was receiving two additional station IDs.

Normal stations:
FA-40
FA-81

While in Denver also receiving:
FA-01
FA-80

Shawn

 

[ScannerSK]

New test build (sdrtrunk_20141227_2052_lj1200_transponder_test.zip) that decodes both the tower transmissions and the transponder transmissions.

Denny

Hi Denny,

The above sdrtrunk build works with both formats.

I have not confirmed this yet however I believe the mystery signals are also tower transmissions and not from transponders. It appears this may be a different type of LoJack system. I may have a chance to check out the signal again tomorrow to confirm whether it is from the hospital.

Shawn

 

[ScannerSK]

SDRTrunk has been working flawlessly, if anyone wants the logs from Florida for further analysis let me know.

Thanks
JSTARS03

Hello JSTARS03,

Here is a summary of what I noticed in your logs.

It appears you are receiving data from two strong towers:
FUNCTION: 8-SITE ID SITE [76-61]
FUNCTION: 8-SITE ID SITE [76-C0]

And one weaker tower:
FUNCTION: 8-SITE ID SITE [76-E0]

During the time the data was collected from approx. 3:46 PM 12/26 through 8:13 PM 12/27 I see two activations which became deactivations:

20141227	71253	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [6D0C84B]	VRC [F6] LRC [F7] CRC [58DA]
20141227	92924	PASSED	FUNCTION: C-DEACTIVATE 	ADDRESS [6D0C84B]	VRC [B4] LRC [08] CRC [D34E]

20141227	190419	PASSED	FUNCTION: 2-ACTIVATION 	ADDRESS [E512842]	VRC [24] LRC [7D] CRC [1078]
20141227	191803	PASSED	FUNCTION: C-DEACTIVATE 	ADDRESS [E512842]	VRC [66] LRC [82] CRC [9BEC]

Shawn

 

[ScannerSK]

After collecting data for several weeks, it appears Tuesday, Wednesday and Saturday are the days which have had the highest number of activations become deactivations. Possibly this corresponds to the days of the week most auto thefts occur?

Sunday had the lowest rate with only two activations which became deactivations on one Sunday.

Shawn

 

[mikewazowski]

I'm seeing FB C0 and FB A0 as site ID's up here in Canada.

 

[ScannerSK]

I have not confirmed this yet however I believe the mystery signals are also tower transmissions and not from transponders. It appears this may be a different type of LoJack system. I may have a chance to check out the signal again tomorrow to confirm whether it is from the hospital.

I had a chance to track down the mystery LoJack signal close to its source. Tracking the signal takes considerable time as the signal only broadcasts a short burst every fifteen minutes. It turns out that the source appears to be about three miles further to the NW of my original estimation. It appears to be originating from one of three tall radio towers in the area of W. 92nd Ave. and Federal Blvd. for those in the Denver area that which to pursue this further.

As to what purpose the signal serves remains unknown. Another user on one of the three towers transmits clock timing signals on a UHF based frequency. The possibility crossed my mind of this mystery LoJack signal being some type of timing signal for the LoJack towers.

As to why it is not showing as licensed with the FCC also remains unknown. As LoJack is a privately held company, I would assume the station would have to be licensed with the FCC to broadcast legally in the area from a radio tower.

The bursts from yesterday are similar to the previous bursts:

12:15:18	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:15:18	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:15:18	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:15:04	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000011
12:15:04	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:15:04	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:53	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010110000010001100000000010000100011000000000100001000110000000011
12:14:44	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:44	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101011101000010001100000000010000100011000000000100001000110000000001
12:14:44	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:31	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:31	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:31	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:21	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:21	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:10	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:10	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:10	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:57	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001001100000000010
12:13:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:18	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:17	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000010
12:13:17	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:12:54	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:12:54	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:12:54	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001

The one burst that was markedly different from the rest the other day (shown below) was due to part of the signal missing.

18:56:30	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010001111111001111111111111111111111111110000100001000110000000001

The spot in the recording with no sound appears to have been filled in with "1" bits. So, it appears all the transmissions which have been strong enough to decode are basically identical. The few bits that are different are likely due to noise in the signal/recording.

Otherwise, there is nothing more to report regarding this mysterious LoJack signal. I don't get into Denver too often so will likely not have anything else to report on this signal.

Shawn

 

[RFI-EMI-GUY]

A thought comes to mind that LoJack might install fixed beacons at predetermined locations to help calibrate the receivers in the squad cars. For example, assuming the LoJack receivers are augmented with GPS, the availability of a beacon transmitter helps improve the resolution.

