New Tracker WanWay S20 Pro

Vincent Tacquet 2 months ago

same here, mine stopped working on the 8th of may, it replaced most of my settings (except my server ip and port), but it changed apn and it is no longer responding to any SMS command... this is there serial output, it doesn't respond to serial commands either, I think i need to send someting while it waits for a couple of ms after "enter factory test timeout", but it is so fast and i still am unable to get something out, the special characters are because of chinese translation

^boot.rom'v'!\nRDY

enter factory test timeout ...
���ļ��ж�ȡϵͳ����,len=1024,1024,1024

get_sys_param:back=0x0,0xa8.main:0x0,0xa8

���ļ��ж�ȡ�û�����,len=1024,1024,1024

get_user_param:back=0x0,0x88.main:0x0,0x88

******************�ϵ���Ϣ******************
--->Ӳ���汾��S20 Pro_V1.00
--->����汾��#S20Pro#ITOJTS11306D260415
--->����ʱ�䣺Apr 15 2026_17:18:43
--->RTCʱ�䣺2026-05-25 21:33:17
--->��汾��BC78_V1.13 241009
******************�����******************
--->����one.gpsog.com
--->IP:<my server ip>,<my server port >
--->��ܼ�IP:47.52.50.49,1234
--->��־������IP:47.52.50.49,4542
--->AGPS DNS:iot.bsjyun.com9885
--->APN:internet4gd.gdsp,,
--->�����:<IMEI>
--->���ټ��:0,5
--->����ֵ:75
--->ȱʡ��ʱ���:10
--->���߶�ʱ���:300
--->����:0
--->��λ״̬:<δ֪>,ret=8
read_active_int: 20
read_byte id: 0x13
Vincent Tacquet 2 months ago

I already found 2 commands that are responsive (over serial port):

command: <CKVER>
answer: <VER:SDK:BC78_V1.13_241009,APP:#S20Pro#ITOJTS11306D260415_Apr 15 2026_17:18:43>

command: <SPBSJ> returns the parameters (normally you could use this command to change them but it doesn' take it) - I changed my SERIALNUMBERxxx and IMEIxxx in the output below
answer: <WW*N:SERIALNUMBERxxx*Q:one.gpsog.com:9760*CGREG:5*CSQ:16*GPS:(V,0,3)*A:internet4gd.gdsp*C:10*O:300*CS:0*3U:0*3Z:0*H:300*2A:1*GP:NO*5C:0*60:1*5Y:3.5*6N:0,0*3E:000050*5T:2,2*9E:00:00*1H:1*3D:000000*2S:0*I:0000000*B:2*HAD:WW*IM:IMEIxxx*RF:1*SCN:*AG:1*wifi_sw:0>

I tried <SPBSJ*A:iot.1nce.net> but it just prints out the current settings like above

dimon 2 months ago

Keep it up like this, and we’ll be able to hack those trackers!

Sc0ps_NL 2 months ago

Hi everyone,

I’ve been investigating the new WanWay S20 Pro tracker firmware because my device suddenly stopped responding to the old SMS commands (SERVER#, PARAM#, etc.).

Here is a summary of everything I discovered so far.

Device information

Tracker:
WanWay S20 Pro

Firmware command:

<CKVER>

Response:

<VER:SDK:BC78SV2.07S250508,APP:#S20Pro#***************>

Hardware:

BC78S CAT1 module
Module marked as “EigenComm”
Firmware internally references:
BC78_V2.07 250508
Serial/UART findings

UART output during boot:

^boot.rom'v'!
RDY
enter factory test timeout ...

Then the tracker prints a large debug/config dump including:

*Q:one.gpsog.com:9760
*T:0.0.0.0,0,10

and:

IP:47.52.50.49,1234
LOG IP:47.52.50.49,4542
AGPS DNS:iot.bsjyun.com9885

The tracker also outputs regular TXT packets like:

<TXT*S:*********** *3G:...>##

Important findings:

UART TX/debug output works
Device does NOT respond to typed serial commands
USB briefly enumerates as multiple ACM devices and then disconnects
Working SMS commands

The old commands (SERVER#, PARAM#, STATUS#, etc.) no longer work on this firmware.

However, these new commands DO work:

Firmware version
<CKVER>
Parameters
<CKPARA>

Response example:

<*I:0000000*H:300*CS:0*1H:1*2A:1*3U:0*3Z:0*GP:OK*60:1*5Y:3.5*6N:0,0*3E:000050*9E:00:00*1H:1*3D:000000*ZD$G:400*XZ:300>
Network/server info
<CKNET>

Response:

<CKIP*Q:one.gpsog.com:9760>
GPS info
<CKGPS>

Response:

CC1167Q,G1B1,N/A,N1000R3.31.1.3269Build11812,N/A,N/A

Important observations

The firmware appears to use a NEW command structure:

Function New command
Version <CKVER>
Parameters <CKPARA>
Network/server <CKNET>
GPS info <CKGPS>

It looks like:

CK = read/check commands
BSJ = write/config commands

Because UART logs contain:

*T:0.0.0.0,0,10

I suspect:

Q: = factory/default cloud server
T: = custom user server override
Attempted write commands

Tried via SMS:

<BSJ*T:***.***.***.***,5015>

and:

<BSJ*T:***.***.***.***,5015,10>

No response, and <CKNET> still reports:

<CKIP*Q:one.gpsog.com:9760>

So either:

write commands are disabled over SMS
require unlock/authentication
only work over UART/factory mode
or require different syntax
Server communication findings

The tracker communicates with:

one.gpsog.com:9760

Connecting manually with netcat:

nc 119.13.106.47 9760

and sending:

##,imei:**************,A;

returns:

LOAD

So the server protocol is active and plaintext at least during login/init.

