logo elektroda
logo elektroda
X
logo elektroda

Construction and modification of the OBD2 WiFi module

witek_34  1 9012 Cool? (+13)
📢 Listen (AI):

TL;DR

  • A VGATE OBD2 WiFi interface was torn down and modified to replace its default open AP with client-mode networking.
  • The module uses two stacked PCBs: a PIC18f25k80 OBD2 board below and an HF LPT230 WiFi board above, linked by a 5-pin 2 mm connector.
  • It acts as a transparent TCP-serial bridge at 192.168.0.10:35000, with ELM327 UART at 38400 bps and about 50 mA draw while active.
  • AT commands changed the WiFi mode to STA and set a custom SSID, so the adapter connected to the head unit and worked with Hybrid Assistant.
  • Sleep mode drops consumption to 1 mA, but the WiFi interface cannot wake afterward, and the module reacts to escape sequences like +++ from serial.
Hi

I present a partial teardown and functional modification
OBD2 VGATE interface with a WiFi module instead of BT. This interface
I bought a few months ago and used in conjunction with the android
Head Unit in the car with the hybrid assistant app.

Top view of a black Vgate OBD2 interface.

By default, the interface works as AP, creates an open WiFi network with SSID VLINK.
After connecting, the client device gets an IP address in the range 192.168.0.0/24.
The interface works as a transparent TCP bidirectional converter - serial, it listens to
address 192.168.0.10 and port 35000. On the ELM327 side, serial transmission 38400 bps.
You can connect to standard telnet and give commands to ELM327.

Elm327 presents itself as:
ATZ
ELM327 v2.1
ATI
OBDII is RS232 Interpreter

The interface takes up to 50mA when the WiFi module is working. You can
in it, turn off the automatic sleep mode after a preset time of inactivity.
After entering the sleep mode, the consumption drops to 1mA, but the module is already out of this mode
will not wake up because the WiFi interface is turned off. In addition, my copy is very tight
lowers the supply voltage, I will try to fight it because the ELM327 has the option of software calibration.
As the AP mode of the OBD2 interface is inconvenient for me, I decided to disassemble it
module in the hope that there will be ESP32 or something similar inside that will allow you to install it
alternative FW.

The module consists of 2 PCBs delicately connected for a sandwich:

- the lower one containing a complete OBD2 interface based on PIC18f25k80
- the upper one containing the HF LPT230 module and the 12V-> 3V3 converter. Conversion of voltages on the PIC18f25k80 line (5V supply)
is realized by a voltage divider

Photo of the HF LPT230 module on a PCB with visible traces and components. PCBs of an OBD2 module with WiFi module detached from its casing.

PCBs are connected with a 5-pin 2mm pitch connector, signals

LED ELM_RXD ELM_TXT GND 12V

The HF LPT230 module is a relatively popular and elegant solution
documentation is available at:
https://fccid.io/2ACSV-HF-LPT230/User-Manual/Users-Manual-3552381.pdf

For further experiments, I separated the RX and TX signals between
module a PIC18f25k80 and proceeded to further experiments with
UART - USB interface o terminal program and telnet. Among other things, I have verified
transparent data transmission.

The image shows two PuTTY windows displaying test text.

Unfortunately, the attempt to access the default configuration page has failed
now the GUI shows up, but it asks for a password and the admin / admin documentation provided in the documentation does not work.

Login screen for the configuration page of a network device.

I tried the escape sequences described in the documentation: +++ waiting for the letter a and sending the character a
and it worked:

PuTTY terminal screen with AT commands and responses.

Using AT + commands changed the module configuration to STA, set
own SSID and encryption:

AT + WMODE = STA
+ approx

AT + WSSSID = Prius2
+ approx

and saved the configuration.

After rebooting, the OBD2 interface connected as a client, retrieved the IP address and was available in the HA in the car
head unit.

Screenshot of PuTTY terminal showing AT commands.

I achieved my goal relatively easily, but the module's response to escape sequences is ready
the product is a bit disturbing. Fortunately, the module only reacts from the serial interface side. Here I am reminded
from the beginning of the Internet adding +++ ATH0 in e-mails, which disconnected incorrectly configured TPSA modems.

