Pet tracker Z8 - help please identifying protocol
I didn't find any protocol sheet. From my testing, commands are as described in this post.
Regarding the codification of GPS position, I think is coded in the following way:
Latittude: <GGMM.MMMM>
Longitude: <GGGMM.MMMM>
G -> degrees
M -> minutesThe following info is in the post, but just as a very litttle summary:
In order to start sending position data, the tracker needs an answer from the server for line with "U101":
Tracker:
PC,<IMEI#>,1{<U101#>}Server answer:
PC,1{<C101#1>}After that, tracker seems to go to live sending lines with "U101", "U102", "U103", and "U104". Lines with "U103" contains position data.
Regards
So what does it actually take to integrate the D79 with Traccar? I'll probably buy 3 of them if it's nothing too bad.
Hi,
I am a new member from France. Many thanks for all the tips disclosed on the forum. I am using the Z8 since a couple of years, and was happy with it so far (I have 3: including one spare, and one dead). But since a few months, the Z8 takes almost one minute to report positions (I have configured the application to report every 10s). This makes the tracker almost useless to track my dog.
I would like to play with a proxy (as Neil did) to observe the protocol exchanges. I am blocked at the first step. when I try to modify the Z8 server by typing the command provided by Neil (ref Neil post 10 months ago):
SERVER,1,mypcserver,port,0The command is not taken into account, and the tracker keeps the original server name which is SERVER,1,dv.yintaifu.com.cn,8889,0
Could you kindly confirm if you managed to change the server name, and give me the SMS command for this
I found my mistake. a # was missing at the end. The SMS command is: SERVER,1,mypcserver,port,0#
The Z8 does not check the validity of the server name (this is what I thought at the beginning), and respond with a 'OK'
I can now proceed to the next phase
Phil
was about to say don't forget the trailing #
i have them communicating with server code i'm developing... accuracy is an issue compared to other trackers i have.
the limited working modes are too constraining, as it doesn't give the option to allow granular control to adjust upload frequency.... it only offers lagged reporting.
Thanks for your feedback. Do you have a hint on the way to specify the IP address of y PC. I tried : SERVER,1,123.456.789.0,port,0# (with my external IP in digits)
But it does not like it and returns: 'Parameter 2 Domain is not formatted correctly'
Should I use brackets, or a header ?
Thanks,
Philippe
if i recall try, for IP try
SERVER,0,###.###.###.###,port,0#
and for domain
SERVER,1,domain,port,0#
i think i documented this above after playing with all the options.
i think the last 1 or 0 before the # is UDP (1) or TCP (0)
I am impressed!
Indeed the information was in your initial post. I hadn't noticed the subtlety. Of the 1 versus 0. I changed the 1 to a 0, and my IP has been accepted
A new obstacle crossed. There will be many others probably :-)
Many thanks for your help (I will try to progress alone now)
Philippe
I documented everything i could find at the time i was playing (earlier posts). I've got a G9 & F9, these are wifi location enabled (Z8 isn't) and use the same protocol, but a different app (different server)... same restrictions, they do have one working mode more.
Hi Neil,
Thanks again for your support. I between I could develop my MitM in Python, and could observe the upstream and downstream exchanges between the China server and my Z8. I captured a lot of traces (surprisingly, I could never hook up the GPS (only LBS), maybe the disturbance caused by my intrusion ?).
I am conscious that I arrive a little late in this exchange. Maybe you've moved on in the last 10 months. But if you are still interested, I would be happy to share my traces with you (I am in the Paris area)
I am still wondering what this long suite of Hex numbers stands for (you have partly decoded it, if I am correct, but not completely)
tracker
b'PC,3512########,1{<U103#;;6,EB1,97,39,EB0,97,42,EB2,97,28,F11,97,21,4E4A,97,13,F12,97,3,14,D0;311020,175753|96|FFFFFFFD>}\r\n'My motivation to start all this, was the long delay to get positions. I could observe that the China server is not faulty. This is the tracker which responds exactly every 2 minutes (whereas I configured it to report every 10 seconds). I still need to check if this comes from my mobile operator or from the tracker itself.
