logo elektroda
logo elektroda
X
logo elektroda

Exploring ELM327 OBD2 Car Reader - WinnerMicro W600-B800 Chipset Internals

divadiow 1977 26
ADVERTISEMENT
  • Helpful post
    #1 21307244
    divadiow
    Level 37  
    Here's another ELM327 I got just to see what was inside.

    ELM327 V1.5 OBD2 diagnostic interface with WinnerMicro chip.

    It's a WinnerMicro W600-B800!
    Close-up of the WinnerMicro W600-B800 chip on a printed circuit board. Close-up of PIC18F25K80 integrated circuit on a green printed circuit board. Close-up of an integrated circuit on a printed circuit board, marked ST1040.

    and from 0TX:

    Code: Text
    Log in, to see the code


    Test pads and OBD2 connectors traced:

    Image showing the interior of an ELM327 interface with pin labels and a circuit diagram.

    I don't think there's any way to backup the firmware of the W600 so as soon as I try flashing OpenW600, the device is no longer any use as an OBD2 reader. I think I will anyway, even though it cannot be used for much after.

    PCB keywords:
    V02-1_S 2017-09-28 Ver:1.2
    V03WC_M_V1.1 2020-11-18
  • ADVERTISEMENT
  • Helpful post
    #2 21307394
    divadiow
    Level 37  
    Screenshot of OpenW600 interface with buttons and system information. Interface of Upgrade Tools V1.5.4 showing firmware update process.

    flashed over PA4/5

    Added after 1 [hours] 39 [minutes]:

    and PB11 and PB12 UART of the W600 traces to these legs of the PIC18F25K80 via resistors

    Image of a circuit board featuring integrated circuits, including PIC18F25K80 and W600, with connections PB11 and PB12 marked.
  • ADVERTISEMENT
  • #3 21622680
    kilowatov
    Level 4  
    Hello! What was the outcome of your research?)

    Added after 2 [minutes]:

    I'm trying to increase the speed of UART W600 but I can't figure out how to enter it into programming mode
  • #4 21622696
    divadiow
    Level 37  
    kilowatov wrote:
    Hello! what was the outcome of your research?)


    the above was the extent of it! I wouldn't know where to begin if I wanted to make an opensource OBD reader using OpenW600. It's back in its box.

    kilowatov wrote:
    I'm trying to increase the speed of UART W600 but I can't figure out how to enter it into programming mode


    W600 can be put into programming mode at power-on if the UART adaptor is waiting to send/receive at the right moment.
    See https://www.elektroda.com/rtvforum/topic4048910.html

    Code: Text
    Log in, to see the code


    what is the aim of "I'm trying to increase the speed of UART"?
  • #6 21622710
    divadiow
    Level 37  
    now that is interesting. I didn't look into what could be done with the PIC18F25K80.
  • #7 21622716
    kilowatov
    Level 4  
    Compatibility test results for ELM327 v2.3 adapter with various OBDII protocol versions
    Bar chart comparing OBD adapter speeds, green bar marks Your adapter

    Added after 3 [minutes]:

    Now it works very well compared to the box according to the recommendations you need to increase the exchange speed and it should be good

    Added after 3 [minutes]:

    >>21622696 wrong mode, I just need to use AT commands to increase the speed on the UART

    Added after 4 [minutes]:


    Screenshot of ELM327 Identifier app showing supported protocol versions
  • #8 21622723
    divadiow
    Level 37  
    oh I get you. Makes sense now. You wouldn't be able to use it at all if you flashed to OpenW600, obviously!
  • ADVERTISEMENT
  • ADVERTISEMENT
  • #11 21622845
    kilowatov
    Level 4  
    Are you saying that something might be blocked?
  • #12 21622849
    divadiow
    Level 37  
    No, I just don't know if it's a given that the developer has enabled/allowed the firmware on there to respond to AT commands. Have you tried sending any commands to see if it responds at all?
  • #13 21622850
    kilowatov
    Level 4  
    yes I tried it does not respond to AT+
  • #14 21623181
    divadiow
    Level 37  
    kilowatov wrote:
    yes I tried it does not respond to AT+

    on either UART?