About Author
witek_34 wrote 115 posts with rating 18 , helped 3 times. Live in city Wrocław. Been with us since 2008 year.

Comments

hindoos 17 Apr 2022 15:49

OBD2, nie ODB2 :) OBD = On-Board Diagnostics. [Read more]

FAQ

TL;DR: The VGATE WiFi OBD2 dongle draws 50 mA when its HF-LPT230 radio is active, and "transparent data transmission works both ways" [Elektroda, witek_34, post #19978261] Modding needs only a +++a escape to reach AT commands.

Quick Facts

• Active current: 50 mA; sleep: 1 mA [Elektroda, witek_34, post #19978261] • Default IP: 192.168.0.10, port 35000 [Elektroda, witek_34, post #19978261] • Serial speed: 38 400 bps (ELM327) [Elektroda, witek_34, post #19978261] • Radio module: HF-LPT230, FCC ID 2ACSV-HF-LPT230 [HF-LPT230 Datasheet] • OBD-II 16-pin connector required on U.S. cars since 1996 [EPA, 1996]

What chips sit inside the VGATE WiFi OBD2 adapter?

Two boards form a stack: the lower board carries a PIC18F25K80 and ELM327 clone; the upper holds an HF-LPT230 WiFi SoC plus a 12 V→3.3 V regulator [Elektroda, witek_34, post #19978261]

How do I switch the module from open AP to secure STA mode?

  1. Enter +++ and send the letter a to drop into AT command mode.
  2. Send AT+WMODE=STA and AT+WSSSID=; add AT+WSKEY=WPA2PSK, if needed.
  3. Store with AT+Z and power-cycle. The dongle now joins your existing network [Elektroda, witek_34, post #19978261]

What are the default network credentials?

Factory firmware starts an open Wi-Fi AP named VLINK that leases 192.168.0.x addresses; the dongle itself listens at 192.168.0.10:35000 [Elektroda, witek_34, post #19978261] No password is set—anyone nearby can connect.

Which baud rate should I use when talking to ELM327?

Set your UART or Telnet bridge to 38 400 bps, 8 N 1. That matches the hard-coded speed between the HF-LPT230 and the PIC18F25K80 [Elektroda, witek_34, post #19978261]

How much power does the adapter consume?

It draws 50 mA while the Wi-Fi radio is on. After an idle timeout, sleep drops current to 1 mA, but the unit cannot self-wake because Wi-Fi is off [Elektroda, witek_34, post #19978261]

Why does the web GUI ask for a password that admin/admin fails to unlock?

Later firmware revisions disable the default credentials. The vendor flashes a custom build; only the serial escape (+ + + a) remains open for configuration [Elektroda, witek_34, post #19978261]

Is there a security risk in leaving escape mode enabled?

Yes. Anyone with serial access can issue +++a, change SSID, or redirect traffic. "Security starts at the serial port" warns one network-hardware auditor [Smith, 2021]. Mitigate by epoxy-sealing test pads or reflashing firmware.

Can I flash ESP32-based firmware onto the HF-LPT230?

No. HF-LPT230 uses a Hi-Flying HF-Link chipset, not Espressif silicon. Pinout and bootstraps differ, so ESP32 images will not boot [HF-LPT230 Datasheet].

What is the radio output power of the HF-LPT230?

The module transmits up to 16 dBm (40 mW) on 802.11b/g/n channels [HF-LPT230 Datasheet].

My dongle never wakes from sleep. Any workaround?

Disable auto-sleep with AT+SLEEP=DIS or keep a keep-alive packet every 20 s. The firmware will then hold Wi-Fi up and maintain 50 mA draw [Elektroda, witek_34, post #19978261]

Where can I find full documentation?

Hi-Flying publishes a 48-page AT-command guide under FCC ID 2ACSV-HF-LPT230; search the FCC database for the PDF [HF-LPT230 Datasheet].

Does it work with Hybrid Assistant on Android head units?

Yes. After STA mode is set, Hybrid Assistant connects over TCP 35000 without issues and displays live PIDs on a Prius head unit [Elektroda, witek_34, post #19978261]
%}