Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
274 (27.9%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
444 (45.3%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
49 (5%)
No, but am looking out for a cheap i3 to hack
50 (5.1%)
Not yet, but probably will if now that a closed-box hack becomes is possible
164 (16.7%)

Total Members Voted: 803

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 3769740 times)

0 Members and 7 Guests are viewing this topic.

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 13148
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #425 on: November 01, 2013, 11:29:11 am »
Whoa ! Were you expecting it ?

May be they have sent you an E8 as a gift for increasing sales of their E4  :-//

That would certainly be a very nice gesture. They may wish to thank you for highlighting the vulnerabilities of their software build. Or it may be a new case as you slightly mangled yours opening it ?

You have me sat on the edge of my seat waiting to see what they have sent you  :)

I wish I got boxes from FLIR...... they usually contain very nice "goodies"

Good PR for FLIR if it is something nice, bad PR if it explodes on opening  :-DD

OPEN IT....OPEN IT NOW ! (Please  ;)  )
« Last Edit: November 01, 2013, 11:30:45 am by Aurora »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #426 on: November 01, 2013, 11:29:55 am »
OK stand down the bomb squad - just the soft case they'd promised - so at least  they're still talking to me (or haven't seen this thread yet...)
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 13148
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #427 on: November 01, 2013, 11:33:14 am »
OH ! .....disappointed  :'(

I thought we were going to witness an amazing act of generosity from the PR people at FLIR.

Too much to ask I suppose.

Thanks for opening it and posting so quickly.
« Last Edit: November 01, 2013, 11:35:51 am by Aurora »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 13148
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #428 on: November 01, 2013, 12:36:00 pm »
As car thermal cameras have been mentioned. I attach a datasheet on AutoLiv as it contains specs etc. I believe this is the system fitted to Audi and BMW cars. It uses LVDS for the cameras video data and CAN Bus for the communication with the ECU. Sadly no mention of how the system copes with auto calibration events. As the ECU forms part of a pedestrian protection system with trajectory projection used for warnings, it may be that the short calibration period is not an issue as the ECU will have already spotted a target some distance away and may delay the calibration routine until the 'target' is passed. These systems appear to be a pedestrian and animal detection safety fitment and are not intended as a true night vision system for driving/piloting a vehicle, with it as the primary vision system (as used by military pilots).


Autoliv website:

http://www.autoliv.com/Pages/default.aspx
« Last Edit: November 01, 2013, 12:49:05 pm by Aurora »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #429 on: November 01, 2013, 02:53:07 pm »
May be they have sent you an E8 as a gift for increasing sales of their E4  :-//
Well they may have trouble selling them, so might as well give a few away...
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline CzokNorris

  • Contributor
  • Posts: 13
Re: Flir E4 Thermal imaging camera teardown
« Reply #430 on: November 01, 2013, 05:17:30 pm »
They use the nigtvision cams (three generations by now) for Audi and BMW premium cars. All from FLIR. Mercedes uses another technology which is basically adding a very strong IR Headlight which illuminates the street without dazzling other drivers (due to the invisibility of IR) and then just using a standard camera for near infrared. So no thermal on Mercedes.

Audi and BMW use standard shutters, no shutter wheel (see image) and probably try to make it as fast as possible (fraction of a second, a few frames) and maybe also combining several shutter sequences together.
The sensor seems the same with the on die ADC.

Unfortunately they use a proprietary interface called LIN which is a high speed differential link for automotive applications to transmit the signal an they also use a cryptographic handshake over CAN-Bus with a unique car identifier with some properitary challenge-response-system to ensure that cameras cannot be retrofitted to another car and only work with the one they are bought with. And of course due to the Dual use bla bla...
It looks like the cam also gets into some lock state, when one tries to send wrong messages to it and it bricks itself...

