LoJack Question

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,585
Personally, I find reply codes and speed ups most useful and interesting. There is nothing more satisfying than hearing a distant stolen vehicle transponder breaking the squelch on my Motorola receiver, tracking down the approximate location and turning it into the police. The LoJack receivers installed in police vehicles actually suffer from RF overload much easier than professional radio receivers in RF rich environments which gives those using a professional radio receiver an advantage when it comes to tracking down stolen vehicles from a distance. A professional radio receiver can detect faint LoJack signals miles away in the distance which are not strong enough to even begin to be decoded by the LoJack receivers installed in police vehicles. I remember when the local LoJack liason made a company paid visit to me. One of the questions he asked was how I was finding the vehicles and turning them into the police. This happened shortly after I turned in a LoJack to the Denver police that could only be detected within a one block radius and which was not responding to tower speed up commands. I think the antenna must have been severed on the LoJack transponder and I can only assume they must have been looking for that vehicle for quite some time. Possibly the battery may have been nearly dead as well in the LoJack transponder.
...

My point was meant to be that I still think those are not being properly parsed. Although the current parsing you are doing is certainly useful, there are things about it that do not make sense (but do not affect its usefulness). I think if properly parsed, they would make more sense on paper.
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,465
Location
Weld County, Colorado
My point was meant to be that I still think those are not being properly parsed. Although the current parsing you are doing is certainly useful, there are things about it that do not make sense (but do not affect its usefulness). I think if properly parsed, they would make more sense on paper.
Assuming the newer versions of SDRTrunk still provide the reply code parsing for each line, you will notice that for the WNVD283 Aurora, IL tower mentioned that the last two characters of the reply code are 83 or 8-3 which matches your results. I've always just looked at the last two characters of the reply code provided automatically by SDRTrunk to differentiate between towers.

As 1.) tracking pulses, 2.) site IDs, 3.) tower commands and 4.) speed ups all have three of their address bits always set to 0, the assumption back in the day was that these specific commands were all using the exact same parsing. When it was verified the correct parsing had been determined for tracking pulses and then later for speed ups, it was logical to conclude site IDs were using the same parsing as they also had the same three bits always set to 0.

All other LoJack commands (tower test, deactivate, activate, quiet, alternate deactivate, etc.) utilize all 28-bits in their addresses (none of the bits are always set to 0) so these commands use a second different decoding scheme other than the one used for 25-bit tracking pulses and speed ups.

So, it is known there are at least two separate parsings of address bits being used by the LoJack system (one based around 25-bits and the other based around 28-bits).

It is certainly possible that the 25-bits in site ID addresses are being parsed yet a third way and not following the established parsing scheme being used to decode the 25-bits in tracking pulses and speed ups.

To keep things simple, SDRTrunk provided a verified reply code parsing for 25-bit addresses and a verified HEX parsing for 28-bit addresses. The 28-bit HEX parsing scheme used was deteremined based off actual screenshots of the working LoJack system provided in manuals to the FCC for functional equipment.

This is what I know. If anyone discovers something new regarding LoJack it would be interesting to look at it before it is turned off.

There is another part of the VHF LoJack system that nobody has ever decoded/parsed referred to as uplink transmissions (transmitted by vehicle transponders). These are transmitted at around 100 bits per second for a duration of 1.8 seconds. Most of these transmissions have to do with the early warning system and vehicle transponders acknowledging activations and deactivations with the LoJack towers. At this point, it's not worth the hassle of attempting to decode these however I thought it was worth a passing mention.
 
Last edited:

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,585
Assuming the newer versions of SDRTrunk still provide the reply code parsing for each line, you will notice that for the WNVD283 Aurora, IL tower mentioned that the last two characters of the reply code are 83 or 8-3 which matches your results. I've always just looked at the last two characters of the reply code provided automatically by SDRTrunk to differentiate between towers.
...

ers. At this point, it's not worth the hassle of attempting to decode these however I thought it was worth a passing mention.

Ok, I will have to try again looking at newer versions. The last version I tried to install, I could not get to work. So I stuck with my current. (I do not often trust what is in manuals as often that reflects hardware designed to look at systems or be easily analyzed (and usually in HEX) without really looking at what is in the designed electronic (and often not in HEX)--I have experienced that in *a lot* of similar signal analysis settings. People often analyze or display in HEX when the underlying is not really HEX--it is just convenient and "good enough" for their purpose. In this case, for site ID's IDs, it is clear to me that 5-bit coding is done, not 4-bit HEX. The rest might be in HEX, but a HEX display is not enough to convince me it originated as HEX due to prior experience with other systems.)