Say for example that a squad car is exactly west of a beacon site (90 degree radial toward beacon) and its doppler system resolves 85 degrees, the receiver knowing its GPS location, and that of the beacon, can adjust the phasing of the antennas to eliminate errors due to the antenna placement on the body of the vehicle.

I had a chance to track down the mystery LoJack signal close to its source. Tracking the signal takes considerable time as the signal only broadcasts a short burst every fifteen minutes. It turns out that the source appears to be about three miles further to the NW of my original estimation. It appears to be originating from one of three tall radio towers in the area of W. 92nd Ave. and Federal Blvd. for those in the Denver area that which to pursue this further.

As to what purpose the signal serves remains unknown. Another user on one of the three towers transmits clock timing signals on a UHF based frequency. The possibility crossed my mind of this mystery LoJack signal being some type of timing signal for the LoJack towers.

As to why it is not showing as licensed with the FCC also remains unknown. As LoJack is a privately held company, I would assume the station would have to be licensed with the FCC to broadcast legally in the area from a radio tower.

The bursts from yesterday are similar to the previous bursts:

12:15:18	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:15:18	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:15:18	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:15:04	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000011
12:15:04	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:15:04	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:53	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010110000010001100000000010000100011000000000100001000110000000011
12:14:44	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:44	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101011101000010001100000000010000100011000000000100001000110000000001
12:14:44	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:31	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:31	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:31	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:21	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:21	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:10	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:10	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:14:10	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:57	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001001100000000010
12:13:48	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:18	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:13:17	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000010
12:13:17	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:12:54	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:12:54	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001
12:12:54	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010101000010001100000000010000100011000000000100001000110000000001

The one burst that was markedly different from the rest the other day (shown below) was due to part of the signal missing.

18:56:30	LJ-1200	UNKNOWN	TRANSPONDER TEST	00101010110101010001111111001111111111111111111111111110000100001000110000000001

The spot in the recording with no sound appears to have been filled in with "1" bits. So, it appears all the transmissions which have been strong enough to decode are basically identical. The few bits that are different are likely due to noise in the signal/recording.

Otherwise, there is nothing more to report regarding this mysterious LoJack signal. I don't get into Denver too often so will likely not have anything else to report on this signal.

Shawn

 

[RFI-EMI-GUY]

Which brings me to another question. Is LoJack using any fixed tracking stations?

Are they receiving bearings back in real time from DF vehicles?

They can perform triangulation and get a better fix on a target.

 

[ScannerSK]

A thought comes to mind that LoJack might install fixed beacons at predetermined locations to help calibrate the receivers in the squad cars. For example, assuming the LoJack receivers are augmented with GPS, the availability of a beacon transmitter helps improve the resolution.

Say for example that a squad car is exactly west of a beacon site (90 degree radial toward beacon) and its doppler system resolves 85 degrees, the receiver knowing its GPS location, and that of the beacon, can adjust the phasing of the antennas to eliminate errors due to the antenna placement on the body of the vehicle.

Which brings me to another question. Is LoJack using any fixed tracking stations?

Are they receiving bearings back in real time from DF vehicles?

They can perform triangulation and get a better fix on a target.

From everything I have read my understanding is the standard LoJack system does not utilize GPS at all except possibly to set the exact time used by the towers.

The Network Repeater Unit states the towers can receive the reply codes and relay them. So, it appears the newer LoJack repeaters are all capable of functioning at least as fixed receiving stations but I believe that is about the limit of their capabilities with very little if any triangulation capabilities.

The stolen vehicles emit pulses which are tracked by receivers simply via the 422 Hz doppler shift carried on the stolen vehicle pulses (patent 4908629). The direction finding/tracking occurs in real time. The direction finding/tracking receivers do not communicate with the towers. From what I understand there is no triangulation taking place; it is all based on tracking via signal strength and direction via the 422 Hz doppler shift.

There is one YouTube video I have run across that states triangulation is used however this is really misinformation in my opinion as the LoJack system is based off doppler shift calculations. My guess is the car dealership created this video assuming it worked off triangulation without the understanding that it actually works based on doppler shift tracking.

Shawn

 

[ScannerSK]

I ran across one document today where LoJack was petitioning the FCC to use the same frequency of 173.075 for LoJack's SafetyNet which is used to recover at risk people.

I'm still thinking this may explain what the other system is used for near Denver.

Shawn

 

[ecps92]

Last I knew, SafetyNet is still 200 Mhz as most of the LE around here have the 200 Mhz Beams

I ran across one document today where LoJack was petitioning the FCC to use the same frequency of 173.075 for LoJack's SafetyNet which is used to recover at risk people.

I'm still thinking this may explain what the other system is used for near Denver.

Shawn