How to decode Lojack?

Status
Not open for further replies.

SCPD

QRT
Joined
Feb 24, 2001
Messages
0
Location
Virginia
Hearing data bursts on 173.075 (lojack telemetry).
I have got a recording here: https://docs.google.com/open?id=0B4TfkZEkxmOYUjFrZDNrX0pSTE9BRGIzU09JdDd1UQ

The modulation format is CPFSK / FSK?
1200bd, Binary 0 = 1.5 cycles @ 1800Hz, Binary 1 = 1 cycle @ 1200Hz

Zooming into the audio sample in audacity
30sko5j.jpg


Is there any free program / way to decode this or maybe some sort of universal fsk decoder?
 

kma371

QRT
Joined
Feb 20, 2001
Messages
6,204
Get a LoJack receiver :)

What you are hearing probably isn't a LoJack from a car. Its likely the main tower polling.
 

SCPD

QRT
Joined
Feb 24, 2001
Messages
0
Location
Virginia
"Get a LoJack receiver

What you are hearing probably isn't a LoJack from a car. Its likely the main tower polling."

Lojack receivers are only rented out to police departments by lojack. It mentioned somewhere that cars with lojack will sent out a signal every x seconds. Anyone else?
 

Confuzzled

Member
Joined
Aug 16, 2008
Messages
704
LoJack is a private company, so their communications are proprietary. Not a good idea to try and hack them.

You wouldn't get much anyways. All the vehicle transmitters send is a an ID code. All the vehicle data is stored at the company. All the PD unit gets is a beep signal and the ID displays on the receiver with a directional arrow.

The PD unit has to contact the company to find out what they're tracking and what kind of vehicle they're looking for.

Unless you have access to the company's database, you won't know anything even if you did hack the signal so you could read the codes.
 

RadioDitch

Signals Identification Member
Premium Subscriber
Joined
Jan 24, 2010
Messages
3,074
Location
All over the map.
It mentioned somewhere that cars with lojack will sent out a signal every x seconds. Anyone else?

Per FCC §90.20(e)(6) regarding LoJack and other SVRS's...

Mobile transmitters operating on this frequency are limited to 2.5 watts power output and base transmitters are limited to 300 watts ERP. F1D and F2D emissions may be used within a maximum authorized 20 kHz bandwidth. Transmissions from mobiles shall be limited to 200 milliseconds every 10 seconds, except that when a vehicle is being tracked actively transmissions may be 200 milliseconds every second. Alternatively, transmissions from mobiles shall be limited to 1800 milliseconds every 300 seconds with a maximum of six such messages in any 30 minute period. Transmissions from base stations shall be limited to a total time of one second every minute.
 

kma371

QRT
Joined
Feb 20, 2001
Messages
6,204
"Get a LoJack receiver

What you are hearing probably isn't a LoJack from a car. Its likely the main tower polling."

Lojack receivers are only rented out to police departments by lojack. It mentioned somewhere that cars with lojack will sent out a signal every x seconds. Anyone else?

It was a joke, hence, the smiley face.

Anyway, like the others said. It's proprietary so unless you have their receiver, you probably won't be able to decode it.
 

mancow

Member
Database Admin
Joined
Feb 19, 2003
Messages
6,879
Location
N.E. Kansas
It would be nice to see what numbers they are sending. I have heard it here too but we have no receivers. We could at least call the company and they could tell us what the description is so we know what kind of vehicle to look for.
 

ecps92

Member
Joined
Jul 8, 2002
Messages
14,360
Location
Taxachusetts
The PD has NO interaction with the company, unless the Device being tracked, or the tracker is defective.

When a mobile unit picks up the code, they radio Dispatch or log into the MDT/MDC [your terminology will vary - but the mobile computer] and Query the 5 Character Alpha-Numeric Code, which returns an NCIC Hit with the Vehicle information.

LoJack is a private company, so their communications are proprietary. Not a good idea to try and hack them.

You wouldn't get much anyways. All the vehicle transmitters send is a an ID code. All the vehicle data is stored at the company. All the PD unit gets is a beep signal and the ID displays on the receiver with a directional arrow.

The PD unit has to contact the company to find out what they're tracking and what kind of vehicle they're looking for.

Unless you have access to the company's database, you won't know anything even if you did hack the signal so you could read the codes.
 

SCPD

QRT
Joined
Feb 24, 2001
Messages
0
Location
Virginia
Thanks for the all the info. It looks like I need a custom receiver but does anyone still know of a Universal Fsk Decoding/Demodulating program?
 

KB0VWG

Member
Joined
Apr 9, 2006
Messages
535
Location
Lyford, Texas
I hear it too

I hear the same sound on that freq from time to time, I left one of my scanners locked on that freq for a few days and I did hear a blurp or data burst every once in a while. I live out in the middle of nowhere and the closest town to me is 10 miles away.
kb0vwg
wqoi992
 

kma371

QRT
Joined
Feb 20, 2001
Messages
6,204
i had heard and still read that the cops get it for free. it is the customer that pays.

That's correct. LoJack donates the equipment to law enforcement. My department has about 10 cars outfitted.
 

K5MPH

Member
Joined
Jul 16, 2003
Messages
1,622
Location
Brownsville Texas,On The Border By The Sea.
I hear the same sound on that freq from time to time, I left one of my scanners locked on that freq for a few days and I did hear a blurp or data burst every once in a while. I live out in the middle of nowhere and the closest town to me is 10 miles away.
kb0vwg
wqoi992

hay michael this is kb5zcs in brownsville just wanted to say hi..........
 

DSheirer

Member
Premium Subscriber
Joined
Feb 15, 2010
Messages
572
Location
Fulton, NY
Attached is a zipped .wav file with two good LoJack examples from here in Colorado.

It should be fairly easy to demodulate the signal with the right program.

Shawn

Thanks Shawn, great recordings!

Your recording has the same sync patterns as the original (clipped) one posted at the beginning of this thread.

I posted a new build of sdrtrunk (20141115_2223.zip). If you want to try it, use the NBFM decoder and the new LJ1200 aux decoder. Select log binary messages and then post the output logs here or PM me. I haven't figured out the CRC yet, so there may be bogus messages output from the decoder.

Denny
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,340
Location
Weld County, Colorado
Hi Denny,

I had a chance to delve into LoJack signals more closely this evening. I noticed both my recordings had the same pattern of bits at the start of each message. This reminded me of the National Weather Service specific area message encoding (S.A.M.E.) which includes a preamble at the beginning of every message.

Searching US patents on the hunch that LoJack signals may include a preamble, I located the attached LoJack patent which outlines the message format. Each transmission starts with 24ms of silence (un-modulated audio) which I may have cut off on my files. Following this, there is a 48-bit preamble for a duration of 40ms which consists of 010101 bits (starting with 0 and ending with 1). (One cycle at 1200 Hz represents the 1 bit and one and one-half cycles at 1800 Hz represents the 0 bit.)

Following the 48-bit preamble there is a Flag which consists of the bits 00001111. After this follows a 64-bit message referred to as message one. Following message one, there is a short preamble consisting of eight bits 01010101 after which the Flag follows again consisting of eight bits 00001111. After this follows the second 64-bit message. This continues for up to eleven messages.

So far, this is what I have determined however I am still in the process of digesting the patent. I downloaded your program sdrtrunk and will attempt to give it a try in Windows. If all else fails, I have enough information to determine the bits in the LoJack signal longhand to ascertain whether the data is sent in ASCII or possibly a proprietary format.

Shawn
KB0LSW
 
Last edited:
Status
Not open for further replies.
Top