Project 'Landlord'

Open source firmware for Worx Landroid robotic mower.

Similar projects worth following
Reverse engineering and develop a new and open source firmware for the Worx Landroid robotic mower family. Add new features. Smarter algoritm. Add GPS for smarter navigation.

DB275 models uses a NXP LPC1768 arm Cortex-m3.
DB504 models are very similar to DB275 but uses a NXP LPC1788 arm cortex-m3.
DB297 models - please share images!

IC's on DB275-10:

IC's on DB504-03:

The onboard bootloader checks USB after memory stick after firmware file and flashes the its contents.
Custom firmware does not overwrite the bootloader, so it is possible to revert to original firmware.
DB275 firmware start at 0x9000
DB504 firmware start at 0x10000

Source code:

To setup build enviroment follow How to install the ARM toolchain
Also possible to use KEIL-MDK.

Please feel free to donate money.
I currently own thrr landdroid's. Two 791e 2015, 794e 2014 - with DB275 motherboard and one wg791e.1 (2016) with DB504.

Bitcoin: 3FnkdzXjkyeHK5o5H3wzM9jDzw52Q3GEog

  • 1 × Brave owner In case the mower starts chasing your pets and begins to burn under your car!
  • 1 × Worx Landroid
  • 1 × USB stick generic for flashing firmware - FAT32 formatted

  • Battery

    Daniel Wiegert07/21/2016 at 20:50 3 comments

    There have been some discussion over batteries and charging down in the comments. I'll publish images of inside of battery.

    The tabs are solders After case is screwed together. So to split it you need to cut the connecting tabs on one side...

    Cells are Sony 18650 1900mAh. Thanks to Jan B!

  • Unpacker for firmware .pck

    Daniel Wiegert07/19/2016 at 19:09 5 comments

    Warning etc etc, use with caution... Might contain bugs :)

    import sys
    if len(sys.argv) <2:
      print( "usage:" )
      print("  " + sys.argv[0] + " [.PCK file]", "[Folder-prefix]" )
      print( "  " )
    import os
    from binascii import crc32
    from struct import unpack
    #get unpack file
    src_file_path = sys.argv[1]
    #read file length
    src_file_size = os.path.getsize(src_file_path)
    #read file
    b = bytearray(open(src_file_path, 'rb').read())
    # crude bytearray to String converter
    def toStr(b):
      return "".join(["%c"%i for i in b]).strip("\x00")
    # convert 4 bytes to int
    def word2int(w):
      return unpack("<I", w)[0]
    # crude filetable parser
    def getHeader(b, datastart):
      beginstart=b.find(63) #"?"
      filename = toStr(b[0:beginstart]).replace("\\","/")
      beginlength=b.find(63,beginstart) #"?"
      start = int(b[beginstart:beginlength],16) + datastart + 4
      length = int(b[beginlength:beginlength+10],16)
      return {
        "filename": filename,
        "start" : start,
        "length" : length,
    #crude way to create nonexisting directories
    def checkCreateDir(filename):
      if not os.path.exists(os.path.dirname(filename)):
        except OSError as exc: # Guard against race condition
            if exc.errno != errno.EEXIST:
    def save(filename, data):
      checkCreateDir(prefix + "/" + filename) #create missing directories
      print ("writing %s\t (%d bytes)"%(filename,len(data)))
      open(prefix + "/" + filename, 'wb').write(data)
    ## Start decoding
    print("Unknown byte 0:\t"+ str(b[0]))
    print("Unknown byte 1:\t"+ str(b[1]))
    print("Unknown byte 2:\t"+ str(b[2]))
    print("Unknown byte 3:\t"+ str(b[3]))
    prefix = sys.argv[2] if len(sys.argv)>=3 else "."
    headerstart_token = bytearray((int(62), int(0x0d), int(0x0a)))
    headerstart = b.find(headerstart_token,0)+3
    datastart_token = bytearray((int(0x0d), int(0x0a), int(0x0d), int(0x0a)))
    datastart = b.find(datastart_token,0)
    print("header end: \t"+ str(datastart))
    nHeaders = b.count(int(13),4,datastart)
    print("# files \t: "+str(nHeaders))
    # crude way to parse the directory table
    files = []
    print ("found %i files\n"%nHeaders)
    token = bytearray((int(0x0d), int(0x0a)))
    for i in range(nHeaders):
      h = getHeader(b[pos:pos2], datastart)
      pos = int(pos2)+2
    for h in files:
      bFile = b[h["start"]:h["start"]+h["length"]]
    #write stripped file

  • Help identifying component (solved)

    Daniel Wiegert07/06/2016 at 08:24 4 comments

    The right one, its a ST L3GD20H, Thanks Ajlitt!