I wish I had decodes of vehicle responses but I have never seen one.
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,465
Location
Weld County, Colorado
I wish I had decodes of vehicle responses but I have never seen one.
Here is an example I recorded while in the Denver area. During seconds 13-15 the vehicle transponder transmitted an uplink/acknowledgement message to the tower that it had been successfully deactivated. This clip contains audio of the tracking pulses, the tower command to deactivate and then the uplink/acknowledgement message (seconds 13-15) transmitted by the vehicle transponder to the tower that it was successfully deactivated. I decoded the bits contained in a number of these vehicle uplink/acknowledgement responses however did not have the desire to pursue it any further. I believe battery status was one of the things that was stated to be transmitted in these uplink messages. Most of the uplink messages being transmitted to the towers from vehicle transponders is simply due to LoJack owners driving around without their early warning wireless key fob with them. This causes the vehicle transponder to send a message to the tower that the vehicle is being moved without the presence of the key fob inside the vehicle which then generates a notification to the owner of the vehicle if they have paid extra for that service.
 

Attachments

  • Deactivation Example (with acknowledgement message) (UU910).zip
    326.3 KB · Views: 9
Last edited:

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,585
Here is an example I recorded while in the Denver area. During seconds 13-15 the vehicle transponder transmitted an uplink/acknowledgement message to the tower that it had been successfully deactivated. This clip contains audio of the tracking pulses, the tower command to deactivate and then the uplink/acknowledgement message (seconds 13-15) transmitted by the vehicle transponder to the tower that it was successfully deactivated. I decoded the bits contained in a number of these vehicle uplink/acknowledgement responses however did not have the desire to pursue it any further. I believe battery status was one of the things that was stated to be transmitted in these uplink messages. Most of the uplink messages being transmitted to the towers from vehicle transponders is simply due to LoJack owners driving around without their early warning wireless key fob with them. This causes the vehicle transponder to send a message to the tower that the vehicle is being moved without the presence of the key fob inside the vehicle which then generates a notification to the owner of the vehicle if they have paid extra for that service.
Thanks I will take a look--it may be in abit due to pain and trouble with keyboard/mouse from should cuff surgery
 

YalekW

Signal Analyzer & Identification specialist
Joined
Jun 16, 2012
Messages
139
Wasnt LoJack discontinued throughout the vast majority of the united states?
 

dlwtrunked

Member
Premium Subscriber
Joined
Dec 19, 2002
Messages
2,585
Wasnt LoJack discontinued throughout the vast majority of the united states?

Reading this thread will show that many of us still hear it with perhaps half the number of base stations still transmitting. As I earlier posted, I hear about 3 opposed to the 6 I used to use and others have similar experience. Discontinued? No. Reduced and fading due to newer technology? Yes.
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,465
Location
Weld County, Colorado
Wasnt LoJack discontinued throughout the vast majority of the united states?
The new LoJack system is available nationwide.

"New LoJack – Nationwide Coverage
"New LoJack which includes both Stolen Vehicle Recovery + Connected Car technology has nationwide coverage through an impressive network of GPS and cellular towers."
 

KevinC

Encryption
Super Moderator
Joined
Jan 7, 2001
Messages
13,546
Location
I'm everywhere Focker!
Speaking of LoJack I have one going off right now near me. Appears to be stationary, so maybe at one of the two tow storage lots near me.
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,465
Location
Weld County, Colorado
Speaking of LoJack I have one going off right now near me. Appears to be stationary, so maybe at one of the two tow storage lots near me.
I've turned half a dozen or so into the police anonymously (to prevent being contacted by LoJack). I usually just provide the approximate location and LoJack code if I have it available. It always bothers me that someone is missing their vehicle at times for days on end.

Possibly the one you are hearing has already been recovered and is in the process of being turned off. Once the tower transmits the deactivation code you will hear the LoJack transponder transmit an uplink to the tower, what sounds like one second of silence, and then it will stop transmitting.
 

ecps92

Member
Joined
Jul 8, 2002
Messages
15,551
Location
Taxachusetts
I've turned half a dozen or so into the police anonymously (to prevent being contacted by LoJack). I usually just provide the approximate location and LoJack code if I have it available. It always bothers me that someone is missing their vehicle at times for days on end.

