logo elektroda
logo elektroda
X
logo elektroda
Advanced Search
logo elektroda

ELM327 OBDII Scanner: Transa Semi ESWIN TR6260S1 MCU Details?

divadiow 1116 6
ADVERTISEMENT
Reply | New topic
  • Helpful post
    #1 21336014
    divadiow
    Level 35  
    Another cheapie ELM327 OBDII car scanner/code reader from Ali Express
    Wifi ELM327 V2.1 OBD2 car scanner from AliExpress.

    https://www.aliexpress.com/item/1005005430283406.html

    but this one, like the one here, is based on the Transa Semi/ESWIN TR6260S1.

    WiFi ELM327 OBDII car scanner from AliExpress ELM327 OBDII car scanner with CD Black ELM327 OBDII car scanner from Ali Express. A white CD with blue print and a small panda graphic, inserted in a paper sleeve. TR6260S1 electronic module inside OBDII scanner casing. Printed circuit board of ELM327 OBDII car scanner marked MID-WF. Close-up of a circuit board with an electronic module inside a black adapter housing.

    Unfortunately the test pads on the bottom appear to be for the unknown MCU hidden under the resin COB. Perhaps RX/TX - there is no plain-text output at any baud. ~2.8v was measured on one pad.

    Close-up of a PCB with GND and 2.8V markings.

    With pogo pins in place before the resistors on RX/TX and TOUT2 grounded, the factory firmware can be dumped to file using the method here. Firmware attached.

    Close-up of an electronic circuit with connected test wires.Circuit board with attached probes and glowing LEDs.


    TR6260S1 IC with pin layout diagram Close-up of TR6260S1 chip on PCB with labeled pins TOUT2, RXD0, and TXD0.

    nothing but the basic boot message in log out, depending on TOUT2/3 boot mode chosen by grounding

    Screenshot of a baud rate settings window displaying the messages entry BootRom and spi-flash boot mode.

    Screenshot of terminal showing boot mode at 57600 baud rate.

    and with TOUT3 grounded - "sdio boot mode"

    During backup the blue LED flashes quickly




    quite a lot of strings in plain-text in the firmware. eg

    Code: Text
    Log in, to see the code


    next I will flash the firmware to the TR6260S1 HLK-M20 module and report back on success/failure.
    Attachments:
  • ADVERTISEMENT
  • ADVERTISEMENT
  • Helpful post
    #3 21336099
    divadiow
    Level 35  
    so yes, flashing the backup to the HLK-M20 does create a working bootable device. The backup file needs splitting in two 0x0-0x6000 then the rest 0x6000-0x100000

    Application interface for flashing firmware on HLK-M20 with selected binary files.

    and the AP broadcasts as if the real ELM327
    A screenshot showing a WiFi signal named WIFI_OBDII.
    Attachments:
  • ADVERTISEMENT
  • Helpful post
    #4 21337433
    divadiow
    Level 35  
    Another one! An OBDII Mini. RX/TX/TOUT2 test pads exist and are more convenient on this one.

    Blue OBDII adapter with the label WI-FI SUPER OBD and MINI. Close-up of an electronic circuit in a transparent blue plastic enclosure.

    Oddly this didn't seem to broadcast an AP, but it did give the standard bootloader output from TX. Also, all the LEDs are permanently lit. Not sure if this is how it's mean to be. No matter. As before, a backup was taken and is attached.

    This one was treated to @insmod's OpenTR6260 build. Flashed with this config:

    Screenshot of UTP software interface for firmware loading.

    AP broadcast and OpenTR6260 GUI:

    Screenshot showing the Wi-Fi network identifier OpenTR6260_B0148555. OpenTR6260 user interface with configuration buttons.

    I also flashed the backup from the first device and this booted and broadcast the WIFI_OBDII AP. LED behaviour was no different.
    Attachments:
  • ADVERTISEMENT
  • #6 21538318
    siddharthsutradhar20
    Level 1  
    divadiow wrote:
    ModelSmsTR6260_IoT
    VendorInfo
    Transa
    VersionInnerTR6260V0.0.1B02
    VersionExt
    TR6260V1.0.0B02
    HardVer
    TR6260HWV0.1
  • #7 21538327
    divadiow
    Level 35  
    >>21538318
    🤔
    Was there a question to be added to this quote?
Reply | New topic
Report a violation of the law

Topic summary

The discussion focuses on a low-cost ELM327 OBDII scanner/code reader available on AliExpress, which utilizes the Transa Semi/ESWIN TR6260S1 MCU. The device features test pads likely for RX/TX signals, but no plain-text output was detected at any baud rate, with a measured voltage of approximately 2.8V on one pad. A backup of the firmware was extracted from the device and successfully flashed onto an HLK-M20 module after splitting the backup into two memory segments (0x0-0x6000 and 0x6000-0x100000), resulting in a working bootable device that broadcasts a Wi-Fi access point mimicking the original ELM327. Another variant, an OBDII Mini with more accessible RX/TX/TOUT2 test pads, was also examined. This Mini did not broadcast an AP initially but provided standard bootloader output via TX and exhibited permanently lit LEDs. The Mini was flashed with the OpenTR6260 firmware build, enabling AP broadcast and GUI interaction. Firmware versions and hardware details were identified as ModelSmsTR6260_IoT, VendorInfo Transa, VersionInnerTR6260V0.0.1B02, VersionExt TR6260V1.0.0B02, and HardVer TR6260HWV0.1, indicating possible SDK differences between device variants.
Summary generated by the language model.
Popular Topics
ADVERTISEMENT