Replicating a signal from a locating device (2.4ghz) to locate tag

Hi,

I would like to start by apologizing for the necromancy, I am aware that this post is five years old. I found this post while looking for information for a very similar project, and figured my progress so far would be useful for other people who do the same.

I have similar tracker, the Girafus Pro-track-tor pet/cat tracker, and I believe the technology is close to identical.

The first thing you want to do is to open the device and look at the chip used. I tried looking at the public FCC data for your device, but the chip markings are smudged in the photos (this seems to be common practice). My device uses a CC2500 family chip from Texas Instruments, so I ordered some CC2500 modules from AliExpress.

The next thing you want to do is determine the frequency and modulation used in your device. I used a HackRF One to record some sample signals between the hand unit and tag. This gave me the precise frequency used. Then you need to look a bit at the signal to figure out other RF parameters, such as the modulation type used, BW, and data rate. It turned out my device uses MSK at 250 kbit. Universal Radio Hacker is useful software tool for this step, even though it does not explicitly support MSK.

For the CC-family chips you can get a CC debugger that lets you run the chips from a TI-provided piece of software called SmarRF Studio. This makes reverse engineering the signals much easier. The 250 kbit MSK turned out to be one of the suggested presets already set up in SmartRF studio, I only had to set the frequency and turn off CRC to get all the correct register settings for the CC2500 chip.

Now you can start to snoop on the communication between the hand unit and tag. In my case the protocol was very simple with some application id, tag id, command byte and probably link quality data sent back by the tag.

I then found some example code for arduino and the CC2500. I exported the chip register settings from SmartRF studio and modified the code, and was able to communicate with both hand unit and tag using a pro mini connected to the cc2500 module by SPI.

I hope this is of help to anyone starting on the same project!

1 Like