Possibly the one you are hearing has already been recovered and is in the process of being turned off. Once the tower transmits the deactivation code you will hear the LoJack transponder transmit an uplink to the tower, what sounds like one second of silence, and then it will stop transmitting.
the legacy transponder DO NOT transmit back to the towers, they only squawk when beeping as stolen.
Sometime the signal just doesn't make it to the box, at the location it was when the Deactivation signal occured.

Generally the PD making an additional inquiry will deactivate it, or other situation require Lo/Jack to go on-site to where the vehicle is.
 

Echo4Thirty

Active Member
Premium Subscriber
Joined
Oct 6, 2021
Messages
1,114
Location
Colorado Springs, CO
Speaking of LoJack I have one going off right now near me. Appears to be stationary, so maybe at one of the two tow storage lots near me.

I think you are starting a whole new genre of posts. First it was "why is my radio inhibited?" to "This car i just got is beeping on 172 MHz, how do I stop it?"
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,465
Location
Weld County, Colorado
the legacy transponder DO NOT transmit back to the towers, they only squawk when beeping as stolen.
Sometime the signal just doesn't make it to the box, at the location it was when the Deactivation signal occured.
Actually, many legacy LoJack transponders do transmit back to the tower. I posted an actual audio recording of this above in post #84:
https://forums.radioreference.com/threads/lojack-question.473248/post-4133842

Legacy LoJack transponders began to transmit "uplink" and "acknowledgement" signals on 173.075 MHz to LoJack towers around 2002 when the early warning system was introduced. When a vehicle equipped with a legacy LoJack system (with early warning capabilites) was moved, without the key fob being present, this would cause the vehicle transponder to transmit an "uplink" signal to the tower which then notified LoJack to send a notification to the vehicle owner that the vehicle was being moved.

These uplink/acknowledgement signals are broadcast on 173.075 MHz and are 1792ms in duration and consist of 100 bits transmitted at around 55.8 baud using a "reduced bit rate, two level FM modulation..."

Specific "uplink" signals referred to as "acknowledgement" messages are also transmitted by legacy LoJack transponders (with early warning capabilities) to notify the tower of successful activations and deactivations to reduce the number of activations and deactivations required to be transmitted by LoJack towers.

True, the very oldest legacy units (prior to 2002) did not transmit back to the tower however newer versions of the legacy units (after 2002) do transmit to the tower.

Documentation on legacy LoJack units "uplink" and "acknowledgement" message capabilities is discussed in the following threads:
https://forums.radioreference.com/threads/how-to-decode-lojack.235059/post-2353334
https://forums.radioreference.com/threads/how-to-decode-lojack.235059/post-2354493

Shawn
 

ecps92

Member
Joined
Jul 8, 2002
Messages
15,551
Location
Taxachusetts
Actually, many legacy LoJack transponders do transmit back to the tower. I posted an actual audio recording of this above in post #84:
https://forums.radioreference.com/threads/lojack-question.473248/post-4133842

Legacy LoJack transponders began to transmit "uplink" and "acknowledgement" signals on 173.075 MHz to LoJack towers around 2002 when the early warning system was introduced. When a vehicle equipped with a legacy LoJack system (with early warning capabilites) was moved, without the key fob being present, this would cause the vehicle transponder to transmit an "uplink" signal to the tower which then notified LoJack to send a notification to the vehicle owner that the vehicle was being moved.

These uplink/acknowledgement signals are broadcast on 173.075 MHz and are 1792ms in duration and consist of 100 bits transmitted at around 55.8 baud using a "reduced bit rate, two level FM modulation..."

Specific "uplink" signals referred to as "acknowledgement" messages are also transmitted by legacy LoJack transponders (with early warning capabilities) to notify the tower of successful activations and deactivations to reduce the number of activations and deactivations required to be transmitted by LoJack towers.

True, the very oldest legacy units (prior to 2002) did not transmit back to the tower however newer versions of the legacy units (after 2002) do transmit to the tower.

Documentation on legacy LoJack units "uplink" and "acknowledgement" message capabilities is discussed in the following threads:
https://forums.radioreference.com/threads/how-to-decode-lojack.235059/post-2353334
https://forums.radioreference.com/threads/how-to-decode-lojack.235059/post-2354493

Shawn
Well then we need to agree to disagree then, as a user of the system (tracking) Towers only transmitted to the box and the Box only transmitted to the Cruisers/Airwing or the few areas that implemented RX Sites to be able to triangulate (rare and expensive)

Boston had one, but it was RX with no Direction, only helped us send cruisers to that High-Spot and start tracking outward from there.
 