    Left is MMA8452Q, 3-axis, 12-bit/8-bit digital accelerometer

  • Pinout DB504

    Daniel Wiegert06/27/2016 at 19:57 3 comments

  • Different motherboards.

    Daniel Wiegert06/20/2016 at 21:16 2 comments

    I've been working on mapping 2016 year model of worx, they use DB504 motherboard. Usually .pck-firmware, its a container and the start is plain-text. It's possible to do a splitter for that but I use dd to copy out the firmware.

    DB504 probably use LPC1788. I've been looking on some io's on a picture I've recieved and it seams to be correct. (not possible to read chip text without removing the conformal coating)

    My guess so far is U10 = spi flash. U11 + U12 compass / accelerometer / gyroscope. Yellow tape protects JTAG from the coating

    Display and Keyboard are the same as previous models. Wire sensor uses a daughter board:

    Should we assume they still uses LPC and that this might be an LPC11U6x?

    Wifi module are supplied from, uses SPI (SSP0) communication. easy to mod! :)

    ( looks like a suspect...)

    So far I've been developing and reversing DB275 (2015 WG790/791/794) It seams all 2016 has DB504.

    WG796e (2015) uses DB297 which I haven't seen yet. So if any one wants to send in pictures of that motherboard it would be very appreciated!

    I don't know much about earlier versions.



  • Some / Slow progress

    Daniel Wiegert06/07/2016 at 09:05 0 comments

    I had a small break, I let the mowers do their job outside! :)

    I've figured out the boundary wire and how it works. I finally got the idea to use the USB d+ and d- (p0.29 + p0.30) and output of p0.7 - p0.10 and measure with oscilloscope.. :) (4 wire inputs -> raising and falling each on pos / neg)

    The blue is probe directly on the boundary wire.

    So if negative measurement is before or after the positive, then you know if you are inside or outside wire.

    p0.21 select amplification or something, you can detect if you are within 1 meter of the wire or not.

    p0.22 probably selects between left and right sensor.

    And if you are close to the sensors you get some weird artifacts in the measurement, longer pulse, and even more than one pulse. It seams this is following a pattern and it might be possible to user and detect the distance to the wire at 0cm, 10cm, 20cm and 100cm.

    And the last one, wire right on top of the sensor.

  • Original firmware?

    Daniel Wiegert05/06/2016 at 12:32 4 comments

    I could use some owners help. I would like to have your firmware-files!
    I need to see how big of a difference it is between models.

    Please contact me!

    Thanks all!

  • Pinout!

    Daniel Wiegert05/03/2016 at 08:14 0 comments

    95% of the pin-out is finished. There are some questions still to be answered. Also the models with WIFI, How do they look inside? I would love to see some pictures of the main board in that one!

    One guess would be that the un-populated IC nead RTC battery is a SPI flash but not confirmed.

    Next important step would be to understand the how the wire sensor works.

