Retro engineering on a pager, Tatoo Hack

This hack, backward me in 1996/1998 during my college years, the pager system was at its peak, there was 3 commercial services and networks here, in France:

  • TamTam, the Cegetel/SFR paging services, stopped in 1999, using ERMES protocol.
  • KOBBY, from Bouygue Telecom, stopped during 2005, using ERMES/FLEX protocol.
  • TATOO, from FT/Orange, using POCSAG, the only still functioning, right now, since 2000, exploited by a Deutsch company, E-Message.

The Kobby and TamTam use VHF frequency band (Update 18/03/14 – 169,425-169,800 Mhz), and the TATOO receiver use UHF band (466.025 MHz – 466.05 MHz – 466.075 MHz – 466.175 MHz – 466.20625 MHz – 466.23125 MHz.). POCSAG protocol is basically easy to decode, with software like POC32 or PDW

“POCSAG is an asynchronous protocol used to transmit data to pagers. The name comes from Post Office Code Standardization Advisory Group, this being the British Post Office which used to run nearly all telecommunications in Britain before privatization. The modulation used is FSK with a ±4.5 kHz shift on the carrier. The high frequency represents a 0 and the low frequency a 1. Often single transmission channels contain blocks of data at more than one of the rates.”  wikipedia

Bellow is a dessication of a MOTOROLA MEMO Pager Receiver (Tatoo, commercial name).

_tatoodissoc2

The pager is composed of two circuits,  a board with a displaying circuit for the lcd, a vibrator, a piezzo buzzer, a backup batterie for the RTC, and a MC68HC68 microcontroler, he probably contain the program to decode/translate the signal and pager ARP address.

_displaypart2

The another board is dedicated to RF reception, you can see a antenna, simple loop of metal, probably a narrow rf input filter, and a strange unidentified IC “99Z32”, maybe a RF IC Receiver …

_rfpart

Now the goal is to identified the pin’s function on the connector. I have already put my Rigol probe on the Pin 4,  and i can see a low/high signal (see bellow). I’ll  try to translate this signal for PDW or POC32 software soon. Any help is welcome.

POCSAG_signal

 Update 26/04

I started to listening the signal (blue) from my UBC 785 on 466.20625 Mhz, in parallel with the signal from the pager (yellow), it seem to be a inverted signal.

NewFile1outfromscan_outfrompager

After feed the signal through a Max232, but no good result with the decoder software! *sic*, maybe need a little amplification before …

reforeafte