Retro engineering on a pager, Tatoo Hack

/ 24 avril 2013 / 36 Comments / Hack

This hack, backward me in 1996/1998 during my college years, the pager system was at its peak, there was 3 commercial services and networks here, in France:

  • TamTam, the Cegetel/SFR paging services, stopped in 1999, using ERMES protocol.
  • KOBBY, from Bouygue Telecom, stopped during 2005, using ERMES/FLEX protocol.
  • TATOO, from FT/Orange, using POCSAG, the only still functioning, right now, since 2000, exploited by a Deutsch company, E-Message.

The Kobby and TamTam use VHF frequency band (Update 18/03/14 – 169,425-169,800 Mhz), and the TATOO receiver use UHF band (466.025 MHz – 466.05 MHz – 466.075 MHz – 466.175 MHz – 466.20625 MHz – 466.23125 MHz.). POCSAG protocol is basically easy to decode, with software like POC32 or PDW

« POCSAG is an asynchronous protocol used to transmit data to pagers. The name comes from Post Office Code Standardization Advisory Group, this being the British Post Office which used to run nearly all telecommunications in Britain before privatization. The modulation used is FSK with a ±4.5 kHz shift on the carrier. The high frequency represents a 0 and the low frequency a 1. Often single transmission channels contain blocks of data at more than one of the rates. »  wikipedia

Bellow is a dessication of a MOTOROLA MEMO Pager Receiver (Tatoo, commercial name).

_tatoodissoc2

The pager is composed of two circuits,  a board with a displaying circuit for the lcd, a vibrator, a piezzo buzzer, a backup batterie for the RTC, and a MC68HC68 microcontroler, he probably contain the program to decode/translate the signal and pager ARP address.

_displaypart2

The another board is dedicated to RF reception, you can see a antenna, simple loop of metal, probably a narrow rf input filter, and a strange unidentified IC « 99Z32 », maybe a RF IC Receiver …

_rfpart

Now the goal is to identified the pin’s function on the connector. I have already put my Rigol probe on the Pin 4,  and i can see a low/high signal (see bellow). I’ll  try to translate this signal for PDW or POC32 software soon. Any help is welcome.

POCSAG_signal

 Update 26/04

I started to listening the signal (blue) from my UBC 785 on 466.20625 Mhz, in parallel with the signal from the pager (yellow), it seem to be a inverted signal.

NewFile1outfromscan_outfrompager

After feed the signal through a Max232, but no good result with the decoder software! *sic*, maybe need a little amplification before …

reforeafte

NOTE: 19/06/2023 Suite au message de Christophe , suppression du lien vers le programme MEMOEXP, (m’écrire si besoin).

NOTE: 24/12/2019 Pager above is successfully hacked on 438.2160 with changing first LO with a 49.152 Mhz quartz.

NOTE 2: 19/02/2020, Message de F4INJ, il est possible de reprogrammé les TATOO’s grâce a un logiciel disponible sur un site Russe. Pour l’installation de MEMOEXP, pas de machine virtuelle cela ne marchera pas, pas compatible avec un 64bits, un pc avec Windows XP fonctionne. Mettre MEMOEXP en racine du disque et lancer la commande CMD, la première fois sera MEMOEXP -INSTALL. Une interface TTL-USB RS232 est nécessaire.


Related:
Arduino POCSAG encoder 1200bp
Un emetteur POCSAG avec Arduino et Raspberry