LoJack Question

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,458
Personally, I find reply codes and speed ups most useful and interesting. There is nothing more satisfying than hearing a distant stolen vehicle transponder breaking the squelch on my Motorola receiver, tracking down the approximate location and turning it into the police. The LoJack receivers installed in police vehicles actually suffer from RF overload much easier than professional radio receivers in RF rich environments which gives those using a professional radio receiver an advantage when it comes to tracking down stolen vehicles from a distance. A professional radio receiver can detect faint LoJack signals miles away in the distance which are not strong enough to even begin to be decoded by the LoJack receivers installed in police vehicles. I remember when the local LoJack liason made a company paid visit to me. One of the questions he asked was how I was finding the vehicles and turning them into the police. This happened shortly after I turned in a LoJack to the Denver police that could only be detected within a one block radius and which was not responding to tower speed up commands. I think the antenna must have been severed on the LoJack transponder and I can only assume they must have been looking for that vehicle for quite some time. Possibly the battery may have been nearly dead as well in the LoJack transponder.
...

My point was meant to be that I still think those are not being properly parsed. Although the current parsing you are doing is certainly useful, there are things about it that do not make sense (but do not affect its usefulness). I think if properly parsed, they would make more sense on paper.
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,449
Location
Weld County, Colorado
My point was meant to be that I still think those are not being properly parsed. Although the current parsing you are doing is certainly useful, there are things about it that do not make sense (but do not affect its usefulness). I think if properly parsed, they would make more sense on paper.
Assuming the newer versions of SDRTrunk still provide the reply code parsing for each line, you will notice that for the WNVD283 Aurora, IL tower mentioned that the last two characters of the reply code are 83 or 8-3 which matches your results. I've always just looked at the last two characters of the reply code provided automatically by SDRTrunk to differentiate between towers.

As 1.) tracking pulses, 2.) site IDs, 3.) tower commands and 4.) speed ups all have three of their address bits always set to 0, the assumption back in the day was that these specific commands were all using the exact same parsing. When it was verified the correct parsing had been determined for tracking pulses and then later for speed ups, it was logical to conclude site IDs were using the same parsing as they also had the same three bits always set to 0.

All other LoJack commands (tower test, deactivate, activate, quiet, alternate deactivate, etc.) utilize all 28-bits in their addresses (none of the bits are always set to 0) so these commands use a second different decoding scheme other than the one used for 25-bit tracking pulses and speed ups.

So, it is known there are at least two separate parsings of address bits being used by the LoJack system (one based around 25-bits and the other based around 28-bits).

It is certainly possible that the 25-bits in site ID addresses are being parsed yet a third way and not following the established parsing scheme being used to decode the 25-bits in tracking pulses and speed ups.

To keep things simple, SDRTrunk provided a verified reply code parsing for 25-bit addresses and a verified HEX parsing for 28-bit addresses. The 28-bit HEX parsing scheme used was deteremined based off actual screenshots of the working LoJack system provided in manuals to the FCC for functional equipment.

This is what I know. If anyone discovers something new regarding LoJack it would be interesting to look at it before it is turned off.

There is another part of the VHF LoJack system that nobody has ever decoded/parsed referred to as uplink transmissions (transmitted by vehicle transponders). These are transmitted at around 100 bits per second for a duration of 1.8 seconds. Most of these transmissions have to do with the early warning system and vehicle transponders acknowledging activations and deactivations with the LoJack towers. At this point, it's not worth the hassle of attempting to decode these however I thought it was worth a passing mention.
 
Last edited:

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,458
Assuming the newer versions of SDRTrunk still provide the reply code parsing for each line, you will notice that for the WNVD283 Aurora, IL tower mentioned that the last two characters of the reply code are 83 or 8-3 which matches your results. I've always just looked at the last two characters of the reply code provided automatically by SDRTrunk to differentiate between towers.
...

ers. At this point, it's not worth the hassle of attempting to decode these however I thought it was worth a passing mention.

Ok, I will have to try again looking at newer versions. The last version I tried to install, I could not get to work. So I stuck with my current. (I do not often trust what is in manuals as often that reflects hardware designed to look at systems or be easily analyzed (and usually in HEX) without really looking at what is in the designed electronic (and often not in HEX)--I have experienced that in *a lot* of similar signal analysis settings. People often analyze or display in HEX when the underlying is not really HEX--it is just convenient and "good enough" for their purpose. In this case, for site ID's IDs, it is clear to me that 5-bit coding is done, not 4-bit HEX. The rest might be in HEX, but a HEX display is not enough to convince me it originated as HEX due to prior experience with other systems.)

I wish I had decodes of vehicle responses but I have never seen one.
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,449
Location
Weld County, Colorado
I wish I had decodes of vehicle responses but I have never seen one.
Here is an example I recorded while in the Denver area. During seconds 13-15 the vehicle transponder transmitted an uplink/acknowledgement message to the tower that it had been successfully deactivated. This clip contains audio of the tracking pulses, the tower command to deactivate and then the uplink/acknowledgement message (seconds 13-15) transmitted by the vehicle transponder to the tower that it was successfully deactivated. I decoded the bits contained in a number of these vehicle uplink/acknowledgement responses however did not have the desire to pursue it any further. I believe battery status was one of the things that was stated to be transmitted in these uplink messages. Most of the uplink messages being transmitted to the towers from vehicle transponders is simply due to LoJack owners driving around without their early warning wireless key fob with them. This causes the vehicle transponder to send a message to the tower that the vehicle is being moved without the presence of the key fob inside the vehicle which then generates a notification to the owner of the vehicle if they have paid extra for that service.
 

Attachments

  • Deactivation Example (with acknowledgement message) (UU910).zip
    326.3 KB · Views: 6
Last edited:

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,458
Here is an example I recorded while in the Denver area. During seconds 13-15 the vehicle transponder transmitted an uplink/acknowledgement message to the tower that it had been successfully deactivated. This clip contains audio of the tracking pulses, the tower command to deactivate and then the uplink/acknowledgement message (seconds 13-15) transmitted by the vehicle transponder to the tower that it was successfully deactivated. I decoded the bits contained in a number of these vehicle uplink/acknowledgement responses however did not have the desire to pursue it any further. I believe battery status was one of the things that was stated to be transmitted in these uplink messages. Most of the uplink messages being transmitted to the towers from vehicle transponders is simply due to LoJack owners driving around without their early warning wireless key fob with them. This causes the vehicle transponder to send a message to the tower that the vehicle is being moved without the presence of the key fob inside the vehicle which then generates a notification to the owner of the vehicle if they have paid extra for that service.
Thanks I will take a look--it may be in abit due to pain and trouble with keyboard/mouse from should cuff surgery
 

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,458
Wasnt LoJack discontinued throughout the vast majority of the united states?

Reading this thread will show that many of us still hear it with perhaps half the number of base stations still transmitting. As I earlier posted, I hear about 3 opposed to the 6 I used to use and others have similar experience. Discontinued? No. Reduced and fading due to newer technology? Yes.
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,449
Location
Weld County, Colorado
Wasnt LoJack discontinued throughout the vast majority of the united states?
The new LoJack system is available nationwide.

"New LoJack – Nationwide Coverage
"New LoJack which includes both Stolen Vehicle Recovery + Connected Car technology has nationwide coverage through an impressive network of GPS and cellular towers."
 
Top