Close

Reversing Gear

A project log for OM127-reboot

repair currupt firmware system in OM127 OBD2 scanner from AUTOPHIX

darkspr1tedarkspr1te 05/24/2018 at 16:040 Comments

Ok, so we have a quick overview of the device, now what. Well that was the hard and fun part, I started with some overhead board shots from my mate 8 and using gimp I traced out all the pins to the first via or component, along with a underside board shot i would trace them to the next point, My main goal was to get to the first big device on each pin, a example would be the TX pin (PA9) , it's first device was a transistor, Ok so this circuit could be a buffer or voltage converter as it has two NPN transistors in series (Q4/Q5) which goes onto pin 7 of the OBD, that K line TX, Then we traced RX into that same circuit via U7 , U7 is a comparitor,   one side of U7 is conected to the K-Line and the other is J1850 bus, My assumption is it's for RX'ing the Differential signals and sending them to the RX of the hardware & software UARTS, the other side of the transistors (Source ) is connected to the 12V+ from the vehicle via a few resistors. 

So now we know that out K-line setup is two transistors in series and a few resistors to 12V, a big o google later and i found that ELM uses that setup for the 327 model chip, see

KL-Line ELM327

It does not have the LM393 there but a few other OBD readers do and all point to the other side of the differential signal and as a buffer, as it's connect to the OUT1 of LM393 then thats a good bet ,

 it's shown in this schematic LM393 in differential RX circuit

Next we shall look at the CAN BUS and J1850+ parts in more depth

Discussions