There is one car night vision camera which works without the cryptographic handshake with the cars main controller which is a Caddilac one (very hard to get here in germany). This camera just outputs NTSC when applied power, but has a reduced resolution of 320x120 which is interlaced to 320x240... So if you over there in 'merica can get your hands on one of these, i would not hesitate as long as the price is ok...

Since I am just interested in the bare sensor, i will try to score one of the Audi or BMW anyway. I don't care if it bricks itself, as long as it does not burn the sensor somehow :-) Cool tip with the car cams btw, mike, thanks for that!!
 

Offline CzokNorris

  • Contributor
  • Posts: 13
Re: Flir E4 Thermal imaging camera teardown
« Reply #431 on: November 01, 2013, 05:19:08 pm »
Huh, seems to have lost the second image of the shutter for Audi.. Here it is again...  :-+
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #432 on: November 01, 2013, 05:36:12 pm »
The sensor seems the same with the on die ADC.
That looks identical to the E4 one - not at all surprising.
At some point I will make a riser board to look at what signals go into the sensor - my guess is the lockout on the car ones is just a flag to tell the FPGA to not do anything. I have no doubt there is some way to reset this via CAN with the right tools. Must have a word with my mate who does dodgy stuff to cars...
Quote
Unfortunately they use a proprietary interface called LIN which is a high speed differential link for automotive applications to transmit the signal an they also use a cryptographic handshake over CAN-Bus with a unique car identifier with some properitary challenge-response-system to ensure that cameras cannot be retrofitted to another car and only work with the one they are bought with. And of course due to the Dual use bla bla...
It looks like the cam also gets into some lock state, when one tries to send wrong messages to it and it bricks itself...
LIN is a low-speed cheap serial bus, typically used between a CAN node and small devices, e.g. a door may have CAN into the door to a door controller, then LIN to the various switches etc. withn the door.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline 0xdeadbeef

  • Super Contributor
  • ***
  • Posts: 1570
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #433 on: November 01, 2013, 06:13:33 pm »
Yep, LIN is the low end replacement for CAN - for sensors and actuators where you don't need CAN.
Not proprietary at all. In the end it's more or less an UART with a different transceiver and a bit of protocol on top.
Trying is the first step towards failure - Homer J. Simpson
 

Offline CzokNorris

  • Contributor
  • Posts: 13
Re: Flir E4 Thermal imaging camera teardown
« Reply #434 on: November 01, 2013, 06:43:09 pm »
Sorry, i mixed it up...
I meant LVDS
The video interface is called LVDS
 

Offline aargee

  • Frequent Contributor
  • **
  • Posts: 871
  • Country: au
Re: Flir E4 Thermal imaging camera teardown
« Reply #435 on: November 01, 2013, 09:29:54 pm »
This just arrived from Flir UK - do you think I should x-ray it before opening....?

I thought it was going to be a box of legal documents!  :)
Not easy, not hard, just need to be incentivised.
 

Offline ixfd64

  • Frequent Contributor
  • **
  • Posts: 345
  • Country: us
    • Facebook
Re: Flir E4 Thermal imaging camera teardown
« Reply #436 on: November 01, 2013, 10:12:23 pm »
Any update on the hidden menu?

Offline 0xdeadbeef

  • Super Contributor
  • ***
  • Posts: 1570
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #437 on: November 01, 2013, 10:13:01 pm »
Sorry, i mixed it up...
I meant LVDS
The video interface is called LVDS
LVDS just means low voltage differential signals. Probably it's flat panel display link (FPD) which uses LVDS and is therefore often (mistakenly) called LVDS.
At least this is common for notebooks and stuff like the Raspberry Pi.
Trying is the first step towards failure - Homer J. Simpson
 

Offline cyr

  • Frequent Contributor
  • **
  • Posts: 252
  • Country: se
Re: Flir E4 Thermal imaging camera teardown
« Reply #438 on: November 01, 2013, 10:27:58 pm »
Or cameralink which is basically the same serial LVDS interface but for camera sensors...
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #439 on: November 01, 2013, 10:33:58 pm »
This PDF documents the LVDS format used by Flir's Tau 2 cameras, which looks the same as the datastream from the E4 sensor, and possibly the automotive units
 http://storage.pardot.com/6132/83776/Tau2_Electrical_IDD.pdf
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline zapta