I would not like to pollute this forum with questions of interest only for me :-). Kindly tell me if I should continue or not
"6,EB1,97,39,EB0,97,42,EB2,97,28,F11,97,21,4E4A,97,13,F12,97,3
looks like 6 phone masts for LBS trilateration.
saying there are 6 blocks of 3 fields. convert the hex to decimal and if i remember cell tower id (CID), cell region/area id (LAC) and decibel level (signal strength from tracker to mast)
you can confirm this against any cell mast database looking by querying your location and network provider to see the towers operational within your area.
not sure on this:
14,D0;
it's the final 2 fields within the LBS block.
one maybe the estimated accuracy in metres of the LBS.
you can't do much with this LBS data unless you can resolve it back to an approximate GPS location... you'll need something like Google's Geolocation API.
then date time of location capture and battery level.
the bitmap (hex) that follows i see on a lot of trackers...not sure if it maps the same, often some sort of state information (4 byte length in binary)... you can generally ignore that i've found.
i've found with most trackers, unless they've moved at least several metres they won't send update information regularly, there is nothing to update you about regardless of the upload setting, you'll still get heartbeat data (like a ping with battery status).
not getting GPS location (built up area in Paris?) makes the trackers generally pointless.
can you put it outside / on a roof top?
this is where the trackers with WiFi location improve accuracy within 30-100m rather than LBS 100m to over 1km
the G9 & F9 use the same protocol and provide WiFi location (like the LBS block, MAC address in hex, decibel level)
After doing some more digging.
The fact you gave me the city, country you are in was a great help, it allowed me to identify the LBS data.
<{<ADDD#GPS Data;Wifi Data;LBS Data;MMDDYY,HHMMSS|Bat Level|Bitmap>}\r\nA = Alpha Character
D = Digit.
location data fields delimited by ;
The last 2 digits are the mobile network MCC & MNC:
The 6 * 3 repeating Cell mast data:
#,CID,LAC,Db (level),...
#=number of repeating 3 fields "CID,LAC,Db (level),"
The final two fields: 14,D0
MCC: 208 (D0)
MNC: 14 (not sure if this is a hex or decimal value). 14 decimal is: Lliad/FREE Mobile, or 14 Hex 20 in decimal is: Bouygues Telecom for MMC 208 (France)
You'll know by your sim card network provider used on the tracker.
That's cracked the LBS data field.
Yes, the SIM card if from Bouygues Telecom, and I am located in Saint Germain en Laye (in the Paris suburb). In France we can easily get the locations of the sites with Cartiradio (https://www.cartoradio.fr/index.html#/). I will have a look tomorrow to see if we can extract something from there.
All this confirms me that you are the Champollion of the trackers :-)
FYI,
I could observe for the first time the message from the tracker when it is locked on the GNSS:
b'PC,3512###########,1{<U103#185525,A,4853.4029,N,00205.2710,E,1.83,147.80,021120,3;;;021120,185525|78|FFFFFFFF>}\r\n'
conform to your analysis in one of your earlier posts
And here is the command/response to remotely shut down the tracker:
from server: b'PC,1{<D217#20201102190318>}\r\n'
Response from Tracker: b'PC,3512###########,1{<C217#20201102190318,1>}\r\n'
I found the Ids of the closest BS: 85253, 72490 and 1740804. But these are not the Cell Id that we are looking for apparently. I continue searching
Hi Neil,
Yes, thanks. I purchased D79 GPS. I've to do more testing, but seems battery duration is higher, water proof (perfect for my dog), and is working well with traccar. On the other side, it's not starting by its own when you start charging it (you need to press the button)
I say that because I was trying to find a GPS to put in my electric scooter, and in case battery gets empty, I need the device to start automatically when new power arrives (scooter is set to on). Z8 is doing this, so I have put the Z8 in the scooter, and D79 on the dog :)
Regarding Z8, I'm doing some testing regarding the protocol. I'll put my findings here if I get more results than the information that appear in this post. I would like to get it working with traccar.