Dissection of a counterfeit ELM327 OBDII Adapter from China

The ELM327 is a popular IC developed by Elm Electronics for communicating with the standard OBDII (On Board Diagnostics) protocols through the OBD2 port on your vehicle. This is used by mechanics and DIY’ers to diagnose and troubleshoot vehicle problems. It is also used by enthusiasts for getting useful information about your vehicle in real-time, such as speed, revs, temperature, air-flow, fuel consumption, etc.

Fake ELM327 adapter from China

I purchased one of these adapters from dx.com (SKU: 126921) , only to realise my mistake later that the adapters sold from China are nearly all counterfeit clones of the original ELM327 by Elm Electronics, and many of them do not work. Taking a look inside the adapter you can see some problems straight away.

Inside a fake ELM327 adapter from China

The inside contains two layers. The top layer has a Beken BK3231 Bluetooth SoC, a Microchip MCP2515 CAN Controller, and a NXP TJA1050 CAN transceiver. There are also three status LED’s which are not visible from the outside. My guess here, is that this design is the same internally as some of the transparent designs sold on the same website which have status LED’s visible. By using different cases, some more closely resembling an official product, they can sell more.

Inside a fake ELM327 adapter from China

The bottom layer is concerning. There are two voltage regulators and solder joints to the ODB2 pins. Only pins 4,5, 6, 7, 14, 15, and 16 are soldered to the bottom board. Pins 1, 2, 3, 8, 9, 10, 11, 12, and 13 are unconnected. The adapter advertises that “All OBDII protocols are supported”. However this is impossible, as pin 2 is required for the Bus Positive Line of SAE J1850 PWM and VPW, while pin 10 is required for the Bus Negative Line of SAE J1850 PWM.

What about the top board? Well the thing about the genuine ELM327 adapter is that it uses a PIC microcontroller, on which the ELM327 firmware is loaded. Nowhere on this adapter is such a PIC microcontoller. In fact, the only IC capable of running code on this adapter is the Beken Bluetooth SoC. According to the Beken datasheet, this SoC has 256 KiB of flash memory, and uses an ARM 968E-S core. This is incompatible with the PIC instruction set. So just what has happened here?

I have to make some guesses about the history of fake ELM327 adapters. Supposedly, the original ELM327 v1.0 did not contain copy protection, and the firmware was cloned in China. The firmware version was changed to report v1.5, and a large number of these fake adapters were made from the pirated ELM327 v1.0 firmware. Keep in mind that Elm Electronics never released a version 1.5 firmware of ELM327. Thus all v1.5 adapters are fake.

However, the version reported on the packaging of my adapter states v1.5, but there is no PIC microcontroller inside. How can this adapter be a clone of the original v1.0 ELM327 firmware?

Perhaps the makers of these fake adapters wanted to save costs by not having to include a PIC microcontroller inside the adapter as well as a Bluetooth controller. Instead they use the Bluetooth controller to run the ELM327 code so they can save cost. The problem is that the ELM327 firmware is written for a PIC microcontoller, and not an ARM CPU, which is what you will find inside Bluetooth SoC devices. It is not easy to re-use the PIC microcode  unless you can emulate the PIC on the ARM.

I guess that the ELM327 firmware had to be re-written, from scratch, perhaps with reference and help from the original PIC microcode. This is no easy task,and it doesn’t seem like they did it correctly. When they finally finished the new “fake” ARM ELM327 firmware, they gave it firmware version 2.1 to keep in line with the latest genuine version from Elm Electronics. The new fake ELM327 v2.1 adapters sold quite well, but there was a problem; there are bugs, and the support of the ELM327 command set is even worse than that of the original v1.0. Word spread around that the v2.1 adapters from China don’t work. To solve this problem they changed the version number back to v1.5. The original clone from China had v1.5 reported, and used a PIC microcontroller, and had full support of the ELM327 v1.0 command set. But this new version only has partial support – as it is a buggy and incomplete re-write of the genuine PIC firmware. The result is that it’s now really hard to tell whether an adapter that states v1.5 firmware is really the original PIC cloned firmware, or the new buggy and incomplete re-write.

To confirm some of this, I connected with Bluetooth to the adapter, and used a terminal application to try out some of the ELM327 command set that should be supported by v1.0 firmware.

