Back in 2018, like many car enthusiasts and DIY mechanics, I decided to invest in an OBD2 scanner to better understand the inner workings of my vehicle. The model that caught my eye was the VXDAS Am3011 Obd2 Scanner. Little did I know that this simple purchase would spark a fascinating journey into the world of automotive electronics, firmware analysis, and reverse engineering. My initial goal was straightforward – to read and clear diagnostic codes. However, the moment the AM3011 arrived, my curiosity shifted towards understanding what made this device tick.
This is the AM3011 OBD2 scanner that started it all:
The VXDAS AM3011 OBD2 Scanner, a budget-friendly tool that opened up a world of automotive diagnostics and reverse engineering possibilities.
The VXDAS AM3011 OBD2 Scanner, readily available online, promised to be a user-friendly tool for basic car diagnostics. Its compact design, featuring a mini-USB port, a few control buttons, and of course, the essential OBD2 interface plug, hinted at a straightforward functionality. But as someone with a background in automotive repair and a passion for technology, I couldn’t resist the urge to peek under the hood, so to speak. My aim quickly became to understand the internal components, the driving force behind its functions, and ultimately, the potential for customization and deeper exploration.
Opening up the AM3011 OBD2 scanner revealed a surprisingly neat and organized circuit board:
Exploring the PCB of the AM3011 OBD2 Scanner unveiled key components like the STM32F103 microcontroller and SPI Flash memory, essential for understanding its operation and potential for modification.
My initial observations confirmed a relatively simple yet effective design. At the heart of the AM3011 was an STM32F103 System-on-a-Chip (SoC), a popular choice for embedded systems. Accompanying it was an SPI SOIC8 Flash memory chip, likely storing the device’s firmware and diagnostic data. The board also included components for power regulation, stepping down the car’s 12V supply to the 5V and 3.3V needed for the electronics. Standard USB data lines, a miniature buzzer for audible feedback, a connector for the display screen, LEDs for visual indicators, and a 6-pin ribbon cable for the button interface completed the component list.
For a budget-friendly OBD2 scanner, the VXDAS AM3011 packed enough components to perform its intended functions. However, for me, the real fun was just beginning. The immediate next step was to attempt to extract the firmware from the device. My goal was to delve into the software, understand its workings, and explore the possibilities of reverse engineering and potentially even customizing the AM3011 OBD2 scanner for more advanced applications.
At this stage, firmware extraction proved to be a hurdle. Despite my efforts, I couldn’t directly access the firmware. Seeking advice, I consulted with colleagues, including @Iskuri, who suggested an alternative approach: bypassing firmware extraction altogether and directly programming the device. The idea was to erase the existing program and upload custom firmware, effectively repurposing the hardware.
This suggestion opened up exciting new possibilities. To proceed with custom firmware development, the crucial first step was to meticulously map out the pinouts and PCB traces of the AM3011. Understanding the connections between the STM32F103, the screen, buttons, and other components was essential for writing code that could interact with the hardware correctly.
Detailed PCB trace mapping of the AM3011 OBD2 Scanner:
Careful tracing of the AM3011’s printed circuit board was crucial for understanding the pin configurations and developing custom firmware.
Leveraging the STM32F103 datasheet, which provides detailed pinout diagrams, I painstakingly traced the connections on the AM3011’s PCB. This process allowed me to create a map of how each component was wired to the microcontroller. With this newfound understanding, I successfully programmed the AM3011 to act as a USB Mass Storage Device (MSD) when connected to a computer. This breakthrough was a significant validation – it proved that I could indeed write and upload my own applications to the device, paving the way for further experimentation.
However, in my eagerness and perhaps a moment of oversight, I inadvertently disabled the SWD (Serial Wire Debug) functionality while experimenting with the firmware. This misstep, unfortunately, “bricked” the AM3011. The SWD interface is crucial for debugging and reprogramming STM32 devices, and disabling it meant I could no longer easily communicate with the microcontroller to fix my mistake.
Reflecting on the bricked AM3011, I considered the balance between time, effort, and the potential of this particular device. The AM3011, based on the STM32F103, with its four buttons, LCD screen, and SPI Flash, offered a decent platform for experimentation. Further research revealed that the VXDAS AM3011 was likely a re-branded device, possibly manufactured by JDiag and sold under various names. This realization led me down a rabbit hole of searching for similar, potentially unbranded or alternative versions of the scanner, hoping to find one with the Copy Protection (CRP) disabled, which would simplify firmware modification.
The quest for the perfect OBD2 scanner for reverse engineering continued, leading me to explore other devices and expand the scope of this project. While the initial AM3011 OBD2 scanner met an untimely end due to my firmware mishap, it served as an invaluable learning experience and the starting point for a deeper dive into the world of automotive diagnostic tools and embedded systems. The next step in this journey involved acquiring and analyzing new OBD2 scanners, each with its own unique hardware and software characteristics, pushing the boundaries of what’s possible with these readily available automotive tools. Stay tuned for the next part of this series, where we explore the IsYoung NL100 and other OBD2 scanners in our quest for the ultimate customizable diagnostic tool.