    P0.0  GPIO Output, Motor Left, Select Forward/Reverse
    P0.1  GPIO Input, Dip switch 3
    P0.2  ADC6, Motor Right, Current ?? -> Need more investigation
    P0.3  ADC7, Motor Left, Current ?? -> Need more investigation
    P0.4 + P0.5 GPIO Output, Selector ADC4 input -> accelerometer LIS352AR pin S0, S1.
      0    0 - ADC4 = X
      0    1 - ADC4 = Y
      1    0 - ADC4 = Z
      1    1 - ADC4 = aux (temp batt)
    P0.6  GPIO Output, Speaker High volume
    P0.7  GPIO Input, ExtInt3 Raising edge - Wire sensor -> Need more investigation
    P0.8  GPIO Input, ExtInt3 Falling edge - Wire sensor -> Need more investigation
    P0.9  GPIO Input, ExtInt3 Raising edge - Wire sensor -> Need more investigation
    P0.10 GPIO Input, ExtInt3 Falling edge - Wire sensor -> Need more investigation
    P0.11 GPIO Output, Enable Charging (in charger, after P1.23 is set to 1)
    P0.15 SPI SCLK, LCD
    P0.16 SPI CSB, LCD
    P0.17 SPI MISO, LCD <- Unused? NC?
    P0.18 SPI SDA, LCD
    P0.19 SPI RSTB, LCD
    P0.20 SPI A0, LCD
    P0.21 GPIO OUTPUT, Selector Guide Wire sensor, Range / Amplification
    P0.22 GPIO OUTPUT, Selector Guide Wire sensor, Unknown function -> Need more investigation
    P0.23 ADC0, Charge current? (Or Charge voltage, Only >0 then charging) 
    P0.24 ADC1, Voltage Battery
    P0.25 ADC2, Accelerometer, Sideways (X/Y)
    P0.26 ADC3, Accelerometer, Forward (X/Y)
    P0.27 GPIO Input, Motor Rotor, Rotation tick? -> Need more investigation
    P0.28 GPIO Input, Charger state? Battery full? -> Need more investigation
    P0.29 USB D+, Maybe used for softUART for GPS / External mcu communication
    P0.30 USB D-, Maybe used for softUART for GPS / External mcu communication
    P1.0  GPIO Input/Output, Keypad matrix Row1
    P1.1  GPIO Input/Output, Keypad matrix Row2
    P1.4  GPIO Input/Output, Keypad matrix Row3
    P1.8  GPIO Input/Output, Keypad matrix Row4
    P1.9  GPIO Input/Output, Keypad matrix Col1
    P1.10 GPIO Input/Output, Keypad matrix Col2
    P1.14 GPIO Input/Output, Keypad matrix Col3
    P1.15 GPIO Input/Output, Keypad matrix Col4
    P1.16 GPIO Input, Hall Sensor, Lifted
    P1.17 GPIO Input, STOP Button
    P1.18 Unknown, NC?
    P1.19 Unknown, NC?
    P1.20 GPIO Output, LCD Backlight ON, PWM1.2 can be used here if motors are inactive. (Pulsing screen then charging)
    P1.21 GPIO Input, High then connected to charger and charger is RED
    P1.22 Unknown, NC? USB Power on??
    P1.23 GPIO Output, Initiate Charger, Keeps charger in RED mode. if low charger shows green light.
    P1.24 GPIO Output, Speaker Low volume
    P1.25 GPIO Output, Keep high for PCB Power on.
    P1.26 Unknown, NC? Sensor?
    P1.27 Unknown, NC? Sensor?
    P1.28 GPIO Input, Power key, Normal HIGH
    P1.29 GPIO Input, Sensor, Rain
    P1.30 ADC4, Output from LIS352AR, Selected by P0.4 + P0.5
    P1.31 ADC5, Motor Rotor, Current ?? -> Need more investigation
    P2.0  PWM1.1, Motor Right speed
    P2.1  PWM1.2, Motor Left speed
    P2.2  PWM1.3, Motor Rotor speed
    P2.3  GPIO Input, Dip switch 2
    P2.4  GPIO Output, Motor Right, Enable/Start | Disable
    P2.5  GPIO Output, Motor Right, Brake ON/OFF
    P2.6  GPIO Output, Motor Right, Select Forward/Reverse
    P2.7  GPIO Input, Dip switch 3
    P2.8  GPIO Output, Motor Left, Brake ON/OFF
    P2.9  GPIO Output, Motor Left, Enable/Start | Disable
    P2.10 GPIO Input, EInt0??, Sens Motor? Error?  -> Need more investigation
    P2.11 GPIO Input, EInt1 Edge, Motor Right Rotation tick
    P2.12 GPIO Input, EInt2 Edge, Motor Left Rotation tick
    P2.13 GPIO Output, Motor Rotor, Enable/Start | Disable
    P3.25 GPIO Output, Motor Rotor, Brake ON/OFF
    P3.26 GPIO Output, Motor Rotor, Select Forward/Reverse
    P4.28 GPIO Input, Hall Sensor, Cover
    P4.29 GPIO Input, Hall Sensor, Front

  • 327 35AR?

    Daniel Wiegert05/02/2016 at 16:03 0 comments

    I think I've solved the mystery!
    Not exacly the same, but I would guess its very similar to this LIS352AR

    Package is the same, same 3 analog outputs.

  • Guide Wire...

    Daniel Wiegert05/02/2016 at 11:59 0 comments

    I am trying to figure out how the guide wire sensors work.

    There are 4 inputs (digital), P0.7, P0.8, 0.9, P0.10) that the original firmware has put on extint3, two trigger on Falling edge, the other two on Raising edge. Probably and each on each sensor.

