Retro engineering on a pager, Tatoo Hack

This hack, backward me in 1996/1998 during my college years, the pager system was at its peak, there was 3 commercial services and networks here, in France:

  • TamTam, the Cegetel/SFR paging services, stopped in 1999, using ERMES protocol.
  • KOBBY, from Bouygue Telecom, stopped during 2005, using ERMES/FLEX protocol.
  • TATOO, from FT/Orange, using POCSAG, the only still functioning, right now, since 2000, exploited by a Deutsch company, E-Message.

The Kobby and TamTam use VHF frequency band (Update 18/03/14 – 169,425-169,800 Mhz), and the TATOO receiver use UHF band (466.025 MHz – 466.05 MHz – 466.075 MHz – 466.175 MHz – 466.20625 MHz – 466.23125 MHz.). POCSAG protocol is basically easy to decode, with software like POC32 or PDW

“POCSAG is an asynchronous protocol used to transmit data to pagers. The name comes from Post Office Code Standardization Advisory Group, this being the British Post Office which used to run nearly all telecommunications in Britain before privatization. The modulation used is FSK with a ±4.5 kHz shift on the carrier. The high frequency represents a 0 and the low frequency a 1. Often single transmission channels contain blocks of data at more than one of the rates.”  wikipedia

Bellow is a dessication of a MOTOROLA MEMO Pager Receiver (Tatoo, commercial name).


The pager is composed of two circuits,  a board with a displaying circuit for the lcd, a vibrator, a piezzo buzzer, a backup batterie for the RTC, and a MC68HC68 microcontroler, he probably contain the program to decode/translate the signal and pager ARP address.


The another board is dedicated to RF reception, you can see a antenna, simple loop of metal, probably a narrow rf input filter, and a strange unidentified IC “99Z32”, maybe a RF IC Receiver …


Now the goal is to identified the pin’s function on the connector. I have already put my Rigol probe on the Pin 4,  and i can see a low/high signal (see bellow). I’ll  try to translate this signal for PDW or POC32 software soon. Any help is welcome.


 Update 26/04

I started to listening the signal (blue) from my UBC 785 on 466.20625 Mhz, in parallel with the signal from the pager (yellow), it seem to be a inverted signal.


After feed the signal through a Max232, but no good result with the decoder software! *sic*, maybe need a little amplification before …



8 thoughts on “Retro engineering on a pager, Tatoo Hack

  1. LeFauve

    Very interesting article!
    Do you think you’ll be able to do something useful with the tatoo?
    This made me dig out my old tamtam :o)
    I think I’ll have a look inside, even if I’m far from being able to do anything useful with it (yet).
    Tell me if you’re interested in pictures from its inside.

  2. j3tstream

    thx for your comment LeFauve, i think the best way is to give “more power” to the signal, the TAMTAM use VHF 169,4-169,8125 MHz frequency, in ERMES protocol, seem to be more complex! any pics of your pager are welcome 🙂

  3. Vincent


    Félicitations pour votre hack 🙂

    Se hack date en effet des années 90 (bien connu dans le milieu des amateurs radio..).

    Sur le mien, le démodulateur FSK est un CI Philips UAA2080T, le décodage des trames pocsag se faisant à partir de la pin 27 (testé avec Multimon-NG et deux autres logiciels de décodage positif).

    Pour information en Allemagne, il existe un (petit) réseau pager radioamateur, fonctionnant sur la fréquence UHF : 439.9875 MHz FMN en FSK 1200 Bauds.

    Une vidéo d”un collègue radioamateur F4GMU :
    Attention l”émission sur 466 MHz est strictement interdit (même pour un radioamateur).

  4. mdtbyk

    hi i have a freind that has a pager and i found online the exact pager my question is how can intercept his signal and see what protocal or signal his using and also how do install that signal on my pager thanks?

    1. j3tstream Post author

      POCSAG is very easy to monitor and “intercept”
      depending where you are, (it’s probably POCSAG),
      buy a small cheap scanner or SDR,
      scan the UHF band to find the frequency, look under the pager, you will see the
      exact frequency band (like 466.20625 …) and a unique ident number called ARP or something like that,
      after that you can create a filter in POC32 to only see the signal of your pager, or not 😉

  5. emp

    Bonjour j3tstream,

    Très interessant, c’est fou ce que google peut nous faire découvrir comme site juste avec de simple mot clé 🙂
    J’ai réactivé mon vieux tatoo de mes années lycée (1998). Ce qui est domage c’est que le coût d’envoi des messages est assez prohibitif.
    Pensez vous qu’avec les tatoo de nos jours on puisse faire quelque chose d’utile sans passer par emessage?

    1. j3tstream Post author

      slt, sans passer par emessage, pas grand chose sans un minimum de matériel et connaissance, il y a des softs qui génère des trames POCSAG, couplé a un émetteur, il ya de quoi recyclé un tatoo mais il faut bidouillé l’étage d’entrée du récepteur, sans parler du problème d’émettre dans une bande non autorisé (sans licence Ra ou autre :/)


Leave a Reply

Your email address will not be published. Required fields are marked *