Restaurant pagers

[theprez98]

While I was standing in line at a restaurant last night with the wife and kids, I couldn't help myself and started taking some brief notes on the "restaurant pager" system they were using (see here).

I found a few Google searches but not as much as I would have expected.

Has anyone done any sort of hacking with these devices and if so what sort of results were you able to obtain? I guess it might help to have the transmitter too, but perhaps there are ways to duplicate that...

[VAX_to_PBX]

Re: Restaurant pagers

It seems to be a low power UHF transmitter that probably transmits unique pulse width sequences to a base, or receiver units on employees belts.

Each manufacturer probably has it's own spectrum of pulse width sequences. You could probably make a scanner that spoofs requests, and causes havoc.

each one would have to have a unique broadcast ID, so no interference would be existent between neighboring systems.

It's actually boring seeing as no information is sent. It's just unique modulated pings.

Someone might make something like a TVBGone for them if they're bored enough. If the central receiver is computer interfaced there may be something interesting there even though no information can be received. The manufacturer didn't mention receiving capability's in the coasters.

That's just what I seen. Maybe someone uses them, and can give real insight, or better yet re-phrase my post, and make it suitable for news articles, and 007 style propaganda.

[LosT]

Re: Restaurant pagers

While I was standing in line at a restaurant last night with the wife and kids, I couldn't help myself and started taking some brief notes on the "restaurant pager" system they were using (see here).

Has anyone done any sort of hacking with these devices and if so what sort of results were you able to obtain? I guess it might help to have the transmitter too, but perhaps there are ways to duplicate that...

There are three major manufacturers of these types of systems. The 'coasters' generally run the restaurant ~$50 each, and the base stations can run upwards of $500. (Not worth it, but knowledge is power)- I have several of the coasters dissected, and generally they consist of RF, LEDs, and small DC motor- there are talks by newer companies to make little hand-held games in them (to entertain the waiting customers)- I assume that the theft of the devices will go up dramatically (as will the cost) if they do this-

The coasters receive a signal from the base station periodically, and if the coaster is in range, all is good (read: quiet)- If you take a coaster away from the effective base station range, they begin to play parts of songs, vibrate, etc- the intent is two-fold: 1. to let you know you have the thing in your car if you are 'accidentally' driving away with one- and 2. to annoy you if you have taken one (it is common for them to play just part of a tune, not quite finishing it- it is supposed to be maddening)-

I was at one point working on a restaurant 'clearer' where I could trigger ALL of the coasters simultaneously - (if nothing more it should be fun to watch all the waiting people charge the desk )-

Maybe I should pick up this project again...

LosT

[theprez98]

Re: Restaurant pagers

Thanks for the input, guys. Definitely worth some further research. I like the "clearer" idea, too. ;)

[VAX_to_PBX]

Re: Restaurant pagers

The "clearer" idea is what I was hinting at by the TVBGone style scanner.

I can see there application in large restaurants, but not in a cafe's, or =>15 table restaurant's.

There's not mutch you can do out of wrapping them in aluminum foil to block the UHF without opening the case, and tapping into BUS traces.

[astcell]

Re: Restaurant pagers

They wanna put GAMES in the pagers? How about a MENU!

[LosT]

Re: Restaurant pagers

The "clearer" idea is what I was hinting at by the TVBGone style scanner.

I can see there application in large restaurants, but not in a cafe's, or =>15 table restaurant's.

There's not mutch you can do out of wrapping them in aluminum foil to block the UHF without opening the case, and tapping into BUS traces.

Generally speaking they are not UHF-

And there is quite a bit you "can do" ;)

And yes AST, I think a menu would be a great idea-

LosT

[VAX_to_PBX]

Re: Restaurant pagers

Generally speaking they are not UHF-

And there is quite a bit you "can do" ;)

And yes AST, I think a menu would be a great idea-

LosT

I agree..who are the FCC to say 300Mhz-3Ghz...

What shall we call 420Mhz-470Mhz?

[LosT]

Re: Restaurant pagers

I agree..who are the FCC to say 300Mhz-3Ghz...

What shall we call 420Mhz-470Mhz?

Maitred System from Commtech: 148 -174 MHz (VHF) -although UHF is available...

iPort's "guest call" is VHF as well...

LRS's pagers are UHF (www.pager.net )the blue ones are cool-

PagingSystemWorld's setup is actually HF (27 MHz)-

So call them what ever you'd like...

LosT

[VAX_to_PBX]

Re: Restaurant pagers

I was making references based on the model you linked to. I wasn't meaning all manufacturers. I understand how you got "generally" now.

If they become populer enough they'll establish a protocol standard, and standard RF band.

[bpitt]

Re: Restaurant pagers

Next time you get one of those pagers, look on the back. There will be located a FCC ID number, write it down. Go to the FCC's website, you can do a freq. search using that ID number. It will give you the name of the company as well as the freq.'s it is allowed to operate on. Next, with the name of the company, do a Google search for said company and inquire about technical documentation. It may be listed on their site, or you may email them, just tell them you work for ABC Radio Communication or whoever. They may just email you, in pdf format, the documention on the pagers. Now you got somewhere to start.
A 'broad' frequency transmitter would do the trick as far as fucking with the pagers. You will now what frequency area to attack by the documentation. There are PLENTY of rf transmitters that can transmit on a wide spectrum. Some are capable of being built at home with a soldering iron and are programmable, i.e., using an onboard ROM or EEPROM that you tell which freq's to variable transmit on. I'll shut up now, you should have a good idea or where to go now.

[Thorn]

Re: Restaurant pagers

Next time you get one of those pagers, look on the back. There will be located a FCC ID number, write it down. Go to the FCC's website, you can do a freq. search using that ID number. It will give you the name of the company as well as the freq.'s it is allowed to operate on.

The FCC site also contains a lot of information regarding the unit, such as interior photographs and block diagrams. They're certainly worth checking out, too, as these documents can yield a lot of information about any device that was submitted for an FCC number.

[VAX_to_PBX]

Re: Restaurant pagers

Isn't it required by the FCC to print the operating range of stand alone RF devices where the copyright, and input voltage is? You could just look there like you where gonna find out the wattage the device uses from the voltage, and amperage.

I could be wrong..

[theprez98]

Re: Restaurant pagers

Isn't it required by the FCC to print the operating range of stand alone RF devices where the copyright, and input voltage is? You could just look there like you where gonna find out the wattage the device uses from the voltage, and amperage.

I could be wrong..

If I remember correctly the Coaster Call devices at www.pager.net do include the operating freqs on the back.

[nak]

Re: Restaurant pagers

The freq. range might also be inside the pager. This one is from peter piper pizza!

Very intersting thread :)