ScannerSK

Member
Joined
Mar 6, 2005
Messages
1,465
Location
Weld County, Colorado
Well then we need to agree to disagree then, as a user of the system (tracking) Towers only transmitted to the box and the Box only transmitted to the Cruisers/Airwing or the few areas that implemented RX Sites to be able to triangulate (rare and expensive)
No need to disagree. What you are saying was true before 2002. What I am saying is true after 2002. We are both correct!

After 2002, legacy LoJack devices, at least those which incorporated the early warning system, had the added/additional capability of transmitting "uplink" messages directly to the towers. This additional capability was requested by LoJack and approved by the FCC. The new "uplink" messages notified the tower if the vehicle was being moved without permission, was being hot wired and whether an activation or deactivation command was successful. The internal battery voltage could also be relayed by these new messages to the towers. This was all done using the 173.075 MHz frequency.

I receive uplink/acknowledgement messages on my scanner all the time on the 173.075 MHz LoJack frequency especially while driving around Denver. Typically, they just sound like someone keying up a dead mic, with a little clicking in the background, for several seconds. The clicking is the 100 bits being transmitted at 55.8 baud. Most of these transmissions are just early warning messages being issued to the towers due to people driving around without their LoJack key fobs with them.

Also, the towers have the capability of detecting reply codes being broadcast on the LoJack frequency. There is some indication LoJack experimented with technology in their towers which could roughly triangulate the location a specific reply code was being broadcast from. The towers also monitor each other to verify they are staying within their assigned time slots. There are even commands sent between towers to resynch them into the correct time slot and for other maintenance related work.

Have you ever studied into the early warning system rolled out in 2002 and how it works? I think you would find this very fascinating. How do you think customers receive e-mails/phone calls from LoJack within 15 minutes of their vehicle being moved without the key fob? The early warning system is another part of the LoJack system, running on 173.075 MHz, which many people are entirely unaware of. The early warning system runs alongside and in conjunction with the primary LoJack system so it's entirely possible for a person to miss this new system and never even realize a new capability was added to the primary LoJack system.

Here are a few quotes from an FCC document regarding the new capability in the legacy LoJack system:
"When activated, the EWD [early warning detector] will detect external movements of the vehicle or determine that the vehicle has been started without using a key (i.e., 'hot-wired'), and thereupon instruct the TU [transponder unit] to transmit an alert message. The nearest base station will process and forward the message to the LoJack central control center, whereupon LoJack personnel will alert the car owner that the vehicle is possibly being stolen. These TU 'uplink' transmissions, which must be limited to six messages per mobile unit in any thirty-minute period, also can be used to acknowledge base station activation and deactivation messages."
"Under the proposed rule change, the mobile-to-base 'uplink' transmissions are used to alert a control center whose personnel, in turn, alert the vehicle owner that his or her vehicle has been moved without consent. Thus, a vehicle theft is detected immediately, which gives the owner the ability to notify the police immediately. By comparison, under the old technology, the stolen vehicle is not tracked until the vehicle owner discovers the theft and reports it to the police. This may not occur for hours or days after the theft."
"While the 'uplink' transmission path incorporates the early warning feature, it also serves to acknowledge base station activation and deactivation messages. Specifically, mobile units using the 1800 milliseconds cycle are capable of transmitting acknowledgements to instructions received from a base station."

Manuals for LoJack units which have the early warning capability state, "The LoJack Early Warning feature will not function if the Vehicle is not in range of a LoJack tower, or if the Vehicle’s battery is discharged or disconnected and the LoJack backup battery also is discharged." User Manual IDIEW2VLU-05 Users Manual

If the LoJack box inside the vehicle cannot communicate with a tower (base station) then the customer will not be notified when their vehicle is moved without permission.

The early warning system is an interesting part of the legacy LoJack system however I believe it failed to deliver as most did not want to pay the extra expense for the early warning system and the towers had a difficult time receiving messages from vehicles. Anyway, there are a lot of documents online about the early warning system and the use of "uplink" messages to the base stations from the LoJack boxes installed in vehicles.

One of the best documents on how the early warning systems works is the following FCC document beginning on page 3:
https://www.fcc.gov/ecfs/document/5006009662/1

Again, the early warning system technology works alongside the existing legacy LoJack technology; it did not replace the old technology it was simply added in 2002 as another layer on top of the existing LoJack technology. They basically sandwiched two different LoJack systems together into one box. Each of the two systems runs on 173.075 however for different purposes. So, it's possible someone could have worked with tracking down LoJacks for decades and never have known this other part of the LoJack system even existed in which the vehicle communicates with the towers.
 
Last edited:
Top