Unlocking the WanWay S20 GPS Tracker

Tip

The contents of this guide are still valid, but for more detailed instructions, you should also check out this repo.

Important

If you can't change the server address on newer devices, you can try downgrading your firmware by following the instructions here.

Introduction

The WanWay S20 is a popular GPS tracker frequently sold on Amazon at a great discount (sometimes even less than €10).

It comes with a SIM card already installed, which seems to be provided by Vodafone NL and uses 'internet4gd.gdsp' as the default APN. Unfortunately, to use this SIM card, you have to purchase a subscription plan and use the "TrackerOne" app, essentially giving your live GPS location to a Chinese server.

Luckily, with some tricks, you can fully unlock this device and use it with your own SIM card and Traccar server by following these steps.

---

Unlocking the device

1. Remove the sticker (and the plastic cover with the WanWay logo if it's installed)
2. Slide and lift the bracket holding the SIM in place and replace it with your own
3. Power on the device by holding the power button located near the micro-USB port until you see the blue, green and red LEDs flashing
4. Backup all the existing settings by texting these codes to the number of the SIM you've inserted:

STATUS#
GPRSSET#
PARAM#

5. Reset the device by sending FACTORYALL#
6. Set the APN of the SIM (in my case, it's a Vodafone IT SIM) APN,mobile.vodafone.it#
7. Set the Traccar server (for testing purposes, you can use one of the free Traccar servers):

• if you are using the IP of the server: SERVER,0,95.217.199.208,5023,0#
• if you prefer to use a domain name: SERVER,1,example.com,5023,0#

Be aware that that the length of the domain must be lower than 32 characters, you can check the current server with SERVER#

8. Create an account on the Traccar server and register a new device with the IMEI you got with the PARAM# command.
9. Don't worry if you see the tracker appear in the middle of the ocean, just move it outside or near a window and wait a couple of minutes.
10. Now that you know everything works, you can host your own Traccar server and tweak some more settings.

---

Useful commands

This tracker uses the GT-06 protocol but only supports a limited subset of commands used by similar devices. Read commands are structured like: COMMAND# Write commands are structured like: COMMAND,value# Both write and read commands are case-insensitive.

Reset to Factory Settings

• FACTORYALL#

Set the Position Update Interval

How frequently to send an update to the Traccar server. From what I've seen, this interval is used only while the tracker is moving.

• Read: TIMER#
• Example response: Timer:10,10;
• Write: TIMER,10#

Time Zone Setting

Sets the timezone of the tracker, E (East) is GMT +X and W (West) is GMT -X. The third parameter of this commands allows setting a minutes offset for the timezone.

• Read: GMT#
• Example response: Currently Timezone(GMT):E,2,0
• Write: GMT,e,2,0#

Get the Latest GPS Position

• Read: WHERE#
• Example response: Last position!Lat:N45.XXXXXX,Lon:E11.XXXXXX,Course:94,Speed:0,DateTime:2023-05-19 20:21:23

Get the Map URL with the Position

The URL is from Google Maps when the language is set to English (LANG,0)

• Read: URL#
• Example response: <2023-05-19 20:21:23>http://maps.google.com/maps?q=N45.XXXXXX,E11.XXXXXX

Set the Language of the Tracker

This command has the side effect of changing the URL# from "http://www.carhere.net/static/html/map.html?q=" to "http://maps.google.com/maps?q=". Set 0 for English and 1 for Chinese.

• Read: LANG#
• Example response: Currently Language:0
• Write: LANG,0#

Set the Heartbeat Interval

From my understanding, this sets how many minutes to wait before sending a "heartbeat" packet to the Traccar server when the device is not moving. The first parameter is when the ignition is ON, and the second is when it's OFF, since this device has no way of knowing its status, it's unclear which value it's using.

• Read: HBT#
• Example response: HBT:3,5;
• Write: HBT,5,5#

Get the Firmware Version of the Device

• Read: VERSION#

As of now, these are the known firmware versions:

• Y2517_GW005A_V03_2022.04.20_10.
• WW_S20_DS_V01_22.10.21

Get All the Parameters from the Device

• Read: SCXSZ#

Set the Center Number

UNTESTED: As of the time of writing, I don't know the meaning of this setting.

• Read: CENTER#
• Example response: Center number is empty.

Set a Password for the Device

USE WITH CAUTION: the default password should be 666666 but it could be different on your device!

If you don't set a password, everyone who knows the phone number of the device will be able to read and set most of its settings. The maximum length of the password should be 19 characters. If a password is enabled, you need to provide it as the first parameter for every command (PWDSW,666666,OFF# for example).

• Read: PWDSW#
• Example response: PWDSW:OFF;
• Write: PWDSW,ON#

Change the Password

To change the default password to 'admin' you can use the command below.

• Write: PASSWORD,666666,admin#

Set the Automatic Timezone

This command should be used (ASETGMT,ON#) to enable the automatic timezone recognition, but it doesn't seem to work on this device.

• Read: ASETGMT#
• Example response: ASETGMT:OFF; Currently Timezone(GMT):E,2,0;

Get the Current Time and Map URL with the Position

The text '当前位置' (current position) will always be in Chinese, regardless of the language you set.

• Read: 123#
• Example response: 当前位置：DateTime: 2023-05-22 16:18:22 ,http://maps.google.com/maps?q=N46.XXXXXX,E11.XXXXXX

Set the SOS Number

Set one (or more) "admin" numbers. This is needed if you want to to call the device and listen to its built-in microphone. I've yet to test this, but these numbers should also receive the alerts if enabled (like SPEED# or BATALM#).

• Read: SOS#
• Example response: SOS number:331XXXXX,,;
• Write (multiple numbers): SOS,A,331XXXXX,331XXXXX,331XXXXX#
• Write (single number): SOS,A,331XXXXX#
• Write (delete): SOS,D,331XXXXX#

Get the Device IMEI

• Read: IMEI#
• Example response: IMEI:867946050XXXXXX

Set the Low Battery Alarm

UNTESTED: This should send an alert over GPRS (0) and via SMS+GPRS (1) when the battery level is critically low.

• Read: BATALM#
• Example response: BATALM:ON,GPRS;
• Write: BATALM,ON,1#

Set a Moving Alarm

UNTESTED: This should send an alert over GPRS (0), via SMS+GPRS (1), or with CALL+SMS+GPRS (2) when the device moves outside the set distance.

• Read: MOVING#
• Example response: Moving Switch:OFF; Radius:100m; Alarm Type:0;
• Write: MOVING,ON,100,2#

Set the Speed Alarm

If the speed exceeds the limit for an amount of time (in the example below, if you go over 90km/h for 60 seconds) it will send an SMS alert to the SOS numbers. You can choose to get an alert over GPRS (0) or via SMS+GPRS (1) as the last parameter. Example SMS alert: OverSpeed Alarm :Speeding! please slow down ,safe driving! The speeded of 131KM/H

• Read: SPEED#
• Example response: SPEED:OFF, 10, 60, 0
• Write: SPEED,ON,60,90,1#

---

Filter zero values in Traccar

During my testing I've discovered that Traccar will sometimes show the speed as 0km/h even if the device is moving. This is because the device doesn't always send the speed. To prevent this, you can use add following filter settings in /opt/traccar/conf/traccar.xml:

<entry key='filter.enable'>true></entry>
<entry key='filter.zero'>true</entry>
<entry key='filter.distance'>5</entry>