    PA4/5 = UART0
    PB11/12 = UART1
  • #15 21757643
    retina1
    Level 5  
    @divadiow Thanks for this post. How did you power the board? Did you put 12 V at the OBD connector, or did you apply voltage at the VCC and ground test pads? If yes, did you put 3.3 V?
  • #16 21757657
    divadiow
    Level 37  
    12v through the battery voltage OBD pin 16
  • #17 21757835
    retina1
    Level 5  
    Great, thanks. I will do that. I'm trying to figure out how to connect the voltage. I don't have an OBD female connector. So I'm thinking maybe soldering wires on the PCB where the OBD pins are soldered?
  • #18 21757842
    divadiow
    Level 37  
    that would work I guess. I've shoved female dupont onto them before and used alligator clips. I could hook up 12v then check voltage of the VCC pad on rear if you want to know what that reads as
  • #19 21757861
    retina1
    Level 5  
    >>21757842
    divadiow wrote:
    I could hook up 12v then check voltage of the VCC pad on rear if you want to know what that reads as

    No, don't bother, but thank you. Using a Dupont is a good idea. Obviously, they are too small, but I will try to make it work. Thanks!
  • #20 21757864
    divadiow
    Level 37  
    I jammed it on. Tore it open 😂

    Added after 1 [minutes]:

    May I ask what your goal is? All I did was run OpenBeken, which is nice, but mostly useless as-is on this device. Nothing close to anything OBD2 function-wise.
  • #21 21757905
    retina1
    Level 5  
    divadiow wrote:
    I jammed it on. Tore it open 😂

    Added after 1 [minutes]:

    May I ask what your goal is? All I did was run OpenBeken, which is nice, but mostly useless as-is on this device. Nothing close to anything OBD2 function-wise.

    I want to create a different firmware to access the ELM327 via Wi-Fi. Implementing APIs to access ELM327 instead of the current bridge on port 35000. I am just experimenting and learning on this for fun. At this point I was able to build a firmware, with the SDK, toolchain, etc. So that's a good start.
  • #22 21757907
    divadiow
    Level 37  
    hey that's cool. nice one
  • Helpful post
    #23 21767939
    retina1
    Level 5  
    divadiow wrote:
    hey that's cool. nice one


    I was able to create the firmware I wanted. The source code is here: https://huggingface.co/spaces/MCP-1st-Birthda...tant/tree/main/MCP_servers/W600-embedded-OBD2 (I will put that on GitHub soon).

    This was part of a Hackathon we participated in: https://huggingface.co/spaces/MCP-1st-Birthday/Vehicle-Diagnostic-Assistant

    Thank you for your help!
  • #24 21814867
    divadiow
    Level 37  
    darn. I transplanted W600 from ELM327 onto the HC-25 for easier SWD dumping but I think maybe SWD is disabled in efuse or something.

    HC-05 Bluetooth module with IC and pin header on blue background

    There is continuity to IC legs and I checked Jlink connected OK still with original chip. WiFi_OBDII AP broadcasts so it's working.

    I was really hoping to get a dump of the OBDII W600 fw

    Connection error in SEGGER J-Flash V8.30 with hexadecimal memory view

    HC-01 wireless module with labeled GPIO and UART interface pins

    Added after 9 [hours] 54 [minutes]:

    testing Python thing to query ROM about security level. This is on Air602

    Code: Text
    Log in, to see the code


    as one would expect on the Air602, [0x34] 'S:0' shows security level to be least restrictive.

    Exploring ELM327 OBD2 Car Reader - WinnerMicro W600-B800 Chipset Internals

    Exploring ELM327 OBD2 Car Reader - WinnerMicro W600-B800 Chipset Internals
  • #25 21815929
    divadiow
    Level 37  
    holding PA0 down at power-on means rom mode and no secboot. here we can get a response to 38, 34 and 3c. Seems to show the OBDII W600 is not locked:

    Code: Text
    Log in, to see the code
  • #26 21816369
    divadiow
    Level 37  
    looking at this from an AT command flash-read angle, W600 OBDII firmware responding to AT commands over PA4/PA5:

    Code: Python
    Log in, to see the code


    Python script that got the responses above:
    Code: text
    Log in, to see the code


    Added after 6 [minutes]:

    :D
    Screenshot showing flash dump progress of W600 to binary file

    Added after 40 [minutes]:

    finally. SWD and UART fail, but a full dump using AT commands.

    Code: Text
    Log in, to see the code


    The dump boots and broadcasts WiFi_OBDII AP when flashed to Air602

    use
    Code: Text
    Log in, to see the code

    Code: Text
    Log in, to see the code

    Code: Text
    Log in, to see the code

Topic summary

The discussion revolves around the internal components of the ELM327 OBD2 reader, specifically focusing on the WinnerMicro W600-B800 chipset. The user shares images of the device and logs from its operation, detailing the initialization process of the SPI flash driver and parameter loading. Additional modifications are mentioned, including connections to the PIC18F25K80 microcontroller via resistors for UART communication. The technical details highlight the device's functionality and the user's exploration of its internal workings.
Summary generated by the language model.
ADVERTISEMENT