    There are also two control pins (digital).
    One is for Range, or Amplification, P0.21.
    If I'm close I get triggers regardless of p0.21 state, and then I am far away from guide wire I only get triggers then P0.21 is High.

    The other control pin is so far unknown, P0.22. It changes the output on P0.7-0.10. I cannot figure out how this works yet.

    The Falling edge's also show if the mower is looking perpendicular to the guide wire; P0.8, P0.10 is high.
    If the mower looks 'Downrange', P0.10 is high, P0.8 low.
    If the mower looks 'forward', the opposite, P0.8 High, P0.10 Low.

    So, any suggestions? My next move is probobly to try to make a logfile of all the triggers, there are around 10-20 per second.

View all 19 project logs

Enjoy this project?



Lennaert Tolhoek wrote 05/26/2021 at 15:34 point

Hello, I'm the owner of a Worx Landroid L2000i. I want my mower to mow 160 hours a week. The default firmware (i think) is limited to 2000m2 and 40 hours a week. While, if the machine could work 24/7, in theory would be able to do 8000m2. Which is what I need. Who can help me to alter the firmware?



  Are you sure? yes | no

SzigetiD wrote 05/20/2021 at 22:07 point


Can anyone help me with the frequency and voltage of the boundary wires?
Can anyone measure it?

Thanks, David

  Are you sure? yes | no

thomywb wrote 08/06/2020 at 19:53 point


i have a WG 795. my Rainsensor error A10 . How i reset the error? How i test the rainsensor ?

It is possible break the wire to the rainsensor?


  Are you sure? yes | no

Ddudu wrote 06/29/2020 at 20:28 point

hello! i got one WG 790 e.1 that i got from a friend, and he forgot the code on it. is there any way to remove the code? or reset?

  Are you sure? yes | no

Isak Johansson wrote 05/18/2020 at 10:56 point

Hi! I got a Worx Landroid WG790E.1 with possibly a DB504 board. Im wondering if anyone can tell me how to reset it manually with the JP4 thing or "reset pin". I only know gaming boards :/. I'll help in any way i can to return the favor.

Kind regards 

Isak ^.^

  Are you sure? yes | no

danielfaxcopy wrote 05/15/2020 at 06:28 point

Hi Friends,

Could you help me, what type exactly Motor Drive IC - there is 3 pieces  - i found Q10 dead  :-(

Thanks for all!

  Are you sure? yes | no

er_toma wrote 05/01/2020 at 06:58 point

Hi, I have Landroid L WG79X with board DB275-9, firmware V0.50. how can I read the log file?

or there is a software to connect the robot?

Thank you

  Are you sure? yes | no

fracii wrote 04/19/2020 at 21:47 point

Hi, I have al-ko robolinho 700 and get crazy over angel/level sensor limit. Its a magnetic chip with 6 wires and a magnet. Working for all directions and work also as bumper and lifting sensor. Anyone know How I can bypass this so I can go greater 45%. Thinking to hack the firmware but it's ASCII.hex.. In service software maximum is set for the program limit for resellers 30 degree..

  Are you sure? yes | no

popz3210 wrote 04/13/2020 at 14:18 point

Has anyone been able to add a WiFi card to the US version?

  Are you sure? yes | no

Niedved wrote 10/17/2019 at 17:16 point

Hi. I bought damaged Worx Landroid WG 797E.1 2016 as a base for my Robo Project :) luckly I was able to fix Base and few more elements inside machine and all start YEAH. Unfortunately Worx was locked with PIN and there is no contact to seller.

If I want to instal this open source firmware is it possible with PIN on it ? Or maybe there is another way to make hard reset to launch original soft to test it before instaling new firmware ?


  Are you sure? yes | no

hans hult wrote 08/05/2019 at 09:16 point

Got an WG790e1 that i will start play with . 

Do i need an Jtag adaptor or are there any drivers to use for direct connection to my pc ? 

// Hans 

  Are you sure? yes | no

Riley wrote 06/13/2019 at 04:24 point

Just got one of these on a pretty good deal for an open box but unused. Want to start hacking on it but so far have hit a snag on normal operation. Clock time resets if the unit turns off. Super annoying but is making me wonder if this Landroid has a bad controller. Any idea if there is a internal battery on the main control board or if I should be investigating the main battery. 