>ATZ
ELM327 v1.5
>ATSP5
OK
>ATE0
OK
>ATS0
?
>ATAT1
?
>ATSTT3A
?
>ATAL
?

The fake ELM327 adapter does not even support all the basic commands of the ELM327 v1.0 command set. The ATZ command resets the device, which worked OK, but the ATAL command – to allow long byte messages – failed to be recognized. As did a number of other commands.

This adapter failed completely in my car, even though it has the pins needed for ISO 14230-4 fast-init protocol soldered on the adapter.
I tried a number of android and PC ELM327 reader applications without success.

Advertisements

20 thoughts on “Dissection of a counterfeit ELM327 OBDII Adapter from China

  1. Tick

    Unlikely that it doesn’t work. I’d reckon it’s compatibility with your car. Have you tried it with multiple cars?

    Reply
    1. timyouard Post author

      Yes, I think it does work on some cars.
      I’ve tried two cars so far. One doesn’t work because of the lack of connected pins inside the adapter.
      The other doesn’t work because the adapter doesn’t support all the ELM327 command set needed for that car.

      Reply
  2. theksmith

    i’ve been through a number of these, both USB & Bluetooth. even 2 clones i got from the exact same company on Amazon had different internals – one did not even have the electronics necessary for my last vehicle (J1850 protocol).

    Scantool.net’s products are all genuinely theirs, but do not use ELM chips. they use STN11xx chips which they make internally. the firmware appears to be a complete rewrite of the ELM 1.3a feature set, plus some of their own features (ST commands) and supposed speed improvements. for a while, some of the STN11xx based products had more capabilities than the ELM stuff (SW-CAN and MS-CAN, which are not OBD but found on some vehicles’ other busses).

    currently however, i think the latest genuine ELM327 chips with the “real” v2.1 firmware now have a slight edge over then STN11xx’s in capability. TotalCarDiagnostics.com is the only place i know that is selling products with a genuine ELM327 v2.1 chip. they are based out of Australia and have USB, Bluetooth, and WiFi versions.

    Reply
      1. Sammy

        Totalcardiagnostics clearly state that they do NOT use the real ELM327 v2.1 chip. It may be better in build quality but they stated v2.1 is their ‘own’ version and not the real ELM327’s v2.1. I seriously doubt ELM ‘allows’ anyone to use just the firmware and not the chip. One can only buy the chip I think. Clone makers found a way to modify ATZ ‘version’ returns to show any number. Total car diagnostics simply managed to get one of those firmwares (some are hacked versions of the old ELM 327 1.0, some are written from scratch to mimic the ELM 327 firm ware. Some even claim to sell real but sell the mimiced ones.

        Check links below:
        From Romania (claims to use real, but dubious):
        http://elm-327.eu/

        Real ELM 327 (highly likely to be real): v1.4b I think
        http://skpang.co.uk/catalog/elm32x-obdii-products-c-26.html?zenid=ncl20uc88emk88jp1h229t5ieqbcej6k

        — Excerpt from TotalCarDiagnostics.com website below —
        http://www.totalcardiagnostics.com/elm327-bluetooth/

        CAUTION: This is latest genuine v2.1 ELM327 Bluetooth scanner using Elm Electronics firmware. Please note, it does NOT use Elm Electronics chip, because that’s expensive to license. Hence we use our own high quality chip with 100% identical functionality, speed and compatibility of Elm Electronics chip. Also, this is NOT a clone/low-quality-build as is sold 99.9% of cases on eBay.

    1. Kristoffer Smith

      Sammy’s comment below is correct – and i should have come back here to update my post… Totalcardiagnostics used to have false claims stating they used a genuine ELM 327 in many places on their website(s) and i relayed that incorrect information. they only recently added the “caution” disclaimer Sammy mentioned.

      i actually purchased one of their units before the new disclaimer was on their site and found it to NOT be genuine. i demanded my money back and informed them that i had filed a report with the BBB and FTC for blatantly false advertising. i can also confirm that the unit i received did not support all of the commands that genuine ELM 327 v2.1 firmware does, despite their new claim. Totalcardiagnostics is based in Australia but apparently has a distributor in NY. sorry to have spread their misinformation!