  • Super Contributor
  • ***
  • Posts: 6189
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #440 on: November 01, 2013, 11:30:46 pm »
Will a kind soul please post here a short summary with the status of the E4 hacking. I am trying to avoid reading all the 33 pages. ;-)

I do have a E4 and would love to increase its resolution.
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #441 on: November 01, 2013, 11:40:23 pm »
Now tested by a couple of users, confirmed on FW 1.18.7 and 1.18.8
Files attatched.

Warning : take care not to break stuff!
This hack may be resilient to firmware updates. Maybe.
But may be best to remove prior to update and replace after, just in case.

Open E8.cfg in a PC text editor (not anything that will mangle linefeeds etc.!)

At the end of the file, replace xxxxxxxx with the 8-digit serial number of your camera

Save the file (Make sure there is exactly one CRLF at the end of the file)

At a PC command prompt, run

  CRC01 E8.cfg  (on the edited file)

This will display a line in the form
# CRC01 xxxxxxxx

Add this line to the end of the E8.cfg file, so it now looks like :

  # ID xxxxxxxx
  # CRC01 yyyyyyyy

where xxxxxxxx is your serial number and yyyyyyyy is the generated CRC
(should be exactly one CRLF after the CRC)

Save the file.

Plug the E4 into USB and open the file folder

Copy the new E8.cfg and copyhack.bat files to the root of the E4 file folder

Unplug USB (Important - otherwise filesystem won't be visible within E4 !)
Wait 5 seconds to ensure E4 has re-mounted the file system. If you get a "file not found" at the next step, wait 5 secs and retry.

Connect to serial console (38K4 baud 8N1)  using Hyperterminal or whatever. press enter until \> prompt appears

Type :
 \flashifs\copyhack

Remove battery, replace and restart. Unit will now start up like an E8.

The files can be removed from the camera's drive

Enjoy!

-----------------------------------------------------------------------
If the new file is wrong, the only symptom will be that the unit will behave like an E4.
Quickest way to tell is to look for the extra measure, display and palatte menu options

-----------------------------------------------------------------------------
Pinout for serial console

FFC connector accessable under label on front of lens housing
Looking at lens side with handle down
You may find it easier to further disassemble than get the label off without damage. Take care  not to lose the lens cover spring - see teardown video.

<left edge> <pin 16>....<pin 1>
Contacts are on bottom side (towards handle)
Pin 3 RXD
Pin 4 TXD
Pin 16 or 8 ground

Use 3.3v TTL level interface, e.g. FTDI TTL-232-3v3 cable

TTL232 Pin 1 (0v) to ground
TTL232 Pin 4 (TXD) to RXD
TTL232 Pin 5 (RXD) to TXD

Suggested FFC jumper cable molex Molex 0210200165 or similar.
If using a 5V serial adapter, use a 10K resistor in series with the adapter's TXD
--------------------------------------------------------------
De-hacking
Using serial console, delete \flashfs\system\appcore.d\config.d\e8.cfg
--------------------------------------------------------------------------

Changing startup screen (cold boot only)
Replace \flashbfs\system\bootlogo_legal.bmp ( copy from USB filesystem as per other files)
Original is 320x240 8 bpp windows bitmap.
Beware of changing format, as if progressapp crashes it may not run the console prompt




 
« Last Edit: November 01, 2013, 11:45:22 pm by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline zapta

  • Super Contributor
  • ***
  • Posts: 6189
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #442 on: November 02, 2013, 03:56:22 am »
Thanks a lot mike!

A  questions:

1. How about adding this procedure to the bottom of the original post in this thread?  It will be easier to find it.

2. What will be the end result of this mod? A full E8 resolution and functionality?

3. "Wait 5 seconds to ensure E4 has re-mounted the file system"   - how do I verity the the file systems was re mounted?

