New Tracker WanWay S20 Pro

Vincent Tacquet 7 days ago

same here, mine stopped working on the 8th of may, it replaced most of my settings (except my server ip and port), but it changed apn and it is no longer responding to any SMS command... this is there serial output, it doesn't respond to serial commands either, I think i need to send someting while it waits for a couple of ms after "enter factory test timeout", but it is so fast and i still am unable to get something out, the special characters are because of chinese translation

^boot.rom'v'!\nRDY

enter factory test timeout ...
���ļ��ж�ȡϵͳ����,len=1024,1024,1024

get_sys_param:back=0x0,0xa8.main:0x0,0xa8

���ļ��ж�ȡ�û�����,len=1024,1024,1024

get_user_param:back=0x0,0x88.main:0x0,0x88

******************�ϵ���Ϣ******************
--->Ӳ���汾��S20 Pro_V1.00
--->����汾��#S20Pro#ITOJTS11306D260415
--->����ʱ�䣺Apr 15 2026_17:18:43
--->RTCʱ�䣺2026-05-25 21:33:17
--->��汾��BC78_V1.13 241009
******************�����******************
--->����one.gpsog.com
--->IP:<my server ip>,<my server port >
--->��ܼ�IP:47.52.50.49,1234
--->��־������IP:47.52.50.49,4542
--->AGPS DNS:iot.bsjyun.com9885
--->APN:internet4gd.gdsp,,
--->�����:<IMEI>
--->���ټ��:0,5
--->����ֵ:75
--->ȱʡ��ʱ���:10
--->���߶�ʱ���:300
--->����:0
--->��λ״̬:<δ֪>,ret=8
read_active_int: 20
read_byte id: 0x13

Vincent Tacquet 6 days ago

I already found 2 commands that are responsive (over serial port):

command: <CKVER>
answer: <VER:SDK:BC78_V1.13_241009,APP:#S20Pro#ITOJTS11306D260415_Apr 15 2026_17:18:43>

command: <SPBSJ> returns the parameters (normally you could use this command to change them but it doesn' take it) - I changed my SERIALNUMBERxxx and IMEIxxx in the output below
answer: <WW*N:SERIALNUMBERxxx*Q:one.gpsog.com:9760*CGREG:5*CSQ:16*GPS:(V,0,3)*A:internet4gd.gdsp*C:10*O:300*CS:0*3U:0*3Z:0*H:300*2A:1*GP:NO*5C:0*60:1*5Y:3.5*6N:0,0*3E:000050*5T:2,2*9E:00:00*1H:1*3D:000000*2S:0*I:0000000*B:2*HAD:WW*IM:IMEIxxx*RF:1*SCN:*AG:1*wifi_sw:0>

I tried <SPBSJ*A:iot.1nce.net> but it just prints out the current settings like above

dimon 5 days ago

Keep it up like this, and we’ll be able to hack those trackers!

Sc0ps_NL 5 days ago

Hi everyone,

I’ve been investigating the new WanWay S20 Pro tracker firmware because my device suddenly stopped responding to the old SMS commands (SERVER#, PARAM#, etc.).

Here is a summary of everything I discovered so far.

Device information

Tracker:
WanWay S20 Pro

Firmware command:

<CKVER>

Response:

<VER:SDK:BC78SV2.07S250508,APP:#S20Pro#***************>

Hardware:

BC78S CAT1 module
Module marked as “EigenComm”
Firmware internally references:
BC78_V2.07 250508
Serial/UART findings

UART output during boot:

^boot.rom'v'!
RDY
enter factory test timeout ...

Then the tracker prints a large debug/config dump including:

*Q:one.gpsog.com:9760
*T:0.0.0.0,0,10

and:

IP:47.52.50.49,1234
LOG IP:47.52.50.49,4542
AGPS DNS:iot.bsjyun.com9885

The tracker also outputs regular TXT packets like:

<TXT*S:*********** *3G:...>##

Important findings:

UART TX/debug output works
Device does NOT respond to typed serial commands
USB briefly enumerates as multiple ACM devices and then disconnects
Working SMS commands

The old commands (SERVER#, PARAM#, STATUS#, etc.) no longer work on this firmware.

However, these new commands DO work:

Firmware version
<CKVER>
Parameters
<CKPARA>

Response example:

<*I:0000000*H:300*CS:0*1H:1*2A:1*3U:0*3Z:0*GP:OK*60:1*5Y:3.5*6N:0,0*3E:000050*9E:00:00*1H:1*3D:000000*ZD$G:400*XZ:300>
Network/server info
<CKNET>

Response:

<CKIP*Q:one.gpsog.com:9760>
GPS info
<CKGPS>

Response:

CC1167Q,G1B1,N/A,N1000R3.31.1.3269Build11812,N/A,N/A

Important observations

The firmware appears to use a NEW command structure:

Function New command
Version <CKVER>
Parameters <CKPARA>
Network/server <CKNET>
GPS info <CKGPS>

It looks like:

CK = read/check commands
BSJ = write/config commands

Because UART logs contain:

*T:0.0.0.0,0,10

I suspect:

Q: = factory/default cloud server
T: = custom user server override
Attempted write commands

Tried via SMS:

<BSJ*T:***.***.***.***,5015>

and:

<BSJ*T:***.***.***.***,5015,10>

No response, and <CKNET> still reports:

<CKIP*Q:one.gpsog.com:9760>

So either:

write commands are disabled over SMS
require unlock/authentication
only work over UART/factory mode
or require different syntax
Server communication findings

The tracker communicates with:

one.gpsog.com:9760

Connecting manually with netcat:

nc 119.13.106.47 9760

and sending:

##,imei:**************,A;

returns:

LOAD

So the server protocol is active and plaintext at least during login/init.

Conclusion

The latest S20 Pro firmware appears to:

remove the old SMS command set
introduce a new hidden CK/BSJ command system
still expose extensive debug/config data over UART
possibly lock configuration writes

At the moment I can:

read firmware version
read parameters
read network info
read GPS info

But I still cannot:

change server IP/domain
change APN
enable custom server override

If anyone has more information about:

BSJ write commands
unlock procedures
factory mode access
BC78S firmware tools
or hidden SMS syntax

please share.