      FYI – this handy Android app will check any Bluetooth (classic BT, not BLE currently) adapter and tell you exactly what firmware version it supports based on the actual AT commands it responds to. it also shows what firmware version the device is reporting itself as. most i’ve encountered report as v1.5 but are actually 1.3 or 1.4 (there never was a “real” 1.5 from ELM electronics).

      Reply
  3. Dennis M.

    I see no one was able to answer Alexandre’s question. I would also like to know where you can purchase an ELM327 v2.1 adapter with a genuine Elm Electronics chip installed? Surely there are manufacturers out there using genuine Elm Electronic chips, or Elm Electronics could not stay in business. Come on boys, find me a genuine adapter, preferably USB.

    Reply
  4. Christopher Temple

    BAFX Products 34t5 Bluetooth OBDII Scan Tool at amazon seems to be good. it’s 20 bucks but their best seller. chipset unknown. i’ve seen reports of satisfactory results with elm v1.5 devices. i got one for 5.33. it works with torque free. ain’t much but i’m not complaining.

    Reply
    1. J Foster

      My Bafx 34t5 blu-tooth from amazon is reported by TorquePro to be v.1.5. It does not work completely with TorquePro, but does provide a few functions.

      Reply
  5. Dave

    Thanks for this post. I’m in the market for a genuine ELM327-based adapter too. Haven’t bought one yet but just noticed that ELM Electronics links to a bunch of distributors of presumable genuine hardware from their website here https://www.elmelectronics.com/help/obd/links/ (in case the link didn’t work it’s elmelectronics dot com slash help slash obd slash links

    Reply
  6. Hans

    Anybody out there uses a SECOND GENERATION (GEN2) Obd Device from CARLY / IviniApps for MERCEDES ?
    Please check this device with Elm327 Identifier and tell me which Version Elm327 it is and if it is a Genuine Elm327 ?
    Device “looks” like a normal obd2 Plug but seems to have “extended” communication commands for Mercedes coding options. I’m searching for Alternatief. Thanks!

    Reply
  7. Loky bacsi

    Teodor, what do you think about the idea that you send one of your products to Kristoffer Smith for a review? The more people review your product, the more likely that your reputation will be solid. I checked the product descriptions on your site and read the reviews, but independent reviewers could contribute to your marketing goals.

    Reply
    1. Loky bacsi

      I just noticed that http://elm-327.eu/ is listed on the chip manufacturer’s website’s OBD Links page. Check here: https://www.elmelectronics.com/help/obd/links/?v=f5b15f58caba
      I guess the chip manufacturer wouldn’t risk putting links to dubious re-seller’s site. By the way, I own a ’97 Passat and I was looking for a way of reading data from it’s computer, hence I started to look for a solution. I’m just a curious guy, nothing more, but I would gladly pay for a genuine product. Too bad the market is flooded with cheap Chinese clones and it’s hard to find original products.

      Reply
  8. David H.

    Hi All,
    The site that Sammy suspected might be dubious seems legit to me, though I have not personally purchased from them. On the link that Dave posted of a list of scan tools suggested by elm electronics (all probably Elm chip purchasers) there is a link to this Romanian site. Elm says it “offers ELM327 interfaces with either Bluetooth or USB connectivity (WiFi is coming). If you’re in the EU, this Romanian company may be just what you’re looking for.”

    Pretty sure the ebay . com seller “car.pulse” is the same company since they
    – are in Romania
    – also claim genuine chips
    – have an identical product pictured
    – show a photo of their circuit board with a factory Elm logo chip.
    – claim to support all ELM327 v2.2 AT commands

    To find their ebay listing, google “ELM327 Bluetooth Original ELM327 2.2 Genuine ELM Electronics chip”.

    I see only one other seller there, also located in Europe, making similar genuineness claims of v2.2 (search “ebay . com” for item 222780716443). I have no personal experience with them either. Might even be the same board, at almost twice the price, with led lights omitted and a different label slapped onto the case. This one has a website printed on the label. Though similar in name, I suspect they have no relation with “scantool . net” who use the STN chips. The link is “scantool-direct . co . uk / genuine-elm-chip-based-tools . html”

    It would be nice to see results of the “ELM327 Identifier” app test on these two.

    Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s