4. Any chance of posting a picture of the serial connector with pin 1 annotation?

5. How do you connect the USB serial adapter to the Molex 0210200165? Can it be soldered? Using a matching connector.

Thanks again. This is an awesome hack!

Z.



 

Offline equinoxe

  • Contributor
  • Posts: 23
Re: Flir E4 Thermal imaging camera teardown
« Reply #443 on: November 02, 2013, 07:09:03 am »
Wow, great hack!! THANKS!! (do not own an e4 yet.. but that may change in the future)

Mike, I looked at the E8 config, and I wonder: what would happen if one would change the following, could one get extra functions?:

.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.enabled bool false

.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false

.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false

.caps.config.image.sysimg.measureFuncs.mline.enabled bool false

Or
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false


and this one:

.caps.config.image.zoom.enabled bool false

« Last Edit: November 02, 2013, 07:15:32 am by equinoxe »
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #444 on: November 02, 2013, 07:50:14 am »
Now tested by a couple of users, confirmed on FW 1.18.7 and 1.18.8
Files attatched.
Great work, thanks!  :-+ I just got the tracking info for my E4 ... can't wait to start playing with it.

3. "Wait 5 seconds to ensure E4 has re-mounted the file system"   - how do I verity the the file systems was re mounted?

You verify this by NOT getting a "file not found" error in the next step. If you do get the error, simply wait a bit and try again. The 5 seconds is just an arbitrary "should be long enough" pause to give win ce some time to sort things out after the usb disconnect.
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #445 on: November 02, 2013, 08:53:31 am »
Now tested by a couple of users, confirmed on FW 1.18.7 and 1.18.8
Files attatched.
Great work, thanks!  :-+ I just got the tracking info for my E4 ... can't wait to start playing with it.

3. "Wait 5 seconds to ensure E4 has re-mounted the file system"   - how do I verity the the file systems was re mounted?

You verify this by NOT getting a "file not found" error in the next step. If you do get the error, simply wait a bit and try again. The 5 seconds is just an arbitrary "should be long enough" pause to give win ce some time to sort things out after the usb disconnect.
I haven't tried all of them but a lot of these got enabled by the earlier service mode hack (e.g. zoom) and didn't seem to do anything. I'm fairly sure a lot of these relate to features which are either not implemented in the E4 software and/or UI menu structure, or need buttons which aren't present. 
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Zoltan von Negrow

  • Contributor
  • Posts: 13
  • Country: cz
Re: Flir E4 Thermal imaging camera teardown
« Reply #446 on: November 02, 2013, 09:56:35 am »
Now tested by a couple of users, confirmed on FW 1.18.7 and 1.18.8


My E4 is 1.19.8. I hope that hack will be working on that firmware.
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #447 on: November 02, 2013, 01:34:42 pm »
Incidentally, you can find some win ce 6.0 resources for that MCIMX257 cpu that's in the E4 at this freescale link. Docs + BSDL file don't require login, the WIN CE 6.0 source does.

 

Offline Hypernova

  • Supporter
  • ****
  • Posts: 655
  • Country: tw
Re: Flir E4 Thermal imaging camera teardown
« Reply #448 on: November 02, 2013, 01:50:07 pm »
Well, I just finished wiring the local distributor the payment for my E4, so for this month, after accounting for income tax, rent, food etc I am left with less than $100 to put in the piggy bank. Damn you Mike, damn you!!!  :D
 

Offline Pinkus

  • Frequent Contributor
  • **
  • Posts: 768
Re: Flir E4 Thermal imaging camera teardown
« Reply #449 on: November 02, 2013, 04:58:16 pm »
My E4 is 1.19.8. I hope that hack will be working on that firmware.
Did you see any differences from the 1.18.8 firmware (see review video)? E.g. is the joystick in the middle connected with any action (without pressing the middle button before)?
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf