Picked my KW902 apart today to see what’s inside. It features probably a SN65HVDA1050A CAN tranciever (ISO 11898-2 high speed up tp 1 Mbps) a BK3231S SoC for Bluetooth 3.0 and 4.0 programmable via JTAG/FLASH both controlled by a PIC18F25K80 (cheapest of the family, also up to 1Mbps bit rate, comforms to CAN 2.0B) programmable via ICSP.

The pins for ICSP may be exposed on the cable for the LED and RST button but since I don’t have the equipment to read out the firmware I didn’t look too closely and called it a day – for now. This cheap IC costs ~2 EUR btw and is well documented.