  Are you sure? yes | no

tgrauss+ wrote 05/19/2019 at 10:45 point


Do you know if it works with the new Landroids? Mine is the New Landroid-M aka WR153E


  Are you sure? yes | no

ch4 wrote 08/19/2018 at 21:50 point

Hi, I have broken my charging station of Worx Landroid S.  Does any one have a reverse enginneering to build the electronic card.

Thanks for your help

  Are you sure? yes | no

Novabilsky wrote 05/16/2018 at 06:59 point

hi, im the owner if the older model worx landroid wg795e, unregistrated, wothout usb port, only with 10pin port. I need to reset the pin as i forgot it, can u help me?

  Are you sure? yes | no

prishtinasboy wrote 08/05/2018 at 20:03 point

hi did u get help to reset the code? my worx have forgotten the pin.. 

  Are you sure? yes | no

V. Deconinck wrote 04/21/2018 at 13:55 point

Hi. I was given a "broken" Landroid WG791E and thought maybe I could repair it and then hack it :-)

The first issue was that the power supply was soaked wet, having caused an internal shortcut. Using a separate PSU, I could get to the "base flashing green" state. I have access to the lawnmower's menu but the motors (wheels and blades) don't start, and I thought maybe that was because no boundary wire was detected nearby.

As I don't have the original boundary wire, I just plugged a piece of random wire between IN and OUT and the PSU overcurrent protection triggered immediately (over the stated max 1.5A) !

After putting a 1K resistor across the "boundary wire" connector, I measured a steady 28V DC on it, like it's directly connected to the incoming 28V, but that doesn't really make sense as the "boundary wire" seems to be just a wire with very low resistance, so I suspect the power part in the base is fried too, but it's hard to diagnose as it is fully potted...

Do you have any information about what signal is required on the boundary wire (DC pulses or AC ? Voltage or current source ? Frequency ?)

Any information would be highly appreciated. KR. Vincent

  Are you sure? yes | no

Jonathan Smårs wrote 06/01/2017 at 14:45 point

I've been reading up on this project and it looks really exciting! I'm wondering how far you have come with this? Is it possible to interface directly with the steering of the mower? If I could access forward/back/turning directly, I think I might build a DGPS or similar location system to get much better cutting.

Also, is there anyone experimenting with alternative batteries to get faster charge rates, giving way more up time and thus larger cutting areas?

  Are you sure? yes | no

Ampeater wrote 11/30/2017 at 00:03 point

There is enough surface area on the mower that you can run straight from solar. Mow continuously as long as the sun is out

  Are you sure? yes | no

Fabian Olesen wrote 05/13/2018 at 14:26 point

ive extended the battery pack with another battery pack, basically, same lineup as original, then connect + to + and - to -. also, ive upgraded the batterypack to 2600 mAh instead, which in total gives me runtime of 2.5 times normal, of course charging will take longer, but so far im only seeing aprox 60% increase in charging time.

  Are you sure? yes | no

Kresten wrote 04/24/2017 at 23:26 point

Great tear-down! 

I recently purchased a Landroid S 500, and found my self wondering if there was anyway of getting it to be a bit smarter, so I found myself here :) 

One improvement that would be nice was a better "return home" function. Mine just follows the boundary wire all the way to the charging station (through all zones)... 

My initial thoughts was that it would be nice if it was possible to add "shortcuts" to the boundary wire - maybe in the form of rfid tags. The mower could be programmed to react to each tag by making x degree turn, in-order to point it in a direction in witch it would reach home faster :)

do all Landroid's return home in this way or do som have a guide wire like the Husqvarna?

  Are you sure? yes | no

Fabian Olesen wrote 05/13/2018 at 14:27 point

that is standard behaviour. i plan to rip the guts out of it when it dies, and rebuild it with my own system, when that time comes, but that might be a few years down the line lol

  Are you sure? yes | no

Mark Holbrook wrote 04/22/2017 at 02:21 point

This is great work! I have a parallel interest in that I'd like to identify what the on board processor's I/O port functions are so that I can cut signal output traces and replace the processor with my own CPU/WiFi/GPS. Has anyone identified the I/O line functions of the board's processor? Don't own a Landroid yet but this looks like it has lots of potential. (Edit) Great! I found your mapping. Superb! 

  Are you sure? yes | no

David wrote 03/31/2017 at 17:47 point

How is the new model SO500i differring from the previous models? It comes with Wifi, hence it might be a good idea to check backward compatibility. Has anyone tried this one?

  Are you sure? yes | no

Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates