Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
109 (22.3%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
239 (48.9%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
23 (4.7%)
No, but am looking out for a cheap i3 to hack
21 (4.3%)
Not yet, but probably will if now that a closed-box hack becomes is possible
97 (19.8%)

Total Members Voted: 448

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 381044 times)

Sentient BeanCurd, stefbeer and 6 Guests are viewing this topic.

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4713
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #270 on: October 27, 2013, 08:29:05 PM »
This version of rndis.rsc enables all USB modes, however The Flir utility seems to get things in a knot - I think it tries to disable MSD to prevent clashes with its own drive letter, and things get into a bit of a mess, and ending up with the user file partition not getting mounted. To fix I had to close the Flir util, force it to unhacked mode by booting with USB in and swap the rndis file back. :phew:

 BTW the utility that gives the virtual drive is Program Files\FLIR Systems\FLIR Device Drivers\FLIR T3Srv\syx86\t3mon.exe
Quote
#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS_UVC_MSD"
# CRC32 A18F2E3B

Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4713
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #271 on: October 27, 2013, 09:19:07 PM »
My hunch was right - adding stuff to
\flashfs\system\service\appcore.d\config.d\conf.cfg
DOES get baked into the checksummed version created by service mode entry, so for example adding
Quote
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool true
to the end of the file makes PIP display mode work once you are in service mode, however you get an error message onscreen in hacked reboot - it still works but there's a menu in the way and the serial console doesn't work.
However MSD is still there so you can change it back.  :phew:
But replacing the previous conf.cnf in \hack still gives the error... hmmmm

Incidentally one advantage of using RNDIS and the FLIR virtual drive over MSD is you can take pics and upload them immediately - MSD locks out taking pics when connected to USB.

Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4713
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #272 on: October 27, 2013, 10:16:41 PM »
Not sure what happenned there - could be it saw the backup copy I'd made of the conf template file in \service. Unfortunately I forgot to make a copy of the CRC'd PIP config file so have to start again, however I've found some more out about the whole config & resource thing...

.rsc files in factory.d folders have CRC32

It looks at any & all files in the folder - e.g. renaming the file to set USB to RNDIS mode seems to still work

.cfg files in config.d folders have CRC01 , and it also appears to look at any and all files are looked at.

Items in these files get copied into the resource tree, so if there are items that can do fun things, they can probably be done as additional files instead of editing existing ones.

The question is can you add things like PIP and other goodies using a CRC32'd .rsc file...

I've modified the applaunch.dat to make it easier to play, so it will copy anything in config and factory folders
Quote
progressapp -f \flashbfs\system\bootlogo.bmp -g flashbfs\system\bocmd /c otlogo_
legal.bmp -d
# Start command shell on the RS-232 port
cmd /R
# Register a default user
defaultusr
cmd /C md \temp\appcore.d\
cmd /C md \temp\appcore.d\config.d
cmd /C md \temp\appcore.d\factory.d
cmd /C copy \flashifs\hack\__highres.cnf \temp
cmd /C copy \flashifs\hack\config\*.cfg \temp\appcore.d\config.d
cmd /C copy \flashifs\hack\factory\*.rsc \temp\appcore.d\factory.d
# Start appcore. Appcore starts other necessary processes
appcore




« Last Edit: October 27, 2013, 10:43:19 PM by mikeselectricstuff »
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4713
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #273 on: October 27, 2013, 11:46:59 PM »
OK so it looks like service mode can be used as a CRC01 stamping tool ;D

1) Copy your modified .cfg files to be stamped (without any checksum) into \flashfs\system\service\appcore.d\config.d\
2) Start service mode via web interface
3) Using serial or telnet console ( no need to wait for service mode restart) ,
copy the files from  \temp\appcore.d\config.d\*.*   to your user flash \hack dir
4) Delete the files you put in \flashfs\system\service\appcore.d\config.d\
(not sure if these are what caused problems before, but better be safe as it was a fiddle to recover)
Make sure the original conf.cfg is stil there.

You now have some CRC'd .cfg files in \hack, which you can try putting in your hack\crc folder to see what they do on the next cold boot.
Note it is not beyond doubt that some resource hacks might cause crashyness if you create resources that bork anything that runs beore applaunch,dat and progressapp (dunno if there are) , however it should in principle be recoverable by starting in E4 mode by cold booting with USB plugged in. Probably. YYMV.

Using this method to create a CRC'd PIP .cfg file from this
Quote
#
# Generated at CONFIG_DATE CONFIG_TIME
#
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool true
.caps.hw entry

 the PIP display mode now works.  8)

I have tried putting a CRC32 on these files but it doesn;t work. CRC32 should for for .rsc files that go in the factory directory, but not sure if you can do anything useful other than change USB mode.
Detailed analysis of the resource attributes shown by rls -lll may give cluse about which reesources can be changed by which method.

now what else can we enable.....? Must read that Ex manual to see what other features the E8 adds...

Just to reiterate - cfg files with CRC01 are almost certainly  unit-specific, so need to be generated on the actual unit being hacked. 
As & when we find the hidden menu, this will all still be  possible without opening, over the RNDIS  connection. The only thing that the serial link is currently essential for is to enable USB RNDIS.

