This is how the OBD bluetooth elmscan-compatible china thingie looks like inside.

IMAG0219.jpg

IMAG0221.jpg
The UART (RC6 and RC7, pin 17 and 18) is connected to the bluetooth module.

Pinout of the 8-pin connector is:
1: (16) +12V
2: (2) Bus+
3: (7) K-Line
4: (15) L-Line
5: (6) CAN-H
6: (14) CAN-L
7: (10) Bus
8: (5+4) GND

Pinout of the OBD2 connector:

Project plan is:
1. Install standard 9pin CAN connector and connection to +12V. Connect it to an external power supply.
2. Fix bluetooth connection to my computer and pair it/try to talk with it.
3. Hook it up to a kvaser usbcan + canking and try to send frames.
4. Install an in-circuit programmer (PICkit2) connector
5. Install MPLAB IDE
6. Try to read-out the code. Check if its possible to re-program it.
7. If not possible, replace the PIC
8. Write my own program for it, with filters and frame-sending capabilities.


2011-02-13 BT connection in Ubuntu 10.10 works
 Finally found my BT-USB dongle and managed to connect to the standard ELM327 over BT device.
Connected 12V to the connector.
After installing all needed BT stuff in ubuntu I could see the device: 

# hcitool scan
Scanning ...
	00:0D:18:B2:73:6C	CBT
# sdptool search sp
Inquiring ...
Searching for sp on 00:0D:18:B2:73:6C ...
Service Name: Dev B
Service RecHandle: 0x10000
Service Class ID List:
  "Serial Port" (0x1101)
Protocol Descriptor List:
  "L2CAP" (0x0100)
  "RFCOMM" (0x0003)
     Channel: 1
Language Base Attr List:
  code_ISO639: 0x656e
  encoding:    0x6a
  base_offset: 0x100
# mknod -m 666 /dev/rfcomm0 c 216 0
# chmod ugo+rw /dev/rfcomm0
# rfcomm connect /dev/rfcomm0 00:0D:18:B2:73:6C
Connected /dev/rfcomm0 to 00:0D:18:B2:73:6C on channel 1
Press CTRL-C for hangup
In another shell fired up minicom: 
minicom -D /dev/rfcomm0
Tried some AT commands. (Google for "elm327 at commands")
AT @1 replied: ">BDII to RS232 Interpreter" (Guess first char disappeard)


2011-03-12 All protection bits set..
 Hooked up a pickit2 to try to read out the code..

IMAG0237.jpg
I had to disconnect MCLR pin and bent it up before soldering a wire to it.. (yellow).

IMAG0239.jpg
Unfortunately, the pirated ELM327 does not want to be pirated :-/ All read protection bits were set. Also all write protection bits were set too. This means that the current pic18f2480 is useless.
Ordered new pic:s to replace it.


2011-03-21 Waiting...
 Still waiting for my pics to show up...


2011-03-25 Lazy..
 The pics showed up 23:rd, haven't got time to figure out if I should make my own HW instead of destroying my ELM thingie..