Conclusion

The latest S20 Pro firmware appears to:

remove the old SMS command set
introduce a new hidden CK/BSJ command system
still expose extensive debug/config data over UART
possibly lock configuration writes

At the moment I can:

read firmware version
read parameters
read network info
read GPS info

But I still cannot:

change server IP/domain
change APN
enable custom server override

If anyone has more information about:

BSJ write commands
unlock procedures
factory mode access
BC78S firmware tools
or hidden SMS syntax

please share.

Gary 2 months ago

Tried this format but no joy <SPWW*P:WWGPS*T:***.***.**.***,*****>

Beerochol 8 days ago

Hi everyone,
I've been reverse-engineering a WanWay S20 Pro GPS tracker to redirect it from the vendor's default platform (⁠one.gpsog.com⁠) to a custom Traccar / Ruhavik server. Here is a summary of my diagnostic data, command syntax, authentication keys, and current roadblocks for anyone looking to dig deeper.

  1. HARDWARE AND FIRMWARE SPECIFICATIONS
    Device Model: WanWay S20 Pro (GPS Tracker)
    Chipset / SDK: Quectel BC78 (SDK Version: ⁠BC78§V2.07§250508⁠)
    Firmware Version: ⁠APP:#S20Pro#ITOJT-S20707D260414⁠ (Build Date: Apr 14, 2026)
    Hardware ID: 11-digit string (e.g., ⁠XXXXXXXXXXX⁠)
    Full IMEI: 15-digit string (e.g., ⁠8630XXXXXXXXXXX⁠ the app appends the ⁠8630⁠ prefix)
    Default Credentials (Official App): Login: ⁠[FULL_IMEI]⁠ | Password: ⁠[LAST_6_DIGITS_OF_IMEI]⁠
    Default Server Target: ⁠one.gpsog.com:9760⁠
  2. COMMAND HISTORY AND BEHAVIOR SHIFT
    Initial Behavior: Out of the box, the device initially responded to standard ⁠#⁠-terminated commands (such as ⁠STATUS#⁠ and ⁠PARAM#⁠), which returned a status string containing the original 11-digit hardware ID and IMEI details.
    Behavior Shift: After connecting to the cellular network / vendor server, the device completely stopped responding to ⁠#⁠-terminated commands and switched exclusively to accepting ⁠< >⁠-enclosed commands (handling ⁠CK⁠ and ⁠SPWW⁠ / ⁠BSJ⁠ parsers).
  3. WORKING DIAGNOSTIC COMMANDS (READ-ONLY)
    The device currently responds to ⁠CK⁠ queries enclosed in angle brackets ⁠< >⁠:
    ⁠<CKPARA>⁠ Returns full system parameter dump (Note: IMEI field defaults to ⁠*I:0000000⁠ in SMS responses).
    ⁠<CKNET>⁠ Returns the active target server by replying with a ⁠<CKIP*Q:...>⁠ payload (e.g., ⁠<CKIP*Q:one.gpsog.com:9760>⁠). (Note: Sending ⁠<CKIP>⁠ directly does nothing on this firmware).
    ⁠<CKVER>⁠ / ⁠<CKVSN>⁠ Returns firmware and SDK version payload.
  4. APP PROTOCOL AND SECRET AUTHENTICATION KEY
    By analyzing execution logs from the vendor's mobile app, I identified the exact write-command prefix and hardcoded authentication secret:
    Write Prefix: ⁠<SPWW*...>⁠
    Auth Secret Key: ⁠WWGPS⁠
    Working Example: Sending ⁠<SPWWP:WWGPS*C:10>⁠ successfully changes the upload interval to 10 seconds.
    Response Pattern: Valid commands trigger a response payload starting with ⁠<WW    N:[HARDWARE_ID]...⁠. ## (via * Tested 5. AND ATTEMPTS Command DNS): FQDN I IP REDIRECTION RESULTS SERVER Variations: ⁠<SPWW*P:WWGPS*Q:[YOUR_SERVER_IP]:[PORT] ⁠Q⁠ ⁠nip.io⁠ and both direct overwriting server target the tried using variable wildcard>⁠
    ⁠<SPWW*P:WWGPS*Q:[YOUR_SERVER_IP].nip.io:[PORT]>⁠
    ⁠<BSJ*P:WWGPS*Q:[YOUR_SERVER_IP]:[PORT]>⁠
    ⁠<BSJ*T:[YOUR_SERVER_IP],[PORT]*WWGPS>⁠
    ⁠<SPWW*P:WWGPS*M:[YOUR_PHONE_NUMBER]>⁠ (Master Number assignment)
    ⁠<SPWW*P:WWGPS*FACTORY>⁠ / ⁠<SPWW*P:WWGPS*RESET>⁠
    Observed Behavior:
    The tracker accepts the syntax and returns a full parameter status response starting with ⁠<WW*N:...>⁠. However, querying ⁠<CKNET>⁠ immediately afterwards reveals that variable ⁠Q⁠ remains unchanged in the device's response (⁠Q:one.gpsog.com:9760⁠).
  5. CONCLUSION AND OPEN QUESTIONS
    The April 2026 firmware revision appears to have a hardcoded lock in the MCU code that silences or drops SMS modifications to server target variables (⁠Q⁠ and ⁠T⁠).
  6. Has anyone found an unlisted SMS/AT command to unlock NVRAM server variables on BC78-based WanWay trackers?
  7. Are UART pads (RX/TX/GND) accessible on the S20 Pro PCB to communicate directly with the BC78 modem via AT commands or re-flash clean firmware?