Incidentally, the first thing you should do before any other hacking, as soon as you have RNDIS running is make a copy of everything in \flashfs as this is all put on at the factory and not easily replaceable,

You can do this at the console by copying to the user partition but it's a pain as there are many directories.
I've not yet managed to get any FTP client other than Windows comamnd-line FTP to work ( have tried FTPsurfer and WinSCP)

Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Online Monkeh

  • Super Contributor
  • ***
  • Posts: 2285
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #274 on: October 28, 2013, 12:03:35 AM »
Try Filezilla as an FTP client. Not a clue if it'll work, but nice client anyway.

Offline amyk

  • Super Contributor
  • ***
  • Posts: 2758
Re: Flir E4 Thermal imaging camera teardown
« Reply #275 on: October 28, 2013, 12:27:52 AM »
Windows' FTP client uses active mode by default, whereas most others use passive - maybe their FTP server only works in active mode.

Offline equinoxe

  • Contributor
  • Posts: 23
Re: Flir E4 Thermal imaging camera teardown
« Reply #276 on: October 28, 2013, 12:29:02 AM »
Windows' FTP client uses active mode by default, whereas most others use passive - maybe their FTP server only works in active mode.

+1

Offline Psi

  • Super Contributor
  • ***
  • Posts: 4665
  • Country: nz
Re: Flir E4 Thermal imaging camera teardown
« Reply #277 on: October 28, 2013, 12:33:28 AM »
it wouldn't surprise me if they left passive mode code & commands out of a embedded development ftp server
It's not like you're ever going to have NAT between the TIC and the PC.

But i expect Mike probably tried passive/active already, it's really the first things you check whenever FTP doesn't work.
« Last Edit: October 28, 2013, 12:36:47 AM by Psi »
Greek letter 'Psi' (not Pounds per Square Inch)

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4713
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #278 on: October 28, 2013, 03:32:34 AM »
it wouldn't surprise me if they left passive mode code & commands out of a embedded development ftp server
It's not like you're ever going to have NAT between the TIC and the PC.

But i expect Mike probably tried passive/active already, it's really the first things you check whenever FTP doesn't work.
Nope - don't know much about networky stuff, I do recall a few years ago needing to use passive mode for something.
Actually the Flir A310 Tech note document recommends filezilla - just tried it an seems to work fine ( and appears to be using passive mode).
 
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4713
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #279 on: October 28, 2013, 04:00:15 AM »
Looks like Marketing went through a few name changes...
Quote
# Default calib for Ex Camera a.k.a. Astra a.k.a. Z3
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline Pinkus

  • Regular Contributor
  • *
  • Posts: 148
Re: Flir E4 Thermal imaging camera teardown
« Reply #280 on: October 28, 2013, 04:18:45 AM »
Quote
BTW is anyone else here actually playing with an E4, or is everyone waiting to see if I manage to brick mine..?
.... as I am on vacation it will have to wait until next week - I will then hack mine, hopefully without bricking. But I know - I will check in here at least once a days to see any Progress.

Mike if you need any files or eeprom file from my E4 then (might be helpful for comparing, as you said some CRC might be serial # related), just send me a PM and I can send you this stuff together with my serial.
OK need to log out - wife is ranting about me sitting at the computer during vacation  ;D


Online ixfd64

  • Regular Contributor
  • *
  • Posts: 206
Re: Flir E4 Thermal imaging camera teardown
« Reply #281 on: October 28, 2013, 04:44:55 AM »
Looks like Marketing went through a few name changes...
Quote
# Default calib for Ex Camera a.k.a. Astra a.k.a. Z3

I think they're the internal code names.

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 1269
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #282 on: October 28, 2013, 04:53:56 AM »
I think they're the internal code names.

They of course have the problem of multiple products with the same hardware, so they can't call an E4 by it's name, and Ex just isn't nice enough.
In the software this model range is referred to as Z3, I'm not sure about Astra but there is a nice picture in the web folder called Z3_Astra:

Online ixfd64

  • Regular Contributor
  • *
  • Posts: 206
Re: Flir E4 Thermal imaging camera teardown
« Reply #283 on: October 28, 2013, 06:04:39 AM »
It could be the code name for the entire product line, kind of like how Haswell is the code name for Intel's latest generation of chips.

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4713
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #284 on: October 28, 2013, 06:54:33 AM »
I've had a good look through the UI template files, and I'm fairly sure there isn't much more functionality to be had.
The manual shows 2 different box sizes for PiP, but the UI toolbar template only shows one.

There are resource keys apparently related to extra functions, but I strongly suspect these may not be implemented in the code and/or need buttons or hardware that aren't present.

As the FPGA will be specific to this model (I assume Ex0 series have significantly different hardware), I think it's reasonable to assume the 9Hz framerate is baked into the FPGA as there would be no reason for it not to be.

So I'm probably not going to spend much more time on this for the moment, and will wait until looking at doing a definitive file package and batch files to ease installation until someone else has confirmed it all works.

Things that still need looking at to make things easier :
1) Find how to get to the hidden menu
2) Figure out the CRC01 method - if we can do this it will simplify the hack process, as you should be able to just add a CRC for your serial number and replace one .cfg file to make it an E8 without needing to use service mode, and not have the minor issues of running in service mode. (Someone is already working on this with my files.)

I will do some FFC breakouts next time I get some PCBs done, which will be in the next couple of weeks - PM me if interested.

All the info is here, and anyone who's been following closely should be able to work it out - I've prepared a step-by-step guide and file set which I will test on my unit, but will wait for someone else to proofread and test it on another unit before publishing - please PM me.



« Last Edit: October 28, 2013, 07:56:13 AM by mikeselectricstuff »
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf